From c951da6935180a8763f202e6eef77676eaecdc9d Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 18 Apr 2018 16:43:05 -0700 Subject: [PATCH 001/187] Began Part 2 of revision --- ...ministrator-with-the-management-console.md | 30 ++-- ...de-packages-with-the-management-console.md | 35 ++--- ...appv-administering-appv-with-powershell.md | 136 ++++-------------- ...pplications-with-the-management-console.md | 110 ++++---------- 4 files changed, 80 insertions(+), 231 deletions(-) diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index 7a031ea941..7867900bd3 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to Add or Remove an Administrator by Using the Management Console (Windows 10) -description: How to Add or Remove an Administrator by Using the Management Console +description: How to add or remove an administrator by using the Management Console author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,33 +8,27 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to add or remove an administrator by using the Management Console - -# How to Add or Remove an Administrator by Using the Management Console - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Use the following procedures to add or remove an administrator on the Microsoft Application Virtualization (App-V) server. -**To add an administrator using the Management Console** +## Add an administrator using the Management Console -1. Open the Microsoft Application Virtualization (App-V) Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of Access Directory (AD) users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. +1. Open the Microsoft Application Virtualization (App-V) Management Console and select **Administrators** in the navigation pane. The navigation pane will display a list of Access Directory (AD) users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. +2. To add a new administrator, select **Add Administrator**. Enter the name of the administrator that you want to add in the **Active Directory Name** field. Make sure to also provide the associated user account domain name. For example, **Domain** \\ **UserName**. +3. Select the account you want to add and select **Add**. The new account should now appear in the list of server administrators. -2. To add a new administrator, click **Add Administrator** Type the name of the administrator that you want to add in the **Active Directory Name** field. Ensure you provide the associated user account domain name. For example, **Domain** \\ **UserName**. +## Remove an administrator using the Management Console -3. Select the account that you want to add and click **Add**. The new account is displayed in the list of server administrators. - -**To remove an administrator using the Management Console** - -1. Open the Microsoft Application Virtualization (App-V) Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. - -2. Right-click the account to be removed from the list of administrators and select **Remove**. +1. Open the Microsoft Application Virtualization (App-V) Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. +2. Right-click the account to be removed from the list of administrators and select **Remove**. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index 19131f8521..8c3b04234f 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to Add or Upgrade Packages by Using the Management Console (Windows 10) -description: How to Add or Upgrade Packages by Using the Management Console +description: How to add or upgrade packages by using the Management Console author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,42 +8,37 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to add or upgrade packages by using the Management Console - -# How to Add or Upgrade Packages by Using the Management Console - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 You can the following procedure to add or upgrade a package to the App-V Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. -**To add a package to the Management Console** +## Add a package to the Management Console -1. Click the **Packages** tab in the navigation pane of the Management Console display. +1. Select the **Packages** tab in the navigation pane of the Management Console display. The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. - Click the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. + Select the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. -2. To specify the package you want to add, click **Add or Upgrade Packages**. +2. Select **Add or Upgrade Packages** to specify which package you want to add. -3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **https://server.1234/file.appv**, and then click **Add**. +3. Enter the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. - **Important**   - You must select a package with the **.appv** file name extension. + >[!IMPORTANT] + >You must select a package with the **.appv** file name extension. -   +4. The page displays the status message **Adding <Packagename>**. Select **IMPORT STATUS** to check the status of a package that you have imported. -4. The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported. + Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, select **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, click **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - -5. Click **Close** to close the **Add or Upgrade Packages** page. +5. Select **Close** to close the **Add or Upgrade Packages** page. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index a27ad2dd60..10327aa2e2 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -1,5 +1,5 @@ --- -title: Administering App-V by Using Windows PowerShell (Windows 10) +title: Administering App-V by using Windows PowerShell (Windows 10) description: Administering App-V by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization @@ -8,130 +8,46 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# Administering App-V by using Windows PowerShell - -# Administering App-V by Using Windows PowerShell - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Microsoft Application Virtualization (App-V) provides Windows PowerShell cmdlets, which can help administrators perform various App-V tasks. The following sections provide more information about using Windows PowerShell with App-V. -## How to administer App-V by using Windows PowerShell - +## How to administer App-V with Windows PowerShell Use the following Windows PowerShell procedures to perform various App-V tasks. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameDescription

[How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)

Describes how to install the Windows PowerShell cmdlets and find cmdlet help and examples.

[How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)

Describes how to manage the client package lifecycle on a stand-alone computer by using Windows PowerShell.

[How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)

Describes how to manage connection groups by using Windows PowerShell.

[How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md)

Describes how to modify the client by using Windows PowerShell.

[How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)

Describes how to apply a user configuration file by using Windows PowerShell.

[How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)

Describes how to apply a deployment configuration file by using Windows PowerShell.

[How to Sequence a Package by Using Windows PowerShell](appv-sequence-a-package-with-powershell.md)

Describes how to create a new package by using Windows PowerShell.

[How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)

Describes how to create a package accelerator by using Windows PowerShell. You can use package accelerators automatically sequence large, complex applications.

[How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)

Describes how to enable the computer running the App-V to send reporting information.

[How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)

Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

[How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) -

Describes how to use Windows PowerShell to configure a client after you deploy the App-V management and publishing servers, and add the required packages and connection groups.

+|Name|Description| +|---|---| +|[How to load the Windows PowerShell cmdlets for App-V and get cmdlet help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)|Describes how to install the Windows PowerShell cmdlets and find cmdlet help and examples.| +|[How to manage App-V packages running on a stand-alone computer by using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)|Describes how to manage the client package lifecycle on a stand-alone computer with Windows PowerShell.| +|[How to manage connection groups on a stand-alone computer by using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)|Describes how to manage connection groups with Windows PowerShell.| +|[How to modify client configuration by using Windows PowerShell](appv-modify-client-configuration-with-powershell.md)|Describes how to modify the client with Windows PowerShell.| +|[How to apply the user configuration file by using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)|Describes how to apply a user configuration file with Windows PowerShell.| +|[How to apply the deployment configuration file by using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)|Describes how to apply a deployment configuration file with Windows PowerShell.| +|[How to sequence a package by using Windows PowerShell](appv-sequence-a-package-with-powershell.md)|Describes how to create a new package with Windows PowerShell.| +|[How to create a package accelerator by using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)|Describes how to create a package accelerator with Windows PowerShell. You can use package accelerators automatically sequence large, complex applications.| +|[How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)|Describes how to enable the computer running the App-V client to send reporting information.| +|[How to install the App-V databases and convert the associated security identifiers by using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)|Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.| +|[How to configure the client to receive package and connection groups updates from the publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md)|Describes how to use Windows PowerShell to configure a client after you deploy the App-V management and publishing servers, and add the required packages and connection groups.| -  - -**Important**   -Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for Windows PowerShell. - -  - -## Windows PowerShell Error Handling +>[!IMPORTANT] +>Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for Windows PowerShell. +## Windows PowerShell error handling Use the following table for information about Windows PowerShell error handling for App-V. - ---- - - - - - - - - - - - - - - - - -
EventAction

Using the RollbackOnError attribute with embedded scripts

When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events:

-
    -

  • Removing a package

    • -

  • Unpublishing a package

    • -

  • Terminating a virtual environment

    • -

  • Terminating a process

    • -

Package name contains $

If a package name contains the character ( $ ), you must use a single-quote ( ' ), for example,

-

Add-AppvClientPackage 'Contoso$App.appv'

- -  +|Event|Action| +|---|---| +|Using the **RollbackOnError** attribute with embedded scripts|When you use the **RollbackOnError** attribute with embedded scripts, the attribute is ignored for the following events:
- Removing a package
- Unpublishing a package
- Terminating a virtual environment
- Terminating a process| +|Package name contains **$**|If a package name contains the character ( **$** ), you must use a single-quote ( **'** ), for example,
```Add-AppvClientPackage 'Contoso$App.appv'```| ## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics - -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) \ No newline at end of file diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md index ff218061cc..915933fa98 100644 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md @@ -8,12 +8,9 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- - - # Administering App-V Virtual Applications by Using the Management Console -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Use the Microsoft Application Virtualization (App-V) management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V client. One or more management servers typically share a common data store for configuration and package information. @@ -21,96 +18,43 @@ The management server uses Active Directory Domain Services (AD DS) groups to ma Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: -- Management Server – Use the management server to manage packages and connection groups. - -- Publishing Server – Use the publishing server to deploy packages to computers that run the App-V client. - -- Management Database - Use the management database to manage the package access and to publish the server’s synchronization with the management server. +- Management Server—Use the management server to manage packages and connection groups. +- Publishing Server—Use the publishing server to deploy packages to computers that run the App-V client. +- Management Database—Use the management database to manage the package access and to publish the server’s synchronization with the management server. ## Management Console tasks - The most common tasks that you can perform with the App-V Management console are: -- [How to Connect to the Management Console](appv-connect-to-the-management-console.md) - -- [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) - -- [How to Configure Access to Packages by Using the Management Console](appv-configure-access-to-packages-with-the-management-console.md) - -- [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md) - -- [How to Delete a Package in the Management Console](appv-delete-a-package-with-the-management-console.md) - -- [How to Add or Remove an Administrator by Using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md) - -- [How to Register and Unregister a Publishing Server by Using the Management Console](appv-register-and-unregister-a-publishing-server-with-the-management-console.md) - -- [How to Create a Custom Configuration File by Using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md) - -- [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md) - -- [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](appv-customize-virtual-application-extensions-with-the-management-console.md) - -- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md) +- [How to connect to the Management Console](appv-connect-to-the-management-console.md) +- [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) +- [How to configure access to packages by using the Management Console](appv-configure-access-to-packages-with-the-management-console.md) +- [How to publish a package by using the Management Console](appv-publish-a-packages-with-the-management-console.md) +- [How to delete a package in the Management Console](appv-delete-a-package-with-the-management-console.md) +- [How to add or remove an administrator by using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md) +- [How to register and unregister a publishing server by using the Management Console](appv-register-and-unregister-a-publishing-server-with-the-management-console.md) +- [How to create a custom configuration file by using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md) +- [How to transfer access and configurations to another version of a package by using the Management Console](appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md) +- [How to customize virtual application extensions for a specific AD group by using the Management Console](appv-customize-virtual-application-extensions-with-the-management-console.md) +- [How to view and configure applications and default virtual application extensions by using the Management Console](appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md) The main elements of the App-V Management Console are: - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
Management Console tabDescription

Packages tab

Use the PACKAGES tab to add or upgrade packages.

Connection Groups tab

Use the CONNECTION GROUPS tab to manage connection groups.

Servers tab

Use the SERVERS tab to register a new server.

Administrators tab

Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V environment.

+|Management Console tab|Description| +|---|---| +|Packages tab|Use the **Packages** tab to add or upgrade packages.| +|Connection Groups tab|Use the **Connection Groups** tab to manage connection groups.| +|Servers tab|Use the **Servers** tab to register a new server.| +|Administrators tab|Use the **Administrators** tab to register, add, or remove administrators in your App-V environment.| -  - -**Important**   -JavaScript must be enabled on the browser that opens the Web Management Console. - -  +>[!IMPORTANT] +>JavaScript must be enabled on the browser that opens the Web Management Console. ## Have a suggestion for App-V? +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for this App-V deployment - - -- [Application Virtualization (App-V) overview](appv-for-windows.md) - -- [Operations for App-V](appv-operations.md) - -  - -  - - - - +## Other resources for this App-V deployment +- [Application Virtualization (App-V) overview](appv-for-windows.md) +- [Operations for App-V](appv-operations.md) \ No newline at end of file From cf74f93f4801ffd7c220d56d03de3bb337074338 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 19 Apr 2018 14:43:10 -0700 Subject: [PATCH 002/187] Formatting for application publishing and client interaction article --- ...inistrators-to-enable-connection-groups.md | 50 +- ...ation-publishing-and-client-interaction.md | 553 +++++++++--------- 2 files changed, 272 insertions(+), 331 deletions(-) diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md index f97ca1f36d..d982f4b88b 100644 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md @@ -8,54 +8,26 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to allow only administrators to enable connection groups +>Applies to: Windows 10, version 1607 -# How to Allow Only Administrators to Enable Connection Groups +You can configure the App-V client so that only administrators, not users, can enable or disable connection groups. In earlier versions of App-V, there was no way to restrict access to disabling connection groups to users. -**Applies to** -- Windows 10, version 1607 - -You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**Note**
-This feature is supported starting in App-V 5.0 SP3. +>[!NOTE] +>This feature is supported starting in App-V 5.0 SP3. Use one of the following methods to allow only administrators to enable or disable connection groups. - ---- - - - - - - - - - - - - - - - - -
MethodSteps

Group Policy setting

Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

-

Computer Configuration > Administrative Templates > System > App-V > Publishing

Windows PowerShell cmdlet

Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

-

Parameter values:

-
    -

  • 0 - False

    • -

  • 1 - True

    • -
-

Example: Set-AppvClientConfiguration -RequirePublishAsAdmin 1

+|Method|Steps| +|---|---| +|Group Policy setting|Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

**Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Publishing**| +|Windows PowerShell cmdlet|Run the **Set-AppvClientConfiguration** cmdlet with the *-RequirePublishAsAdmin* parameter.

Parameter values:
- **0** – False
- **1** – True

Example: ```Set-AppvClientConfiguration -RequirePublishAsAdmin 1```| ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Managing Connection Groups](appv-managing-connection-groups.md) +- [Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 4674fddc02..79b0720209 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -1,6 +1,6 @@ --- title: Application Publishing and Client Interaction (Windows 10) -description: Application Publishing and Client Interaction +description: Application publishing and client interaction. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,20 +8,26 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# Application publishing and client interaction - -# Application Publishing and Client Interaction - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 This article provides technical information about common App-V client operations and their integration with the local operating system. ## App-V package files created by the Sequencer - The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: +|File|Description| +|---|---| +|.appv|- The primary package file, which contains the captured assets and state information from the sequencing process.
- Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.| +|.MSI|Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.| +|_DeploymentConfig.XML|File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.| +|_UserConfig.XML|File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.| +|Report.xml|Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.| +|.CAB|Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.| +|.appvt|Optional: Sequencer template file used to retain commonly reused Sequencer settings.| + @@ -72,7 +78,6 @@ For information about sequencing, see [How to Sequence a New Application with Ap ## What’s in the appv file? - The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. @@ -80,7 +85,7 @@ To view the appv file contents, make a copy of the package, and then rename the The appv file contains the following folder and files, which are used when creating and publishing a virtual application: | Name | Type | Description | -| - | - | - | +|---|---|---| | Root | File folder | Directory that contains the file system for the virtualized application that is captured during sequencing. | | [Content_Types].xml | XML File | List of the core content types in the appv file (e.g. DLL, EXE, BIN). | | AppxBlockMap.xml | XML File | Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.| @@ -90,14 +95,12 @@ The appv file contains the following folder and files, which are used when creat | Registry.dat | DAT File | Registry keys and values captured during the sequencing process for the package.| | StreamMap.xml | XML File | List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.| -  - ## App-V client data storage locations The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. | Name | Location | Description | -| - | - | - | +|---|---|---| | Package Store | %ProgramData%\App-V| Default location for read only package files| | Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents| | User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents| @@ -126,21 +129,26 @@ To change the default location of the package store during setup, see [Enable th If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). -> [!NOTE] +> [!NOTE] > The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. -  - ### Package catalogs The App-V Client manages the following two file-based locations: -- **Catalogs (user and machine).** - -- **Registry locations** - depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  +- **Catalogs (user and machine).** +- **Registry locations**—depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  ### Machine catalog +||| +|---|---| +|Description|Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (such as when the package directory is in a shared disk location).

If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.| +|Default storage location|```%programdata%\Microsoft\AppV\Client\Catalog\```

This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.| +|Files in the machine catalog|- Manifest.xml
- DeploymentConfiguration.xml
- UserManifest.xml (Globally Published Package)
- UserDeploymentConfiguration.xml (Globally Published Package)| +|Additional machine catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned previously as the default storage location:

```%programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID```| +|Additional files in the machine catalog when the package is part of a connection group|- PackageGroupDescriptor.xml
- UserPackageGroupDescriptor.xml (globally published Connection Group)| +
@@ -182,10 +190,16 @@ The App-V Client manages the following two file-based locations:
-  - ### User catalog +||| +|---|---| +|Description|Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.| +|Default storage location|```appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID```| +|Files in the user catalog|- UserManifest.xml
- DynamicConfiguration.xml or UserDeploymentConfiguration.xml| +|Additional user catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned above:

```appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID```| +|Additional file in the machine catalog when the package is part of a connection group|```UserPackageGroupDescriptor.xml```| + @@ -221,11 +235,9 @@ The App-V Client manages the following two file-based locations:
-  - ### Shortcut backups -During the publishing process, the App-V Client backs up any shortcuts and integration points to `%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups.` This backup enables the restoration of these integration points to the previous versions when the package is unpublished. +During the publishing process, the App-V Client backs up any shortcuts and integration points to ```%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups```. This backup enables the restoration of these integration points to the previous versions when the package is unpublished. ### Copy on Write files @@ -239,17 +251,15 @@ The COW Roaming location described above stores changes to files and directories The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. -## Package registry - +## Package registry Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. +When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at ```%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat```. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. **Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGuid}.dat** -  -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. +When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location ```HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY```. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location ```HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User```. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. ### Package registry staging vs. connection group registry staging @@ -267,6 +277,12 @@ There are two package registry locations and two connection group locations wher **Single Package VReg:** +|Location|Description| +|---|---| +|COW|- Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)
- User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes
- User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)| +|Package|- Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine
- User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry| +|Native|- Native application registry location| + @@ -301,12 +317,14 @@ There are two package registry locations and two connection group locations wher
-  - -  - **Connection Group VReg:** +|Location|Description| +|---|---| +|COW|- Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)
- User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes)
- User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY| +|Package|- Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY
- User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY| +|Native|- Native application registry location| + @@ -341,41 +359,36 @@ There are two package registry locations and two connection group locations wher
-  - -  - There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. ### Pass-through keys -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key `HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry`. Any key that appears under this multi-string value (and their children) will be treated as pass-through. +Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key ```HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry```. Any key that appears under this multi-string value (and their children) will be treated as pass-through. The following locations are configured as pass-through locations by default: -- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel +- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application +- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger +- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger -- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings +- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies +- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies -- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies +- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. ## App-V package store behavior - App-V manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. ### Add packages @@ -384,11 +397,19 @@ App-V Packages are staged upon addition to the computer with the App-V Client. T ### Mounting packages -Packages can be explicitly loaded using the Windows PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. +Packages can be explicitly loaded by entering the **Mount-AppVClientPackage** PowerShell cmdlet or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. ### Streaming packages -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the Windows PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: +The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: ```HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming```. Policies are set by entering the **Set-AppvClientConfiguration** PowerShell cmdlet. The following policies apply to streaming: + +|Policy|Description| +|---|---| +|AllowHighCostLaunch|Allows streaming over 3G and cellular networks| +|AutoLoad|Specifies the Background Load setting:
**0** – Disabled
**1** – Previously Used Packages only
**2** – All Packages| +|PackageInstallationRoot|The root folder for the package store in the local machine| +|PackageSourceRoot|The root override where packages should be streamed from| +|SharedContentStoreMode|Enables the use of Shared Content Store for VDI scenarios| @@ -428,21 +449,15 @@ The App-V Client can be configured to change the default behavior of streaming.
-  - -  - These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: -- Background Streaming - -- Optimized Streaming - -- Stream Faults +- Background Streaming +- Optimized Streaming +- Stream Faults ### Background streaming -The Windows PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. +The Windows PowerShell cmdlet ```Get-AppvClientConfiguration``` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. ### Optimized streaming @@ -454,36 +469,37 @@ After the initial stream of any publishing data and the primary feature block, r ### Package upgrades -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: `%ProgramData%\App-V\{PkgGUID}\{newVerGUID}`. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. +App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: ```%ProgramData%\App-V\{PkgGUID}\{newVerGUID}```. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. ### Package removal -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. - -## Roaming registry and data +The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet ```Remove-AppVClientPackge``` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. +## Roaming registry and data App-V is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data do not roam from computer to computer, since they are in locations that are not roamed. -### Roaming requirements and user catalog data storage +### Roaming requirements and user catalog data storage App-V stores data, which represents the state of the user’s catalog, in the form of: -- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog - -- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` +- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog +- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. -> [!NOTE] -> The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. - -  +>[!NOTE] +>The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. ### Registry-based data App-V registry roaming falls into two scenarios, as shown in the following table. +|Scenario|Description| +|---|---| +|Applications that are run as standard users|When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:
- HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
- HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE
The locations are enabled for roaming based on the operating system settings.| +|Applications that are run with elevation|When an application is launched with elevation:
- HKLM data is stored in the HKLM hive on the local computer
- HKCU data is stored in the User Registry location
In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:
- HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE
- HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE| + @@ -521,8 +537,6 @@ App-V registry roaming falls into two scenarios, as shown in the following table
-  - ### App-V and folder redirection App-V supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. @@ -532,7 +546,7 @@ A typical package has several locations mapped in the user’s backing store for The following table shows local and roaming locations, when folder redirection has not been implemented. | VFS directory in package | Mapped location of backing store | -| - | - | +|---|---| | ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | | SystemX86 | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | | Windows | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | @@ -542,64 +556,48 @@ The following table shows local and roaming locations, when folder redirection h The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). | VFS directory in package | Mapped location of backing store | -| - | - | +|---|---| | ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | | SystemX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | | Windows | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | | appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv\_ROOT | | AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\<GUID>\AppData | -  The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: -1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. - -2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. - -3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. +1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. +2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. +3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: -1. App-V application is shut down, which shuts down the virtual environment. - -2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. - -3. A timestamp at the end of the ZIP packaging process is used to name the file. - -4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. - -5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. +1. App-V application is shut down, which shuts down the virtual environment. +2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. +3. A timestamp at the end of the ZIP packaging process is used to name the file. +4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. +5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: -1. The user starts the virtual environment by starting an application. - -2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. - -3. The registry is checked for the last known uploaded timestamp, if present. - -4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. - -5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. - -6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. - -7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. +1. The user starts the virtual environment by starting an application. +2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. +3. The registry is checked for the last known uploaded timestamp, if present. +4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. +5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. +6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. +7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: -1. During repair, detect if the path to the user’s roaming AppData directory is not local. - -2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. - -3. Delete the timestamp stored in the registry, if present. +1. During repair, detect if the path to the user’s roaming AppData directory is not local. +2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. +3. Delete the timestamp stored in the registry, if present. This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. ## App-V client application lifecycle management - -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of Windows PowerShell commands initiated on the computer running the App-V Client. +In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of Windows PowerShell commands initiated on the computer running the App-V Client. This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). @@ -609,19 +607,15 @@ The App-V application lifecycle tasks are triggered at user login (default), mac The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: -- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. - -- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. - -- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. - -- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. +- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. +- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. +- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. +- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: -- Adding an App-V Package - -- Publishing an App-V Package +- Adding an App-V Package +- Publishing an App-V Package ### Adding an App-V package @@ -629,65 +623,61 @@ Adding an App-V package to the client is the first step of the publishing refres **How to add an App-V package** -1. Manual initiation via Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. +1. Manual initiation via Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. - 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. + 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. + 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. -2. The Publishing Agent on the App-V Client performs all actions below serialized. +2. The Publishing Agent on the App-V Client performs all actions below serialized. Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. -3. Configure the packages by identifying an Add or Update operations. +3. Configure the packages by identifying an Add or Update operations. - 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. + 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. + 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. - 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. + 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. - - Icons: Targets of extension points. + - Icons: Targets of extension points. + - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. + - Scripts: Download scripts directory for use throughout the publishing process. - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. + 4. Populate the Package store: - - Scripts: Download scripts directory for use throughout the publishing process. + 1. Create sparse files on disk that represent the extracted package for any directories listed. - 4. Populate the Package store: + 2. Stage top level files and directories under root. - 1. Create sparse files on disk that represent the extracted package for any directories listed. + 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. - 2. Stage top level files and directories under root. + 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). - 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. + 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog - 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). + 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat - 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog + 8. Register the package with the App-V Kernal Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV - 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat + 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. - 8. Register the package with the App-V Kernal Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV +4. Configure Connection Groups by adding and enabling or disabling. - 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. +5. Remove objects that are not published to the target (user or machine). -4. Configure Connection Groups by adding and enabling or disabling. + >[!NOTE] + >This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). -5. Remove objects that are not published to the target (user or machine). +6. Invoke background load mounting based on client configuration. - > [!NOTE] - > This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). +7. Packages that already have publishing information for the machine or user are immediately restored. -   + >[!NOTE] + >This condition occurs as a product of removal without unpublishing with background addition of the package. -6. Invoke background load mounting based on client configuration. -7. Packages that already have publishing information for the machine or user are immediately restored. - - > [!NOTE]    - > This condition occurs as a product of removal without unpublishing with background addition of the package. - -   This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). @@ -697,28 +687,28 @@ This completes an App-V package add of the publishing refresh process. The next During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. -**How to publish and App-V package** +#### How to publish an App-V package -1. Package entries are added to the user catalog +1. Package entries are added to the user catalog - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog + 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog + 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog -2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV +2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV -3. Perform integration tasks. +3. Perform integration tasks. - 1. Create extension points. + 1. Create extension points. - 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). + 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). - **Note**   - This enables restore extension points if the package is unpublished. + >[!NOTE] + >This enables restore extension points if the package is unpublished. -   - 3. Run scripts targeted for publishing timing. + + 3. Run scripts targeted for publishing timing. Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. @@ -728,25 +718,24 @@ Publishing an App-V Package that is part of a Connection Group is very similar t After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. -**How to launch App-V applications** +#### How to launch App-V applications -1. User launches the application by clicking on a shortcut or file type invocation. +1. User launches the application by clicking on a shortcut or file type invocation. -2. The App-V Client verifies existence in the User Catalog for the following files +2. The App-V Client verifies existence in the User Catalog for the following files - - UserDeploymentConfiguration.xml + - UserDeploymentConfiguration.xml + - UserManifest.xml - - UserManifest.xml +3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. -3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. +4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. -4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. +5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. -5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. +6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. -6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. - -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. +7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) @@ -754,52 +743,52 @@ After the Publishing Refresh process, the user launches and subsequently re-laun The App-V package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: -**How to upgrade an App-V package** +#### How to upgrade an App-V package -1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. +1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. -2. Package entries are added to the appropriate catalog for the new version +2. Package entries are added to the appropriate catalog for the new version - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID -3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV +3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV -4. Perform integration tasks. +4. Perform integration tasks. 1. Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. - 2. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. + 2. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. - 3. Version 1 EPs already exist when a new version becomes available. + 3. Version 1 EPs already exist when a new version becomes available. - 4. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. + 4. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. -5. Run scripts targeted for publishing timing. +5. Run scripts targeted for publishing timing. -6. Install Side by Side assemblies as required. +6. Install Side by Side assemblies as required. ### Upgrading an in-use App-V package If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: | Task type | Applicable rule | -| - | - | -| User-based task, e.g., publishing a package to a user | The pending task will be performed after the user logs off and then logs back on. | -| Globally based task, e.g., enabling a connection group globally | The pending task will be performed when the computer is shut down and then restarted. | +|---|---| +| User-based tasks, such as publishing a package to a user | The pending task will be performed after the user logs off and then logs back on. | +| Globally based tasks, such as enabling a connection group globally | The pending task will be performed when the computer is shut down and then restarted. | When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: | User-based or globally based task | Where the registry key is generated | -| - | - | +|---|---| | User-based tasks | HKEY\_CURRENT\_USER\Software\Microsoft\AppV\Client\PendingTasks | | Globally based tasks | HKEY\_LOCAL\_MACHINE\Software\Microsoft\AppV\Client\PendingTasks | The following operations must be completed before users can use the newer version of the package: | Task | Details | -| - | - | +|---|---| | Add the package to the computer | This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above. | | Publish the package | See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task. | @@ -810,14 +799,12 @@ Use the following example scenarios as a guide for updating packages. | App-V package is not in use when you try to upgrade | None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and ran. | | App-V package is in use when the administrator publishes a newer version of the package | The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

If the package has shell extensions, which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.| -  -### Global vs user publishing +### Global vs. user publishing App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: -- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. - -- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). +- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. +- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). ### Removing an App-V package @@ -829,52 +816,37 @@ The repair operation is very simple but may affect many locations on the machine ## Integration of App-V packages - The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: -- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. - -- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. - -- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. +- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. +- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. +- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. ### Rules of integration When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: -- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. +- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. +- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. +- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. -- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. - -- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. - - 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. - - 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. - - 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. + 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. + 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. + 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. ### Extension points The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: -- Shortcuts - -- File Type Associations - -- Shell Extensions - -- COM - -- Software Clients - -- Application capabilities - -- URL Protocol Handler - -- AppPath - -- Virtual Application +- Shortcuts +- File Type Associations +- Shell Extensions +- COM +- Software Clients +- Application capabilities +- URL Protocol Handler +- AppPath +- Virtual Application ### Shortcuts @@ -882,7 +854,7 @@ The short cut is one of the basic elements of integration with the OS and is the From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: -``` syntax +```XML [{Common Desktop}]\Adobe Reader.lnk @@ -902,7 +874,7 @@ As mentioned previously, the App-V shortcuts are placed by default in the user The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: -``` syntax +```XML @@ -939,48 +911,39 @@ The App-V Client manages the local operating system File Type Associations durin ``` -**Note**   -In this example: - -- `.xdp` is the extension - -- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) - -- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable - -  +>[!NOTE] +>In this example: +> + >- `.xdp` is the extension + >- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) + >- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable ### Shell extensions Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no additional setup or configuration on the client to enable the shell extension functionality. -**Requirements for using shell extensions:** +#### Requirements for using shell extensions -- Packages that contain embedded shell extensions must be published globally. +- Packages that contain embedded shell extensions must be published globally. +- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. + - The version of the application is 64-bit. + - The Sequencer is running on a 64-bit computer. + - The package is being delivered to a 64-bit App-V client computer. The following table displays the supported shell extensions. | Handler | Description | -| - | - | +|---|---| | Context menu handler | Adds menu items to the context menu. It is called before the context menu is displayed. | | Drag-and-drop handler | Controls the action upon right-click drag-and-drop and modifies the context menu that appears. | | Drop target handler | Controls the action after a data object is dragged-and-dropped over a drop target such as a file.| | Data object handler| Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.| | Property sheet handler| Replaces or adds pages to the property sheet dialog box of an object.| -| Infotip handler| Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover.| +| Infotip handler| Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse-hover.| | Column handler| Allows creating and displaying custom columns in Windows Explorer *Details view*. It can be used to extend sorting and grouping.| | Preview handler| Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.| -  - ### COM The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. @@ -995,7 +958,7 @@ App-V supports specific software clients and application capabilities extension Example of software client registration of an App-V based mail client. -``` syntax +```XML @@ -1035,16 +998,12 @@ Example of software client registration of an App-V based mail client. ``` -**Note**   +>[!NOTE] In this example: - -- `` is the overall Software Clients setting to integrate Email clients - -- `` is the flag to set a particular Email client as the default Email client - -- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration - -  +> + >- `` is the overall Software Clients setting to integrate Email clients + >- `` is the flag to set a particular Email client as the default Email client + >- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration ### URL Protocol handler @@ -1068,6 +1027,25 @@ The extension points described above are integrated into the operating system ba Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. +|Virtual Extension|Requires target OS Sequencing|Requires Global Publishing| +|---|:---:|:---:| +|Shortcut||| +|File Type Association||| +|URL Protocols|X|| +|AppPaths|X|| +|COM Mode||| +|Software Client|X|| +|Application Capabilities|X|X| +|Context Menu Handler|X|X| +|Drag-and-drop Handler|X|| +|Data Object Handler|X|| +|Property Sheet Handler|X|| +|Infotip Handler|X|| +|Column Handler|X|| +|Shell Extensions|X|| +|Browser Helper Object|X|X| +|Active X Object|X|X| + @@ -1180,9 +1158,9 @@ App-V Packages contain the Manifest file inside of the appv package file, which The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). -**Manifest** +#### Manifest -``` syntax +```XML [{Common Programs}]\7-Zip\7-Zip File Manager.lnk @@ -1192,9 +1170,9 @@ The example below shows the combination of the Manifest, Deployment Configuratio ``` -**Deployment Configuration** +#### Deployment Configuration -``` syntax +```XML @@ -1207,9 +1185,9 @@ The example below shows the combination of the Manifest, Deployment Configuratio ``` -**User Configuration** +#### User Configuration -``` syntax +```XML @@ -1248,41 +1226,32 @@ The example below shows the combination of the Manifest, Deployment Configuratio ## Side-by-side assemblies +App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. -App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The Side by Side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. +Side-by-side assembly support in App-V has the following features. -Side by Side Assembly support in App-V has the following features. - -- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. - -- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. - -- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. - -- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. +- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. +- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. +- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. +- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. ### Automatic publishing of SxS assemblies During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. -> [!NOTE] -> Unpublishing or removing a package with an assembly does not remove the assemblies for that package. - -  +>[!NOTE] +>Unpublishing or removing a package with an assembly does not remove the assemblies for that package. ## Client logging - The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. There are three specific categories of events recorded described below. -**Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. - -**Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. - -**Virtual Application**: Logs virtual application launches and use of virtualization subsystems. +- **Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. +- **Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. +- **Virtual Application**: Logs virtual application launches and use of virtualization subsystems. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file From 2cb3a88000fdbe2802b45a9b42fb1b403d9a22dc Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 19 Apr 2018 16:43:10 -0700 Subject: [PATCH 003/187] Began editorial text edits for article --- ...ation-publishing-and-client-interaction.md | 52 +++++++++---------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 79b0720209..3965e42334 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -86,11 +86,11 @@ The appv file contains the following folder and files, which are used when creat | Name | Type | Description | |---|---|---| -| Root | File folder | Directory that contains the file system for the virtualized application that is captured during sequencing. | -| [Content_Types].xml | XML File | List of the core content types in the appv file (e.g. DLL, EXE, BIN). | +| Root | File folder | Directory that contains the file system for the virtualized application captured during sequencing. | +| [Content_Types].xml | XML File | List of the core content types in the appv file (for example, DLL, EXE, BIN). | | AppxBlockMap.xml | XML File | Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.| | AppxManifest.xml | XML File | Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.| -| FilesystemMetadata.xml | XML File | List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names). | +| FilesystemMetadata.xml | XML File | List of the files captured during sequencing, including attributes (such as directories, files, opaque directories, empty directories, and long and short names). | | PackageHistory.xml | XML File | Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).| | Registry.dat | DAT File | Registry keys and values captured during the sequencing process for the package.| | StreamMap.xml | XML File | List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.| @@ -101,43 +101,43 @@ The App-V client performs tasks to ensure that virtual applications run properly | Name | Location | Description | |---|---|---| -| Package Store | %ProgramData%\App-V| Default location for read only package files| -| Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents| -| User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents| -| Shortcut Backups | %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups| Stores previous integration points that enable restore on package unpublish| -| Copy on Write (COW) Roaming | %AppData%\Microsoft\AppV\Client\VFS| Writeable roaming location for package modification| -| Copy on Write (COW) Local | %LocalAppData%\Microsoft\AppV\Client\VFS| Writeable non-roaming location for package modification| -| Machine Registry | HKLM\Software\Microsoft\AppV| Contains package state information, including VReg for machine or globally published packages (Machine hive)| -| User Registry | HKCU\Software\Microsoft\AppV| Contains user package state information including VReg| -| User Registry Classes | HKCU\Software\Classes\AppV| Contains additional user package state information| +| Package Store | %ProgramData%\App-V| Default location for read only package files| +| Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents| +| User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents| +| Shortcut Backups | %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups| Stores previous integration points that enable restore on package unpublish| +| Copy on Write (COW) Roaming | %AppData%\Microsoft\AppV\Client\VFS| Writeable roaming location for package modification| +| Copy on Write (COW) Local | %LocalAppData%\Microsoft\AppV\Client\VFS| Writeable non-roaming location for package modification| +| Machine Registry | HKLM\Software\Microsoft\AppV| Contains package state information, including VReg for machine or globally published packages (Machine hive)| +| User Registry | HKCU\Software\Microsoft\AppV| Contains user package state information including VReg| +| User Registry Classes | HKCU\Software\Classes\AppV| Contains additional user package state information| Additional details for the table are provided in the section below and throughout the document. ### Package store -The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the `Set-AppVClientConfiguration` Windows PowerShell cmdlet, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named for the Package GUID and Version GUID. +The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. Example of a path to a specific application: -``` syntax -C:\ProgramData\App-V\PackGUID\VersionGUID +```syntax +C:\ProgramData\App-V\PackGUID\VersionGUID ``` To change the default location of the package store during setup, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). ### Shared Content Store -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). +If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high-performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). -> [!NOTE] -> The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. +>[!NOTE] +>The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. ### Package catalogs The App-V Client manages the following two file-based locations: - **Catalogs (user and machine).** -- **Registry locations**—depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  +- **Registry locations**—depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine catalog stores global information applicable to all users or any specific user, and the User catalog stores information applicable to a specific user. The catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version. ### Machine catalog @@ -194,7 +194,7 @@ The App-V Client manages the following two file-based locations: ||| |---|---| -|Description|Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.| +|Description|Created during the publishing process. Contains information used for publishing the package, and for making sure that a package is provisioned to a specific user at launch. Created in a roaming location and includes user-specific publishing information.

When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.| |Default storage location|```appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID```| |Files in the user catalog|- UserManifest.xml
- DynamicConfiguration.xml or UserDeploymentConfiguration.xml| |Additional user catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned above:

```appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID```| @@ -237,7 +237,7 @@ The App-V Client manages the following two file-based locations: ### Shortcut backups -During the publishing process, the App-V Client backs up any shortcuts and integration points to ```%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups```. This backup enables the restoration of these integration points to the previous versions when the package is unpublished. +During the publishing process, the App-V Client backs up any shortcuts and integration points to ```%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups```. This backup lets integration points restore to the previous versions when the package is unpublished. ### Copy on Write files @@ -249,7 +249,7 @@ The COW Roaming location described above stores changes to files and directories ### COW local -The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. +The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (for example, Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. ## Package registry @@ -269,13 +269,13 @@ The staged registry persists the same way as in the single package case. Staged ### Virtual registry -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality – that is any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. +The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality—that is, any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. ### Registry locations There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups are not shared: -**Single Package VReg:** +#### Single Package VReg |Location|Description| |---|---| @@ -317,7 +317,7 @@ There are two package registry locations and two connection group locations wher
-**Connection Group VReg:** +#### Connection Group VReg |Location|Description| |---|---| @@ -385,7 +385,7 @@ The following locations are configured as pass-through locations by default: - HKEY\_CURRENT\_USER\\SOFTWARE\\Policies -The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. +The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy-based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI-based applications. Administers ideally should not modify any of the default pass-through keys, but in some instances, based on application behavior the admin may need to add additional pass-through keys. ## App-V package store behavior From 5bc924ab867285d06ddf472881c9a3f6a1f394c6 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 20 Apr 2018 11:07:01 -0700 Subject: [PATCH 004/187] Continued updating text for app publishing and client interaction article --- ...ation-publishing-and-client-interaction.md | 20 +++++++++---------- ...v-planning-folder-redirection-with-appv.md | 2 +- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 3965e42334..8af9f4e472 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -80,7 +80,7 @@ For information about sequencing, see [How to Sequence a New Application with Ap The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. -To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. +To view the appv file contents, make a copy of the package, and then rename the copied file to a .zip extension. The appv file contains the following folder and files, which are used when creating and publishing a virtual application: @@ -385,7 +385,7 @@ The following locations are configured as pass-through locations by default: - HKEY\_CURRENT\_USER\\SOFTWARE\\Policies -The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy-based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI-based applications. Administers ideally should not modify any of the default pass-through keys, but in some instances, based on application behavior the admin may need to add additional pass-through keys. +The purpose of pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy-based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI-based applications. Administers ideally should not modify any of the default pass-through keys, but in some instances, based on application behavior the admin may need to add additional pass-through keys. ## App-V package store behavior @@ -563,7 +563,7 @@ The following table shows local and roaming locations, when folder redirection h | appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv\_ROOT | | AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\<GUID>\AppData | -The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: +The current App-V Client VFS driver can't write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: 1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. 2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. @@ -572,19 +572,19 @@ The current App-V Client VFS driver cannot write to network locations, so the Ap This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: 1. App-V application is shut down, which shuts down the virtual environment. -2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. -3. A timestamp at the end of the ZIP packaging process is used to name the file. +2. The local cache of the roaming AppData location is compressed and stored in a .zip file. +3. A timestamp at the end of the .zip packaging process is used to name the file. 4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. -5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. +5. The folder redirection process is called to evaluate and initiate the .zip file uploaded to the roaming AppData directory. The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: 1. The user starts the virtual environment by starting an application. -2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. +2. The application’s virtual environment checks for the most recent time stamped .zip file, if present. 3. The registry is checked for the last known uploaded timestamp, if present. -4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. -5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. -6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. +4. The most recent .zip file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the .zip file. +5. If the local last known upload timestamp is earlier than that of the most recent .zip file in the roaming AppData location, the .zip file is extracted to the local temp directory in the user’s profile. +6. After the .zip file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. 7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md index 28f695046f..7665805a14 100644 --- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md +++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md @@ -33,7 +33,7 @@ To use %AppData% folder redirection, you must: * Files under %appdata%\Microsoft\AppV\Client\Catalog * Registry settings under HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages -For more information, see [Application publishing and client interaction](appv-application-publishing-and-client-interaction.md#bkmk-clt-inter-roam-reqs). +For more information, see [Application publishing and client interaction](appv-application-publishing-and-client-interaction.md#roaming-requirements-and-user-catalog-data-storage). ## Unsupported scenarios for App-V folder redirection From ae8693a8e25def760c97b8d73394bbdd7113d405 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 24 Apr 2018 11:53:44 -0700 Subject: [PATCH 005/187] Continued article revision --- ...ation-publishing-and-client-interaction.md | 35 ++++++++----------- 1 file changed, 15 insertions(+), 20 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 8af9f4e472..5263548ceb 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -573,17 +573,17 @@ This process solves the problem of a non-local %AppData% that is not supported b 1. App-V application is shut down, which shuts down the virtual environment. 2. The local cache of the roaming AppData location is compressed and stored in a .zip file. -3. A timestamp at the end of the .zip packaging process is used to name the file. -4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. +3. A time stamp at the end of the .zip packaging process is used to name the file. +4. The time stamp is recorded in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. 5. The folder redirection process is called to evaluate and initiate the .zip file uploaded to the roaming AppData directory. -The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: +The time stamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: 1. The user starts the virtual environment by starting an application. 2. The application’s virtual environment checks for the most recent time stamped .zip file, if present. -3. The registry is checked for the last known uploaded timestamp, if present. -4. The most recent .zip file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the .zip file. -5. If the local last known upload timestamp is earlier than that of the most recent .zip file in the roaming AppData location, the .zip file is extracted to the local temp directory in the user’s profile. +3. The registry is checked for the last known uploaded time stamp, if present. +4. The most recent .zip file is downloaded unless the local last known upload time stamp is greater than or equal to the time stamp from the .zip file. +5. If the local last known upload time stamp is earlier than that of the most recent .zip file in the roaming AppData location, the .zip file is extracted to the local temp directory in the user’s profile. 6. After the .zip file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. 7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. @@ -591,37 +591,34 @@ This completes the successful roaming of application settings that are present i 1. During repair, detect if the path to the user’s roaming AppData directory is not local. 2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. -3. Delete the timestamp stored in the registry, if present. +3. Delete the time stamp stored in the registry, if present. -This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. +This process will re-create both the local and network locations for AppData and remove the registry record of the time stamp. ## App-V client application lifecycle management -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of Windows PowerShell commands initiated on the computer running the App-V Client. +In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are input as PowerShell commands on the computer running the App-V Client. This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). -The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). +The App-V application lifecycle tasks are triggered at user sign in (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). ### Publishing refresh -The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: +The publishing refresh process comprises several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process when the user signs in, the machine turns on, and at scheduled intervals. The client configuration during setup listed in the previous section is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: - **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. - **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. - **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. - **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. -The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: +The following sections will elaborate what goes on during the publishing refresh process. -- Adding an App-V Package -- Publishing an App-V Package - -### Adding an App-V package +#### Adding an App-V package Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in Windows PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. -**How to add an App-V package** +#### How to add an App-V package 1. Manual initiation via Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. @@ -677,13 +674,11 @@ Adding an App-V package to the client is the first step of the publishing refres >[!NOTE] >This condition occurs as a product of removal without unpublishing with background addition of the package. - - This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). ![package add file and registry data](images/packageaddfileandregistrydata.png) -### Publishing an App-V package +#### Publishing an App-V package During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. From 6c16e0aea013414c52b4e8da72812e864a7a0f70 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 24 Apr 2018 13:20:56 -0700 Subject: [PATCH 006/187] Continued editing --- .../app-v/appv-application-publishing-and-client-interaction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 5263548ceb..7403663b3d 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -620,7 +620,7 @@ Adding an App-V package to the client is the first step of the publishing refres #### How to add an App-V package -1. Manual initiation via Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. +1. Initiate installation manually through Windows PowerShell or Task Sequence initiation of the Publishing Refresh process. 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. From 54a6ac6cf79807701c32c6b347109a6d5bf6c4ee Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 15:38:26 -0700 Subject: [PATCH 007/187] Continued editorial changes --- ...ation-publishing-and-client-interaction.md | 68 +++++++++---------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 7403663b3d..137715003d 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -616,7 +616,9 @@ The following sections will elaborate what goes on during the publishing refresh #### Adding an App-V package -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in Windows PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. +Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the **Add-AppVClientPackage** cmdlet in Windows PowerShell, except the publishing refresh add process contacts the configured publishing server and passes a high-level list of applications back to the client to pull more detailed information, rather than just doing a single package add operation. + +The process then configures the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. #### How to add an App-V package @@ -624,41 +626,39 @@ Adding an App-V package to the client is the first step of the publishing refres 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. + 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per-package basis. -2. The Publishing Agent on the App-V Client performs all actions below serialized. +2. The Publishing Agent on the App-V Client will evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. - Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. - -3. Configure the packages by identifying an Add or Update operations. +3. Configure the packages by identifying the **Add** or **Update** operations. 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. + 2. The package file is opened and the **AppXManifest.xml** and **StreamMap.xml** files are downloaded to the Package Store. - 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. + 3. Completely stream publishing block data defined in the **StreamMap.xml**. Publishing block data is stored in Package Store\\PkgGUID\\VerGUID\\Root. - Icons: Targets of extension points. - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. + - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, accessed directly or through file types. - Scripts: Download scripts directory for use throughout the publishing process. - 4. Populate the Package store: + 4. Populate the Package store by doing the following: 1. Create sparse files on disk that represent the extracted package for any directories listed. - 2. Stage top level files and directories under root. + 2. Stage top-level files and directories under root. - 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. + All other files are created when the directory is listed as sparse on disk and streamed on demand. - 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). + 5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created). 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog - 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat + 7. Create the **Registry.dat** file from the package store to **%ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat** - 8. Register the package with the App-V Kernal Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV + 8. Register the package with the App-V Kernal Mode Driver at HKLM\\Microsoft\\Software\\AppV\\MAV - 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. + 9. Invoke scripting from the **AppxManifest.xml** or **DeploymentConfig.xml** file for Package Add timing. 4. Configure Connection Groups by adding and enabling or disabling. @@ -674,21 +674,21 @@ Adding an App-V package to the client is the first step of the publishing refres >[!NOTE] >This condition occurs as a product of removal without unpublishing with background addition of the package. -This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). +This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). -![package add file and registry data](images/packageaddfileandregistrydata.png) +![Package add file and registry data](images/packageaddfileandregistrydata.png) #### Publishing an App-V package -During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. +During the Publishing Refresh operation, the specific publishing operation, **Publish-AppVClientPackage**, adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. #### How to publish an App-V package 1. Package entries are added to the user catalog - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog + 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the User Catalog. - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog + 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the Machine Catalog. 2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV @@ -705,7 +705,7 @@ During the Publishing Refresh operation, the specific publishing operation (Publ 3. Run scripts targeted for publishing timing. -Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. +Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information in the preceding sections for details. ![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) @@ -719,8 +719,8 @@ After the Publishing Refresh process, the user launches and subsequently re-laun 2. The App-V Client verifies existence in the User Catalog for the following files - - UserDeploymentConfiguration.xml - - UserManifest.xml + - **UserDeploymentConfiguration.xml** + - **UserManifest.xml** 3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. @@ -736,7 +736,7 @@ After the Publishing Refresh process, the user launches and subsequently re-laun ### Upgrading an App-V package -The App-V package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: +The App-V package upgrade process in the current version of App-V differs from the older versions. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time, as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only new files are added to the new version store location, and hard links are created for unchanged files. This reduces overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. #### How to upgrade an App-V package @@ -744,9 +744,9 @@ The App-V package upgrade process differs from the older versions of App-V. App- 2. Package entries are added to the appropriate catalog for the new version - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID 3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV @@ -762,11 +762,11 @@ The App-V package upgrade process differs from the older versions of App-V. App- 5. Run scripts targeted for publishing timing. -6. Install Side by Side assemblies as required. +6. Install Side-by-Side assemblies as required. ### Upgrading an in-use App-V package -If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: +If you try to upgrade a package that is currently in use, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: | Task type | Applicable rule | |---|---| @@ -784,19 +784,19 @@ The following operations must be completed before users can use the newer versio | Task | Details | |---|---| -| Add the package to the computer | This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above. | -| Publish the package | See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task. | +| Add the package to the computer | This task is computer-specific and you can perform it at any time by completing the steps in [How to add an App-V package](#how-to-add-an-app-v-package). | +| Publish the package | See the Package Publishing section above for steps. This process requires that you update extension points on the system. You can't complete this task while the application is in use. | Use the following example scenarios as a guide for updating packages. | Scenario | Requirements | -| - | - | +|---|---| | App-V package is not in use when you try to upgrade | None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and ran. | -| App-V package is in use when the administrator publishes a newer version of the package | The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

If the package has shell extensions, which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.| +| App-V package is in use when the administrator publishes a newer version of the package | The App-V Client sets the operation to "pending," which means that it is queued and will be carried out later when the package is not in use.

If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

If the package has shell extensions, which are permanently loaded by Windows Explorer, the user won't be able to sign in. Users must sign off and then sign back in to initiate the App-V package upgrade.| ### Global vs. user publishing -App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: +App-V Packages can be published in one of two ways; as User, which entitles an App-V package to a specific user or group of users, or as Global, which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. - **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). From b5931aa815471b28b60dbba895ae37f2bb7e112a Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 15:45:20 -0700 Subject: [PATCH 008/187] Continued editorial changes --- .../appv-application-publishing-and-client-interaction.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 137715003d..5e97160b6e 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -796,10 +796,10 @@ Use the following example scenarios as a guide for updating packages. ### Global vs. user publishing -App-V Packages can be published in one of two ways; as User, which entitles an App-V package to a specific user or group of users, or as Global, which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: +App-V Packages can be published in one of two ways; as user, which entitles an App-V package to a specific user or group of users, or as global, which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. -- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). +- **User-published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). ### Removing an App-V package From d420810616a5f6d4dd95a30029e12d4ad4c60b36 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 26 Apr 2018 16:37:37 -0700 Subject: [PATCH 009/187] Continued editorial changes --- ...-application-publishing-and-client-interaction.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 5e97160b6e..ddcc7b70aa 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -799,7 +799,7 @@ Use the following example scenarios as a guide for updating packages. App-V Packages can be published in one of two ways; as user, which entitles an App-V package to a specific user or group of users, or as global, which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. -- **User-published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via Windows PowerShell commands). +- **User-published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user signs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly through Windows PowerShell commands). ### Removing an App-V package @@ -807,19 +807,19 @@ Removing App-V applications in a Full Infrastructure is an unpublish operation, ### Repairing an App-V package -The repair operation is very simple but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are de-integrated and then re-integrated. Please review the COW data placement locations by reviewing where they are registered in the registry. This operation is done automatically and there is no administrative control other than initiating a Repair operation from the App-V Client Console or via Windows PowerShell (Repair-AppVClientPackage). +The repair operation is easy to do, but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are deintegrated and then reintegrated. Before repairing, please review where the COW data placement locations are registered in the registry. To perform a Repair operation, all you need to do is initiate it from the App-V Client Console or through the **Repair-AppVClientPackage** PowerShell cmdlet. After that, the operation is completed automatically. ## Integration of App-V packages The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: -- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. -- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. -- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. +- **AppXManifest.xml**: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. +- **DeploymentConfig.xml**: Provides configuration information of computer- and user-based integration extension points. +- **UserConfig.xml**: A subset of the **Deploymentconfig.xml** that only provides user-based configurations and only targets user-based extension points. ### Rules of integration -When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: +When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the following list: - Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. - User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. From ad1619c6fb6a6dfe13cf6c30da1bc0e31b58b41f Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 7 May 2018 15:49:48 -0700 Subject: [PATCH 010/187] Continued updating article --- ...ation-publishing-and-client-interaction.md | 49 +++++++++---------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index ddcc7b70aa..4ffa37db03 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -834,18 +834,18 @@ When App-V applications are published to a computer with the App-V Client, some The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - Shortcuts -- File Type Associations -- Shell Extensions +- File type associations +- Shell extensions - COM -- Software Clients +- Software clients - Application capabilities -- URL Protocol Handler +- URL Protocol handler - AppPath -- Virtual Application +- Virtual application ### Shortcuts -The short cut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. +The shortcut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: @@ -908,10 +908,9 @@ The App-V Client manages the local operating system File Type Associations durin >[!NOTE] >In this example: -> - >- `.xdp` is the extension - >- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) - >- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable +>- `.xdp` is the extension +>- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) +>- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable ### Shell extensions @@ -921,10 +920,9 @@ Shell extensions are embedded in the package automatically during the sequencing - Packages that contain embedded shell extensions must be published globally. - The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - The Sequencer is running on a 64-bit computer. - - The package is being delivered to a 64-bit App-V client computer. + - The version of the application is 64-bit. + - The Sequencer is running on a 64-bit computer. + - The package is being delivered to a 64-bit App-V client computer. The following table displays the supported shell extensions. @@ -943,15 +941,15 @@ The following table displays the supported shell extensions. The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). +App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and In-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes Off, Isolated, and Integrated. Integrated mode is configured for either the Out-of-process or In-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (**deploymentconfig.xml** or **userconfig.xml**). For details on App-V integration, see [Microsoft Application Virtualization 5.0 Integration](https://blogs.technet.microsoft.com/appv/2013/01/03/microsoft-application-virtualization-5-0-integration). ### Software clients and application capabilities -App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and media player. This operation is performed in the control panel with the Set Program Access and Computer Defaults, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. +App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and using the media player. This operation is performed in the control panel with **Set Program Access** and **Computer Defaults**, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. -Example of software client registration of an App-V based mail client. +The following is an example of software client registration of an App-V-based mail client. ```XML @@ -994,15 +992,14 @@ Example of software client registration of an App-V based mail client. ``` >[!NOTE] -In this example: -> - >- `` is the overall Software Clients setting to integrate Email clients - >- `` is the flag to set a particular Email client as the default Email client - >- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration +>In this example: +>- `` is the overall Software Clients setting to integrate Email clients. +>- `` is the flag to set a particular Email client as the default Email client. +>- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration. ### URL Protocol handler -Applications do not always specifically called virtualized applications utilizing file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user clicks on a mailto: link and expects to get their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL protocol handlers are automatically added to the package. +Virtual applications don't always specifically utilize file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user selects the link expecting to access their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL Protocol handlers are automatically added to the package. For situations where there is more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that should not be the primary application launched. @@ -1014,15 +1011,15 @@ The AppPath extension point is configured either in the manifest or in the dynam ### Virtual application -This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, it is possible to disable all extension points belonging to one application, in order to allow only integration of extension points of other application. +This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, you can disable all extension points belonging to one application to only allow integration of extension points for the other application. ### Extension point rules -The extension points described above are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). +The previously described extension points are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. -|Virtual Extension|Requires target OS Sequencing|Requires Global Publishing| +|Virtual Extension|Requires target OS sequencing|Requires global publishing| |---|:---:|:---:| |Shortcut||| |File Type Association||| From 02a04c43352cc265466ed79c82a93a8a9860b794 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 8 May 2018 11:01:46 -0700 Subject: [PATCH 011/187] Continued text revision --- ...plication-publishing-and-client-interaction.md | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 4ffa37db03..2bcdae3587 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -1135,20 +1135,17 @@ Extension points are not all published the same way, where some extension points -  +## Dynamic configuration processing -## Dynamic configuration processing +Deploying App-V packages to a single machine or user is very simple. However, as organizations deploy App-V applications across business lines and geographic and political boundaries, it becomes impossible to sequence all applications with the same settings. App-V was designed to overcome this problem by capturing specific settings and configurations during sequencing in the Manifest file while also supporting modification with Dynamic Configuration files. +App-V dynamic configuration lets you specify a package policy at either the machine or user levels. Dynamic Configuration files enable sequencing engineers to modify the configuration of a package post-sequencing to address the needs of individual groups of users or machines. In some instances, it may be necessary to modify the application to provide proper functionality within the App-V environment. For example, you may need to modify the \_\*config.xml files to allow certain actions to be performed at a specified time while executing the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. -Deploying App-V packages to one machine or user is very simple. However, as organizations deploy AppV applications across business lines and geographic and political boundaries, the ability to sequence an application one time with one set of settings becomes impossible. App-V was designed for this scenario, as it captures specific settings and configurations during sequencing in the Manifest file, but also supports modification with Dynamic Configuration files. - -App-V dynamic configuration allows for specifying a policy for a package either at the machine level or at the user level. The Dynamic Configuration files enable sequencing engineers to modify the configuration of a package, post-sequencing, to address the needs of individual groups of users or machines. In some instances it may be necessary to make modifications to the application to provide proper functionality within the App-V environment. For example, it may be necessary to make modifications to the \_\*config.xml files to allow certain actions to be performed at a specified time during the execution of the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. - -App-V Packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow the publishing of an application to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. +App-V packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow an application to be published to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. ### Example for dynamic configuration files -The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). +The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). #### Manifest @@ -1218,7 +1215,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio ## Side-by-side assemblies -App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. +App-V supports automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. For assemblies consisting of Visual C++ (Version 8 and newer) or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they weren't installed during monitoring. The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in App-V applications deployed to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. Side-by-side assembly support in App-V has the following features. From 5197bec938d16e628db56b04dc7c210dc4f6ed3c Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 8 May 2018 13:40:48 -0700 Subject: [PATCH 012/187] Finished first sweep of text edits. --- ...ation-publishing-and-client-interaction.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 2bcdae3587..198ee44fd2 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -1215,30 +1215,30 @@ The following example shows the combination of the Manifest, Deployment Configur ## Side-by-side assemblies -App-V supports automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. For assemblies consisting of Visual C++ (Version 8 and newer) or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they weren't installed during monitoring. The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in App-V applications deployed to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. +App-V supports automatic packaging of side-by-side assemblies during sequencing and deployment on the client during virtual application publishing. App-V also supports capturing side-by-side assemblies during sequencing for assemblies not present on the sequencing machine. For assemblies consisting of Visual C++ (Version 8 and newer) or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they weren't installed during monitoring. The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in App-V applications deployed to clients missing the required side-by-side assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. -Side-by-side assembly support in App-V has the following features. +Side-by-side assembly support in App-V has the following features: -- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. -- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. +- Automatic captures of side-by-side assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. +- The App-V Client automatically installs required side-by-side assemblies to the client computer at publishing time if they aren't already installed. - The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. - The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. -### Automatic publishing of SxS assemblies +### Automatic publishing of side-by-side assemblies -During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. +During publishing of an App-V package with side-by-side assemblies, the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the side-by-side assembly installations in the base packages, as the connection groups don't contain any information about assembly installation. >[!NOTE] >Unpublishing or removing a package with an assembly does not remove the assemblies for that package. ## Client logging -The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. +The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer under **Applications and Services Logs\\Microsoft\\AppV\\Client**. -There are three specific categories of events recorded described below. +There are three specific categories of events recorded: -- **Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. -- **Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. +- **Admin**: Logs events for configurations applied to the App-V Client, and also contains the primary warnings and errors. +- **Operational**: Logs the general App-V execution and usage of individual components, creating an audit log of the App-V client's completed App-V operations. - **Virtual Application**: Logs virtual application launches and use of virtualization subsystems. ## Have a suggestion for App-V? From 30288a4b9ff49a3334f04dd433bee0f908b31f56 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 8 May 2018 14:45:45 -0700 Subject: [PATCH 013/187] Consistent client capitalization --- ...ation-publishing-and-client-interaction.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 198ee44fd2..e8393bccb7 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -12,7 +12,7 @@ ms.date: 04/19/2017 >Applies to: Windows 10, version 1607 -This article provides technical information about common App-V client operations and their integration with the local operating system. +This article provides technical information about common App-V Client operations and their integration with the local operating system. ## App-V package files created by the Sequencer @@ -22,8 +22,8 @@ The Sequencer creates App-V packages and produces a virtualized application. The |---|---| |.appv|- The primary package file, which contains the captured assets and state information from the sequencing process.
- Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.| |.MSI|Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.| -|_DeploymentConfig.XML|File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.| -|_UserConfig.XML|File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.| +|_DeploymentConfig.XML|File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V Client.| +|_UserConfig.XML|File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V Client.| |Report.xml|Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.| |.CAB|Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.| |.appvt|Optional: Sequencer template file used to retain commonly reused Sequencer settings.| @@ -53,11 +53,11 @@ The Sequencer creates App-V packages and produces a virtualized application. The

_DeploymentConfig.XML

-

File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.

+

File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V Client.

_UserConfig.XML

-

File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.

+

File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V Client.

Report.xml

@@ -95,9 +95,9 @@ The appv file contains the following folder and files, which are used when creat | Registry.dat | DAT File | Registry keys and values captured during the sequencing process for the package.| | StreamMap.xml | XML File | List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.| -## App-V client data storage locations +## App-V Client data storage locations -The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. +The App-V Client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. | Name | Location | Description | |---|---|---| @@ -469,11 +469,11 @@ After the initial stream of any publishing data and the primary feature block, r ### Package upgrades -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: ```%ProgramData%\App-V\{PkgGUID}\{newVerGUID}```. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. +App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: ```%ProgramData%\App-V\{PkgGUID}\{newVerGUID}```. The upgrade operation is optimized by creating hard links to identical and streamed files from other versions of the same package. ### Package removal -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet ```Remove-AppVClientPackge``` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. +The App-V Client's behavior when packages are removed depends on the package removal method. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet ```Remove-AppVClientPackge``` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. ## Roaming registry and data @@ -595,7 +595,7 @@ This completes the successful roaming of application settings that are present i This process will re-create both the local and network locations for AppData and remove the registry record of the time stamp. -## App-V client application lifecycle management +## App-V Client application lifecycle management In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are input as PowerShell commands on the computer running the App-V Client. @@ -773,7 +773,7 @@ If you try to upgrade a package that is currently in use, the upgrade task is pl | User-based tasks, such as publishing a package to a user | The pending task will be performed after the user logs off and then logs back on. | | Globally based tasks, such as enabling a connection group globally | The pending task will be performed when the computer is shut down and then restarted. | -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: +When a task is placed in a pending state, the App-V Client also generates a registry key for the pending task, as follows: | User-based or globally based task | Where the registry key is generated | |---|---| @@ -919,10 +919,10 @@ Shell extensions are embedded in the package automatically during the sequencing #### Requirements for using shell extensions - Packages that contain embedded shell extensions must be published globally. -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: +- The “bitness” of the application, Sequencer, and App-V Client must match, or the shell extensions won’t work. For example: - The version of the application is 64-bit. - The Sequencer is running on a 64-bit computer. - - The package is being delivered to a 64-bit App-V client computer. + - The package is being delivered to a 64-bit App-V Client computer. The following table displays the supported shell extensions. @@ -1233,12 +1233,12 @@ During publishing of an App-V package with side-by-side assemblies, the App-V Cl ## Client logging -The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer under **Applications and Services Logs\\Microsoft\\AppV\\Client**. +The App-V Client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer under **Applications and Services Logs\\Microsoft\\AppV\\Client**. There are three specific categories of events recorded: - **Admin**: Logs events for configurations applied to the App-V Client, and also contains the primary warnings and errors. -- **Operational**: Logs the general App-V execution and usage of individual components, creating an audit log of the App-V client's completed App-V operations. +- **Operational**: Logs the general App-V execution and usage of individual components, creating an audit log of the App-V Client's completed App-V operations. - **Virtual Application**: Logs virtual application launches and use of virtualization subsystems. ## Have a suggestion for App-V? From 2e4bc8a09387770d2ffdb1e5fddaa1b4c05dc311 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 8 May 2018 16:14:01 -0700 Subject: [PATCH 014/187] Continued text edit --- .../app-v/appv-application-publishing-and-client-interaction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index e8393bccb7..846ca41788 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -20,7 +20,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The |File|Description| |---|---| -|.appv|- The primary package file, which contains the captured assets and state information from the sequencing process.
- Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.| +|.appv|- The primary package file, which contains captured assets and state information from the sequencing process.
- Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.| |.MSI|Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.| |_DeploymentConfig.XML|File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V Client.| |_UserConfig.XML|File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V Client.| From 831d50b821c2a56d1b44dd6fd5fc52e52d6f8bbc Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 9 May 2018 14:19:32 -0700 Subject: [PATCH 015/187] Continued updating text --- ...ation-publishing-and-client-interaction.md | 146 +----------------- 1 file changed, 6 insertions(+), 140 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 846ca41788..741a277cee 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -497,45 +497,8 @@ App-V registry roaming falls into two scenarios, as shown in the following table |Scenario|Description| |---|---| -|Applications that are run as standard users|When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:
- HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
- HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE
The locations are enabled for roaming based on the operating system settings.| -|Applications that are run with elevation|When an application is launched with elevation:
- HKLM data is stored in the HKLM hive on the local computer
- HKCU data is stored in the User Registry location
In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:
- HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE
- HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE| - - ---- - - - - - - - - - - - - - - - - -
ScenarioDescription

Applications that are run as standard users

When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

-
    -

  • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

    • -

  • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE

    • -
-

The locations are enabled for roaming based on the operating system settings.

Applications that are run with elevation

When an application is launched with elevation:

-
    -

  • HKLM data is stored in the HKLM hive on the local computer

    • -

  • HKCU data is stored in the User Registry location

    • -
-

In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

-
    -

  • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE

    • -

  • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE

    • -
+|Applications that are run as standard users|When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

- HKLM's location is HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
- HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE

The locations are enabled for roaming based on the operating system settings.| +|Applications that are run with elevation|When an application is launched with elevation:

- HKLM data is stored in the HKLM hive on the local computer
- HKCU data is stored in the User Registry location

In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following locations:

- HKLM's location is HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE
- HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE| ### App-V and folder redirection @@ -607,10 +570,10 @@ The App-V application lifecycle tasks are triggered at user sign in (default), m The publishing refresh process comprises several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process when the user signs in, the machine turns on, and at scheduled intervals. The client configuration during setup listed in the previous section is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: -- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. -- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. -- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. -- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. +- **Add-AppVPublishingServer** configures the client with an App-V Publishing Server that provides App-V packages. +- **Set-AppVPublishingServer** modifies the current settings for the App-V Publishing Server. +- **Set-AppVClientConfiguration** modifies the currents settings for the App-V Client. +- **Sync-AppVPublishingServer** initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. The following sections will elaborate what goes on during the publishing refresh process. @@ -1038,103 +1001,6 @@ Extension points are not all published the same way, where some extension points |Browser Helper Object|X|X| |Active X Object|X|X| - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Virtual ExtensionRequires target OS SequencingRequires Global Publishing

Shortcut

File Type Association

URL Protocols

X

AppPaths

X

COM Mode

Software Client

X

Application Capabilities

X

X

Context Menu Handler

X

X

Drag-and-drop Handler

X

Data Object Handler

X

Property Sheet Handler

X

Infotip Handler

X

Column Handler

X

Shell Extensions

X

Browser Helper Object

X

X

Active X Object

X

X

- ## Dynamic configuration processing Deploying App-V packages to a single machine or user is very simple. However, as organizations deploy App-V applications across business lines and geographic and political boundaries, it becomes impossible to sequence all applications with the same settings. App-V was designed to overcome this problem by capturing specific settings and configurations during sequencing in the Manifest file while also supporting modification with Dynamic Configuration files. From 04a40479f931832f07c91c28fc5004f5e16eaace Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 10 May 2018 12:29:40 -0700 Subject: [PATCH 016/187] Continued edits, deleted old duplicate HTML tables --- ...ation-publishing-and-client-interaction.md | 130 +----------------- 1 file changed, 4 insertions(+), 126 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 741a277cee..9cd1577d1f 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -28,53 +28,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The |.CAB|Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.| |.appvt|Optional: Sequencer template file used to retain commonly reused Sequencer settings.| - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FileDescription

.appv

    -

  • The primary package file, which contains the captured assets and state information from the sequencing process.

    • -

  • Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.

    • -

.MSI

Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.

_DeploymentConfig.XML

File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V Client.

_UserConfig.XML

File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V Client.

Report.xml

Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.

.CAB

Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.

.appvt

Optional: Sequencer template file used to retain commonly reused Sequencer settings.

- -For information about sequencing, see [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). +To learn more about sequencing, see [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). ## What’s in the appv file? @@ -149,47 +103,6 @@ The App-V Client manages the following two file-based locations: |Additional machine catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned previously as the default storage location:

```%programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID```| |Additional files in the machine catalog when the package is part of a connection group|- PackageGroupDescriptor.xml
- UserPackageGroupDescriptor.xml (globally published Connection Group)| - ---- - - - - - - - - - - - - - - - - - - - - - - -

Description

Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

-

If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location).

-

If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.

Default storage location

%programdata%\Microsoft\AppV\Client\Catalog\

-

This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.

Files in the machine catalog

    -

  • Manifest.xml

    • -

  • DeploymentConfiguration.xml

    • -

  • UserManifest.xml (Globally Published Package)

    • -

  • UserDeploymentConfiguration.xml (Globally Published Package)

    • -

Additional machine catalog location, used when the package is part of a connection group

The following location is in addition to the specific package location mentioned above:

-

%programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID

Additional files in the machine catalog when the package is part of a connection group

    -

  • PackageGroupDescriptor.xml

    • -

  • UserPackageGroupDescriptor.xml (globally published Connection Group)

    • -
- ### User catalog ||| @@ -200,41 +113,6 @@ The App-V Client manages the following two file-based locations: |Additional user catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned above:

```appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID```| |Additional file in the machine catalog when the package is part of a connection group|```UserPackageGroupDescriptor.xml```| - ---- - - - - - - - - - - - - - - - - - - - - - - -

Description

Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

-

When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

-

For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.

Default storage location

appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID

Files in the user catalog

    -

  • UserManifest.xml

    • -

  • DynamicConfiguration.xml or UserDeploymentConfiguration.xml

    • -

Additional user catalog location, used when the package is part of a connection group

The following location is in addition to the specific package location mentioned above:

-

appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID

Additional file in the machine catalog when the package is part of a connection group

UserPackageGroupDescriptor.xml

- ### Shortcut backups During the publishing process, the App-V Client backs up any shortcuts and integration points to ```%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups```. This backup lets integration points restore to the previous versions when the package is unpublished. @@ -1103,9 +981,9 @@ The App-V Client logs information to the Windows Event log in standard ETW forma There are three specific categories of events recorded: -- **Admin**: Logs events for configurations applied to the App-V Client, and also contains the primary warnings and errors. -- **Operational**: Logs the general App-V execution and usage of individual components, creating an audit log of the App-V Client's completed App-V operations. -- **Virtual Application**: Logs virtual application launches and use of virtualization subsystems. +- **Admin** logs events for configurations applied to the App-V Client and also contains the primary warnings and errors. +- **Operational** logs the general App-V execution and usage of individual components, creating an audit log of the App-V Client's completed App-V operations. +- **Virtual Application** logs virtual application launches and use of virtualization subsystems. ## Have a suggestion for App-V? From 606a4e2716e3ae89bdcfab0664cfa603c8e963c3 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 11 May 2018 17:00:01 -0700 Subject: [PATCH 017/187] Removing HTML tables and sweeping for passive voice --- ...de-packages-with-the-management-console.md | 2 +- ...appv-administering-appv-with-powershell.md | 14 +-- ...pplications-with-the-management-console.md | 18 +-- ...ation-publishing-and-client-interaction.md | 118 +----------------- 4 files changed, 23 insertions(+), 129 deletions(-) diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index 8c3b04234f..97631d1114 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -12,7 +12,7 @@ ms.date: 04/19/2017 >Applies to: Windows 10, version 1607 -You can the following procedure to add or upgrade a package to the App-V Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. +You can use the following procedure to add or upgrade a package to the App-V Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. ## Add a package to the Management Console diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index 10327aa2e2..1a003ccf5c 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -12,11 +12,11 @@ ms.date: 04/19/2017 >Applies to: Windows 10, version 1607 -Microsoft Application Virtualization (App-V) provides Windows PowerShell cmdlets, which can help administrators perform various App-V tasks. The following sections provide more information about using Windows PowerShell with App-V. +Microsoft Application Virtualization (App-V) supports Windows PowerShell cmdlets that give administrators a quick and easy way to manage App-V. The following sections will tell you more about how to use Windows PowerShell with App-V. ## How to administer App-V with Windows PowerShell -Use the following Windows PowerShell procedures to perform various App-V tasks. +The following table lists articles that will tell you more about how to use PowerShell for App-V. |Name|Description| |---|---| @@ -27,22 +27,22 @@ Use the following Windows PowerShell procedures to perform various App-V tasks. |[How to apply the user configuration file by using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)|Describes how to apply a user configuration file with Windows PowerShell.| |[How to apply the deployment configuration file by using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)|Describes how to apply a deployment configuration file with Windows PowerShell.| |[How to sequence a package by using Windows PowerShell](appv-sequence-a-package-with-powershell.md)|Describes how to create a new package with Windows PowerShell.| -|[How to create a package accelerator by using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)|Describes how to create a package accelerator with Windows PowerShell. You can use package accelerators automatically sequence large, complex applications.| -|[How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)|Describes how to enable the computer running the App-V client to send reporting information.| +|[How to create a package accelerator by using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)|Describes how to create a package accelerator with Windows PowerShell. You can use package accelerators to automatically sequence large, complex applications.| +|[How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)|Describes how to enable the computer running the App-V Client to send reporting information.| |[How to install the App-V databases and convert the associated security identifiers by using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)|Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.| -|[How to configure the client to receive package and connection groups updates from the publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md)|Describes how to use Windows PowerShell to configure a client after you deploy the App-V management and publishing servers, and add the required packages and connection groups.| +|[How to configure the client to receive package and connection groups updates from the publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md)|Describes how to use Windows PowerShell to configure a client after you have deployed the App-V management and publishing servers and added the required packages and connection groups.| >[!IMPORTANT] >Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for Windows PowerShell. ## Windows PowerShell error handling -Use the following table for information about Windows PowerShell error handling for App-V. +The following table describes Windows PowerShell error handling for App-V. |Event|Action| |---|---| |Using the **RollbackOnError** attribute with embedded scripts|When you use the **RollbackOnError** attribute with embedded scripts, the attribute is ignored for the following events:
- Removing a package
- Unpublishing a package
- Terminating a virtual environment
- Terminating a process| -|Package name contains **$**|If a package name contains the character ( **$** ), you must use a single-quote ( **'** ), for example,
```Add-AppvClientPackage 'Contoso$App.appv'```| +|Package name contains **$**|If a package name contains the character \$\, you must use a single-quote ( **'** ).
For example:
```Add-AppvClientPackage 'Contoso$App.appv'```| ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md index 915933fa98..58e54b4527 100644 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md @@ -1,6 +1,6 @@ --- -title: Administering App-V Virtual Applications by Using the Management Console (Windows 10) -description: Administering App-V Virtual Applications by Using the Management Console +title: Administering App-V Virtual Applications by using the Management Console (Windows 10) +description: Administering App-V Virtual Applications by using the Management Console author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,23 +8,23 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- -# Administering App-V Virtual Applications by Using the Management Console +# Administering App-V Virtual Applications by using the Management Console >Applies to: Windows 10, version 1607 -Use the Microsoft Application Virtualization (App-V) management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V client. One or more management servers typically share a common data store for configuration and package information. +Use the Microsoft Application Virtualization (App-V) management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers running the App-V client. One or more management servers typically share a common data store for configuration and package information. The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: -- Management Server—Use the management server to manage packages and connection groups. -- Publishing Server—Use the publishing server to deploy packages to computers that run the App-V client. -- Management Database—Use the management database to manage the package access and to publish the server’s synchronization with the management server. +- The **management server** manages packages and connection groups. +- The **publishing server** deploys packages to computers running the App-V Client. +- The **management database** manages the package access publishes the server’s synchronization with the management server. ## Management Console tasks -The most common tasks that you can perform with the App-V Management console are: +Here are some articles that can show you how to perform the most common tasks that the App-V Management Console is used for: - [How to connect to the Management Console](appv-connect-to-the-management-console.md) - [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) @@ -48,7 +48,7 @@ The main elements of the App-V Management Console are: |Administrators tab|Use the **Administrators** tab to register, add, or remove administrators in your App-V environment.| >[!IMPORTANT] ->JavaScript must be enabled on the browser that opens the Web Management Console. +>JavaScript must be enabled on the browser you use to open the Web Management Console. ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 9cd1577d1f..7d6b629a30 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -161,40 +161,6 @@ There are two package registry locations and two connection group locations wher |Package|- Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine
- User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry| |Native|- Native application registry location| - ---- - - - - - - - - - - - - - - - - - - -

Location

Description

COW

    -

  • Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)

    • -

  • User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes

    • -

  • User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)

    • -

Package

    -

  • Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine

    • -

  • User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry

    • -

Native

    -

  • Native application registry location

    • -
- #### Connection Group VReg |Location|Description| @@ -203,45 +169,11 @@ There are two package registry locations and two connection group locations wher |Package|- Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY
- User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY| |Native|- Native application registry location| - ---- - - - - - - - - - - - - - - - - - - -

Location

Description

COW

    -

  • Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)

    • -

  • User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes

    • -

  • User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY

    • -

Package

    -

  • Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

    • -

  • User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

    • -

Native

    -

  • Native application registry location

    • -
- -There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. +There are two COW locations for HKLM: elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. ### Pass-through keys -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key ```HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry```. Any key that appears under this multi-string value (and their children) will be treated as pass-through. +Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package-specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key ```HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry```. Any key that appears under this multi-string value (and their children) will be treated as pass-through. The following locations are configured as pass-through locations by default: @@ -263,7 +195,7 @@ The following locations are configured as pass-through locations by default: - HKEY\_CURRENT\_USER\\SOFTWARE\\Policies -The purpose of pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy-based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI-based applications. Administers ideally should not modify any of the default pass-through keys, but in some instances, based on application behavior the admin may need to add additional pass-through keys. +The purpose of pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy-based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI-based applications. Administers ideally should not modify any of the default pass-through keys, but in some instances, the admin may need to add additional pass-through keys to adjust application behavior. ## App-V package store behavior @@ -271,7 +203,7 @@ App-V manages the Package Store, which is the location where the expanded asset ### Add packages -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. During publishing or a manual Add-AppVClientPackage, the data structure is built in the package store (c:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml are added to the system and the top level folders and child files staged to ensure proper application assets exist at launch. +App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. When publishing or manually entering the **Add-AppVClientPackage** cmdlet, the data structure is built in the package store (C:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the **StreamMap.xml** file are added to the system, and the top level folders and child files are staged to ensure proper application assets exist at launch. ### Mounting packages @@ -289,45 +221,7 @@ The App-V Client can be configured to change the default behavior of streaming. |PackageSourceRoot|The root override where packages should be streamed from| |SharedContentStoreMode|Enables the use of Shared Content Store for VDI scenarios| - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyDescription

AllowHighCostLaunch

Allows streaming over 3G and cellular networks

AutoLoad

Specifies the Background Load setting:

-

0 - Disabled

-

1 – Previously Used Packages only

-

2 – All Packages

PackageInstallationRoot

The root folder for the package store in the local machine

PackageSourceRoot

The root override where packages should be streamed from

SharedContentStoreMode

Enables the use of Shared Content Store for VDI scenarios

- -These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: +These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors in streaming packages that it's particularly important to understand: - Background Streaming - Optimized Streaming @@ -335,7 +229,7 @@ These settings affect the behavior of streaming App-V package assets to the clie ### Background streaming -The Windows PowerShell cmdlet ```Get-AppvClientConfiguration``` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. +The Windows PowerShell cmdlet ```Get-AppvClientConfiguration``` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with either the **Set-AppvClientConfiguration** cmdlet or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can either be disabled altogether (value=0) or enabled for all packages (value=2), regardless of whether they have been launched. ### Optimized streaming From 234bab4303fb9ee7641925e995ee27e58923add6 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 14 May 2018 11:13:12 -0700 Subject: [PATCH 018/187] Editorial changes continued --- .../appv-application-publishing-and-client-interaction.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 7d6b629a30..b59475bc77 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -245,7 +245,7 @@ App-V Packages require updating throughout the lifecycle of the application. App ### Package removal -The App-V Client's behavior when packages are removed depends on the package removal method. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet ```Remove-AppVClientPackge``` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. +The App-V Client's behavior when packages are removed depends on the package removal method. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the **Remove-AppVClientPackge** Windows PowerShell cmdlet is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. ## Roaming registry and data @@ -306,7 +306,7 @@ The current App-V Client VFS driver can't write to network locations, so the App This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: -1. App-V application is shut down, which shuts down the virtual environment. +1. The App-V application is shut down, which shuts down the virtual environment. 2. The local cache of the roaming AppData location is compressed and stored in a .zip file. 3. A time stamp at the end of the .zip packaging process is used to name the file. 4. The time stamp is recorded in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. @@ -324,7 +324,7 @@ The time stamp is used to determine a “last writer wins” scenario if there i This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: -1. During repair, detect if the path to the user’s roaming AppData directory is not local. +1. During repair, detect if the path to the user’s roaming AppData directory isn't local. 2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. 3. Delete the time stamp stored in the registry, if present. From c556663ed203d2169c443b71d3a9040fe17bdbe3 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 14 May 2018 11:19:42 -0700 Subject: [PATCH 019/187] Removed unnecessary hyphen --- .../appv-application-publishing-and-client-interaction.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index b59475bc77..e1f6e45eab 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -325,10 +325,10 @@ The time stamp is used to determine a “last writer wins” scenario if there i This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: 1. During repair, detect if the path to the user’s roaming AppData directory isn't local. -2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. +2. Map the non-local roaming AppData path targets, recreating the expected roaming and local AppData locations. 3. Delete the time stamp stored in the registry, if present. -This process will re-create both the local and network locations for AppData and remove the registry record of the time stamp. +This process will recreate both the local and network locations for AppData and remove the registry record of the time stamp. ## App-V Client application lifecycle management From cc50450d9cbd7297e3a5c764ef6c8c30bb71973f Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 14 May 2018 16:43:32 -0700 Subject: [PATCH 020/187] Continued editorial changes --- ...-application-publishing-and-client-interaction.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index e1f6e45eab..3f37c1d810 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -436,17 +436,15 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu >[!NOTE] >This enables restore extension points if the package is unpublished. - - 3. Run scripts targeted for publishing timing. -Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information in the preceding sections for details. +Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. ![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) ### Application launch -After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. +After the Publishing Refresh process, the user launches and then relaunches an App-V application. The App-V Client checks the path to the user catalog for files created during publishing. After establishing rights to launch the package, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. Once the virtual environment created and configured for the specific package and application, the application starts. This might seem like a lot, but the process in action is actually quite fast, and is optimized to minimize network traffic. #### How to launch App-V applications @@ -471,7 +469,7 @@ After the Publishing Refresh process, the user launches and subsequently re-laun ### Upgrading an App-V package -The App-V package upgrade process in the current version of App-V differs from the older versions. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time, as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only new files are added to the new version store location, and hard links are created for unchanged files. This reduces overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. +The current version of App-V's package upgrade process differs from the older versions in its storage optimization. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time, as the package store and catalogs are updated with the new resources. During an upgrade in the new version, only new files are added to the new version store location, and hard links are created for unchanged files. This reduces overall storage by only presenting the file on one disk location, then projecting it into all folders with a file location entry on the disk. #### How to upgrade an App-V package @@ -602,7 +600,7 @@ As mentioned previously, the App-V shortcuts are placed by default in the user ### File type associations -The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: +The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files, as represented in the following example: ```XML @@ -654,7 +652,7 @@ Shell extensions are embedded in the package automatically during the sequencing #### Requirements for using shell extensions - Packages that contain embedded shell extensions must be published globally. -- The “bitness” of the application, Sequencer, and App-V Client must match, or the shell extensions won’t work. For example: +- The “bitness” of the application, Sequencer, and App-V Client must match, or the shell extensions won’t work. The following example configuration fuflills the matching requirement: - The version of the application is 64-bit. - The Sequencer is running on a 64-bit computer. - The package is being delivered to a 64-bit App-V Client computer. From d4a48f591e776362d548b6e0bfca73b4a73551e4 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 15 May 2018 11:14:55 -0700 Subject: [PATCH 021/187] Continued editorial changes --- .../appv-application-publishing-and-client-interaction.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 3f37c1d810..6d9f2a6201 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -738,7 +738,7 @@ For situations where there is more than one application that could register the ### AppPath -The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. +The AppPath extension point supports calling App-V applications directly from the operating system. Administrators can provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable from either the Run or Start Screen, depending on the operating system. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: [App Paths - A Virtual Application Extension in App-V 5.0](https://blogs.technet.microsoft.com/virtualworld/2012/12/12/app-paths-a-virtual-application-extension-in-app-v-5-0/). @@ -777,9 +777,9 @@ Deploying App-V packages to a single machine or user is very simple. However, as App-V dynamic configuration lets you specify a package policy at either the machine or user levels. Dynamic Configuration files enable sequencing engineers to modify the configuration of a package post-sequencing to address the needs of individual groups of users or machines. In some instances, it may be necessary to modify the application to provide proper functionality within the App-V environment. For example, you may need to modify the \_\*config.xml files to allow certain actions to be performed at a specified time while executing the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. -App-V packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow an application to be published to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. +App-V packages contain the Manifest file inside of the App-V Package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow an application to be published to different desktops or users with different extension points. The two Dynamic Configuration files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. -### Example for dynamic configuration files +### Examples of dynamic configuration files The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). From fede32b1fef6f16fa7b7628e764dd627ad373ef2 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 15 May 2018 13:21:49 -0700 Subject: [PATCH 022/187] Replaced unnecessary uses of "enabled" --- ...ation-publishing-and-client-interaction.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 6d9f2a6201..e4747adc38 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -173,7 +173,7 @@ There are two COW locations for HKLM: elevated and non-elevated processes. Eleva ### Pass-through keys -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package-specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key ```HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry```. Any key that appears under this multi-string value (and their children) will be treated as pass-through. +An administrator can use pass-through keys to configure certain keys to only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package-specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key ```HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry```. Any key that appears under this multi-string value (and their children) will be treated as pass-through. The following locations are configured as pass-through locations by default: @@ -564,7 +564,7 @@ When App-V applications are published to a computer with the App-V Client, some ### Extension points -The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: +The App-V publishing files (manifest and dynamic configuration) provide several extension points to integrate the application with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - Shortcuts - File type associations @@ -600,7 +600,7 @@ As mentioned previously, the App-V shortcuts are placed by default in the user ### File type associations -The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files, as represented in the following example: +Users can use file type invocations or open a file with a specifically registered extension (.docx) to start an App-V application because the App-V Client manages the local operating system File Type Associations during publishing. File type associations are present in the manifest and dynamic configuration files, as shown in the following example: ```XML @@ -680,7 +680,7 @@ For details on App-V integration, see [Microsoft Application Virtualization 5.0 ### Software clients and application capabilities -App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and using the media player. This operation is performed in the control panel with **Set Program Access** and **Computer Defaults**, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. +App-V supports specific software clients and application capabilities extension points to register virtualized applications with the operating system's software client. This means users can select default programs for operations like email, instant messaging, and using the media player. This operation is performed in the control panel with **Set Program Access** and **Computer Defaults**, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. The following is an example of software client registration of an App-V-based mail client. @@ -775,7 +775,7 @@ Extension points are not all published the same way, where some extension points Deploying App-V packages to a single machine or user is very simple. However, as organizations deploy App-V applications across business lines and geographic and political boundaries, it becomes impossible to sequence all applications with the same settings. App-V was designed to overcome this problem by capturing specific settings and configurations during sequencing in the Manifest file while also supporting modification with Dynamic Configuration files. -App-V dynamic configuration lets you specify a package policy at either the machine or user levels. Dynamic Configuration files enable sequencing engineers to modify the configuration of a package post-sequencing to address the needs of individual groups of users or machines. In some instances, it may be necessary to modify the application to provide proper functionality within the App-V environment. For example, you may need to modify the \_\*config.xml files to allow certain actions to be performed at a specified time while executing the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. +App-V dynamic configuration lets you specify a package policy at either the machine or user levels. Sequencing engineers can use Dynamic Configuration files to modify the configuration of a package post-sequencing to address the needs of individual groups of users or machines. In some instances, it may be necessary to modify the application to provide proper functionality within the App-V environment. For example, you may need to modify the \_\*config.xml files to allow certain actions to be performed at a specified time while executing the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. App-V packages contain the Manifest file inside of the App-V Package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow an application to be published to different desktops or users with different extension points. The two Dynamic Configuration files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. @@ -851,18 +851,20 @@ The following example shows the combination of the Manifest, Deployment Configur ## Side-by-side assemblies -App-V supports automatic packaging of side-by-side assemblies during sequencing and deployment on the client during virtual application publishing. App-V also supports capturing side-by-side assemblies during sequencing for assemblies not present on the sequencing machine. For assemblies consisting of Visual C++ (Version 8 and newer) or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they weren't installed during monitoring. The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in App-V applications deployed to clients missing the required side-by-side assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. +App-V supports automatic packaging of side-by-side assemblies during sequencing and deployment on the client during virtual application publishing. App-V also supports capturing side-by-side assemblies during sequencing for assemblies not present on the sequencing machine. For assemblies consisting of Visual C++ (Version 8 and newer) or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they weren't installed during monitoring. + +The side-by-side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatized the assemblies, which limited it to one bit version per package. This behavior resulted in App-V applications being deployed to clients missing the required side-by-side assemblies, which led to application launch failures. This forced the packaging process to document and ensure that all assemblies required for packages were locally installed on the user’s client operating system. This task was both a management and implementation challenge due to the number of assemblies and the lack of application documentation for the required dependencies. Side-by-side assembly support in App-V has the following features: -- Automatic captures of side-by-side assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. +- Automatic captures of side-by-side assembly during sequencing, regardless of whether the assembly was already installed on the sequencing workstation. - The App-V Client automatically installs required side-by-side assemblies to the client computer at publishing time if they aren't already installed. - The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. -- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. +- The Sequencer allows opting to not package assemblies already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. ### Automatic publishing of side-by-side assemblies -During publishing of an App-V package with side-by-side assemblies, the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the side-by-side assembly installations in the base packages, as the connection groups don't contain any information about assembly installation. +During publishing of an App-V package with side-by-side assemblies, the App-V Client will check for the presence of the assembly on the machine. If it doesn't detect an assembly, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the side-by-side assembly installations in the base packages, as the connection groups don't contain any information about assembly installation. >[!NOTE] >Unpublishing or removing a package with an assembly does not remove the assemblies for that package. From c8ae649193550e8e3301156dccb723d9a58127db Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 15 May 2018 13:49:41 -0700 Subject: [PATCH 023/187] Editorial changes --- ...istering-virtual-applications-with-the-management-console.md | 2 +- .../app-v/appv-application-publishing-and-client-interaction.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md index 58e54b4527..5abc5df2bd 100644 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md @@ -48,7 +48,7 @@ The main elements of the App-V Management Console are: |Administrators tab|Use the **Administrators** tab to register, add, or remove administrators in your App-V environment.| >[!IMPORTANT] ->JavaScript must be enabled on the browser you use to open the Web Management Console. +>The browser you're using to open the Web Management Console must have JavaScript enabled. ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index e4747adc38..5bedf07e80 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -51,7 +51,7 @@ The appv file contains the following folder and files, which are used when creat ## App-V Client data storage locations -The App-V Client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. +The App-V Client performs tasks to keep virtual applications running properly and working like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. | Name | Location | Description | |---|---|---| From 089059c61a9cb1c19bbbce1f776a855bc6c1f6a2 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 15 May 2018 14:30:07 -0700 Subject: [PATCH 024/187] Error fix sweep --- ...ation-publishing-and-client-interaction.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 5bedf07e80..9902296574 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -55,15 +55,15 @@ The App-V Client performs tasks to keep virtual applications running properly an | Name | Location | Description | |---|---|---| -| Package Store | %ProgramData%\App-V| Default location for read only package files| -| Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents| -| User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents| -| Shortcut Backups | %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups| Stores previous integration points that enable restore on package unpublish| -| Copy on Write (COW) Roaming | %AppData%\Microsoft\AppV\Client\VFS| Writeable roaming location for package modification| -| Copy on Write (COW) Local | %LocalAppData%\Microsoft\AppV\Client\VFS| Writeable non-roaming location for package modification| -| Machine Registry | HKLM\Software\Microsoft\AppV| Contains package state information, including VReg for machine or globally published packages (Machine hive)| -| User Registry | HKCU\Software\Microsoft\AppV| Contains user package state information including VReg| -| User Registry Classes | HKCU\Software\Classes\AppV| Contains additional user package state information| +| Package Store | %ProgramData%\App-V| Default location for read-only package files.| +| Machine Catalog | %ProgramData%\Microsoft\AppV\Client\Catalog| Contains per-machine configuration documents.| +| User Catalog | %AppData%\Microsoft\AppV\Client\Catalog| Contains per-user configuration documents.| +| Shortcut Backups | %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups| Stores previous integration points that enable restore on package unpublish.| +| Copy on Write (COW) Roaming | %AppData%\Microsoft\AppV\Client\VFS| Writeable roaming location for package modification.| +| Copy on Write (COW) Local | %LocalAppData%\Microsoft\AppV\Client\VFS| Writeable non-roaming location for package modification.| +| Machine Registry | HKLM\Software\Microsoft\AppV| Contains package state information, including VReg for machine or globally published packages (Machine hive).| +| User Registry | HKCU\Software\Microsoft\AppV| Contains user package state information including VReg.| +| User Registry Classes | HKCU\Software\Classes\AppV| Contains additional user package state information.| Additional details for the table are provided in the section below and throughout the document. @@ -97,7 +97,7 @@ The App-V Client manages the following two file-based locations: ||| |---|---| -|Description|Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (such as when the package directory is in a shared disk location).

If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.| +|Description|Stores package documents that are available to users on the machine when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (such as when the package directory is in a shared disk location).

If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.| |Default storage location|```%programdata%\Microsoft\AppV\Client\Catalog\```

This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.| |Files in the machine catalog|- Manifest.xml
- DeploymentConfiguration.xml
- UserManifest.xml (Globally Published Package)
- UserDeploymentConfiguration.xml (Globally Published Package)| |Additional machine catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned previously as the default storage location:

```%programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID```| @@ -119,7 +119,7 @@ During the publishing process, the App-V Client backs up any shortcuts and integ ### Copy on Write files -The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. These changes are not made in the package store in order to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. +The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. However, these changes aren't made in the package store to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. ### COW roaming @@ -127,7 +127,7 @@ The COW Roaming location described above stores changes to files and directories ### COW local -The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (for example, Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. +The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (for example, Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the signed-in users. The non-**S** location stores user-based changes. ## Package registry @@ -137,7 +137,7 @@ When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file **Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGuid}.dat** -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location ```HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY```. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location ```HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User```. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. +When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location ```HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY```. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a user-specific location ```HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User```. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. ### Package registry staging vs. connection group registry staging @@ -157,7 +157,7 @@ There are two package registry locations and two connection group locations wher |Location|Description| |---|---| -|COW|- Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)
- User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes
- User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)| +|COW|- Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)
- User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes
- User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non-elevated process)| |Package|- Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine
- User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry| |Native|- Native application registry location| From 5ef357a7eb359dffbf24dc9e50c20d74bd7a2d98 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 15 May 2018 15:47:55 -0700 Subject: [PATCH 025/187] Passive voice & editorial changes --- ...ation-publishing-and-client-interaction.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 9902296574..cf5a6a46e8 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -147,7 +147,7 @@ The staged registry persists the same way as in the single package case. Staged ### Virtual registry -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality—that is, any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. +The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality—that is, any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the **registry COW** > **package** > **native**. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. ### Registry locations @@ -241,11 +241,11 @@ After the initial stream of any publishing data and the primary feature block, r ### Package upgrades -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: ```%ProgramData%\App-V\{PkgGUID}\{newVerGUID}```. The upgrade operation is optimized by creating hard links to identical and streamed files from other versions of the same package. +App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are like the package publish operation, as each version will be created in its own PackageRoot location: ```%ProgramData%\App-V\{PkgGUID}\{newVerGUID}```. The upgrade operation is optimized by creating hard links to identical and streamed files from other versions of the same package. ### Package removal -The App-V Client's behavior when packages are removed depends on the package removal method. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the **Remove-AppVClientPackge** Windows PowerShell cmdlet is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. +The App-V Client's behavior when packages are removed depends on the package removal method. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but the package store location and COW locations remain. When the **Remove-AppVClientPackge** Windows PowerShell cmdlet is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. ## Roaming registry and data @@ -306,20 +306,20 @@ The current App-V Client VFS driver can't write to network locations, so the App This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: -1. The App-V application is shut down, which shuts down the virtual environment. -2. The local cache of the roaming AppData location is compressed and stored in a .zip file. -3. A time stamp at the end of the .zip packaging process is used to name the file. -4. The time stamp is recorded in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. -5. The folder redirection process is called to evaluate and initiate the .zip file uploaded to the roaming AppData directory. +1. Shut down the App-V application, which also shuts down the virtual environment. +2. Compress the local cache of the roaming AppData location and store it in a .zip file. +3. Use the time stamp at the end of the .zip packaging process to name the file. +4. Record the time stamp in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. +5. Call the folder redirection process to evaluate and initiate the .zip file uploaded to the roaming AppData directory. -The time stamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: +The time stamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published, or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: -1. The user starts the virtual environment by starting an application. +1. The user starts an application, which also starts the virtual environment. 2. The application’s virtual environment checks for the most recent time stamped .zip file, if present. -3. The registry is checked for the last known uploaded time stamp, if present. +3. The virtual environment checks the registry for the last known uploaded time stamp, if present. 4. The most recent .zip file is downloaded unless the local last known upload time stamp is greater than or equal to the time stamp from the .zip file. 5. If the local last known upload time stamp is earlier than that of the most recent .zip file in the roaming AppData location, the .zip file is extracted to the local temp directory in the user’s profile. -6. After the .zip file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. +6. After the .zip file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data moved into place. 7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: From 1774417a72ce5b1166608d4ef6d60d40601fc87d Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 16 May 2018 10:18:54 -0700 Subject: [PATCH 026/187] Editorial changes --- ...ation-publishing-and-client-interaction.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index cf5a6a46e8..969d5c7296 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -298,35 +298,35 @@ The following table shows local and roaming locations, when folder redirection h | appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv\_ROOT | | AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\<GUID>\AppData | -The current App-V Client VFS driver can't write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: +The current App-V Client VFS driver can't write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. Here's what happens during the process: 1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. 2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. 3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. -This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: +This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The process does the following things: -1. Shut down the App-V application, which also shuts down the virtual environment. -2. Compress the local cache of the roaming AppData location and store it in a .zip file. -3. Use the time stamp at the end of the .zip packaging process to name the file. -4. Record the time stamp in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. -5. Call the folder redirection process to evaluate and initiate the .zip file uploaded to the roaming AppData directory. +1. Shuts down the App-V application, which also shuts down the virtual environment. +2. Compresses the local cache of the roaming AppData location and store it in a .zip file. +3. Uses the time stamp at the end of the .zip packaging process to name the file. +4. Records the time stamp in the HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime registry as the last known AppData time stamp. +5. Calls the folder redirection process to evaluate and initiate the .zip file uploaded to the roaming AppData directory. -The time stamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published, or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: +The time stamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published, or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. Here's what happens during the process: 1. The user starts an application, which also starts the virtual environment. 2. The application’s virtual environment checks for the most recent time stamped .zip file, if present. 3. The virtual environment checks the registry for the last known uploaded time stamp, if present. -4. The most recent .zip file is downloaded unless the local last known upload time stamp is greater than or equal to the time stamp from the .zip file. -5. If the local last known upload time stamp is earlier than that of the most recent .zip file in the roaming AppData location, the .zip file is extracted to the local temp directory in the user’s profile. +4. The virtual environment downloads the most recent .zip file unless the local last known upload time stamp is greater than or equal to the time stamp from the .zip file. +5. If the local last known upload time stamp is earlier than that of the most recent .zip file in the roaming AppData location, the virtual environment extracts the .zip file to the local temp directory in the user’s profile. 6. After the .zip file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data moved into place. 7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. -This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: +This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The process does the following things: -1. During repair, detect if the path to the user’s roaming AppData directory isn't local. -2. Map the non-local roaming AppData path targets, recreating the expected roaming and local AppData locations. -3. Delete the time stamp stored in the registry, if present. +1. During repair, detects if the path to the user’s roaming AppData directory isn't local. +2. Maps the non-local roaming AppData path targets, recreating the expected roaming and local AppData locations. +3. Deletes the time stamp stored in the registry, if present. This process will recreate both the local and network locations for AppData and remove the registry record of the time stamp. From c4a086a4747f4e1eb12e973917e927554a786233 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 18 May 2018 15:20:29 -0700 Subject: [PATCH 027/187] Editorial changes --- ...ministrator-with-the-management-console.md | 2 +- ...de-packages-with-the-management-console.md | 4 +-- ...ation-publishing-and-client-interaction.md | 32 +++++++++---------- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index 7867900bd3..a7c0447d3e 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -22,7 +22,7 @@ Use the following procedures to add or remove an administrator on the Microsoft ## Remove an administrator using the Management Console -1. Open the Microsoft Application Virtualization (App-V) Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. +1. Open the Microsoft Application Virtualization (App-V) Management Console and select **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) server. 2. Right-click the account to be removed from the list of administrators and select **Remove**. ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index 97631d1114..5f03b7e815 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -24,14 +24,14 @@ You can use the following procedure to add or upgrade a package to the App-V Man 2. Select **Add or Upgrade Packages** to specify which package you want to add. -3. Enter the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. +3. Enter the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then select **Add**. >[!IMPORTANT] >You must select a package with the **.appv** file name extension. 4. The page displays the status message **Adding <Packagename>**. Select **IMPORT STATUS** to check the status of a package that you have imported. - Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, select **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. + Select **OK** to add the package and close the **Add Package** page. If there was an error during the import, select **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. 5. Select **Close** to close the **Add or Upgrade Packages** page. diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 969d5c7296..80495b4c66 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -387,11 +387,11 @@ The process then configures the client for package or connection group additions 5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created). - 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog + 6. Create location of the package store in the registry **HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog**. - 7. Create the **Registry.dat** file from the package store to **%ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat** + 7. Create the **Registry.dat** file from the package store to **%ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat**. - 8. Register the package with the App-V Kernal Mode Driver at HKLM\\Microsoft\\Software\\AppV\\MAV + 8. Register the package with the App-V Kernal Mode Driver at **HKLM\\Microsoft\\Software\\AppV\\MAV**. 9. Invoke scripting from the **AppxManifest.xml** or **DeploymentConfig.xml** file for Package Add timing. @@ -425,7 +425,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the Machine Catalog. -2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV +2. Register the package with the kernel mode driver for the user at **HKLM\\Software\\Microsoft\\AppV\\MAV**. 3. Perform integration tasks. @@ -448,7 +448,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A #### How to launch App-V applications -1. User launches the application by clicking on a shortcut or file type invocation. +1. User launches the application by selecting a shortcut or file type invocation. 2. The App-V Client verifies existence in the User Catalog for the following files @@ -477,11 +477,11 @@ The current version of App-V's package upgrade process differs from the older ve 2. Package entries are added to the appropriate catalog for the new version - 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the user catalog at **appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. - 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID + 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the machine catalog at **%programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. -3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV +3. Register the package with the kernel mode driver for the user at **HKLM\\Software\\Microsoft\\AppV\\MAV**. 4. Perform integration tasks. @@ -536,11 +536,11 @@ App-V Packages can be published in one of two ways; as user, which entitles an A ### Removing an App-V package -Removing App-V applications in a Full Infrastructure is an unpublish operation, and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. +Removing App-V applications in a Full Infrastructure is an unpublish operation and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. ### Repairing an App-V package -The repair operation is easy to do, but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are deintegrated and then reintegrated. Before repairing, please review where the COW data placement locations are registered in the registry. To perform a Repair operation, all you need to do is initiate it from the App-V Client Console or through the **Repair-AppVClientPackage** PowerShell cmdlet. After that, the operation is completed automatically. +The repair operation is easy to do but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are deintegrated and then reintegrated. Before repairing, please review where the COW data placement locations are registered in the registry. To perform a Repair operation, all you need to do is initiate it from the App-V Client Console or through the **Repair-AppVClientPackage** PowerShell cmdlet. After that, the operation is completed automatically. ## Integration of App-V packages @@ -560,7 +560,7 @@ When App-V applications are published to a computer with the App-V Client, some 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. - 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. + 3. Restore the backed-up data when the last package is unpublished or removed on a per-extension point basis. ### Extension points @@ -580,7 +580,7 @@ The App-V publishing files (manifest and dynamic configuration) provide several The shortcut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. -From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: +From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section like the following: ```XML @@ -652,7 +652,7 @@ Shell extensions are embedded in the package automatically during the sequencing #### Requirements for using shell extensions - Packages that contain embedded shell extensions must be published globally. -- The “bitness” of the application, Sequencer, and App-V Client must match, or the shell extensions won’t work. The following example configuration fuflills the matching requirement: +- The “bitness” of the application, Sequencer, and App-V Client must match, or the shell extensions won’t work. The following example configuration fulfills the matching requirement: - The version of the application is 64-bit. - The Sequencer is running on a 64-bit computer. - The package is being delivered to a 64-bit App-V Client computer. @@ -663,7 +663,7 @@ The following table displays the supported shell extensions. |---|---| | Context menu handler | Adds menu items to the context menu. It is called before the context menu is displayed. | | Drag-and-drop handler | Controls the action upon right-click drag-and-drop and modifies the context menu that appears. | -| Drop target handler | Controls the action after a data object is dragged-and-dropped over a drop target such as a file.| +| Drop target handler | Controls the action after a data object is dragged-and-dropped over a drop target, such as a file.| | Data object handler| Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.| | Property sheet handler| Replaces or adds pages to the property sheet dialog box of an object.| | Infotip handler| Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse-hover.| @@ -744,11 +744,11 @@ The AppPath extension point is configured either in the manifest or in the dynam ### Virtual application -This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, you can disable all extension points belonging to one application to only allow integration of extension points for the other application. +This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a specific application can be disabled using dynamic configuration files. For example, if a package contains two applications, you can disable all extension points belonging to one application to only allow integration of extension points for the other application. ### Extension point rules -The previously described extension points are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). +The previously described extension points are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example, a shortcut created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. From 139597c4252f2882d0e5cb0df2664ef5daacc236 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 29 May 2018 09:21:36 -0700 Subject: [PATCH 028/187] Added spacing --- .../remove-provisioned-apps-during-update.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index fc63f4cba3..489c97927a 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -93,36 +93,68 @@ Windows Registry Editor Version 5.00 ;1709 Registry Keys [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OneConnect_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Print3D_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.StorePurchaseApp_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Wallet_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsStore_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Xbox.TCUI_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxApp_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxGameOverlay_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] ``` From 30765d8bde8c1448ff0feb1d92f67bb6f2874c7e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 30 May 2018 16:47:23 -0700 Subject: [PATCH 029/187] win 8.1 --- .../windows-defender-atp/TOC.md | 1 + ...ows-defender-advanced-threat-protection.md | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index e69658d82e..a8defba7ee 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -7,6 +7,7 @@ ### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) ## [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md) +### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) ### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) #### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) #### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..875feb88d2 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -0,0 +1,100 @@ +--- +title: Onboard Windows 7 SP 1 machines on Windows Defender ATP +description: Onboard Windows 7 SP 1 machines so that they can send sensor data to the Windows Defender ATP sensor +keywords: Onboard Windows 7 machines, oms, sp1, enterprise, pro, down level +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 06/11/2018 +--- + +# Onboard Windows 7 SP1 machines + +**Applies to:** + +- Windows 7 SP1 Enterprise +- Windows 7 SP1 Pro +- Windows 8.1 +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[!include[Prerelease information](prerelease.md)] + +Windows Defender ATP extends support to also include down-level operating systems, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console. + +To onboard down-level Windows client endpoints to Windows Defender ATP, youll need to: +- Configure and update System Center Endpoint Protection clients. +- Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP as instructed below. + +>[!TIP] +> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md). + +## Configure and update System Center Endpoint Protection clients +>[!IMPORTANT] +>This step is required only if your organization uses System Center Endpoint Protection (SCEP). + +Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. + +The following steps are required to enable this integration: +- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/en-us/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) +- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting + +## Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP + +### Before you begin +Review the following details to verify minimum system requirements: +- Install the [February monthly update rollout](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598) +- Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) +- Meet the Azure Log Analytics agent minimum system requirements. For more information, see [Collect data from computers in you environment with Log Analytics](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-concept-hybrid#prerequisites) + +1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603) or [Windows 32-bit agent](https://go.microsoft.com/fwlink/?LinkId=828604). + +2. Obtain the workspace ID: + - In the Windows Defender ATP navigation pane, select **Settings > Machine management > Onboarding** + - Select **Windows 7 SP1 and 8.1** as the operating system + - Copy the workspace ID and workspace key + +3. Using the Workspace ID and Workspace key choose any of the following installation methods to install the agent: + - Manually install the agent using setup
+ On the **Agent Setup Options** page, select **Connect the agent to Azure Log Analytics (OMS) + - [Install the agent using command line](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#add-a-workspace-using-a-script). + +4. If youre using a proxy server to connect to the Internet see the Configure proxy settings section. + +Once completed, you should see onboarded servers in the portal within an hour. + +### Configure server proxy and Internet connectivity settings + +- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway). +- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service: + +Agent Resource | Ports +:---|:--- +| *.oms.opinsights.azure.com | 443 | +| *.blob.core.windows.net | 443 | +| *.azure-automation.net | 443 | +| *.ods.opinsights.azure.com | 443 | +| winatp-gw-cus.microsoft.com | 443 | +| winatp-gw-eus.microsoft.com | 443 | +| winatp-gw-neu.microsoft.com | 443 | +| winatp-gw-weu.microsoft.com | 443 | +|winatp-gw-uks.microsoft.com | 443 | +|winatp-gw-ukw.microsoft.com | 443 | +| winatp-gw-aus.microsoft.com | 443| +| winatp-gw-aue.microsoft.com |443 | + + +## Offboard client endpoints +To offboard, you can uninstall the MMA agent from the endpoint or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the endpoint will no longer send sensor data to Windows Defender ATP. + +>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevele-belowfoldlink) + + + + + + From af0db775a7d8cefda4fd2bafed457cbe8cefadd5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 30 May 2018 16:47:40 -0700 Subject: [PATCH 030/187] remove --- ...oard-downlevel-windows-defender-advanced-threat-protection.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md index 875feb88d2..fb9fa92c3a 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -19,7 +19,6 @@ ms.date: 06/11/2018 - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro -- Windows 8.1 - Windows Defender Advanced Threat Protection (Windows Defender ATP) [!include[Prerelease information](prerelease.md)] From 883c7e82eef703451c19dbb246df4050bb86a133 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 31 May 2018 10:35:04 -0700 Subject: [PATCH 031/187] add downlevel support in preview features topic --- ...-windows-defender-advanced-threat-protection.md | 14 +++++++------- ...-windows-defender-advanced-threat-protection.md | 9 ++++++++- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md index fb9fa92c3a..a542df63b1 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: Onboard Windows 7 SP 1 machines on Windows Defender ATP -description: Onboard Windows 7 SP 1 machines so that they can send sensor data to the Windows Defender ATP sensor -keywords: Onboard Windows 7 machines, oms, sp1, enterprise, pro, down level +title: Onboard previous versions of Windows on Windows Defender ATP +description: Onboard supported previous versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor +keywords: onboard, windows, 7, 8, oms, sp1, enterprise, pro, down level search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -13,12 +13,14 @@ ms.localizationpriority: high ms.date: 06/11/2018 --- -# Onboard Windows 7 SP1 machines +# Onboard Windows previous versions of Windows **Applies to:** - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro +- Windows 8.1 Enterprise +- Windows 8.1 Pro - Windows Defender Advanced Threat Protection (Windows Defender ATP) [!include[Prerelease information](prerelease.md)] @@ -62,7 +64,7 @@ Review the following details to verify minimum system requirements: On the **Agent Setup Options** page, select **Connect the agent to Azure Log Analytics (OMS) - [Install the agent using command line](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#add-a-workspace-using-a-script). -4. If youre using a proxy server to connect to the Internet see the Configure proxy settings section. +4. If you're using a proxy server to connect to the Internet see the Configure proxy settings section. Once completed, you should see onboarded servers in the portal within an hour. @@ -83,8 +85,6 @@ Agent Resource | Ports | winatp-gw-weu.microsoft.com | 443 | |winatp-gw-uks.microsoft.com | 443 | |winatp-gw-ukw.microsoft.com | 443 | -| winatp-gw-aus.microsoft.com | 443| -| winatp-gw-aue.microsoft.com |443 | ## Offboard client endpoints diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index 4b90b87fb8..90008c037e 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 04/24/2018 +ms.date: 06/11/2018 --- # Windows Defender ATP preview features @@ -42,12 +42,19 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Onboard previous versions of Windows](onboard-downlevel--windows-defender-advanced-threat-protection.md)
+Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor + - Windows 7 SP1 Enterprise + - Windows 7 SP1 Pro + - Windows 8.1 Enterprise + - Windows 8.1 Pro - [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the onboarding of the following servers: - Windows Server 2012 R2 - Windows Server 2016 - Windows Server, version 1803 + - [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the use of Power BI data connectors to enable you to connect and access Windows Defender ATP data using Microsoft Graph. From 7551ecb60a5997c4d6baa36f1e4eedada6f8fdea Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 31 May 2018 10:58:28 -0700 Subject: [PATCH 032/187] fix broken link --- .../preview-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index 90008c037e..13702b6849 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -42,7 +42,7 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: -- [Onboard previous versions of Windows](onboard-downlevel--windows-defender-advanced-threat-protection.md)
+- [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md)
Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro From 1a50171de2689d5a0dedee1e8da09f79e3e341c9 Mon Sep 17 00:00:00 2001 From: D76C6399A0F334216B3A58BE07C3C3137D5E14542BC13CA38EB0800D9FFC1FE6 Date: Fri, 1 Jun 2018 13:43:37 -0400 Subject: [PATCH 033/187] Fixes #1008 Fixes #1008 --- .../basic-level-windows-diagnostic-events-and-fields.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields.md index 187e7a2c48..1713e744d8 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields.md @@ -1509,15 +1509,20 @@ This event sends data about the processor (architecture, speed, number of cores, The following fields are available: -- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. +- **KvaShadow** Microcode info of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. +- **ProcessorArchitecture** Processor architecture of the installed operating system. - **ProcessorClockSpeed** Clock speed of the processor in MHz. - **ProcessorCores** Number of logical cores in the processor. - **ProcessorIdentifier** Processor Identifier of a manufacturer. - **ProcessorManufacturer** Name of the processor manufacturer. - **ProcessorModel** Name of the processor model. - **ProcessorPhysicalCores** Number of physical cores in the processor. -- **ProcessorUpdateRevision** Microcode revision +- **ProcessorUpdateRevision** Microcode revision. +- **ProcessorUpdateStatus** The status of the microcode update. - **SocketCount** Count of CPU sockets. +- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability. ### Census.Security From ed837b15f7724e17e1f2de459171ba81e4dc6d09 Mon Sep 17 00:00:00 2001 From: Jan Pilar Date: Mon, 4 Jun 2018 07:57:11 +0200 Subject: [PATCH 034/187] Update automated-investigations-windows-defender-advanced-threat-protection.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The remediation options table contains error. There are four semi-remediation actions available in Windows Defender Security Center portal. The table describes five rules where that extra rule has name from row above (Semi - require approval for non-temp folders remediation) and description from row below (Semi - require approval for core folders remediation). I suppose it´s error. --- ...investigations-windows-defender-advanced-threat-protection.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md index b4c4800faf..0fbf8430f5 100644 --- a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md @@ -73,7 +73,6 @@ Automation level | Description :---|:--- Semi - require approval for any remediation | This is the default automation level.

An approval is needed for any remediation action. Semi - require approval for non-temp folders remediation | An approval is required on files or executables that are not in temporary folders.

Files or executables in temporary folders, such as the user's download folder or the user's temp folder, will automatically be remediated if needed. -Semi - require approval for non-temp folders remediation | An approval is required on files or executables that are in the operating system directories such as Windows folder and Program files folder.

Files or executables in all other folders will automatically be remediated if needed. Semi - require approval for core folders remediation | An approval is required on files or executables that are in the operating system directories such as Windows folder and Program files folder.

Files or executables in all other folders will automatically be remediated if needed. Full - remediate threats automatically | All remediation actions will be performed automatically. From 9589c5d157cea9f66222e11f289dd6c797389f6c Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 4 Jun 2018 16:49:34 -0700 Subject: [PATCH 035/187] Removing unnecessary monospace formatting --- ...ation-publishing-and-client-interaction.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 80495b4c66..a3563907c0 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -69,7 +69,7 @@ Additional details for the table are provided in the section below and throughou ### Package store -The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. +The App-V Client manages the applications assets mounted in the package store. This default storage location is %ProgramData%\App-V, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (`PackageInstallationRoot` value under the HKLM\Software\Microsoft\AppV\Client\Streaming key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. Example of a path to a specific application: @@ -98,9 +98,9 @@ The App-V Client manages the following two file-based locations: ||| |---|---| |Description|Stores package documents that are available to users on the machine when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (such as when the package directory is in a shared disk location).

If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.| -|Default storage location|```%programdata%\Microsoft\AppV\Client\Catalog\```

This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.| +|Default storage location|%programdata%\Microsoft\AppV\Client\Catalog\

This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.| |Files in the machine catalog|- Manifest.xml
- DeploymentConfiguration.xml
- UserManifest.xml (Globally Published Package)
- UserDeploymentConfiguration.xml (Globally Published Package)| -|Additional machine catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned previously as the default storage location:

```%programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID```| +|Additional machine catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned previously as the default storage location:

%programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID| |Additional files in the machine catalog when the package is part of a connection group|- PackageGroupDescriptor.xml
- UserPackageGroupDescriptor.xml (globally published Connection Group)| ### User catalog @@ -108,14 +108,14 @@ The App-V Client manages the following two file-based locations: ||| |---|---| |Description|Created during the publishing process. Contains information used for publishing the package, and for making sure that a package is provisioned to a specific user at launch. Created in a roaming location and includes user-specific publishing information.

When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.| -|Default storage location|```appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID```| +|Default storage location|appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID| |Files in the user catalog|- UserManifest.xml
- DynamicConfiguration.xml or UserDeploymentConfiguration.xml| -|Additional user catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned above:

```appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID```| -|Additional file in the machine catalog when the package is part of a connection group|```UserPackageGroupDescriptor.xml```| +|Additional user catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned above:

appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID| +|Additional file in the machine catalog when the package is part of a connection group|**UserPackageGroupDescriptor.xml**| ### Shortcut backups -During the publishing process, the App-V Client backs up any shortcuts and integration points to ```%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups```. This backup lets integration points restore to the previous versions when the package is unpublished. +During the publishing process, the App-V Client backs up any shortcuts and integration points to %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups. This backup lets integration points restore to the previous versions when the package is unpublished. ### Copy on Write files @@ -133,11 +133,11 @@ The COW Local location is similar to the roaming location, but the directories a Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at ```%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat```. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. +When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at %ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. **Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGuid}.dat** -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location ```HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY```. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a user-specific location ```HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User```. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. +When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a user-specific location HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. ### Package registry staging vs. connection group registry staging @@ -173,7 +173,7 @@ There are two COW locations for HKLM: elevated and non-elevated processes. Eleva ### Pass-through keys -An administrator can use pass-through keys to configure certain keys to only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package-specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key ```HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry```. Any key that appears under this multi-string value (and their children) will be treated as pass-through. +An administrator can use pass-through keys to configure certain keys to only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package-specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry. Any key that appears under this multi-string value (and their children) will be treated as pass-through. The following locations are configured as pass-through locations by default: @@ -211,7 +211,7 @@ Packages can be explicitly loaded by entering the **Mount-AppVClientPackage** P ### Streaming packages -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: ```HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming```. Policies are set by entering the **Set-AppvClientConfiguration** PowerShell cmdlet. The following policies apply to streaming: +The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming. Policies are set by entering the **Set-AppvClientConfiguration** PowerShell cmdlet. The following policies apply to streaming: |Policy|Description| |---|---| @@ -229,7 +229,7 @@ These settings affect the behavior of streaming App-V package assets to the clie ### Background streaming -The Windows PowerShell cmdlet ```Get-AppvClientConfiguration``` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with either the **Set-AppvClientConfiguration** cmdlet or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can either be disabled altogether (value=0) or enabled for all packages (value=2), regardless of whether they have been launched. +The Windows PowerShell cmdlet **Get-AppvClientConfiguration** can be used to determine the current mode for background streaming with the AutoLoad setting and modified with either the **Set-AppvClientConfiguration** cmdlet or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can either be disabled altogether (value=0) or enabled for all packages (value=2), regardless of whether they have been launched. ### Optimized streaming @@ -241,7 +241,7 @@ After the initial stream of any publishing data and the primary feature block, r ### Package upgrades -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are like the package publish operation, as each version will be created in its own PackageRoot location: ```%ProgramData%\App-V\{PkgGUID}\{newVerGUID}```. The upgrade operation is optimized by creating hard links to identical and streamed files from other versions of the same package. +App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are like the package publish operation, as each version will be created in its own PackageRoot location: %ProgramData%\App-V\{PkgGUID}\{newVerGUID}. The upgrade operation is optimized by creating hard links to identical and streamed files from other versions of the same package. ### Package removal @@ -256,12 +256,12 @@ App-V is able to provide a near-native experience when roaming, depending on how App-V stores data, which represents the state of the user’s catalog, in the form of: - Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog -- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` +- Registry settings under HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. >[!NOTE] ->The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. +>The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under HKEY_CURRENT_USER is missing or mismatched with the data in %appdata%. ### Registry-based data From 1c5e849a89dbc02c818b4b80cc28ec967e097669 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 5 Jun 2018 14:05:37 +0000 Subject: [PATCH 036/187] Merged PR 8779: new Intune kiosk profile instructions --- ...change-history-for-configure-windows-10.md | 8 +++++++- .../lock-down-windows-10-to-specific-apps.md | 20 +++++++++---------- .../setup-kiosk-digital-signage.md | 12 +++++------ 3 files changed, 22 insertions(+), 18 deletions(-) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 95e3da2dff..8b3d74ac3b 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -10,13 +10,19 @@ ms.localizationpriority: high author: jdeckerms ms.author: jdecker ms.topic: article -ms.date: 05/31/2018 +ms.date: 06/05/2018 --- # Change history for Configure Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## June 2018 + +New or changed topic | Description +--- | --- +[Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education](setup-kiosk-digital-signage.md) and [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Updated instructions for using Microsoft Intune to configure a kiosk. + ## May 2018 New or changed topic | Description diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index f1cc7e5caa..7610e6fe75 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: high -ms.date: 04/30/2018 +ms.date: 06/05/2018 ms.author: jdecker ms.topic: article --- @@ -38,9 +38,6 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi ## Configure a kiosk in Microsoft Intune -Watch how to use Intune to configure a multi-app kiosk. - ->[!VIDEO https://www.microsoft.com/videoplayer/embed/ce9992ab-9fea-465d-b773-ee960b990c4a?autoplay=false] 1. [Generate the Start layout for the kiosk device.](#startlayout) 2. In the Microsoft Azure portal, search for **Intune** or go to **More services** > **Intune**. @@ -49,14 +46,15 @@ Watch how to use Intune to configure a multi-app kiosk. 5. Select **Create profile**. 6. Enter a friendly name for the profile. 7. Select **Windows 10 and later** for the platform. -8. Select **Device restrictions** for the profile type. -9. Select **Kiosk**. -10. In **Kiosk Mode**, select **Multi app kiosk**. -11. Select **Add** to define a configuration, which specifies the apps that will run and the layout for the Start menu. +8. Select **Kiosk (Preview)** for the profile type. +9. Select **Kiosk - 1 setting available**. +10. Select **Add** to define a configuration, which specifies the apps that will run and the layout for the Start menu. 12. Enter a friendly name for the configuration. -13. Select an app type, either **Win32 App** for a classic desktop application or **UWP App** for a Universal Windows Platform app. - - For **Win32 App**, enter the fully qualified pathname of the executable, with respect to the device. - - For **UWP App**, enter the Application User Model ID for an installed app. +10. In **Kiosk Mode**, select **Multi app kiosk**. +13. Select an app type. + - For **Add Win32 app**, enter the **App Name** and **Identifier**. + - For **Add managed apps**, select an app that you manage through Intune. + - For **Add app by AUMID**, enter the Application User Model ID (AUMID) for an installed UWP app. 14. Select whether to enable the taskbar. 15. Browse to and select the Start layout XML file that you generated in step 1. 16. Add one or more accounts. When the account signs in, only the apps defined in the configuration will be available. diff --git a/windows/configuration/setup-kiosk-digital-signage.md b/windows/configuration/setup-kiosk-digital-signage.md index a2b8efc53b..36581a3438 100644 --- a/windows/configuration/setup-kiosk-digital-signage.md +++ b/windows/configuration/setup-kiosk-digital-signage.md @@ -10,7 +10,7 @@ author: jdeckerms ms.author: jdecker ms.topic: article ms.localizationpriority: high -ms.date: 05/25/2018 +ms.date: 06/05/2018 --- # Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education @@ -268,11 +268,11 @@ The following steps explain how to configure a kiosk in Microsoft Intune. For ot 5. Select **Create profile**. 6. Enter a friendly name for the profile. 7. Select **Windows 10 and later** for the platform. -8. Select **Device restrictions** for the profile type. -9. Select **Kiosk**. -10. In **Kiosk Mode**, select **Single app kiosk**. -1. Enter the user account (Azure AD or a local standard user account). -11. Enter the Application User Model ID for an installed app. +8. Select **Kiosk (Preview)** for the profile type. +9. Enter a friendly name for the kiosk configuration. +10. In **Kiosk Mode**, select **Single full-screen app kiosk**. +10. Select either **Select a managed app** to choose a kiosk app that is managed by Intune, or **Enter UWP app AUMID** to specify the kiosk app by AUMID, and then select the app or enter the AUMID as appropriate. +1. For the user account, select either **Autologon** to create a user account for the kiosk that will sign in automatically, or **Local user account** to configure an existing user account to run the kiosk. **Local user account** can be a local standard user account on the device or an Azure Active Directory account. 14. Select **OK**, and then select **Create**. 18. Assign the profile to a device group to configure the devices in that group as kiosks. From 78dc002c7659e2ccaeb996844f9812b5db5e7813 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 5 Jun 2018 16:15:04 +0000 Subject: [PATCH 037/187] Merged PR 8783: privacy - change tile on landing page --- windows/privacy/index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml index 8c3307e588..b600667ee2 100644 --- a/windows/privacy/index.yml +++ b/windows/privacy/index.yml @@ -46,7 +46,7 @@ sections: items: - - href: \windows\privacy\gdpr-win10-whitepaper + - href: \windows\privacy\gdpr-it-guidance html:

Learn about GDPR and how Microsoft helps you get started towards compliance

@@ -54,7 +54,7 @@ sections: src: https://docs.microsoft.com/media/common/i_advanced.svg - title: Begin your GDPR journey + title: Start with GDPR basics - href: \windows\privacy\configure-windows-diagnostic-data-in-your-organization From a14aa182d76bf51136f6833c200c473da47e52b1 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Tue, 5 Jun 2018 16:52:18 +0000 Subject: [PATCH 038/187] Merged PR 8786: Update MC:EE Device promotion details --- .../windows/get-minecraft-device-promotion.md | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/education/windows/get-minecraft-device-promotion.md b/education/windows/get-minecraft-device-promotion.md index 45c3a1d2d0..5bbd1a39a2 100644 --- a/education/windows/get-minecraft-device-promotion.md +++ b/education/windows/get-minecraft-device-promotion.md @@ -10,7 +10,7 @@ author: trudyha searchScope: - Store ms.author: trudyha -ms.date: 07/27/2017 +ms.date: 06/05/2018 ms.technology: Windows --- @@ -20,6 +20,19 @@ ms.technology: Windows - Windows 10 +The **Minecraft: Education Edition** with Windows 10 device promotion ended January 31, 2018. + +Qualifying customers that received one-year subscriptions for Minecraft: Education Edition as part of this program and wish to continue using the game in their schools can purchase new subscriptions in Microsoft Store for Education. +For more information on purchasing Minecraft: Education Edition, see [Add Minecraft to your Store for Education](https://docs.microsoft.com/education/windows/school-get-minecraft?toc=/microsoft-store/education/toc.json). + +>[!Note] +>**Minecraft: Education Edition** with Windows 10 device promotion subscriptions are valid for 1 year from the time +of redemption. At the end of 1 year, the promotional subscriptions will expire and any people using these subscriptions will be reverted to a trial license of **Minecraft: Education Edition**. + +To prevent being reverted to a trial license, admins or teachers need to purchase new **Minecraft: Education Edition** subscriptions from Store for Education, and assign licenses to users who used a promotional subscription. + + + \ No newline at end of file From 2a16e70b02edbd90add739e161521e77da1c66b7 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 5 Jun 2018 10:18:28 -0700 Subject: [PATCH 039/187] Removed monospace, added little location disclaimers before some tables --- ...pplication-publishing-and-client-interaction.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index a3563907c0..bd399c1e22 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -69,7 +69,7 @@ Additional details for the table are provided in the section below and throughou ### Package store -The App-V Client manages the applications assets mounted in the package store. This default storage location is %ProgramData%\App-V, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (`PackageInstallationRoot` value under the HKLM\Software\Microsoft\AppV\Client\Streaming key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. +The App-V Client manages the applications assets mounted in the package store. This default storage location is %ProgramData%\App-V, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (**PackageInstallationRoot** value under the HKLM\Software\Microsoft\AppV\Client\Streaming key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. Example of a path to a specific application: @@ -95,6 +95,8 @@ The App-V Client manages the following two file-based locations: ### Machine catalog +The locations described in this table can be found in the %programdata%\Microsoft\AppV\Client\Catalog\ folder. + ||| |---|---| |Description|Stores package documents that are available to users on the machine when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (such as when the package directory is in a shared disk location).

If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.| @@ -105,6 +107,8 @@ The App-V Client manages the following two file-based locations: ### User catalog +The locations described in this table can be found in the appdata\roaming\Microsoft\AppV\Client\Catalog\ folder. + ||| |---|---| |Description|Created during the publishing process. Contains information used for publishing the package, and for making sure that a package is provisioned to a specific user at launch. Created in a roaming location and includes user-specific publishing information.

When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.| @@ -155,6 +159,8 @@ There are two package registry locations and two connection group locations wher #### Single Package VReg +The registries in the following table are located in the Registry\Client\Packages\PkgGUID\ folder. + |Location|Description| |---|---| |COW|- Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)
- User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes
- User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non-elevated process)| @@ -163,6 +169,8 @@ There are two package registry locations and two connection group locations wher #### Connection Group VReg +The registries in the following table are located in the Machine Registry\Client\PackageGroups\GrpGUID\ and User Registry Classes\Client\PackageGroups\GrpGUID\ folders. + |Location|Description| |---|---| |COW|- Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)
- User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes)
- User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY| @@ -278,7 +286,7 @@ App-V supports folder redirection of the roaming AppData folder (%AppData%). Whe A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. -The following table shows local and roaming locations, when folder redirection has not been implemented. +The following table shows local and roaming locations when folder redirection has not been implemented. | VFS directory in package | Mapped location of backing store | |---|---| @@ -288,7 +296,7 @@ The following table shows local and roaming locations, when folder redirection h | appv\_ROOT | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv_ROOT| | AppData | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\AppData | -The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). +The following table shows local and roaming locations when folder redirection has been implemented for %AppData% and the location has been redirected (typically to a network location). | VFS directory in package | Mapped location of backing store | |---|---| From d3c2b03303e4a0caed58c3fb893a1b806e52bf54 Mon Sep 17 00:00:00 2001 From: MikeBlodge Date: Tue, 5 Jun 2018 13:05:56 -0700 Subject: [PATCH 040/187] editing metadata --- education/windows/s-mode-switch-to-edu.md | 9 +++++---- windows/deployment/windows-10-pro-in-s-mode.md | 4 ++-- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md index 73aa07a2c3..3c85be7184 100644 --- a/education/windows/s-mode-switch-to-edu.md +++ b/education/windows/s-mode-switch-to-edu.md @@ -1,7 +1,7 @@ --- title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode -description: Overview of Windows 10 Pro Education in S mode, switching options, and system requirements -keywords: S mode Switch, switch in S mode, Switch S mode, Windows 10 Pro Education in S mode, S mode, system requirements, Overview, Windows 10 Pro in S mode, Education, EDU +description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. +keywords: Windows 10 S switch, S mode Switch, switch in S mode, Switch S mode, Windows 10 Pro Education in S mode, S mode, system requirements, Overview, Windows 10 Pro in S mode, Education, EDU ms.mktglfcycl: deploy ms.localizationpriority: high ms.prod: w10 @@ -13,11 +13,12 @@ author: Mikeblodge --- # Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode - -S mode is an enhanced security mode of Windows 10 – streamlined for security and superior performance. With Windows 10 in S mode, everyone can download and install Microsoft-verified apps from the Microsoft Store for Education – this keep devices running fast and secure day in and day out. +The S mode switch motion enables users to switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode. This gives users access to the Microsoft Store for Education as well as other Education offers. ## Benefits of Windows 10 Pro in S mode for Education +S mode is an enhanced security mode of Windows 10 – streamlined for security and superior performance. With Windows 10 in S mode, everyone can download and install Microsoft-verified apps from the Microsoft Store for Education – this keep devices running fast and secure day in and day out. + - **Microsoft-verified security** - It reduces risk of malware and exploitations that harm students and educators, because only Microsoft-verified apps can be installed. - **Performance that lasts** - Provides all-day battery life to keep students on task and not tripping over cords. Also, verified apps won’t degrade device performance over time. - **Streamlined for Speed** - Offers faster log-in times so teachers spend less time waiting and more time teaching. diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index c28bb0c1bd..fa10f10cee 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -1,7 +1,7 @@ --- title: Windows 10 Pro in S mode -description: Overview of Windows 10 Pro in S mode, switching options, and system requirements -keywords: S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode +description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. +keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode ms.mktglfcycl: deploy ms.localizationpriority: high ms.prod: w10 From 1fd5125817aa2e50990158efa84923b8ac76f58d Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 5 Jun 2018 20:52:00 +0000 Subject: [PATCH 041/187] Merged PR 8804: Fixing bugs 17776623 and 17624369 --- ...system-components-to-microsoft-services.md | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 8c98fdf633..a948b817ad 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -7,16 +7,16 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high -author: brianlic-msft -ms.author: brianlic-msft -ms.date: 04/09/2018 +author: danihalfin +ms.author: daniha +ms.date: 06/05/2018 --- # Manage connections from Windows operating system components to Microsoft services **Applies to** -- Windows 10 Enterprise edition +- Windows 10 Enterprise, version 1607 and newer - Windows Server 2016 If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). @@ -32,7 +32,10 @@ This baseline was created in the same way as the [Windows security baselines](/w Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. -You should not extract this package to the windows\\system32 folder because it will not apply correctly. +You should not extract this package to the windows\\system32 folder because it will not apply correctly. + +>[!IMPORTANT] +> As part of the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887), MDM functionallity is disabled. If you manage devices through MDM, make sure [cloud notifications are enabled](#bkmk-priv-notifications). Applying the Windows Restricted Traffic Limited Functionality Baseline is the same as applying each setting covered in this article. It is recommended that you restart a device after making configuration changes to it. @@ -87,12 +90,12 @@ Here's a list of changes that were made to this article for Windows 10, version The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections. ->[!NOTE] ->For some settings, MDM policies only partly cover capabilities available through Group Policy. See each setting’s section for more details. - ### Settings for Windows 10 Enterprise edition -The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1703. +The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1607. + +>[!NOTE] +>For some settings, MDM policies only partly cover capabilities available through Group Policy. See each setting’s section for more details. | Setting | UI | Group Policy | MDM policy | Registry | Command line | | - | :-: | :-: | :-: | :-: | :-: | @@ -1075,6 +1078,9 @@ To turn off **Choose apps that can use your microphone**: ### 17.5 Notifications +>[!IMPORTANT] +>Disabling notifications will also disable the ability to manage the device through MDM. If you are using an MDM solution, make sure cloud notifications are enabled through one of the options below. + To turn off notifications network usage: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn off Notifications network usage** From eba24edeba93514eecc20ff80bc683b30a11f90e Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 5 Jun 2018 15:52:12 -0700 Subject: [PATCH 042/187] added texttransform --- .../microsoft-recommended-block-rules.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 4bbf440bbc..b3f44ab315 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -78,7 +78,7 @@ For October 2017, we are announcing an update to system.management.automation.dl Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet: ``` - + 10.0.0.0 {A244370E-44C9-4C06-B551-F6016E563076} @@ -132,6 +132,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -508,6 +509,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + From 4b54eebda95719c0f6072bbe6803cbdc14d303ae Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 5 Jun 2018 16:02:13 -0700 Subject: [PATCH 043/187] fixed case for EventID --- ...windows-event-forwarding-to-assist-in-intrusion-detection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 8e5b6d0232..e42efc4ec8 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -630,7 +630,7 @@ Here are the minimum steps for WEF to operate: - + From 2811c27e80881aab34a292e8c825187dcbe3e055 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 5 Jun 2018 16:37:56 -0700 Subject: [PATCH 044/187] Editorial change and added caption to image --- .../appv-application-publishing-and-client-interaction.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index bd399c1e22..e30c2e41a4 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -269,7 +269,7 @@ App-V stores data, which represents the state of the user’s catalog, in the fo Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. >[!NOTE] ->The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under HKEY_CURRENT_USER is missing or mismatched with the data in %appdata%. +>The **Repair-AppvClientPackage** cmdlet doesn't repair the publishing state of packages where the user’s App-V state under HKEY_CURRENT_USER is missing or mismatched with the data in %appdata%. ### Registry-based data @@ -420,6 +420,7 @@ The process then configures the client for package or connection group additions This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). ![Package add file and registry data](images/packageaddfileandregistrydata.png) +**Package add file and registry data** #### Publishing an App-V package From cbc89d418794aad278a69f017b7657b5d5921e37 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 5 Jun 2018 16:58:26 -0700 Subject: [PATCH 045/187] Caption --- .../app-v/appv-application-publishing-and-client-interaction.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index e30c2e41a4..48f6a6768a 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -450,6 +450,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. ![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) +**Package add file and registry data—global** ### Application launch @@ -475,6 +476,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) + **Package add file and registry data—stream** ### Upgrading an App-V package From 11aad88252cc635218d6463a478fae7ddad81257 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 5 Jun 2018 17:21:26 -0700 Subject: [PATCH 046/187] added vulnerabilirt and countermeasure --- .../security-policy-settings/create-global-objects.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/security/threat-protection/security-policy-settings/create-global-objects.md b/windows/security/threat-protection/security-policy-settings/create-global-objects.md index ba22997a67..b8a4c7c248 100644 --- a/windows/security/threat-protection/security-policy-settings/create-global-objects.md +++ b/windows/security/threat-protection/security-policy-settings/create-global-objects.md @@ -76,6 +76,16 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability +The **Create global objects** user right is required for a user account to create global objects in Remote Desktop sessions. Users can still create session-specfic objects without being assigned this user right. Assigning this right can be a security risk. + +By default, members of the **Administrators** group, the System account, and services that are started by the Service Control Manager are assigned the **Create global objects** user right. Users who are added to the **Remote Desktop Users** group also have this user right. + +### Countermeasure + +When non-administrators need to access a server using Remote Desktop, add the users to the **Remote Desktop Users** group rather than assining them this user right. + +### Vulnerability + >**Caution:**  A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts.   Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any currently logged on account. They could escalate their privileges or create a denial-of-service (DoS) condition. From a56694d55297fb2fe6f591ee8457ff45d5a05ce8 Mon Sep 17 00:00:00 2001 From: Ajay Vijayvargiya Date: Wed, 6 Jun 2018 14:35:47 +0530 Subject: [PATCH 047/187] Update network-access-allow-anonymous-sidname-translation.md --- .../network-access-allow-anonymous-sidname-translation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md index f5d8338e71..b684158c99 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md @@ -29,7 +29,7 @@ Misuse of this policy setting is a common error that can cause data loss or prob - Enabled - An anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects the SID-to-name translation as well as the name-to-SID translation + An anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects the SID-to-name translation as well as the name-to-SID translation. - Disabled @@ -52,7 +52,7 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | | Default Domain Policy| Not defined| -| Default Domain Controller Policy | Note defined| +| Default Domain Controller Policy | Not defined| | Stand-Alone Server Default Settings | Disabled| | DC Effective Default Settings | Enabled| | Member Server Effective Default Settings| Disabled| From 38988f718d39741764961a0e761b0b4573d9495f Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 6 Jun 2018 15:06:55 +0000 Subject: [PATCH 048/187] Merged PR 8829: Add link to blog post; update metadata --- devices/hololens/change-history-hololens.md | 3 +-- devices/hololens/hololens-encryption.md | 3 +-- devices/hololens/hololens-enroll-mdm.md | 3 +-- devices/hololens/hololens-install-apps.md | 3 +-- devices/hololens/hololens-kiosk.md | 4 +--- devices/hololens/hololens-microsoft-layout-app.md | 4 +--- devices/hololens/hololens-microsoft-remote-assist-app.md | 4 +--- devices/hololens/hololens-multiple-users.md | 4 +--- devices/hololens/hololens-provisioning.md | 4 +--- devices/hololens/hololens-public-preview-apps.md | 4 +--- devices/hololens/hololens-requirements.md | 4 +--- devices/hololens/hololens-setup.md | 4 +--- devices/hololens/hololens-updates.md | 4 +--- devices/hololens/hololens-upgrade-enterprise.md | 4 +--- devices/hololens/hololens-whats-new.md | 4 +--- devices/hololens/index.md | 4 +--- devices/surface-hub/accessibility-surface-hub.md | 4 +--- .../admin-group-management-for-surface-hub.md | 4 +--- .../appendix-a-powershell-scripts-for-surface-hub.md | 4 +--- ...ctivesync-policies-for-surface-hub-device-accounts.md | 4 +--- devices/surface-hub/change-history-surface-hub.md | 4 +--- devices/surface-hub/change-surface-hub-device-account.md | 4 +--- .../surface-hub/connect-and-display-with-surface-hub.md | 4 +--- .../create-a-device-account-using-office-365.md | 4 +--- .../create-and-test-a-device-account-surface-hub.md | 4 +--- devices/surface-hub/device-reset-surface-hub.md | 4 +--- ...nces-between-surface-hub-and-windows-10-enterprise.md | 4 +--- devices/surface-hub/enable-8021x-wired-authentication.md | 4 +--- ...xchange-properties-for-surface-hub-device-accounts.md | 4 +--- .../surface-hub/finishing-your-surface-hub-meeting.md | 4 +--- devices/surface-hub/first-run-program-surface-hub.md | 4 +--- .../hybrid-deployment-surface-hub-device-accounts.md | 4 +--- devices/surface-hub/index.md | 4 +--- devices/surface-hub/install-apps-on-surface-hub.md | 4 +--- .../surface-hub/local-management-surface-hub-settings.md | 4 +--- .../manage-settings-with-mdm-for-surface-hub.md | 4 +--- devices/surface-hub/manage-surface-hub-settings.md | 4 +--- devices/surface-hub/manage-surface-hub.md | 4 +--- .../manage-windows-updates-for-surface-hub.md | 9 ++++++--- devices/surface-hub/miracast-over-infrastructure.md | 4 +--- devices/surface-hub/miracast-troubleshooting.md | 4 +--- devices/surface-hub/monitor-surface-hub.md | 4 +--- ...on-premises-deployment-surface-hub-device-accounts.md | 4 +--- .../on-premises-deployment-surface-hub-multi-forest.md | 4 +--- .../online-deployment-surface-hub-device-accounts.md | 4 +--- ...assword-management-for-surface-hub-device-accounts.md | 4 +--- .../physically-install-your-surface-hub-device.md | 4 +--- .../prepare-your-environment-for-surface-hub.md | 4 +--- .../surface-hub/provisioning-packages-for-surface-hub.md | 4 +--- devices/surface-hub/remote-surface-hub-management.md | 4 +--- devices/surface-hub/save-bitlocker-key-surface-hub.md | 4 +--- devices/surface-hub/set-up-your-surface-hub.md | 4 +--- devices/surface-hub/setup-worksheet-surface-hub.md | 4 +--- devices/surface-hub/skype-hybrid-voice.md | 4 +--- devices/surface-hub/support-solutions-surface-hub.md | 4 +--- devices/surface-hub/surface-hub-authenticator-app.md | 4 +--- devices/surface-hub/surface-hub-downloads.md | 4 +--- devices/surface-hub/surface-hub-recovery-tool.md | 4 +--- devices/surface-hub/surface-hub-start-menu.md | 4 +--- devices/surface-hub/surface-hub-wifi-direct.md | 4 +--- devices/surface-hub/surfacehub-whats-new-1703.md | 4 +--- devices/surface-hub/troubleshoot-surface-hub.md | 4 +--- .../use-fully-qualified-domain-name-surface-hub.md | 4 +--- .../use-room-control-system-with-surface-hub.md | 4 +--- devices/surface-hub/whiteboard-collaboration.md | 4 +--- .../wireless-network-management-for-surface-hub.md | 4 +--- 66 files changed, 71 insertions(+), 194 deletions(-) diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md index 312d0a523b..68f9c695ce 100644 --- a/devices/hololens/change-history-hololens.md +++ b/devices/hololens/change-history-hololens.md @@ -2,10 +2,9 @@ title: Change history for Microsoft HoloLens documentation description: This topic lists new and updated topics for HoloLens. keywords: change history -ms.prod: w10 +ms.prod: hololens ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md index c600771609..8210e1f2fb 100644 --- a/devices/hololens/hololens-encryption.md +++ b/devices/hololens/hololens-encryption.md @@ -1,9 +1,8 @@ --- title: Enable Bitlocker encryption for HoloLens (HoloLens) description: Enable Bitlocker device encryption to protect files stored on the HoloLens -ms.prod: w10 +ms.prod: hololens ms.mktglfcycl: manage -ms.pagetype: hololens, devices ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md index fde1f15636..5f79d72c2e 100644 --- a/devices/hololens/hololens-enroll-mdm.md +++ b/devices/hololens/hololens-enroll-mdm.md @@ -1,9 +1,8 @@ --- title: Enroll HoloLens in MDM (HoloLens) description: Enroll HoloLens in mobile device management (MDM) for easier management of multiple devices. -ms.prod: w10 +ms.prod: hololens ms.mktglfcycl: manage -ms.pagetype: hololens, devices ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md index d33b78b2a9..3de34452cf 100644 --- a/devices/hololens/hololens-install-apps.md +++ b/devices/hololens/hololens-install-apps.md @@ -1,9 +1,8 @@ --- title: Install apps on HoloLens (HoloLens) description: The recommended way to install apps on HoloLens is to use Microsoft Store for Business. -ms.prod: w10 +ms.prod: hololens ms.mktglfcycl: manage -ms.pagetype: hololens, devices ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index d1be189b4b..0abcc7ac79 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -1,9 +1,7 @@ --- title: Set up HoloLens in kiosk mode (HoloLens) description: Use a kiosk configuration to lock down the apps on HoloLens. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-microsoft-layout-app.md b/devices/hololens/hololens-microsoft-layout-app.md index 6e782af99f..d2357ed2ee 100644 --- a/devices/hololens/hololens-microsoft-layout-app.md +++ b/devices/hololens/hololens-microsoft-layout-app.md @@ -1,9 +1,7 @@ --- title: Microsoft Layout description: How to get and deploy the Microsoft Layout app throughout your organization -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: alhopper-msft ms.author: alhopper diff --git a/devices/hololens/hololens-microsoft-remote-assist-app.md b/devices/hololens/hololens-microsoft-remote-assist-app.md index cea23cde18..221c650ada 100644 --- a/devices/hololens/hololens-microsoft-remote-assist-app.md +++ b/devices/hololens/hololens-microsoft-remote-assist-app.md @@ -1,9 +1,7 @@ --- title: Microsoft Remote Assist description: How to get and deploy the Microsoft Remote Assist app throughout your organization -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: alhopper-msft ms.author: alhopper diff --git a/devices/hololens/hololens-multiple-users.md b/devices/hololens/hololens-multiple-users.md index 2f75216d91..f5bbdf30af 100644 --- a/devices/hololens/hololens-multiple-users.md +++ b/devices/hololens/hololens-multiple-users.md @@ -1,9 +1,7 @@ --- title: Share HoloLens with multiple people (HoloLens) description: You can configure HoloLens to be shared by multiple Azure Active Directory accounts. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index 3db745d872..86631b4976 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -1,9 +1,7 @@ --- title: Configure HoloLens using a provisioning package (HoloLens) description: Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-public-preview-apps.md b/devices/hololens/hololens-public-preview-apps.md index dc61a8e6e2..e3a966f008 100644 --- a/devices/hololens/hololens-public-preview-apps.md +++ b/devices/hololens/hololens-public-preview-apps.md @@ -1,9 +1,7 @@ --- title: Preview new mixed reality apps for HoloLens description: Here's how to download and distribute new mixed reality apps for HoloLens, free for a limited time during public preview -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: alhopper ms.author: alhopper diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7120c2c082..402cb33a40 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -1,9 +1,7 @@ --- title: HoloLens in the enterprise requirements and FAQ (HoloLens) description: Requirements and FAQ for general use, Wi-Fi, and device management for HoloLens in the enterprise. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md index 513cc01e01..8850ba0f96 100644 --- a/devices/hololens/hololens-setup.md +++ b/devices/hololens/hololens-setup.md @@ -1,9 +1,7 @@ --- title: Set up HoloLens (HoloLens) description: The first time you set up HoloLens, you'll need a Wi-Fi network and either a Microsoft or Azure Active Directory account. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md index db02ac16fe..0b91b6f361 100644 --- a/devices/hololens/hololens-updates.md +++ b/devices/hololens/hololens-updates.md @@ -1,9 +1,7 @@ --- title: Manage updates to HoloLens (HoloLens) description: Administrators can use mobile device management to manage updates to HoloLens devices. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md index 8af44caabc..b855080450 100644 --- a/devices/hololens/hololens-upgrade-enterprise.md +++ b/devices/hololens/hololens-upgrade-enterprise.md @@ -1,9 +1,7 @@ --- title: Unlock Windows Holographic for Business features (HoloLens) description: HoloLens provides extra features designed for business when you upgrade to Windows Holographic for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/hololens-whats-new.md b/devices/hololens/hololens-whats-new.md index 9fd9e4d5de..75556a83db 100644 --- a/devices/hololens/hololens-whats-new.md +++ b/devices/hololens/hololens-whats-new.md @@ -1,9 +1,7 @@ --- title: What's new in Microsoft HoloLens (HoloLens) description: Windows Holographic for Business gets new features in Windows 10, version 1803. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/hololens/index.md b/devices/hololens/index.md index 3ec29c73a2..90e76edb5e 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -1,9 +1,7 @@ --- title: Microsoft HoloLens (HoloLens) description: HoloLens provides extra features designed for business in the Commercial Suite. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: hololens, devices +ms.prod: hololens ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/surface-hub/accessibility-surface-hub.md b/devices/surface-hub/accessibility-surface-hub.md index 3fbf1e269e..618afe96b7 100644 --- a/devices/surface-hub/accessibility-surface-hub.md +++ b/devices/surface-hub/accessibility-surface-hub.md @@ -3,9 +3,7 @@ title: Accessibility (Surface Hub) description: Accessibility settings for the Microsoft Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10. ms.assetid: 1D44723B-1162-4DF6-99A2-8A3F24443442 keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surfacehub +ms.prod: surface-hub ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/surface-hub/admin-group-management-for-surface-hub.md b/devices/surface-hub/admin-group-management-for-surface-hub.md index 2803f47304..5771b3f3c5 100644 --- a/devices/surface-hub/admin-group-management-for-surface-hub.md +++ b/devices/surface-hub/admin-group-management-for-surface-hub.md @@ -3,10 +3,8 @@ title: Admin group management (Surface Hub) description: Every Microsoft Surface Hub can be configured individually by opening the Settings app on the device. ms.assetid: FA67209E-B355-4333-B903-482C4A3BDCCE keywords: admin group management, Settings app, configure Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, security author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index 36df6680a5..7dafdcf898 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -3,10 +3,8 @@ title: PowerShell for Surface Hub (Surface Hub) description: PowerShell scripts to help set up and manage your Microsoft Surface Hub. ms.assetid: 3EF48F63-8E4C-4D74-ACD5-461F1C653784 keywords: PowerShell, set up Surface Hub, manage Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md index cd10c695db..f34a48b0b7 100644 --- a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md @@ -3,10 +3,8 @@ title: Applying ActiveSync policies to device accounts (Surface Hub) description: The Microsoft Surface Hub's device account uses ActiveSync to sync mail and calendar. This allows people to join and start scheduled meetings from the Surface Hub, and allows them to email any whiteboards they have made during their meeting. ms.assetid: FAABBA74-3088-4275-B58E-EC1070F4D110 keywords: Surface Hub, ActiveSync policies -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index 3d35042b08..1a7df44a44 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -2,10 +2,8 @@ title: Change history for Surface Hub description: This topic lists new and updated topics for Surface Hub. keywords: change history -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/change-surface-hub-device-account.md b/devices/surface-hub/change-surface-hub-device-account.md index 9e7f3c004d..bef2ff6610 100644 --- a/devices/surface-hub/change-surface-hub-device-account.md +++ b/devices/surface-hub/change-surface-hub-device-account.md @@ -3,10 +3,8 @@ title: Change the Microsoft Surface Hub device account description: You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned. ms.assetid: AFC43043-3319-44BC-9310-29B1F375E672 keywords: change device account, change properties, Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md index 225d3e235a..4a5167db40 100644 --- a/devices/surface-hub/connect-and-display-with-surface-hub.md +++ b/devices/surface-hub/connect-and-display-with-surface-hub.md @@ -2,10 +2,8 @@ title: Connect other devices and display with Surface Hub description: You can connect other device to your Surface Hub to display content. ms.assetid: 8BB80FA3-D364-4A90-B72B-65F0F0FC1F0D -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index cc1d0ec9cd..6b6492acc1 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -3,10 +3,8 @@ title: Create a device account using UI (Surface Hub) description: If you prefer to use a graphical user interface, you can create a device account for your Microsoft Surface Hub with either the Office 365 UI or the Exchange Admin Center. ms.assetid: D11BCDC4-DABA-4B9A-9ECB-58E02CC8218C keywords: create device account, Office 365 UI, Exchange Admin center, Office 365 admin center, Skype for Business, mobile device mailbox policy -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md index cc60ff723c..3895e5aea7 100644 --- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md +++ b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md @@ -3,10 +3,8 @@ title: Create and test a device account (Surface Hub) description: This topic introduces how to create and test the device account that Microsoft Surface Hub uses to communicate with Microsoft Exchange and Skype. ms.assetid: C8605B5F-2178-4C3A-B4E0-CE32C70ECF67 keywords: create and test device account, device account, Surface Hub and Microsoft Exchange, Surface Hub and Skype -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md index 281dc1b880..b4ee4473f6 100644 --- a/devices/surface-hub/device-reset-surface-hub.md +++ b/devices/surface-hub/device-reset-surface-hub.md @@ -3,10 +3,8 @@ title: Device reset (Surface Hub) description: You may wish to reset your Microsoft Surface Hub. ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF keywords: reset Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md index 40c7b012de..ae478d22b4 100644 --- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md +++ b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md @@ -2,10 +2,8 @@ title: Differences between Surface Hub and Windows 10 Enterprise description: This topic explains the differences between Windows 10 Team and Windows 10 Enterprise. keywords: change history -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: isaiahng ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/enable-8021x-wired-authentication.md b/devices/surface-hub/enable-8021x-wired-authentication.md index ff69e90418..8407392860 100644 --- a/devices/surface-hub/enable-8021x-wired-authentication.md +++ b/devices/surface-hub/enable-8021x-wired-authentication.md @@ -1,10 +1,8 @@ --- title: Enable 802.1x wired authentication description: 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md index 40f93af750..2975a20db0 100644 --- a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md @@ -3,10 +3,8 @@ title: Microsoft Exchange properties (Surface Hub) description: Some Microsoft Exchange properties of the device account must be set to particular values to have the best meeting experience on Microsoft Surface Hub. ms.assetid: 3E84393B-C425-45BF-95A6-D6502BA1BF29 keywords: Microsoft Exchange properties, device account, Surface Hub, Windows PowerShell cmdlet -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/finishing-your-surface-hub-meeting.md b/devices/surface-hub/finishing-your-surface-hub-meeting.md index bfc104fa22..c56335e042 100644 --- a/devices/surface-hub/finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/finishing-your-surface-hub-meeting.md @@ -2,10 +2,8 @@ title: End session - ending a Surface Hub meeting description: To end a Surface Hub meeting, tap End session. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md index d488122210..2574c2cbf6 100644 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ b/devices/surface-hub/first-run-program-surface-hub.md @@ -3,10 +3,8 @@ title: First-run program (Surface Hub) description: The term \ 0034;first run \ 0034; refers to the series of steps you'll go through the first time you power up your Microsoft Surface Hub, and means the same thing as \ 0034;out-of-box experience \ 0034; (OOBE). This section will walk you through the process. ms.assetid: 07C9E84C-1245-4511-B3B3-75939AD57C49 keywords: first run, Surface Hub, out-of-box experience, OOBE -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index eabfb6c6cd..e0111f0b35 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -3,10 +3,8 @@ title: Hybrid deployment (Surface Hub) description: A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. ms.assetid: 7BFBB7BE-F587-422E-9CE4-C9DDF829E4F1 keywords: hybrid deployment, device account for Surface Hub, Exchange hosted on-prem, Exchange hosted online -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index e966b4a42f..b819e54b9a 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -2,10 +2,8 @@ title: Microsoft Surface Hub admin guide description: Documents related to the Microsoft Surface Hub. ms.assetid: 69C99E91-1441-4318-BCAF-FE8207420555 -ms.prod: w10 -ms.mktglfcycl: explore +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md index 69f12c9881..ffa77e640e 100644 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ b/devices/surface-hub/install-apps-on-surface-hub.md @@ -3,10 +3,8 @@ title: Install apps on your Microsoft Surface Hub description: Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business. ms.assetid: 3885CB45-D496-4424-8533-C9E3D0EDFD94 keywords: install apps, Microsoft Store, Microsoft Store for Business -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, store author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/local-management-surface-hub-settings.md b/devices/surface-hub/local-management-surface-hub-settings.md index 9bff610bcf..b53d27448f 100644 --- a/devices/surface-hub/local-management-surface-hub-settings.md +++ b/devices/surface-hub/local-management-surface-hub-settings.md @@ -2,10 +2,8 @@ title: Local management Surface Hub settings description: How to manage Surface Hub settings with Settings. keywords: manage Surface Hub, Surface Hub settings -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index a21025c060..13af52d485 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -3,10 +3,8 @@ title: Manage settings with an MDM provider (Surface Hub) description: Microsoft Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution. ms.assetid: 18EB8464-6E22-479D-B0C3-21C4ADD168FE keywords: mobile device management, MDM, manage policies -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, mobility author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/manage-surface-hub-settings.md b/devices/surface-hub/manage-surface-hub-settings.md index a4a53440fb..ac7d714624 100644 --- a/devices/surface-hub/manage-surface-hub-settings.md +++ b/devices/surface-hub/manage-surface-hub-settings.md @@ -2,10 +2,8 @@ title: Manage Surface Hub settings description: This section lists topics for managing Surface Hub settings. keywords: Surface Hub accessibility settings, device account, device reset, windows updates, wireless network management -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md index 47c62571ef..9518232b8b 100644 --- a/devices/surface-hub/manage-surface-hub.md +++ b/devices/surface-hub/manage-surface-hub.md @@ -3,10 +3,8 @@ title: Manage Microsoft Surface Hub description: How to manage your Surface Hub after finishing the first-run program. ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1 keywords: manage Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index d3e78f1ff7..c769840d86 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -3,10 +3,8 @@ title: Windows updates (Surface Hub) description: You can manage Windows updates on your Microsoft Surface Hub by setting the maintenance window, deferring updates, or using Windows Server Update Services (WSUS). ms.assetid: A737BD50-2D36-4DE5-A604-55053D549045 keywords: manage Windows updates, Surface Hub, Windows Server Update Services, WSUS -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article @@ -132,6 +130,11 @@ A default maintenance window is set for all new Surface Hubs: To change the maintenance window using MDM, set the **MOMAgent** node in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for more details. +## More information + +- [Blog post: Servicing, Flighting, and Managing updates for Surface Hub (With Intune, of course!)](https://blogs.technet.microsoft.com/y0av/2018/05/31/7-3/) + + ## Related topics [Manage Microsoft Surface Hub](manage-surface-hub.md) diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md index a6a44e2d03..fb81f8e16d 100644 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ b/devices/surface-hub/miracast-over-infrastructure.md @@ -1,10 +1,8 @@ --- title: Miracast on existing wireless network or LAN description: Windows 10 enables you to send a Miracast stream over a local network. -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/miracast-troubleshooting.md b/devices/surface-hub/miracast-troubleshooting.md index 3c6c085881..6f3bdf62ec 100644 --- a/devices/surface-hub/miracast-troubleshooting.md +++ b/devices/surface-hub/miracast-troubleshooting.md @@ -1,10 +1,8 @@ --- title: Troubleshoot Miracast on Surface Hub description: Learn how to resolve issues with Miracast on Surface Hub. -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md index 6b10bdc4c5..ac60abe27d 100644 --- a/devices/surface-hub/monitor-surface-hub.md +++ b/devices/surface-hub/monitor-surface-hub.md @@ -3,10 +3,8 @@ title: Monitor your Microsoft Surface Hub description: Monitoring for Microsoft Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS). ms.assetid: 1D2ED317-DFD9-423D-B525-B16C2B9D6942 keywords: monitor Surface Hub, Microsoft Operations Management Suite, OMS -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md index aadc1fa22e..15d5c2746e 100644 --- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md @@ -3,10 +3,8 @@ title: On-premises deployment single forest (Surface Hub) description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment. ms.assetid: 80E12195-A65B-42D1-8B84-ECC3FCBAAFC6 keywords: single forest deployment, on prem deployment, device account, Surface Hub -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.date: 06/01/2018 diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md index 3c92823a8b..b367367025 100644 --- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md +++ b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md @@ -2,10 +2,8 @@ title: On-premises deployment multi-forest (Surface Hub) description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment. keywords: multi forest deployment, on prem deployment, device account, Surface Hub -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.date: 06/01/2018 diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index c253d82d11..d5c567a57f 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -3,10 +3,8 @@ title: Online deployment with Office 365 (Surface Hub) description: This topic has instructions for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. ms.assetid: D325CA68-A03F-43DF-8520-EACF7C3EDEC1 keywords: device account for Surface Hub, online deployment -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md index c17507564e..be86720a3a 100644 --- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md @@ -3,10 +3,8 @@ title: Password management (Surface Hub) description: Every Microsoft Surface Hub device account requires a password to authenticate and enable features on the device. ms.assetid: 0FBFB546-05F0-430E-905E-87111046E4B8 keywords: password, password management, password rotation, device account -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, security author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md index fb4c19723b..f750d07a4f 100644 --- a/devices/surface-hub/physically-install-your-surface-hub-device.md +++ b/devices/surface-hub/physically-install-your-surface-hub-device.md @@ -3,10 +3,8 @@ title: Physically install Microsoft Surface Hub description: The Microsoft Surface Hub Readiness Guide will help make sure that your site is ready for the installation. ms.assetid: C764DBFB-429B-4B29-B4E8-D7F0073BC554 keywords: Surface Hub, readiness guide, installation location, mounting options -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, readiness author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md index 5ac57b764e..b9239014a4 100644 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md @@ -3,10 +3,8 @@ title: Prepare your environment for Microsoft Surface Hub description: This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Microsoft Surface Hub. ms.assetid: 336A206C-5893-413E-A270-61BFF3DF7DA9 keywords: prepare environment, features of Surface Hub, create and test device account, check network availability -ms.prod: w10 -ms.mktglfcycl: plan +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md index 8646da068a..ad3c3d7d7e 100644 --- a/devices/surface-hub/provisioning-packages-for-surface-hub.md +++ b/devices/surface-hub/provisioning-packages-for-surface-hub.md @@ -3,10 +3,8 @@ title: Create provisioning packages (Surface Hub) description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345 keywords: add certificate, provisioning package -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md index d4b921b254..5038e225b5 100644 --- a/devices/surface-hub/remote-surface-hub-management.md +++ b/devices/surface-hub/remote-surface-hub-management.md @@ -2,10 +2,8 @@ title: Remote Surface Hub management description: This section lists topics for managing Surface Hub. keywords: remote management, MDM, install apps, monitor Surface Hub, Operations Management Suite, OMS -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md index 5fedc2bf80..3a013dd827 100644 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md @@ -3,10 +3,8 @@ title: Save your BitLocker key (Surface Hub) description: Every Microsoft Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys. ms.assetid: E11E4AB6-B13E-4ACA-BCE1-4EDC9987E4F2 keywords: Surface Hub, BitLocker, Bitlocker recovery keys -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, security author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md index 876fd56138..80178e7c22 100644 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ b/devices/surface-hub/set-up-your-surface-hub.md @@ -3,10 +3,8 @@ title: Set up Microsoft Surface Hub description: Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. ms.assetid: 4D1722BC-704D-4471-BBBE-D0500B006221 keywords: set up instructions, Surface Hub, setup worksheet, first-run program -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md index f74f466fe8..f66fce4ef7 100644 --- a/devices/surface-hub/setup-worksheet-surface-hub.md +++ b/devices/surface-hub/setup-worksheet-surface-hub.md @@ -3,10 +3,8 @@ title: Setup worksheet (Surface Hub) description: When you've finished pre-setup and are ready to start first-time setup for your Microsoft Surface Hub, make sure you have all the information listed in this section. ms.assetid: AC6F925B-BADE-48F5-8D53-8B6FFF6EE3EB keywords: Setup worksheet, pre-setup, first-time setup -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md index 8ad23c643f..4b3c12deab 100644 --- a/devices/surface-hub/skype-hybrid-voice.md +++ b/devices/surface-hub/skype-hybrid-voice.md @@ -2,10 +2,8 @@ title: Online or hybrid deployment using Skype Hybrid Voice environment (Surface Hub) description: This topic explains how to enable Skype for Business Cloud PBX with on premises PSTN connectivity via Cloud Connector Edition or Skype for Business 2015 pool. keywords: hybrid deployment, Skype Hybrid Voice -ms.prod: w10 -ms.mktglfcycl: deploy +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/support-solutions-surface-hub.md b/devices/surface-hub/support-solutions-surface-hub.md index b40eaef7de..66d4455737 100644 --- a/devices/surface-hub/support-solutions-surface-hub.md +++ b/devices/surface-hub/support-solutions-surface-hub.md @@ -3,10 +3,8 @@ title: Top support solutions for Microsoft Surface Hub description: Find top solutions for common issues using Surface Hub. ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A keywords: Troubleshoot common problems, setup issues -ms.prod: w10 -ms.mktglfcycl: support +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: kaushika-msft ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md index b4bbecf00d..d5f9dc8d57 100644 --- a/devices/surface-hub/surface-hub-authenticator-app.md +++ b/devices/surface-hub/surface-hub-authenticator-app.md @@ -1,10 +1,8 @@ --- title: Sign in to Surface Hub with Microsoft Authenticator description: Use Microsoft Authenticator on your mobile device to sign in to Surface Hub. -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md index 0f35d022a9..257bc6b58b 100644 --- a/devices/surface-hub/surface-hub-downloads.md +++ b/devices/surface-hub/surface-hub-downloads.md @@ -1,10 +1,8 @@ --- title: Useful downloads for Microsoft Surface Hub description: Downloads related to the Microsoft Surface Hub. -ms.prod: w10 -ms.mktglfcycl: explore +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/surface-hub-recovery-tool.md b/devices/surface-hub/surface-hub-recovery-tool.md index c185f07d3c..81c91723b7 100644 --- a/devices/surface-hub/surface-hub-recovery-tool.md +++ b/devices/surface-hub/surface-hub-recovery-tool.md @@ -3,10 +3,8 @@ title: Using the Surface Hub Recovery Tool description: How to use the Surface Hub Recovery Tool to re-image the SSD. ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1 keywords: manage Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md index 1be0ee8978..5e6469aab1 100644 --- a/devices/surface-hub/surface-hub-start-menu.md +++ b/devices/surface-hub/surface-hub-start-menu.md @@ -1,10 +1,8 @@ --- title: Configure Surface Hub Start menu description: Use MDM to customize the Start menu on Surface Hub. -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/surface-hub-wifi-direct.md b/devices/surface-hub/surface-hub-wifi-direct.md index 3f933415fc..c4051021b6 100644 --- a/devices/surface-hub/surface-hub-wifi-direct.md +++ b/devices/surface-hub/surface-hub-wifi-direct.md @@ -2,10 +2,8 @@ title: How Surface Hub addresses Wi-Fi Direct security issues description: This topic provides guidance on Wi-Fi Direct security risks. keywords: change history -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md index 5c18d5d2d8..1473174177 100644 --- a/devices/surface-hub/surfacehub-whats-new-1703.md +++ b/devices/surface-hub/surfacehub-whats-new-1703.md @@ -1,9 +1,7 @@ --- title: What's new in Windows 10, version 1703 for Surface Hub description: Windows 10, version 1703 (Creators Update) brings new features to Microsoft Surface Hub. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: devices +ms.prod: surface-hub ms.sitesec: library author: jdeckerms ms.author: jdecker diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md index d33bb2ca55..a6158edff8 100644 --- a/devices/surface-hub/troubleshoot-surface-hub.md +++ b/devices/surface-hub/troubleshoot-surface-hub.md @@ -3,10 +3,8 @@ title: Troubleshoot Microsoft Surface Hub description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A keywords: Troubleshoot common problems, setup issues, Exchange ActiveSync errors -ms.prod: w10 -ms.mktglfcycl: support +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md index 8ae6d82f72..c9183716e7 100644 --- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md +++ b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md @@ -7,10 +7,8 @@ ms.author: jdecker ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: support +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub --- # Configure domain name for Skype for Business diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md index 8bcdde0580..7c5fc0e5d9 100644 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md @@ -3,10 +3,8 @@ title: Using a room control system (Surface Hub) description: Room control systems can be used with your Microsoft Surface Hub. ms.assetid: DC365002-6B35-45C5-A2B8-3E1EB0CB8B50 keywords: room control system, Surface Hub -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md index dd9606c9c3..08346d20b4 100644 --- a/devices/surface-hub/whiteboard-collaboration.md +++ b/devices/surface-hub/whiteboard-collaboration.md @@ -1,10 +1,8 @@ --- title: Set up and use Whiteboard to Whiteboard collaboration description: Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker ms.topic: article diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md index c7aac74ce4..516ddeab67 100644 --- a/devices/surface-hub/wireless-network-management-for-surface-hub.md +++ b/devices/surface-hub/wireless-network-management-for-surface-hub.md @@ -3,10 +3,8 @@ title: Wireless network management (Surface Hub) description: Microsoft Surface Hub offers two options for network connectivity to your corporate network and Internet wireless, and wired. While both provide network access, we recommend you use a wired connection. ms.assetid: D2CFB90B-FBAA-4532-B658-9AA33CAEA31D keywords: network connectivity, wired connection -ms.prod: w10 -ms.mktglfcycl: manage +ms.prod: surface-hub ms.sitesec: library -ms.pagetype: surfacehub, networking author: jdeckerms ms.author: jdecker ms.topic: article From 7149176ecded8d3f5d6a886f23ac47747dc59216 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 6 Jun 2018 09:17:15 -0700 Subject: [PATCH 049/187] Spacing fix for captions --- .../appv-application-publishing-and-client-interaction.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 48f6a6768a..b4a36706c2 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -420,6 +420,7 @@ The process then configures the client for package or connection group additions This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). ![Package add file and registry data](images/packageaddfileandregistrydata.png) + **Package add file and registry data** #### Publishing an App-V package @@ -450,6 +451,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. ![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) + **Package add file and registry data—global** ### Application launch @@ -476,6 +478,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) + **Package add file and registry data—stream** ### Upgrading an App-V package From 3e32a4ad06b78423b140c43515ba57a9d099131f Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 6 Jun 2018 09:50:13 -0700 Subject: [PATCH 050/187] Editorial changes --- .../appv-application-publishing-and-client-interaction.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index b4a36706c2..d4937d1ba9 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -71,7 +71,7 @@ Additional details for the table are provided in the section below and throughou The App-V Client manages the applications assets mounted in the package store. This default storage location is %ProgramData%\App-V, but you can configure it during or after setup by using the **Set-AppVClientConfiguration** Windows PowerShell cmdlet, which modifies the local registry (**PackageInstallationRoot** value under the HKLM\Software\Microsoft\AppV\Client\Streaming key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named after the Package GUID and Version GUID. -Example of a path to a specific application: +The following is an example of a path to a specific application: ```syntax C:\ProgramData\App-V\PackGUID\VersionGUID @@ -81,7 +81,7 @@ To change the default location of the package store during setup, see [Enable th ### Shared Content Store -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high-performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). +If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). In VDI environments where local storage can be limited, it's important to use as little disk space as possible. You can minimize disk space usage by streaming applications from a high-performance network location (such as a SAN). For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). >[!NOTE] >The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. @@ -478,7 +478,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) - + **Package add file and registry data—stream** ### Upgrading an App-V package From 39934d5b30d7593f96556652a58e5143f92fe570 Mon Sep 17 00:00:00 2001 From: nicksev <38920847+nicksev@users.noreply.github.com> Date: Wed, 6 Jun 2018 10:40:48 -0700 Subject: [PATCH 051/187] Update teacher-get-minecraft.md I've re-written the beginning of this article to have more context and content relevant for teachers. I've left the Distribute section and below largely untouched, but we do need to update the screenshots at some point. --- education/windows/teacher-get-minecraft.md | 41 +++++++++++++--------- 1 file changed, 25 insertions(+), 16 deletions(-) diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index eb7e30081b..9e459af597 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -21,35 +21,44 @@ ms.topic: conceptual - Windows 10 -Learn how teachers can get and distribute Minecraft: Education Edition. +The following article describes how teachers can get and distribute Minecraft: Education Edition. +Minecraft: Education Edition is available for anyone to trial, and subscriptions can be purchased by qualified educational institutions directly in the Microsoft Store for Education, via volume licensing agreements and through partner resellers. -## Add Minecraft to your Microsoft Store for Education +To get started, go to http://education.minecraft.net/ and select **GET STARTED**. -1. Go to [http://education.minecraft.net/](http://education.minecraft.net/) and select **GET STARTED**. +## Try Minecraft: Education Edition for Free - +Minecraft: Education Edition is available for anyone to try, but there is a limit to the number of logins allowed before purchasing a subscription is required. -2. Enter your email address. +To learn more and get started, go to http://education.minecraft.net/ and select **GET STARTED**. - - -3. Select **Get the app**. This will take you to Microsoft Store for Ecucation to download the app. You will also receive an email with instructions and a link to the Store. +## Purchase Minecraft: Education Edition for Teachers and Students - +Minecraft: Education Edition is licensed via yearly subscriptions that are purchased through the Microsoft Store for Education, via volume licensing agreements and through partner resellers. -4. Sign in to Microsoft Store for Education with your email address. +>[!Note] +>M:EE is available on many platforms, but all license purchases can only be done through one of the three methods listed above. -5. Read and accept the Microsoft Store for Business and Education Service Agreement, and then select **Next**. +As a teacher, you may purchase subscription licenses for you and your students directly through the Microsoft Store for Education, or you may already have access to licenses at your school (through a volume license agreement) if you have an Office 365 account. -6. **Minecraft: Education Edition** opens in the Microsoft Store for Education. Select **Get the app**. This places **Minecraft: Education Edition** in your Microsoft Store inventory. +>[!Note] +>If you already have Office 365, you may already have Minecraft: Education Edition licenses for your school! M:EE is included in many volume license agreements, however, only the administrators at your school will be able to assign and manage those licenses. If you have an Office 365 account, check with your school administration or IT administrator prior to purchasing M:EE directly. + +You can purchase individual Minecraft: Education Edition subscriptions for you and other teachers and students directly in the Microsoft Store for Education. + +To purchase individual Minecraft: Education Edition subscriptions (i.e. direct purchase): + +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account. +2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it) +3. Click **Buy** + +>[!Note] +>Administrators can restrict the ability for teachers to purchase applications in the Microsoft Store for Education. If you do not have the ability to Buy, contact your school administration or IT administrator. - - -If you need additional licenses for **Minecraft: Education Edition**, see [Purchase additional licenses](https://docs.microsoft.com/education/windows/education-scenarios-store-for-business#purchase-additional-licenses). ## Distribute Minecraft -After Minecraft: Education Edition is added to your Microsoft Store for Education inventory, you have three options: +After Minecraft: Education Edition licenses have been purchased, either directly, through a volume license agreement or through a partner reseller, those licenses will be added to your Microsoft Store for Education. From there you have three options: - You can install the app on your PC. - You can assign the app to others. From 0b4c9314e0d565eee454fd195f4d55b85a14a1b0 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 6 Jun 2018 10:41:44 -0700 Subject: [PATCH 052/187] Editorial changes --- ...-application-publishing-and-client-interaction.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index d4937d1ba9..28c6a826f2 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -139,9 +139,9 @@ Before an application can access the package registry data, the App-V Client mus When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at %ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. -**Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGuid}.dat** +**Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGUID}.dat** -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a user-specific location HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. +When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGUID\REGISTRY. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a user-specific location HKCU\Software\Microsoft\AppV\Client\Packages\PackageGUID\Registry\User. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. ### Package registry staging vs. connection group registry staging @@ -278,7 +278,7 @@ App-V registry roaming falls into two scenarios, as shown in the following table |Scenario|Description| |---|---| |Applications that are run as standard users|When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

- HKLM's location is HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
- HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE

The locations are enabled for roaming based on the operating system settings.| -|Applications that are run with elevation|When an application is launched with elevation:

- HKLM data is stored in the HKLM hive on the local computer
- HKCU data is stored in the User Registry location

In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following locations:

- HKLM's location is HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE
- HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE| +|Applications that are run with elevation|When an application is launched with elevation:

- HKLM data is stored in the HKLM hive on the local computer
- HKCU data is stored in the User Registry location

In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following locations:

- HKLM's location is HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE
- HKCU's location is HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE| ### App-V and folder redirection @@ -475,7 +475,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. +7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as-needed basis. ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) @@ -489,7 +489,7 @@ The current version of App-V's package upgrade process differs from the older ve 1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. -2. Package entries are added to the appropriate catalog for the new version +2. Package entries are added to the appropriate catalog for the new version. 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the user catalog at **appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. @@ -694,7 +694,7 @@ For details on App-V integration, see [Microsoft Application Virtualization 5.0 ### Software clients and application capabilities -App-V supports specific software clients and application capabilities extension points to register virtualized applications with the operating system's software client. This means users can select default programs for operations like email, instant messaging, and using the media player. This operation is performed in the control panel with **Set Program Access** and **Computer Defaults**, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. +App-V supports specific software clients and application capabilities extension points to register virtualized applications with the operating system's software client. This means users can select default programs for operations like email, instant messaging, and using the media player. This operation is performed in the control panel with **Set Program Access** and **Computer Defaults**, and is configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. The following is an example of software client registration of an App-V-based mail client. From b0d49ca8f7799fe6e23be695006a45c85907493c Mon Sep 17 00:00:00 2001 From: Patti Short Date: Wed, 6 Jun 2018 14:34:46 -0700 Subject: [PATCH 053/187] clarified some of the policies --- browsers/edge/available-policies.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 2ba0d202e0..e93509d40f 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -32,11 +32,11 @@ Computer Configuration\Administrative Templates\Windows Components\Microsoft Edg >*Supported versions: Windows 10, version 1803*
>*Default setting: None* -You can configure Microsoft Edge to use a shared folder to store books from the Books Library. +You can configure Microsoft Edge to store books from the Books Library to a default, shared folder for Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads book files automatically to a common, shared folder, and prevents users from removing the book from the library. For this policy to work properly, users must be signed in with a school or work account. + +If you disable or don’t configure this policy, Microsoft Edge does not use a shared folder but downloads book files to a per-user folder for each user. -If enabled, a shared books folder is allowed. - -If disabled, a shared books folder not allowed. + **MDM settings in Microsoft Intune** | | | @@ -45,30 +45,30 @@ If disabled, a shared books folder not allowed. |Supported devices |Desktop | |URI full path |./Vendor/MSFT/Policy/Config/Browser/UseSharedFolderForBooks | |Data type |Integer | -|Allowed values |
  • **0** - No folder shared.
  • **1** - Use a shared folder.
| +|Allowed values |
  • **0** - Disabled.
  • **1** - Enabled.
| ## Allow Address bar drop-down list suggestions >*Supported versions: Windows 10, version 1703 or later* -The Address bar drop-down list, when enabled, allows the Address bar drop-down functionality in Microsoft Edge. By default, this policy is enabled. If disabled, you do not see the address bar drop-down functionality and disables the user-defined policy "Show search and site suggestions as I type." Therefore, because search suggestions are shown in the drop-down, this policy takes precedence over the [Configure search suggestions in Address bar](https://review.docs.microsoft.com/en-us/microsoft-edge/deploy/available-policies?branch=pashort_edge-backlog_vsts15846461#configure-search-suggestions-in-address-bar) or [AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowsearchsuggestionsinaddressbar) policy. +By default, Microsoft Edge shows the Address bar drop-down list and makes it available. If you want to minimize network connections from Microsoft Edge to Microsoft service, we recommend disabling this policy. Disabling this policy turns off the Address bar drop-down list functionality. -If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend that you disable this policy. +When disabled, Microsoft Edge also disables the user-defined policy Show search and site suggestions as I type. Because the drop-down shows the search suggestions, this policy takes precedence over the [Configure search suggestions in Address bar](https://docs.microsoft.com/en-us/microsoft-edge/deploy/available-policies#configure-search-suggestions-in-address-bar) policy. **Microsoft Intune to manage your MDM settings** | | | |---|---| -|MDM name |[AllowAddressBarDropdown](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowaddressbardropdown) | +|MDM name |Browser/[AllowAddressBarDropdown](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowaddressbardropdown) | |Supported devices |Desktop | |URI full path | ./Vendor/MSFT/Policy/Config/Browser/AllowAddressBarDropdown | |Data type | Integer | -|Allowed values |
  • **0** - Not Allowed. Address bar drop-down is disabled, which also disables the user-defined policy, "Show search and site suggestions as I type."
  • **1 (default)** - Allowed. Address bar drop-down is enabled.
| +|Allowed values |
  • **0** - Disabled. Not allowed.
  • **1 (default)** - Enabled or not configured. Allowed.
| ## Allow Adobe Flash >*Supported version: Windows 10* -Adobe Flash is integrated with Microsoft Edge and is updated via Windows Update. By default, this policy is enabled or not configured allowing you to use Adobe Flash Player in Microsoft Edge. +Adobe Flash is integrated with Microsoft Edge and updated via Windows Update. With this policy, you can configure Microsoft Edge to run Adobe Flash content or prevent Adobe Flash from running. **Microsoft Intune to manage your MDM settings** | | | @@ -77,12 +77,12 @@ Adobe Flash is integrated with Microsoft Edge and is updated via Windows Update. |Supported devices |Desktop | |URI full path | ./Vendor/MSFT/Policy/Config/Browser/AllowAdobeFlash | |Data type | Integer | -|Allowed values |
  • **0** - Adobe Flash cannot be used Microsoft Edge.
  • **1 (default)** - Adobe Flash can be used in Microsoft Edge.
| +|Allowed values |
  • **0** - Disabled. Microsoft Edge prevents Adobe Flash content from running.
  • **1 (default)** - Enabled or not configured. Microsoft Edge runs Adobe Flash content.
| ## Allow clearing browsing data on exit >*Supported versions: Windows 10, version 1703* -Your browsing data is the information that Microsoft Edge remembers and stores as you browse websites. Browsing data includes information you entered forms, passwords, and the websites you visited. By default, this policy is disabled or not configured, the browsing data is not cleared when exiting. When this policy is disabled or not configured, you can turn on and configure the Clear browsing data option under Settings. +By default, Microsoft Edge does not clear the browsing data on exit, but users can configure the _Clear browsing data_ option in Settings. Browsing data includes information you entered in forms, passwords, and even the websites visited. Enable this policy if you want to clear the browsing data automatically each time Microsoft Edge closes. **Microsoft Intune to manage your MDM settings** @@ -92,7 +92,7 @@ Your browsing data is the information that Microsoft Edge remembers and stores a |Supported devices |Desktop | |URI full path | ./Vendor/MSFT/Policy/Config/Browser/ClearBrowsingDataOnExit | |Data type | Integer | -|Allowed values |
  • **0 (default)** - Browsing data is not cleared on exit. The type of browsing data to clear can be configured by the employee in the Clear browsing data options under Settings.
  • **1** - Browsing data is cleared on exit.
| +|Allowed values |
  • **0 (default)** - Disabled or not configured. Microsoft Edge does not clear the browsing data on exit, but users can configure the _Clear browsing data_ option in Settings.
  • **1** - Enabled. Clears the browsing data each time Microsoft Edge closes.
| ## Allow configuration updates for the Books Library From f7333dd3316bc52e6e33d7601a0583d6a6b16963 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 7 Jun 2018 17:36:37 +0000 Subject: [PATCH 054/187] Merged PR 8879: Fixed footnote in two policies --- .../policy-configuration-service-provider.md | 10 +- .../mdm/policy-csp-system.md | 142 +++++++++++++++++- 2 files changed, 150 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 4b7797c7be..3f01008ea8 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 06/05/2018 --- # Policy CSP @@ -2974,6 +2974,12 @@ The following diagram shows the Policy configuration service provider in tree fo
System/BootStartDriverInitialization
+
+ System/ConfigureTelemetryOptInChangeNotification +
+
+ System/ConfigureTelemetryOptInSettingsUx +
System/DisableEnterpriseAuthProxy
@@ -4587,6 +4593,8 @@ The following diagram shows the Policy configuration service provider in tree fo - [System/AllowLocation](./policy-csp-system.md#system-allowlocation) - [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) - [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) +- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) - [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) - [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) - [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 343d589daa..8f4da31f35 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 06/05/2018 --- # Policy CSP - System +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
@@ -46,6 +48,12 @@ ms.date: 05/14/2018
System/BootStartDriverInitialization
+
+ System/ConfigureTelemetryOptInChangeNotification +
+
+ System/ConfigureTelemetryOptInSettingsUx +
System/DisableEnterpriseAuthProxy
@@ -683,6 +691,137 @@ ADMX Info:
+ +**System/ConfigureTelemetryOptInChangeNotification** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark4check mark4check mark4check mark4
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting determines whether a device shows notifications about telemetry levels to people on first logon or when changes occur in Settings.  +If you set this policy setting to "Disable telemetry change notifications", telemetry level notifications stop appearing. +If you set this policy setting to "Enable telemetry change notifications" or don't configure this policy setting, telemetry notifications appear at first logon and when changes occur in Settings. + + + +ADMX Info: +- GP English name: *Configure telemetry opt-in change notifications.* +- GP name: *ConfigureTelemetryOptInChangeNotification* +- GP element: *ConfigureTelemetryOptInChangeNotification* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + + + + + + + + + + + +
+ + +**System/ConfigureTelemetryOptInSettingsUx** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark4check mark4check mark4check mark4
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting determines whether people can change their own telemetry levels in Settings. This setting should be used in conjunction with the Allow Telemetry settings. + +If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. + +If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. + +Note: +Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. + + + +ADMX Info: +- GP English name: *Configure telemetry opt-in setting user interface.* +- GP name: *ConfigureTelemetryOptInSettingsUx* +- GP element: *ConfigureTelemetryOptInSettingsUx* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + + + + + + + + + + + +
+ **System/DisableEnterpriseAuthProxy** @@ -1051,6 +1190,7 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. From 3e1db15848ecb5c982d671b32303027822fbb41a Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 7 Jun 2018 18:17:31 +0000 Subject: [PATCH 055/187] Merged PR 8883: Clarification The itsy bitsy spider went up the water spout --- .../upgrade/windows-10-downgrade-paths.md | 30 ++++--------------- 1 file changed, 5 insertions(+), 25 deletions(-) diff --git a/windows/deployment/upgrade/windows-10-downgrade-paths.md b/windows/deployment/upgrade/windows-10-downgrade-paths.md index d095a3d449..4422179d21 100644 --- a/windows/deployment/upgrade/windows-10-downgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-downgrade-paths.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.localizationpriority: high ms.pagetype: mobile author: greg-lindsay -ms.date: 02/15/2018 +ms.date: 06/07/2018 --- # Windows 10 downgrade paths @@ -17,13 +17,11 @@ ms.date: 02/15/2018 ## Downgrading Windows 10 -This topic provides a summary of supported Windows 10 downgrade paths. You might need to downgrade the edition of Windows 10, for example, if an Enterprise license is expired. +This topic provides a summary of supported Windows 10 downgrade paths. You might need to downgrade the edition of Windows 10, for example, if an Enterprise license is expired. To perform a downgrade, you can use the same methods as when performing an [edition upgrade](windows-10-edition-upgrades.md). For example, you might downgrade an Enterprise edition by manually entering a valid Pro license key. If a downgrade is supported, then your apps and settings can be migrated from the current edition to the downgraded edition. If a path is not supported, then a clean install is required. -To perform a downgrade, you can use the same methods as when performing an [edition upgrade](windows-10-edition-upgrades.md). - -Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not supported, unless you are performing a rollback of a previous upgrade. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. +Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a different product key is not supported. The only downgrade method available for this the rollback of a previous upgrade. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. >**Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. @@ -32,7 +30,8 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor ### Supported Windows 10 downgrade paths >[!NOTE] ->Edition changes that are considered upgrades (Ex: Pro to Enterprise) are not shown here. Switching between different editions of Pro is supported. This is not strictly considered an edition downgrade, but is included here for clarity. +>Edition changes that are considered upgrades (Ex: Pro to Enterprise) are not shown here.
+>Switching between different editions of Pro is also not strictly considered an edition downgrade, but is included here for clarity. ✔ = Supported downgrade path
@@ -48,7 +47,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor Pro Pro for Workstations Pro Education - S Education Enterprise LTSC Enterprise @@ -65,7 +63,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor - Pro @@ -73,7 +70,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor ✔ ✔ - ✔ @@ -84,7 +80,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor ✔ ✔ - ✔ @@ -95,18 +90,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor ✔ ✔ - ✔ - - - - - - S - - ✔ - ✔ - ✔ - @@ -117,7 +100,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor ✔ ✔ ✔ - ✔ @@ -129,7 +111,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor - @@ -140,7 +121,6 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 is not suppor ✔ ✔ ✔ - ✔ From d18ea151813980dd69ca192a03a83b0e97ad076f Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Thu, 7 Jun 2018 18:28:13 +0000 Subject: [PATCH 056/187] Merged PR 8881: Updated Updated advanced-hunting-reference-windows-defender-advanced-threat-protection.md --- ...ce-windows-defender-advanced-threat-protection.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md index 5919dad684..50820acbc3 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md @@ -28,10 +28,8 @@ ms.date: 06/01/2018 >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -## Advanced hunting table reference -When you run a query using Advanced hunting, a table with columns is returned as a result. - -Use the following table to understand what the columns represent, its data type, and their description. +## Advanced hunting column reference +To effectively build queries that span multiple tables, you need to understand the columns in the Advanced hunting schema. The following table lists all the available columns, along with their data types and descriptions. This information is also available in the schema representation in the Advanced hunting screen. | Column name | Data type | Description :---|:--- |:--- @@ -70,7 +68,7 @@ Use the following table to understand what the columns represent, its data type, | LocalIP | string | IP address assigned to the local machine used during communication | | LocalPort | int | TCP port on the local machine used during communication | | LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| LogonType | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen.

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients.

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed.

- **Batch** - Session initiated by scheduled tasks.

- **Service** - Session initiated by services as they start.
+| LogonType | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine. | | MachineId | string | Unique identifier for the machine in the service | | MD5 | string | MD5 hash of the file that the recorded action was applied to | @@ -88,16 +86,16 @@ Use the following table to understand what the columns represent, its data type, | ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. | | ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | | ProviderId | string | Unique identifier for the Event Tracing for Windows (ETW) provider that collected the event log | -| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information. | | | RegistryKey | string | Registry key that the recorded action was applied to | | RegistryValueData | string | Data of the registry value that the recorded action was applied to | | RegistryValueName | string | Name of the registry value that the recorded action was applied to | | RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | +| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information. | | RemoteIP | string | IP address that was being connected to | | RemotePort | int | TCP port on the remote device that was being connected to | | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | | ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns. | +| SHA1 | string | SHA-1 of the file that the recorded action was applied to | | SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink) From d648b40d6dc66bce26ee0a22f220fbd38c980ede Mon Sep 17 00:00:00 2001 From: Adam Gross Date: Thu, 7 Jun 2018 13:43:16 -0500 Subject: [PATCH 057/187] Update resolution-procedures.md --- windows/deployment/upgrade/resolution-procedures.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 5a48e7d896..d0b6fcc004 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -738,7 +738,7 @@ Also see the following sequential list of modern setup (mosetup) error codes wit | 0XC190020d | MOSETUP_E_DOWNLOADDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to download. | | 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the diskspace requirements to install the payload. | | 0XC190020f | MOSETUP_E_INSTALLDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to install. | -| 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has use the setup.exe command line to do scanonly, not to install the OS. | +| 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has used the setup.exe command line to do scanonly, not to install the OS. | | 0XC1900211 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_BLOCK | The system does not pass the disk space requirements to download and unpack media. | | 0XC1900212 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_MULTIARCH_BLOCK | The system does not pass the disk space requirements to download and unpack multi-architecture media. | | 0XC1900213 | MOSETUP_E_NO_OFFER_FOUND | There was no offer found that matches the required criteria. | From d55002ae4346d4b697207bf676f7bb0576a8cadb Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 7 Jun 2018 12:06:07 -0700 Subject: [PATCH 058/187] Updating Note content Adding link to new TEI article in the Edge IT Center and removing extraneous text. Minor edits/cleanup --- browsers/edge/Index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md index a18d463fa8..12e65e0580 100644 --- a/browsers/edge/Index.md +++ b/browsers/edge/Index.md @@ -24,9 +24,9 @@ Microsoft Edge is the new, default web browser for Windows 10, helping you to e Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. >[!Note] ->For more info about the potential impact of using Microsoft Edge in a large organization, you can download an infographic from here: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/download/details.aspx?id=55956). For a detailed report that provides you with a framework to evaluate the potential financial impact of adopting Microsoft Edge within your organization, you can download the full study here: [Total Economic Impact of Microsoft Edge: Forrester Study](https://www.microsoft.com/download/details.aspx?id=55847). +>For more information about the potential impact of using Microsoft Edge in a large organization, refer to the [Measuring the impact of Microsoft Edge](https://www.microsoft.com/itpro/microsoft-edge/technical-benefits) topic on the Microsoft Edge IT Center. ->Also, if you've arrived here looking for Internet Explorer 11 content, you'll need to go to the [Internet Explorer 11 (IE11)](https://docs.microsoft.com/en-us/internet-explorer/) area. +>If you are looking for Internet Explorer 11 content, please visit the [Internet Explorer 11 (IE11)](https://docs.microsoft.com/en-us/internet-explorer/) area. ## In this section From a83dcdec710d0c1027256fb506cb3f458530dfcb Mon Sep 17 00:00:00 2001 From: Chris Nylen <30357366+chnylen@users.noreply.github.com> Date: Thu, 7 Jun 2018 18:03:32 -0400 Subject: [PATCH 059/187] Update windows-analytics-get-started.md Fixed a typo. --- windows/deployment/update/windows-analytics-get-started.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md index 380e966c13..2bd55d23db 100644 --- a/windows/deployment/update/windows-analytics-get-started.md +++ b/windows/deployment/update/windows-analytics-get-started.md @@ -107,7 +107,7 @@ After data is sent from devices to Microsoft, it generally takes 48-56 hours for ## Deploy additional optional settings -Certain of the Windows Analytics features have additional settings you can use. +Certain Windows Analytics features have additional settings you can use. - **Update Compliance** is only compatible with Windows 10 desktop devices (workstations and laptops). To use the Windows Defender Antivirus Assessment, devices must be protected by Windows Defender AV (and not a partner antivirus application), and must have enabled cloud-delivered protection, as described in [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). See the [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting) topic for help with ensuring that the configuration is correct. From 1e57c7112bed9f2b504b0b8b84bcae58dbc90713 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 7 Jun 2018 15:56:11 -0700 Subject: [PATCH 060/187] new flow --- ...ows-defender-advanced-threat-protection.md | 48 ++++++++++++------- 1 file changed, 32 insertions(+), 16 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md index 595710cac3..db4d4d1e03 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 05/01/2018 +ms.date: 06/06/2018 --- # Configure alert notifications in Windows Defender ATP @@ -41,29 +41,45 @@ Only users assigned to the Global administrator role can manage notification rul The email notification includes basic information about the alert and a link to the portal where you can do further investigation. -## Set up email notifications for alerts -The email notifications feature is turned off by default. Turn it on to start receiving email notifications. +## Create rules for alert notifications +You can create rules that determine the machines and alert severities to send email notifications for and the notification recipients. -1. On the navigation pane, select **Settings** > **Alert notifications**. -2. Toggle the setting between **On** and **Off**. -3. Select the alert severity level that youd like your recipients to receive: - - **High** Select this level to send notifications for high-severity alerts. - - **Medium** Select this level to send notifications for medium-severity alerts. - - **Low** - Select this level to send notifications for low-severity alerts. - - **Informational** - Select this level to send notification for alerts that might not be considered harmful but good to keep track of. -4. In **Email recipients to notify on new alerts**, type the email address then select the + sign. -5. Click **Save preferences** when youve completed adding all the recipients. -Check that email recipients are able to receive the email notifications by selecting **Send test email**. All recipients in the list will receive the test email. +1. In the navigation pane, select **Settings** > **Alert notifications**. + +2. Click **Add notification rule**. + +3. Specify the General information: + - **Rule name** + - **Machines** - Choose whether to notify recipients for alerts on all machines (Global administrator role only) or on selected machine groups. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md). + - **Alert severity** - Choose the alert severity level + +4. Click **Next**. + +5. Enter the recipient's email address then click **Add recipient**. You can add multiple email addresses. + +6. Check that email recipients are able to receive the email notifications by selecting **Send test email**. + +7. Click **Save notification rule**. Here's an example email notification: ![Image of example email notification](images/atp-example-email-notification.png) -## Remove email recipients +## Edit a notification rule +1. Select the notification rule you'd like to edit. + +2. Update the General and Recipient tab information. + +3. Click **Save notification rule**. + + +## Delete notification rule + +1. Select the notification rule you'd like to delete. + +2. Click **Delete**. -1. Select the trash bin icon beside the email address youd like to remove. -2. Click **Save preferences**. ## Troubleshoot email notifications for alerts This section lists various issues that you may encounter when using email notifications for alerts. From 1587be2070083e66a7723643e48b1aa655dd57e2 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 7 Jun 2018 23:41:30 +0000 Subject: [PATCH 061/187] Merged PR 8906: Added note to deprecated policie --- .../mdm/policy-csp-localpoliciessecurityoptions.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 7f888cd8b6..49a48f512a 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -808,6 +808,10 @@ GP Info: + +> [!Warning] +> Starting in the next major version of Windows, this policy is deprecated. + Domain member: Digitally encrypt or sign secure channel data (always) This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. @@ -883,6 +887,10 @@ GP Info: + +> [!Warning] +> Starting in the next major version of Windows, this policy is deprecated. + Domain member: Digitally encrypt secure channel data (when possible) This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. @@ -955,6 +963,10 @@ GP Info: + +> [!Warning] +> Starting in the next major version of Windows, this policy is deprecated. + Domain member: Disable machine account password changes Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. From c15a4ac2ea7c8bfe3dd5b808b0804f3544900941 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Fri, 8 Jun 2018 12:39:48 +0000 Subject: [PATCH 062/187] Merged PR 8910: Added Privacy/AllowCrossDeviceClipboard to Policy CSP --- .../policy-configuration-service-provider.md | 26 ++ .../mdm/policy-csp-privacy.md | 363 +++++++++++++++++- 2 files changed, 388 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 3f01008ea8..403a5e2cb4 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2322,6 +2322,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
+
+ Privacy/AllowCrossDeviceClipboard +
Privacy/AllowInputPersonalization
@@ -2403,6 +2406,18 @@ The following diagram shows the Policy configuration service provider in tree fo
Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
+
+ Privacy/LetAppsAccessGazeInput +
+
+ Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps +
+
+ Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps +
+
+ Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps +
Privacy/LetAppsAccessLocation
@@ -2550,6 +2565,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Privacy/PublishUserActivities
+
+ Privacy/UploadUserActivities +
### RemoteAssistance policies @@ -4454,6 +4472,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) - [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) - [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) - [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) - [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) - [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) @@ -4530,6 +4549,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) - [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) - [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) +- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) - [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) - [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) - [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) @@ -4734,7 +4754,13 @@ The following diagram shows the Policy configuration service provider in tree fo - [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) - [Experience/AllowCortana](#experience-allowcortana) - [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) +- [Privacy/AllowCrossDeviceClipboard](#privacy-allowcrossdeviceclipboard) - [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) +- [Privacy/LetAppsAccessGazeInput](#privacy-letappsaccessgazeinput) +- [Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps](#privacy-letappsaccessgazeinput-forceallowtheseapps) +- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](#privacy-letappsaccessgazeinput-forcedenytheseapps) +- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](#privacy-letappsaccessgazeinput-userincontroloftheseapps) +- [Privacy/UploadUserActivities](#privacy-uploaduseractivities) - [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - [Settings/AllowDateTime](#settings-allowdatetime) diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index eb2b36eac7..23a98eaa7b 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 06/05/2018 --- # Policy CSP - Privacy +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
@@ -22,6 +24,9 @@ ms.date: 05/14/2018
Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
+
+ Privacy/AllowCrossDeviceClipboard +
Privacy/AllowInputPersonalization
@@ -103,6 +108,18 @@ ms.date: 05/14/2018
Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
+
+ Privacy/LetAppsAccessGazeInput +
+
+ Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps +
+
+ Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps +
+
+ Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps +
Privacy/LetAppsAccessLocation
@@ -250,6 +267,9 @@ ms.date: 05/14/2018
Privacy/PublishUserActivities
+
+ Privacy/UploadUserActivities +
@@ -311,6 +331,72 @@ The following list shows the supported values:
+ +**Privacy/AllowCrossDeviceClipboard** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Added in Windows 10, next major version. Specifies whether clipboard items roam across devices. When this is allowed, an item copied to the clipboard is uploaded to the cloud so that other devices can access. Also, when this is allowed, a new clipboard item on the cloud is downloaded to a device so that user can paste on the device. + +Most restricted value is 0. + + + +ADMX Info: +- GP English name: *Allow Clipboard synchronization across devices* +- GP name: *AllowCrossDeviceClipboard* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + + +The following list shows the supported values: + +0 – Not allowed. +1 (default) – Allowed. + + + + + + + + + + +
+ **Privacy/AllowInputPersonalization** @@ -1804,6 +1890,214 @@ ADMX Info:
+ +**Privacy/LetAppsAccessGazeInput** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether Windows apps can access the eye tracker. + + + + + + + + + + + + + +
+ + +**Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + + + + + + + + + + +
+ + +**Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + + + + + + + + + + +
+ + +**Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + + + + + + + + + + +
+ **Privacy/LetAppsAccessLocation** @@ -4478,6 +4772,66 @@ The following list shows the supported values: + +
+ + +**Privacy/UploadUserActivities** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check mark5check mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Allows ActivityFeed to upload published 'User Activities'. + + + +ADMX Info: +- GP English name: *Allow upload of User Activities* +- GP name: *UploadUserActivities* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + + + + + + + + + + +
Footnote: @@ -4486,13 +4840,20 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. ## Privacy policies supported by Windows Holographic for Business +- [Privacy/AllowCrossDeviceClipboard](#privacy-allowcrossdeviceclipboard) - [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) +- [Privacy/LetAppsAccessGazeInput](#privacy-letappsaccessgazeinput) +- [Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps](#privacy-letappsaccessgazeinput-forceallowtheseapps) +- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](#privacy-letappsaccessgazeinput-forcedenytheseapps) +- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](#privacy-letappsaccessgazeinput-userincontroloftheseapps) +- [Privacy/UploadUserActivities](#privacy-uploaduseractivities) From 2efe65312e037aa8c658a3b932770ca49ea6466f Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 8 Jun 2018 15:48:35 +0000 Subject: [PATCH 063/187] Merged PR 8914: UI updates updates for remove from private store --- ...ventory-management-microsoft-store-for-business.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md index 378577a85c..b15ad00612 100644 --- a/store-for-business/app-inventory-management-microsoft-store-for-business.md +++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md @@ -9,7 +9,7 @@ ms.pagetype: store author: TrudyHa ms.author: TrudyHa ms.topic: conceptual -ms.date: 10/16/2017 +ms.date: 06/07/2018 --- # App inventory management for Microsoft Store for Business and Education @@ -100,9 +100,10 @@ If you decide that you don't want an app available for employees to install on t **To remove an app from the private store** -1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Apps & software**. -3. Find an app, click the ellipses under **Action**, choose **Remove from private store**, and then click **Remove**. +1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). +2. Click **Manage**, and then choose **Products & services**. +3. Find an app, click the ellipses, choose **Remove from private store**, and then click **Remove**. +4. Choose the private store collection, and then under **In collection**, switch to **Off**. The app will still be in your inventory, but your employees will not have access to the app from your private store. @@ -110,7 +111,7 @@ The app will still be in your inventory, but your employees will not have access 1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). 2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses under **Action**, and then choose **Assign to people**. +3. Find an app, click the ellipses, and then choose **Assign to people**. 4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. Employees will receive an email with a link that will install the app on their device. Click the link to start the Microsoft Store app, and then click **Install**. Also, in the Microsoft Store app, they can find the app under **My Library**. From dc3f7282d55e3c222c3753008b307a6eb505f9ba Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 8 Jun 2018 10:25:27 -0700 Subject: [PATCH 064/187] Editorial and formatting changes --- ...ation-publishing-and-client-interaction.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 28c6a826f2..0eecec1c8d 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -115,7 +115,7 @@ The locations described in this table can be found in the appdata\roaming\Micros |Default storage location|appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID| |Files in the user catalog|- UserManifest.xml
- DynamicConfiguration.xml or UserDeploymentConfiguration.xml| |Additional user catalog location, used when the package is part of a connection group|The following location is in addition to the specific package location mentioned above:

appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID| -|Additional file in the machine catalog when the package is part of a connection group|**UserPackageGroupDescriptor.xml**| +|Additional file in the machine catalog when the package is part of a connection group|UserPackageGroupDescriptor.xml| ### Shortcut backups @@ -211,7 +211,7 @@ App-V manages the Package Store, which is the location where the expanded asset ### Add packages -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. When publishing or manually entering the **Add-AppVClientPackage** cmdlet, the data structure is built in the package store (C:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the **StreamMap.xml** file are added to the system, and the top level folders and child files are staged to ensure proper application assets exist at launch. +App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. When publishing or manually entering the **Add-AppVClientPackage** cmdlet, the data structure is built in the package store (C:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml file are added to the system, and the top level folders and child files are staged to ensure proper application assets exist at launch. ### Mounting packages @@ -224,7 +224,7 @@ The App-V Client can be configured to change the default behavior of streaming. |Policy|Description| |---|---| |AllowHighCostLaunch|Allows streaming over 3G and cellular networks| -|AutoLoad|Specifies the Background Load setting:
**0** – Disabled
**1** – Previously Used Packages only
**2** – All Packages| +|AutoLoad|Specifies the Background Load setting:
0 – Disabled
1 – Previously Used Packages only
2 – All Packages| |PackageInstallationRoot|The root folder for the package store in the local machine| |PackageSourceRoot|The root override where packages should be streamed from| |SharedContentStoreMode|Enables the use of Shared Content Store for VDI scenarios| @@ -379,7 +379,7 @@ The process then configures the client for package or connection group additions 2. The package file is opened and the **AppXManifest.xml** and **StreamMap.xml** files are downloaded to the Package Store. - 3. Completely stream publishing block data defined in the **StreamMap.xml**. Publishing block data is stored in Package Store\\PkgGUID\\VerGUID\\Root. + 3. Completely stream publishing block data defined in the **StreamMap.xml** file. Publishing block data is stored in Package Store\\PkgGUID\\VerGUID\\Root. - Icons: Targets of extension points. - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, accessed directly or through file types. @@ -393,7 +393,7 @@ The process then configures the client for package or connection group additions All other files are created when the directory is listed as sparse on disk and streamed on demand. - 5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created). + 5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** files from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created). 6. Create location of the package store in the registry **HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog**. @@ -431,7 +431,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu 1. Package entries are added to the user catalog - 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the User Catalog. + 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** files are placed on the machine in the User Catalog. 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the Machine Catalog. @@ -491,7 +491,7 @@ The current version of App-V's package upgrade process differs from the older ve 2. Package entries are added to the appropriate catalog for the new version. - 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** are placed on the machine in the user catalog at **appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. + 1. User targeted packages: the **UserDeploymentConfiguration.xml** and **UserManifest.xml** files are placed on the machine in the user catalog at **appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. 2. Machine targeted (global) packages: the **UserDeploymentConfiguration.xml** is placed in the machine catalog at **%programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID**. @@ -545,8 +545,8 @@ Use the following example scenarios as a guide for updating packages. App-V Packages can be published in one of two ways; as user, which entitles an App-V package to a specific user or group of users, or as global, which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: -- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. -- **User-published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user signs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly through Windows PowerShell commands). +- Global publishing is when the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. +- User publishing is when the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user signs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly through Windows PowerShell commands). ### Removing an App-V package @@ -560,9 +560,9 @@ The repair operation is easy to do but may affect many locations on the machine. The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: -- **AppXManifest.xml**: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. -- **DeploymentConfig.xml**: Provides configuration information of computer- and user-based integration extension points. -- **UserConfig.xml**: A subset of the **Deploymentconfig.xml** that only provides user-based configurations and only targets user-based extension points. +- AppXManifest.xml is stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. +- DeploymentConfig.xml provides configuration information of computer- and user-based integration extension points. +- UserConfig.xml is a subset of the Deploymentconfig.xml file that only provides user-based configurations and only targets user-based extension points. ### Rules of integration @@ -688,7 +688,7 @@ The following table displays the supported shell extensions. The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and In-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes Off, Isolated, and Integrated. Integrated mode is configured for either the Out-of-process or In-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (**deploymentconfig.xml** or **userconfig.xml**). +App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and In-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes Off, Isolated, and Integrated. Integrated mode is configured for either the Out-of-process or In-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). For details on App-V integration, see [Microsoft Application Virtualization 5.0 Integration](https://blogs.technet.microsoft.com/appv/2013/01/03/microsoft-application-virtualization-5-0-integration). From 07e75322189926cea008b7e0b39989bc8dfbfc22 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 8 Jun 2018 10:26:50 -0700 Subject: [PATCH 065/187] Updated date metadata --- windows/application-management/app-v/appv-about-appv.md | 2 +- ...dd-or-remove-an-administrator-with-the-management-console.md | 2 +- .../appv-add-or-upgrade-packages-with-the-management-console.md | 2 +- .../app-v/appv-administering-appv-with-powershell.md | 2 +- ...istering-virtual-applications-with-the-management-console.md | 2 +- .../appv-allow-administrators-to-enable-connection-groups.md | 2 +- .../app-v/appv-application-publishing-and-client-interaction.md | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md index c2421f0918..f0f2f8eb1a 100644 --- a/windows/application-management/app-v/appv-about-appv.md +++ b/windows/application-management/app-v/appv-about-appv.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/18/2018 +ms.date: 06/08/2018 --- # What's new in App-V for Windows 10, version 1703 and earlier diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index a7c0447d3e..c5a7ad334d 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/08/2018 --- # How to add or remove an administrator by using the Management Console diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index 5f03b7e815..0ae1a703c8 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/08/2018 --- # How to add or upgrade packages by using the Management Console diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index 1a003ccf5c..b6cf8bf3d3 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/08/2018 --- # Administering App-V by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md index 5abc5df2bd..a7662c1689 100644 --- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/08/2018 --- # Administering App-V Virtual Applications by using the Management Console diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md index d982f4b88b..36c4204881 100644 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/08/2018 --- # How to allow only administrators to enable connection groups diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 0eecec1c8d..9ef9c0bee3 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/08/2018 --- # Application publishing and client interaction From bbc1d059e3433ff07bb022d18d5afcc803d719a8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 12:33:06 -0700 Subject: [PATCH 066/187] added finder --- .../microsoft-recommended-block-rules.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index b3f44ab315..9ccc601294 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -59,6 +59,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you |Alex Ionescu | @aionescu| |Lee Christensen|@tifkin_| |Vladas Bulavas | Kaspersky Lab | +|Lasse Trolle Borup | Langkjaer Cyber Defence |
From 4191e823361608e891d59daa22d1afd022a68efb Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 12:40:44 -0700 Subject: [PATCH 067/187] added finder --- .../microsoft-recommended-block-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 9ccc601294..ae37d52989 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: jsuther1974 -ms.date: 05/03/2018 +ms.date: 06/08/2018 --- # Microsoft recommended block rules From 204035dad996656cec2d0d76dd0104035c29a6f8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:14:16 -0700 Subject: [PATCH 068/187] fixed issue --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 180c949a49..fad1f39565 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -169,7 +169,7 @@ In the Feedback and Settings page under Privacy Settings you can now delete the ### Security Baselines -A draft of the new [security baseline for Windows 10 version 1803](https://blogs.technet.microsoft.com/secguide/2018/03/27/security-baseline-for-windows-10-v1803-redstone-4-draft/) has been published. +The new [security baseline for Windows 10 version 1803](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10) has been published. ### Windows Defender Antivirus From f7a9d43d7439d8df9e87541e0b9a5779a4211a0b Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:16:28 -0700 Subject: [PATCH 069/187] fixed issue --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index fad1f39565..8107213fac 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay -ms.date: 05/10/2018 +ms.date: 06/08/2018 ms.localizationpriority: high --- From 7ebd39f45254da85432b45ae1d1bdba0861f2817 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:23:19 -0700 Subject: [PATCH 070/187] removed note about autdit mode not available --- .../applocker/configure-an-applocker-policy-for-audit-only.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index 58bfcf7ebb..1127619715 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -21,8 +21,6 @@ This topic for IT professionals describes how to set AppLocker policies to **Aud After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. - ->**Note:**  There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md).   You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). From 4c978edb61c62ef01c0c1be07be776ee33cc34e8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:26:22 -0700 Subject: [PATCH 071/187] removed note about audit mode not available --- .../applocker/configure-an-applocker-policy-for-audit-only.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index 1127619715..3330eda208 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: brianlic-msft -ms.date: 09/21/2017 +ms.date: 06/08/2018 --- # Configure an AppLocker policy for audit only From 3bbc5d43d1cc7184c3bb393f94bae28b831b811c Mon Sep 17 00:00:00 2001 From: Dune Desormeaux Date: Fri, 8 Jun 2018 16:14:11 -0700 Subject: [PATCH 072/187] Clarify WDATP + WDAV compatibility wording WDAV won't always be in passive mode if WDATP is enabled. Clarifying this. --- .../windows-defender-antivirus-compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 6d409e7449..eae5b16c1e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -71,7 +71,7 @@ Passive mode | Windows Defender AV will not be used as the antivirus app, and th Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)]] Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your configuration tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. +Passive mode is enabled if you are enrolled in Windows Defender ATP and you are using a third party antimalware product because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware or other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. From 983cfd76af8cfa48f920e94c4b499a19668d1409 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Fri, 8 Jun 2018 23:19:00 +0000 Subject: [PATCH 073/187] Merged PR 8950: small formatting fix --- windows/privacy/manage-windows-endpoints.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/privacy/manage-windows-endpoints.md b/windows/privacy/manage-windows-endpoints.md index d0be3c4145..e43a9ddff4 100644 --- a/windows/privacy/manage-windows-endpoints.md +++ b/windows/privacy/manage-windows-endpoints.md @@ -502,8 +502,7 @@ In addition to the endpoints listed for Windows 10 Enterprise, the following end | *.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. | | *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. | | *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). | -| *prod.do.dsp.mp.microsoft.com | TLSv1.2/ -HTTPS | Used for Windows Update downloads of apps and OS updates. | +| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. | | .g.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. | | telecommand.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. | | 2.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. | @@ -594,8 +593,7 @@ TLSv1.2 | Used to check for updates to maps that have been downloaded for offlin | *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. | | *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. | | *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). | -| *prod.do.dsp.mp.microsoft.com | TLSv1.2/ -HTTPS | Used for Windows Update downloads of apps and OS updates. | +| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. | | 3.dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. | | 3.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. | From 41d5e00c6a519f9c7eedd5553f7addd3706135bc Mon Sep 17 00:00:00 2001 From: Dune Desormeaux Date: Fri, 8 Jun 2018 16:20:59 -0700 Subject: [PATCH 074/187] Dudeso-dd clarity Switch to active voice --- .../windows-defender-antivirus-compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index eae5b16c1e..47d5189976 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -71,7 +71,7 @@ Passive mode | Windows Defender AV will not be used as the antivirus app, and th Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)]] Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your configuration tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Passive mode is enabled if you are enrolled in Windows Defender ATP and you are using a third party antimalware product because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. +If you are enrolled in Windows Defender ATP and you are using a third party antimalware product then passive mode is enabled because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware or other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. From 046155ed06c52330fb5df8df1bab69ca2a4ba7b8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 8 Jun 2018 16:46:29 -0700 Subject: [PATCH 075/187] New round of revisions --- ...ment-configuration-file-with-powershell.md | 47 +++++++------ ...user-configuration-file-with-powershell.md | 34 ++++++---- .../appv-auto-clean-unpublished-packages.md | 67 +++++++------------ .../app-v/appv-available-mdm-settings.md | 23 ++++++- 4 files changed, 95 insertions(+), 76 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index ce1b3601b9..42754ef837 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Apply the Deployment Configuration File by Using Windows PowerShell (Windows 10) -description: How to Apply the Deployment Configuration File by Using Windows PowerShell +title: How to apply the deployment configuration file by using Windows PowerShell (Windows 10) +description: How to apply the deployment configuration file by using Windows PowerShell for Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,35 +8,42 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to apply the deployment configuration file by using Windows PowerShell +>Applies to: Windows 10, version 1607 -# How to Apply the Deployment Configuration File by Using Windows PowerShell +The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings of the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: -**Applies to** -- Windows 10, version 1607 +* C:\\Packages\\Contoso\\MyApp.appv +* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: +## Apply the deployment configuration file with Windows PowerShell -**c:\\Packages\\Contoso\\MyApp.appv** +>[!NOTE] +>The following procedure is an example that uses the following two file paths for the package and configuration files: + > + >* C:\\Packages\\Contoso\\MyApp.appv + >* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml + > +>If your package and configuration file use different file paths than the example, feel free to replace them as needed. -**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** +To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, enter the following cmdlet: -**To Apply the Deployment Configuration File Using Windows PowerShell** +```PowerShell +Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml +``` -- To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, type the following: +>[!NOTE] +>This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: + > + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` - `Add-AppVClientPackage -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` - - **Note**
- This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - - `Set-AppVClientPackage -Name Myapp -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` - -   ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index a59c999681..2632d17e87 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -8,34 +8,42 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to apply the user configuration file by using Windows PowerShell - -# How to Apply the User Configuration File by Using Windows PowerShell - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: -**c:\\Packages\\Contoso\\MyApp.appv** +* C:\\Packages\\Contoso\\MyApp.appv -**To apply a user Configuration file** +## Apply a user configuration file -1. To add the package to the computer using the Windows PowerShell console, type the following command: +Use the following procedure to specify a user-specific configuration file. - `Add-AppVClientPackage c:\Packages\Contoso\MyApp.appv` +>[!NOTE] +>The following procedure uses the following example file path for its package: + > + >* C:\\Packages\\Contoso\\MyApp.appv. + > +>f your package file uses a different file path than the example, feel free to replace it. -2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: +1. Enter the following cmdlet to add the package to the computer using the Windows PowerShell console: - `Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml` + ```PowerShell + Add-AppVClientPackage C:\Packages\Contoso\MyApp.appv + ``` +2. Enter the following cmdlet to publish the package to the user and specify the updated the dynamic user configuration file: + ```PowerShell + Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml + ``` ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 23a9fe37c6..5292d2ed73 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -8,70 +8,55 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# Automatically clean up unpublished packages on the App-V client +>Applies to: Windows 10, version 1703 -# Automatically cleanup unpublished packages on the App-V client +Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after a device restart. -**Applies to** -- Windows 10, version 1703 +## Clean up with PowerShell cmdlets -Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. +You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, which will automatically clean up your unpublished App-V packages from your App-V client devices. -## Cleanup by using PowerShell commands -Using PowerShell, you can turn on the **AutoCleanupEnabled** setting to automatically cleanup your unpublished App-V packages from your App-V client devices. +### Turn on the AutoCleanupEnabled option -**To turn on the AutoCleanupEnabled option** +1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package clean up functionality: -1. Open PowerShell as an admin and run the following command to turn on the automatic package cleanup functionality: - - ```ps1 + ```PowerShell Set-AppvClientConfiguration -AutoCleanupEnabled 1 ``` - The command runs and you should see the following info on the PowerShell screen: - - - - - - - - - - - - - - - - -
NameValueSetbyGroupPolicy
AutoCleanupEnabled1False
+ After running the cmdlet, you should see the following info on the PowerShell screen: -2. Run the following command to make sure the configuration is ready to automatically cleanup your packages. + |Name|Value|SetbyGroupPolicy| + |---|---|---| + |AutoCleanupEnabled|1|False| - ```ps1 +2. Run the following cmdlet to make sure the configuration is ready to automatically clean up your packages. + + ```PowerShell Get-AppvClientConfiguration ``` - You should see the **AutoCleanupEnabled** option turned on (shows a value of "1") in the configuration list. + If the **AutoCleanupEnabled** option shows a value of **1** in the configuration list, that means the setting is turned on. -## Cleanup by using Group Policy settings -Using Group Policy, you can turn on the **Enable automatic cleanup of unused appv packages** setting to automatically cleanup your unpublished App-V packages from your App-V client devices. +## Clean up with Group Policy settings -**To turn on the Enable automatic cleanup of unused appv packages setting** +Using Group Policy, you can turn on the **Enable automatic clean up of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. -1. Open your Group Policy editor and double-click the Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused appv packages setting. +### Turn on the Enable automatic clean up of unused App-V packages setting -2. Click **Enabled**, and then click **OK**. +1. Open your Group Policy editor and select the **Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused App-V packages** setting. - After your Group Policy updates, the setting is turned on and will cleanup any unpublished App-V packages on the App-V Client after restarting. +2. Select **Enabled**, then select **OK**. + + After your Group Policy updates and you reset the client, the setting will clean up any unpublished App-V packages on the App-V client. ### Related topics + - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) - - [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186) - - [Using the App-V Client Management Console](appv-using-the-client-management-console.md) +## Have a suggestion for App-V? -**Have a suggestion for App-V?**

-Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 7d050134a8..7544ce59d5 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -8,9 +8,28 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- - # Available Mobile Device Management (MDM) settings for App-V -With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps by using these Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. + +With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps by using these Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. + +|Policy name|Supported versions|URI full path|Data type|Values| +|---|---|---|---|---| +|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Name|String|Read-only data, provided by your App-V packages.| +|Version|Windows 10, version 1703|||| +|Publisher|Windows 10, version 1703|||| +|InstallLocation|Windows 10, version 1703|||| +|InstallDate|Windows 10, version 1703|||| +|Users|Windows 10, version 1703|||| +|AppVPackageID|Windows 10, version 1703|||| +|AppVVersionID|Windows 10, version 1703|||| +|AppVPackageUri|Windows 10, version 1703|||| +|LastError|Windows 10, version 1703|||| +|LastErrorDescription|Windows 10, version 1703|||| +|SyncStatusDescription|Windows 10, version 1703|||| +|SyncProgress|Windows 10, version 1703|||| +|PublishXML|Windows 10, version 1703|||| +|Policy|Windows 10, version 1703|||| + From a72487a8239474b30943e627227b6294e4c3cf50 Mon Sep 17 00:00:00 2001 From: Yuhang Zhu Date: Mon, 11 Jun 2018 12:51:50 +0000 Subject: [PATCH 076/187] Merged PR 8963: Remove a statement from MicrosoftNetworkClient policy. This a real edit change. Thanks. --- .../policy-configuration-service-provider.md | 16 + ...policy-csp-localpoliciessecurityoptions.md | 365 +++++++++++++++--- 2 files changed, 317 insertions(+), 64 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 403a5e2cb4..921e2c246d 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2048,12 +2048,18 @@ The following diagram shows the Policy configuration service provider in tree fo
LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways +
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession +
LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
@@ -2075,6 +2081,9 @@ The following diagram shows the Policy configuration service provider in tree fo
LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM +
LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
@@ -2084,6 +2093,9 @@ The following diagram shows the Policy configuration service provider in tree fo
LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients +
LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
@@ -4407,17 +4419,21 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) - [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) - [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) - [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) - [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-amountofidletimerequiredbeforesuspendingsession) - [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) - [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) - [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) - [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) - [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) - [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowlocalsystemtousecomputeridentityforntlm) - [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) - [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) - [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) - [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) - [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) - [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 49a48f512a..ce338ff2ae 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,11 +6,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/06/2018 +ms.date: 06/05/2018 --- # Policy CSP - LocalPoliciesSecurityOptions +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +
@@ -81,12 +84,18 @@ ms.date: 04/06/2018
LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways +
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession +
LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
@@ -108,6 +117,9 @@ ms.date: 04/06/2018
LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM +
LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
@@ -117,6 +129,9 @@ ms.date: 04/06/2018
LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients +
LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
@@ -838,15 +853,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -914,15 +920,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -985,15 +982,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -1495,6 +1483,83 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways** + + +
+ + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +

+ + + +Microsoft network client: Digitally sign communications (always) + +This security setting determines whether packet signing is required by the SMB client component. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. + +If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. + +Default: Disabled. + + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + +GP Info: +- GP English name: *Microsoft network client: Digitally sign communications (always)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees** @@ -1618,6 +1683,72 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Microsoft network server: Amount of idle time required before suspending a session + +This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. + +Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. + +For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. + +Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. + + + +GP Info: +- GP English name: *Microsoft network server: Amount of idle time required before suspending session* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways** @@ -2051,6 +2182,78 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Network security: Allow Local System to use computer identity for NTLM + +This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. + +If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. + +If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. + +By default, this policy is enabled on Windows 7 and above. + +By default, this policy is disabled on Windows Vista. + +This policy is supported on at least Windows Vista or Windows Server 2008. + +Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. + + + +GP Info: +- GP English name: *Network security: Allow Local System to use computer identity for NTLM* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests** @@ -2246,6 +2449,75 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + +This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. +Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + + + +GP Info: +- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers** @@ -2359,15 +2631,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -2429,15 +2692,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -2499,15 +2753,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -2569,15 +2814,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -3406,6 +3642,7 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. From df4de51f2c1c9ff924c6b3b2938d26838430f9e4 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 11 Jun 2018 13:08:15 +0000 Subject: [PATCH 077/187] Merged PR 8966: Remove outdated wifi requirement --- devices/hololens/hololens-setup.md | 1 - 1 file changed, 1 deletion(-) diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md index 8850ba0f96..0f62fc2e6e 100644 --- a/devices/hololens/hololens-setup.md +++ b/devices/hololens/hololens-setup.md @@ -19,7 +19,6 @@ Before you get started setting up your HoloLens, make sure you have a Wi-Fi netw The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. You need to connect HoloLens to a Wi-Fi network with Internet connectivity so that the user account can be authenticated. - It can be an open Wi-Fi or password-protected Wi-Fi network. -- The Wi-Fi network cannot require you to navigate to a webpage to connect. - The Wi-Fi network cannot require certificates to connect. - The Wi-Fi network does not need to provide access to enterprise resources or intranet sites. From 9c18365310bd10f21e6e73f71f94b1ccbde60149 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 10:03:07 -0700 Subject: [PATCH 078/187] Created updated table --- .../app-v/appv-available-mdm-settings.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 7544ce59d5..3e8fa55d1c 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -15,20 +15,20 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| |Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10, version 1703|||| -|Publisher|Windows 10, version 1703|||| -|InstallLocation|Windows 10, version 1703|||| -|InstallDate|Windows 10, version 1703|||| -|Users|Windows 10, version 1703|||| -|AppVPackageID|Windows 10, version 1703|||| -|AppVVersionID|Windows 10, version 1703|||| -|AppVPackageUri|Windows 10, version 1703|||| -|LastError|Windows 10, version 1703|||| -|LastErrorDescription|Windows 10, version 1703|||| -|SyncStatusDescription|Windows 10, version 1703|||| -|SyncProgress|Windows 10, version 1703|||| -|PublishXML|Windows 10, version 1703|||| -|Policy|Windows 10, version 1703|||| +|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Version|String|Read-only data, provided by your App-V packages.| +|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Publisher|String|Read-only data, provided by your App-V packages.| +|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallLocation|String|Read-only data, provided by your App-V packages.| +|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallDate|String|Read-only data, provided by your App-V packages.| +|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Users|String|Read-only data, provided by your App-V packages.| +|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageID|String|Read-only data, provided by your App-V packages.| +|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVVersionID|String|Read-only data, provided by your App-V packages.| +|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageUri|String|Read-only data, provided by your App-V packages.| +|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| From 840bcc7b6cca660898932c8db701fd3f25ebca24 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 11 Jun 2018 10:14:47 -0700 Subject: [PATCH 079/187] added other entities for allowed blocked list settings --- ...ows-defender-advanced-threat-protection.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md index 4b6a427b67..f1e3dbc4a5 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 04/24/2018 +ms.date: 06/11/2018 --- # Manage automation allowed/blocked lists @@ -38,30 +38,31 @@ You can define the conditions for when entities are identified as malicious or s ## Create an allowed or blocked list 1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. -2. Select the type of entity you'd like to create an exclusion for. You can choose any of the following entities: +2. Select the tab of the type of entity you'd like to create an exclusion for. You can choose any of the following entities: - File hash - Certificate + - IP address + - DNS + - Email + - Process memory 3. Click **Add system exclusion**. -4. For each attribute specify the exclusion type, details, and the following required values: - - - **Files** - Hash value - - **Certificate** - PEM certificate file +4. For each attribute specify the exclusion type, details, and their corresponding required values. -5. Click **Update rule**. +5. Click **Add rule**. ## Edit a list 1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. -2. Select the type of entity you'd like to edit the list from. +2. Select the tab of the entity type you'd like to edit the list from. 3. Update the details of the rule and click **Update rule**. ## Delete a list 1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. -2. Select the type of entity you'd like to delete the list from. +2. Select the tab of the entity type you'd like to delete the list from. 3. Select the list type by clicking the check-box beside the list type. From da1c082a0a63f06c655ee551e74576227f4a0d84 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 10:26:34 -0700 Subject: [PATCH 080/187] Attempt to shorten uri column --- .../app-v/appv-available-mdm-settings.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 3e8fa55d1c..9e95747a79 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -14,21 +14,21 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| -|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Version|String|Read-only data, provided by your App-V packages.| -|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Publisher|String|Read-only data, provided by your App-V packages.| -|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallLocation|String|Read-only data, provided by your App-V packages.| -|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallDate|String|Read-only data, provided by your App-V packages.| -|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Users|String|Read-only data, provided by your App-V packages.| -|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageID|String|Read-only data, provided by your App-V packages.| -|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVVersionID|String|Read-only data, provided by your App-V packages.| -|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageUri|String|Read-only data, provided by your App-V packages.| -|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| +|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Name|String|Read-only data, provided by your App-V packages.| +|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Version|String|Read-only data, provided by your App-V packages.| +|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Publisher|String|Read-only data, provided by your App-V packages.| +|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallLocation|String|Read-only data, provided by your App-V packages.| +|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallDate|String|Read-only data, provided by your App-V packages.| +|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Users|String|Read-only data, provided by your App-V packages.| +|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageID|String|Read-only data, provided by your App-V packages.| +|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVVersionID|String|Read-only data, provided by your App-V packages.| +|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageUri|String|Read-only data, provided by your App-V packages.| +|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.|
From 148043f8e793881391661712b133c22022217788 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 10:27:56 -0700 Subject: [PATCH 081/187] Added bullets --- .../app-v/appv-available-mdm-settings.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 9e95747a79..8b09c32feb 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -24,9 +24,9 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVVersionID|String|Read-only data, provided by your App-V packages.| |AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageUri|String|Read-only data, provided by your App-V packages.| |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ Sync/PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 37e2e1acf6109387995f304f8b7521386ea843ec Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 11 Jun 2018 18:42:11 +0000 Subject: [PATCH 082/187] Merged PR 8974: add link for how to update HoloLens directly; update Intune kiosk profile --- devices/hololens/hololens-microsoft-layout-app.md | 2 +- devices/hololens/hololens-updates.md | 2 +- .../configuration/lock-down-windows-10-to-specific-apps.md | 5 +++-- windows/configuration/setup-kiosk-digital-signage.md | 4 +++- 4 files changed, 8 insertions(+), 5 deletions(-) diff --git a/devices/hololens/hololens-microsoft-layout-app.md b/devices/hololens/hololens-microsoft-layout-app.md index d2357ed2ee..4f5540e858 100644 --- a/devices/hololens/hololens-microsoft-layout-app.md +++ b/devices/hololens/hololens-microsoft-layout-app.md @@ -25,7 +25,7 @@ Microsoft Layout works with a HoloLens, or with a Windows Mixed Reality headset | OS requirements | Details | |:----------------------------------|:-----------------------------------------------------------| -| Build 10.0.17134.77 or above | See [Manage updates to HoloLens](hololens-updates.md) for instructions on upgrading to this build. | +| Build 10.0.17134.77 or above | See [Update HoloLens](https://support.microsoft.com/help/12643/hololens-update-hololens) for instructions on upgrading to this build. | #### Windows Mixed Reality headset requirements diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md index 0b91b6f361..e10552862b 100644 --- a/devices/hololens/hololens-updates.md +++ b/devices/hololens/hololens-updates.md @@ -12,7 +12,7 @@ ms.date: 04/30/2018 # Manage updates to HoloLens - +>**Looking for how to get the latest update? See [Update HoloLens](https://support.microsoft.com/help/12643/hololens-update-hololens).** Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. As with desktop devices, administrators can manage updates to the HoloLens operating system using [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb). diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 7610e6fe75..34225059f4 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -52,7 +52,7 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi 12. Enter a friendly name for the configuration. 10. In **Kiosk Mode**, select **Multi app kiosk**. 13. Select an app type. - - For **Add Win32 app**, enter the **App Name** and **Identifier**. + - For **Add Win32 app**, enter a friendly name for the app in **App Name**, and enter the path to the app executable in **Identifier**. - For **Add managed apps**, select an app that you manage through Intune. - For **Add app by AUMID**, enter the Application User Model ID (AUMID) for an installed UWP app. 14. Select whether to enable the taskbar. @@ -61,7 +61,8 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi 17. Select **OK**. You can add additional configurations or finish. 18. Assign the profile to a device group to configure the devices in that group as kiosks. - +>[!NOTE] +>Managed apps are apps that are in the Microsoft Store for Business that is synced with your Intune subscription. diff --git a/windows/configuration/setup-kiosk-digital-signage.md b/windows/configuration/setup-kiosk-digital-signage.md index 36581a3438..a2442ee9fb 100644 --- a/windows/configuration/setup-kiosk-digital-signage.md +++ b/windows/configuration/setup-kiosk-digital-signage.md @@ -270,7 +270,9 @@ The following steps explain how to configure a kiosk in Microsoft Intune. For ot 7. Select **Windows 10 and later** for the platform. 8. Select **Kiosk (Preview)** for the profile type. 9. Enter a friendly name for the kiosk configuration. -10. In **Kiosk Mode**, select **Single full-screen app kiosk**. +10. Select **Kiosk - 1 setting available**. +10. Select **Add** to add a kiosk configuration. +10. Enter a friendly name for the kiosk configuration, and then in **Kiosk Mode**, select **Single full-screen app kiosk**. 10. Select either **Select a managed app** to choose a kiosk app that is managed by Intune, or **Enter UWP app AUMID** to specify the kiosk app by AUMID, and then select the app or enter the AUMID as appropriate. 1. For the user account, select either **Autologon** to create a user account for the kiosk that will sign in automatically, or **Local user account** to configure an existing user account to run the kiosk. **Local user account** can be a local standard user account on the device or an Azure Active Directory account. 14. Select **OK**, and then select **Create**. From 8acf5994725441506f024dc89773edb32bd39547 Mon Sep 17 00:00:00 2001 From: danhwang1 <40180973+danhwang1@users.noreply.github.com> Date: Mon, 11 Jun 2018 11:45:40 -0700 Subject: [PATCH 083/187] Update supl-ddf-file.md We have recently made a change in our Location Platform pertaining to SUPL to increase the max number of root certificates from 3 to 6 (as mandated). As a result, we will need to update the necessary public documentation here: https://docs.microsoft.com/en-us/windows/client-management/mdm/supl-ddf-file --- .../client-management/mdm/supl-ddf-file.md | 198 +++++++++++++++++- 1 file changed, 197 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index e6ed98d713..4ee4e4ad1d 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -171,7 +171,7 @@ The XML below is the current version for this CSP. - MCCMNPairs + MCCMNCPairs @@ -482,6 +482,201 @@ The XML below is the current version for this CSP. + + RootCertificate4 + + + + + Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + + + + + + + + + + + + + + + Name + + + + + + Specifies the name of the H-SLP root certificate as a string, in the format name.cer. + + + + + + + + + + + text/plain + + + + + Data + + + + + + The base 64 encoded blob of the H-SLP root certificate. + + + + + + + + + + + + + + + + + RootCertificate5 + + + + + Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + + + + + + + + + + + + + + + Name + + + + + + Specifies the name of the H-SLP root certificate as a string, in the format name.cer. + + + + + + + + + + + text/plain + + + + + Data + + + + + + The base 64 encoded blob of the H-SLP root certificate. + + + + + + + + + + + + + + + + + RootCertificate6 + + + + + Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + + + + + + + + + + + + + + + Name + + + + + + Specifies the name of the H-SLP root certificate as a string, in the format name.cer. + + + + + + + + + + + text/plain + + + + + Data + + + + + + The base 64 encoded blob of the H-SLP root certificate. + + + + + + + + + + + + + + + V2UPL1 @@ -662,6 +857,7 @@ The XML below is the current version for this CSP. + ```   From 92466c0e772bfd4e17fddcf0f2c80c95046c2826 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 12:37:34 -0700 Subject: [PATCH 084/187] Adjusted spacing --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 8b09c32feb..1c5d1625d3 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -26,8 +26,8 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ Sync/PublishXML|String|Custom value, entered by admin.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 769a8b5bab997efd83405d5d51096f6afc8f6619 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 13:06:27 -0700 Subject: [PATCH 085/187] Attempt to adjust spacing. --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 1c5d1625d3..7b4de19db8 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -26,8 +26,8 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/ PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 2e791f3bf1304fc2ad71c51c5a9f4b2aa7063454 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Mon, 11 Jun 2018 21:27:30 +0000 Subject: [PATCH 086/187] Updated inclusive-classroom-it-admin.md --- education/get-started/inclusive-classroom-it-admin.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 16b5c8a0e2..6d3bb808df 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -37,10 +37,10 @@ ms.date: 03/18/2018 | Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| -| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| | | | | | | | | -| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | | | -| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| | | | | | | | | -| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| | | | | | | | | +| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | | | | +| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | +| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | | | | +| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | | Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | | | | Ability to request accessible content |
  • Outlook Web Access
| | | | | | | | |
@@ -48,6 +48,5 @@ ms.date: 03/18/2018 | Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| -| Translate Language of Document |
  • Word 2016
  • PowerPoint 2016
| | | | | | | | | -| PowerPoint Translator |
  • PowerPoint 2016 Add-in
| | | | | | | | | +| Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in
|

X

|

X

|

X

|

X

|

X

| | | |
\ No newline at end of file From c124f6d063f0900374e1fa2604aa397b800ae3a7 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 15:41:07 -0700 Subject: [PATCH 087/187] Next attempt at spacing adjustment --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 7b4de19db8..b6a44c1356 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -26,8 +26,8 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/ PublishXML|String|Custom value, entered by admin.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 05281c5b94d42d29d56c80c5121dfd1632af5004 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 16:57:32 -0700 Subject: [PATCH 088/187] Continued updating articles --- ...to-packages-with-the-management-console.md | 49 ++++++++----------- 1 file changed, 21 insertions(+), 28 deletions(-) diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index 58b23dd73f..86ded03016 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -8,60 +8,53 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- - - # How to Configure Access to Packages by Using the Management Console -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Before you deploy an App-V virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. Use the following procedure to configure access to virtualized packages. -**To grant access to an App-V package** +## Grant access to an App-V package -1. Find the package you want to configure: +1. Find the package you want to configure: - 1. Open the App-V Management console. + 1. Open the App-V Management console. - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. + 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD ACCESS** page. Alternatively, select the package and select **EDIT** in the **AD ACCESS** pane. -2. Provision a security group for the package: +2. Provision a security group for the package: - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. + 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. - 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. + 1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**. - **Note**   - Ensure that you provide an associated domain name for the group that you are searching for. + >[!NOTE]   + >Ensure that you provide an associated domain name for the group that you are searching for. -   +3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. -3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. +4. Select **Close** to accept the default configuration settings and close the AD ACCESS page. -4. + To customize configurations for a specific group, select the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To make changes to your custom configurations, select **EDIT**. After you grant access, select **Close**. - To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. +## Remove access to an App-V package - To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. +1. Find the package you want to configure: -**To remove access to an App-V package** + 1. Open the App-V Management console. -1. Find the package you want to configure: + 1. To display the **AD ACCESS** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **EDIT** in the **AD ACCESS** pane. - 1. Open the App-V Management console. +2. Select the group you want to remove, then select **DELETE**. - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Select the group you want to remove, and click **DELETE**. - -3. To close the **AD ACCESS** page, click **Close**. +3. Select **Close**. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) From c763226d7779d7c9452a8b6611e0a731e6a067e6 Mon Sep 17 00:00:00 2001 From: Peter Lewis Date: Tue, 12 Jun 2018 12:01:16 +0100 Subject: [PATCH 089/187] Fix spelling mistake Corrected 'ois' to 'is' --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index c769840d86..a01bbdbab3 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -44,7 +44,7 @@ Microsoft publishes two types of Surface Hub releases broadly on an ongoing basi In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes. -The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime ois finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. +The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). From f762fd133f9936e4f6aafadca5b82cc089fdf059 Mon Sep 17 00:00:00 2001 From: Patti Short Date: Tue, 12 Jun 2018 06:14:26 -0700 Subject: [PATCH 090/187] changed the GP path to the policy --- browsers/edge/emie-to-improve-compatibility.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index fc8a612b80..b6c34c4968 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -43,14 +43,14 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip ### Set up Microsoft Edge to use the Enterprise Mode site list -You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). +You must turn on the **Configure the Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). > **Note**
> If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. **To turn on Enterprise Mode using Group Policy** -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Allows you to configure the Enterprise Mode Site list** setting.

Turning this setting on also requires you to create and store a site list.

![Local Group Policy Editor for using a site list](images/edge-emie-grouppolicysitelist.png) +1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Configure the Enterprise Mode Site List** policy.

Turning this setting on also requires you to create and store a site list.

![Local Group Policy Editor for using a site list](images/edge-emie-grouppolicysitelist.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. From 96c9a3a425f765ffd432d28053dca331103a068d Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 12 Jun 2018 13:45:04 +0000 Subject: [PATCH 091/187] Merged PR 8996: fix broken link for Surface Hub download --- devices/surface-hub/surface-hub-downloads.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md index 257bc6b58b..8ddafa924a 100644 --- a/devices/surface-hub/surface-hub-downloads.md +++ b/devices/surface-hub/surface-hub-downloads.md @@ -18,7 +18,7 @@ This topic provides links to useful Surface Hub documents, such as product datas | --- | --- | | [Surface Hub Site Readiness Guide (PDF)](http://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) | Make sure your site is ready for Surface Hub, including structural and power requirements, and get technical specs for Surface Hub. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov) | | [Surface Hub Setup Guide (English, French, Spanish) (PDF)](http://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. | -| [Surface Hub Quick Reference Guide (PDF)](http://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface Hub Quick Reference Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. | +| [Surface Hub Quick Reference Guide (PDF)](http://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. | | [Surface Hub User Guide (PDF)](http://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. | | [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC. | | [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf) | Learn how to replace the solid state drive (SSD) for the 55- and 84-inch Surface Hub. | From 0b0dedb2b287abddf0ba8ddc7d423e3e39d94522 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 10:19:28 -0700 Subject: [PATCH 092/187] added links to how to set startup auth --- .../information-protection/bitlocker/bitlocker-security-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index db335bddd1..a1988d5ced 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv ## What are the implications of using the sleep or hibernate power management options? -BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. +BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). ## What are the advantages of a TPM? From 691fcc8adcef630ede24ab5336814e0586e0a4ba Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 12 Jun 2018 10:23:42 -0700 Subject: [PATCH 093/187] first pass fixing links to dead OMS marketing page --- .../update/device-health-get-started.md | 13 ++++++++----- .../update/update-compliance-get-started.md | 8 ++++++-- .../upgrade/upgrade-readiness-get-started.md | 15 +++++++++------ .../upgrade/upgrade-readiness-requirements.md | 14 +++++++------- 4 files changed, 30 insertions(+), 20 deletions(-) diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md index 81a57be6d4..5b3a7b3474 100644 --- a/windows/deployment/update/device-health-get-started.md +++ b/windows/deployment/update/device-health-get-started.md @@ -5,7 +5,7 @@ keywords: Device Health, oms, operations management suite, prerequisites, requir ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.date: 03/20/2018 +ms.date: 06/12/2018 ms.pagetype: deploy author: jaimeo ms.author: jaimeo @@ -24,13 +24,16 @@ Steps are provided in sections that follow the recommended setup process: -## Add Device Health to Microsoft Operations Management Suite +## Add Device Health to Microsoft Operations Management Suite or Azure Log Analytics -Device Health is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). +Device Health is offered as a solution in the Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). -**If you are already using Windows Analytics**, you should use the same Azure Log Analytics workspace you're already using. find Device Health in the Solutions Gallery. Select the **Device Health** tile in the gallery and then click **Add** on the solution's details page. Device Health is now visible in your workspace. While you're in the Solutions Gallery, you should consider installing the [Upgrade Readiness](../upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) and [Update Compliance](update-compliance-monitor.md) solutions as well, if you haven't already. +**If you are already using Windows Analytics**, you should use the same Azure Log Analytics workspace you're already using. Find Device Health in the Solutions Gallery. Select the **Device Health** tile in the gallery and then click **Add** on the solution's details page. Device Health is now visible in your workspace. While you're in the Solutions Gallery, you should consider installing the [Upgrade Readiness](../upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) and [Update Compliance](update-compliance-monitor.md) solutions as well, if you haven't already. -**If you are not yet using Windows Analytics or Azure Log Analytics**, use the following steps to subscribe: +>[!NOTE] +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=DeviceHealthProd) to go directly to the Device Health solution and add it to your workspace. + +**If you are not yet using Windows Analytics or Azure Log Analytics**, follow these steps to subscribe: 1. Go to [Operations Management Suite](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**. [![Operations Management Suite bar with sign-in button](images/uc-02a.png)](images/uc-02.png) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 6cfecd1c73..9887546277 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -23,12 +23,16 @@ Steps are provided in sections that follow the recommended setup process: -## Add Update Compliance to Microsoft Operations Management Suite +## Add Update Compliance to Microsoft Operations Management Suite or Azure Log Analytics -Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). +Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). If you are already using OMS, skip to step **6** to add Update Compliance to your workspace. +>[!NOTE] +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=WaaSUpdateInsights) to go directly to the Device Health solution and add it to your workspace. + + If you are not yet using OMS, use the following steps to subscribe to OMS Update Compliance: 1. Go to [Operations Management Suite](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**. diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md index e80d01d273..3ee8a1a528 100644 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: deploy author: jaimeo ms.author: jaimeo -ms.date: 03/20/2018 +ms.date: 06/12/2018 ms.localizationpriority: high --- @@ -35,7 +35,7 @@ When you are ready to begin using Upgrade Readiness, perform the following steps To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information. -## Add Upgrade Readiness to Operations Management Suite +## Add Upgrade Readiness to Operations Management Suite or Azure Log Analytics Upgrade Readiness is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/). @@ -44,11 +44,14 @@ Upgrade Readiness is offered as a solution in the Microsoft Operations Managemen If you are already using OMS, you’ll find Upgrade Readiness in the Solutions Gallery. Select the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution's details page. Upgrade Readiness is now visible in your workspace. While you have this dialog open, you should also consider adding the [Device Health](../update/device-health-monitor.md) and [Update Compliance](../update/update-compliance-monitor.md) solutions as well, if you haven't already. To do so, just select the check boxes for those solutions. -If you are not using OMS: +>[!NOTE] +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=CompatibilityAssessment) to go directly to the Upgrade Readiness solution and add it to your workspace. -1. Go to the [Upgrade Readiness page on Microsoft.com](https://go.microsoft.com/fwlink/?LinkID=799190&clcid=0x409) and select **New Customers >** to start the process. -2. Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. -3. Create a new OMS workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. +If you are not using OMS or Azure Log Analytics: + +1. Go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. +2. Sign in to Operations Management Suite (OMS or Azure Log Analytics You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. +3. Create a new workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. 4. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. > If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. Your workspace opens. diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index 21dfb741d1..538d13cb2a 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -5,7 +5,7 @@ keywords: windows analytics, oms, operations management suite, prerequisites, re ms.prod: w10 author: jaimeo ms.author: -ms.date: 03/15/2018 +ms.date: 06/12/2018 ms.localizationpriority: high --- @@ -32,19 +32,19 @@ See [Windows 10 Specifications](http://www.microsoft.com/en-US/windows/windows-1 ### Windows 10 Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates. -The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com). +The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com). While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC. -## Operations Management Suite +## Operations Management Suite or Azure Log Analytics -Upgrade Readiness is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing on premise and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). +Upgrade Readiness is offered as a solution in Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud based services for managing on premise and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). -If you’re already using OMS, you’ll find Upgrade Readiness in the Solutions Gallery. Click the Upgrade Readiness tile in the gallery and then click Add on the solution’s details page. Upgrade Readiness is now visible in your workspace. +If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace. You can also -If you are not using OMS, go to the [Upgrade Readiness page](https://www.microsoft.com/en-us/windowsforbusiness/simplified-updates) on Microsoft.com and select **Sign up** to kick off the OMS onboarding process. During the onboarding process, you’ll create an OMS workspace and add the Upgrade Readiness solution to it. +If you are not using OMS or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. -Important: You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. +>[!IMPORTANT] You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work >or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. ## System Center Configuration Manager integration From ff9f493205532351390043b00a4859451d2f2bbf Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 10:24:27 -0700 Subject: [PATCH 094/187] added links to how to set startup auth --- .../bitlocker/bitlocker-security-faq.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index a1988d5ced..13ee71372a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: high author: brianlic-msft -ms.date: 05/03/2018 +ms.date: 06/12/2018 --- # BitLocker Security FAQ @@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv ## What are the implications of using the sleep or hibernate power management options? -BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). +BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For increased security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). ## What are the advantages of a TPM? From 49a75ea072dd6c8affa016687153e01b9e1c598a Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 10:25:42 -0700 Subject: [PATCH 095/187] Cleaning up for pull request Going to try something funky with that big table. --- ...ment-configuration-file-with-powershell.md | 14 +- ...user-configuration-file-with-powershell.md | 18 +- .../appv-auto-clean-unpublished-packages.md | 16 +- .../app-v/appv-available-mdm-settings.md | 202 +----------------- 4 files changed, 23 insertions(+), 227 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 42754ef837..a3958c5d49 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # How to apply the deployment configuration file by using Windows PowerShell @@ -20,12 +20,12 @@ The dynamic deployment configuration file is applied when a package is added or ## Apply the deployment configuration file with Windows PowerShell >[!NOTE] ->The following procedure is an example that uses the following two file paths for the package and configuration files: +>The following example cmdlet uses the following two file paths for the package and configuration files: > >* C:\\Packages\\Contoso\\MyApp.appv >* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml > ->If your package and configuration file use different file paths than the example, feel free to replace them as needed. +>If your package and configuration files use different file paths than the example, feel free to replace them as needed. To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, enter the following cmdlet: @@ -35,10 +35,10 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - > - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` + + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index 2632d17e87..c115854e06 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -1,12 +1,12 @@ --- -title: How to Apply the User Configuration File by Using Windows PowerShell (Windows 10) -description: How to Apply the User Configuration File by Using Windows PowerShell +title: How to apply the user configuration file by using Windows PowerShell (Windows 10) +description: How to apply the user configuration file by using Windows PowerShell (Windows 10). author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # How to apply the user configuration file by using Windows PowerShell @@ -14,22 +14,18 @@ ms.date: 04/19/2017 The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. -Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: - -* C:\\Packages\\Contoso\\MyApp.appv - ## Apply a user configuration file -Use the following procedure to specify a user-specific configuration file. +You can follow these steps to specify a user-specific configuration file: >[!NOTE] >The following procedure uses the following example file path for its package: > >* C:\\Packages\\Contoso\\MyApp.appv. > ->f your package file uses a different file path than the example, feel free to replace it. +>f your package file uses a different file path than the example, feel free to replace it as needed. -1. Enter the following cmdlet to add the package to the computer using the Windows PowerShell console: +1. Enter the following cmdlet in Windows PowerShell to add the package to the computer: ```PowerShell Add-AppVClientPackage C:\Packages\Contoso\MyApp.appv @@ -37,7 +33,7 @@ Use the following procedure to specify a user-specific configuration file. 2. Enter the following cmdlet to publish the package to the user and specify the updated the dynamic user configuration file: ```PowerShell - Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml + Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath C:\Packages\Contoso\config.xml ``` ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 5292d2ed73..bb51d5cad8 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -1,18 +1,18 @@ --- -title: Automatically cleanup unpublished packages on the App-V client (Windows 10) -description: How to automatically clean-up any unpublished packages on your App-V client devices. +title: Automatically clean up unpublished packages on the App-V client (Windows 10) +description: How to automatically clean up any unpublished packages on your App-V client devices. author: eross-msft ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # Automatically clean up unpublished packages on the App-V client >Applies to: Windows 10, version 1703 -Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after a device restart. +If you wanted to free up additional storage space in previous versions of App-V, you would have had to manually remove your unpublished packages from your client devices. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after restarting your device. ## Clean up with PowerShell cmdlets @@ -20,7 +20,7 @@ You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, ### Turn on the AutoCleanupEnabled option -1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package clean up functionality: +1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package cleanup functionality: ```PowerShell Set-AppvClientConfiguration -AutoCleanupEnabled 1 @@ -32,7 +32,7 @@ You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, |---|---|---| |AutoCleanupEnabled|1|False| -2. Run the following cmdlet to make sure the configuration is ready to automatically clean up your packages. +1. Run the following cmdlet to check if the configuration has the cleanup setting turned on. ```PowerShell Get-AppvClientConfiguration @@ -41,9 +41,9 @@ You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, ## Clean up with Group Policy settings -Using Group Policy, you can turn on the **Enable automatic clean up of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. +Using Group Policy, you can turn on the **Enable automatic cleanup of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. -### Turn on the Enable automatic clean up of unused App-V packages setting +### Turn on the Enable automatic cleanup of unused App-V packages setting 1. Open your Group Policy editor and select the **Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused App-V packages** setting. diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index b6a44c1356..6c749e9884 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -28,204 +28,4 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Policy nameSupported versionsDetails
NameWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Name
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
VersionWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Version
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
PublisherWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Publisher
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
InstallLocationWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/InstallLocation
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
InstallDateWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/InstallDate
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
UsersWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Users
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
AppVPackageIDWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/AppVPackageID
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
AppVVersionIDWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/AppVVersionID
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
AppVPackageUriWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/AppVPackageUri
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
LastErrorWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastError
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V client.
    • -
-
LastErrorDescriptionWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastErrorDescription
    • -
  • Data type. String
    • -
  • Values. -
      -
    • 0. No errors returned during publish.
      • -
    • 1. Unpublish groups failed during publish.
      • -
    • 2. Publish no-group packages failed during publish.
      • -
    • 3. Publish group packages failed during publish.
      • -
    • 4. Unpublish packages failed during publish.
      • -
    • 5. New policy write failed during publish.
      • -
    • 6. Multiple non-fatal errors occurred during publish.
      • -
    -
    • -
-
SyncStatusDescriptionWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncStatusDescription
    • -
  • Data type. String
    • -
  • Values. -
      -
    • 0. App-V publishing is idle.
      • -
    • 1. App-V connection groups publish in progress.
      • -
    • 2. App-V packages (non-connection group) publish in progress.
      • -
    • 3. App-V packages (connection group) publish in progress.
      • -
    • 4. App-V packages unpublish in progress.
      • -
    -
    • -
-
SyncProgressWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress
    • -
  • Data type. String
    • -
  • Values. -
      -
    • 0. App-V Sync is idle.
      • -
    • 1. App-V Sync is initializing.
      • -
    • 2. App-V Sync is in progress.
      • -
    • 3. App-V Sync is complete.
      • -
    • 4. App-V Sync requires device reboot.
      • -
    -
    • -
-
PublishXMLWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML
    • -
  • Data type. String
    • -
  • Value. Custom value, entered by admin.
    • -
-
PolicyWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/configurationid/Policy
    • -
  • Data type. String
    • -
  • Value. Custom value, entered by admin.
    • -
-
\ No newline at end of file +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From 274ecc83c3c8159d5ab5c48dcd920bdfe64b0ac0 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 10:26:33 -0700 Subject: [PATCH 096/187] added links to how to set startup auth --- .../information-protection/bitlocker/bitlocker-security-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index 13ee71372a..6aac433261 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv ## What are the implications of using the sleep or hibernate power management options? -BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For increased security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). +BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For improved security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). ## What are the advantages of a TPM? From 4d22e79913ec5ec7a2b975c554a71af6815f5a20 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 10:37:48 -0700 Subject: [PATCH 097/187] Attempted spacing fix for middle column --- .../app-v/appv-available-mdm-settings.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 6c749e9884..b53a68364c 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -14,18 +14,18 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| -|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Version|String|Read-only data, provided by your App-V packages.| -|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Publisher|String|Read-only data, provided by your App-V packages.| -|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallLocation|String|Read-only data, provided by your App-V packages.| -|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallDate|String|Read-only data, provided by your App-V packages.| -|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Users|String|Read-only data, provided by your App-V packages.| -|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageID|String|Read-only data, provided by your App-V packages.| -|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVVersionID|String|Read-only data, provided by your App-V packages.| -|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageUri|String|Read-only data, provided by your App-V packages.| -|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file +|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Name|String|Read-only data, provided by your App-V packages.| +|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Version|String|Read-only data, provided by your App-V packages.| +|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Publisher|String|Read-only data, provided by your App-V packages.| +|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //InstallLocation|String|Read-only data, provided by your App-V packages.| +|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //InstallDate|String|Read-only data, provided by your App-V packages.| +|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Users|String|Read-only data, provided by your App-V packages.| +|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVPackageID|String|Read-only data, provided by your App-V packages.| +|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVVersionID|String|Read-only data, provided by your App-V packages.| +|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVPackageUri|String|Read-only data, provided by your App-V packages.| +|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From cdebda815d631819f1d4ac932d5c0c99abd2a3e4 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 17:40:24 +0000 Subject: [PATCH 098/187] Updated inclusive-classroom-it-admin.md --- education/get-started/inclusive-classroom-it-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 6d3bb808df..bcff2649a4 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -16,7 +16,7 @@ ms.date: 03/18/2018 |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| |

X

| | | +| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| |

X

| | | | Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| |

X

| | | | Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| |

X

| | | | Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | |

X

| |

X

| From 73311e46a1db5125647ccfac28e05eb1b1b5b579 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 17:46:51 +0000 Subject: [PATCH 099/187] Updated inclusive-classroom-it-admin.md, testing headings --- education/get-started/inclusive-classroom-it-admin.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index bcff2649a4..4ce644acdc 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -14,6 +14,9 @@ ms.author: alhughes ms.date: 03/18/2018 --- +# Inclusive Classroom IT Admin Guide + +## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| | Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| |

X

| | | @@ -45,7 +48,6 @@ ms.date: 03/18/2018 | Ability to request accessible content |
  • Outlook Web Access
| | | | | | | | |
- | Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| | Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in
|

X

|

X

|

X

|

X

|

X

| | | | From 13238fcf3e90753450b81f1c31ca00d5833af540 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 17:54:09 +0000 Subject: [PATCH 100/187] Updated inclusive-classroom-it-admin.md --- .../get-started/inclusive-classroom-it-admin.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 4ce644acdc..1367c70c95 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -17,14 +17,14 @@ ms.date: 03/18/2018 # Inclusive Classroom IT Admin Guide ## Inclusive Classroom features -|Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | +|Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| |

X

| | | -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| |

X

| | | -| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| |

X

| | | -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | |

X

| |

X

| -| Line focus mode |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | |

X

| | | -| Picture Dictionary |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | |

X

| |

X

| +| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| | +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| | +| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| | +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | | +| Line focus mode |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | | +| Picture Dictionary |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | |
| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | From 0ecac91aae729a9c46418e51c7942cb834f959fc Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 11:05:29 -0700 Subject: [PATCH 101/187] Cleanup --- ...ss-to-packages-with-the-management-console.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index 86ded03016..f9a3d2bb7e 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # How to Configure Access to Packages by Using the Management Console @@ -22,22 +22,22 @@ Use the following procedure to configure access to virtualized packages. 1. Open the App-V Management console. - 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD ACCESS** page. Alternatively, select the package and select **EDIT** in the **AD ACCESS** pane. + 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD Access** page. Alternatively, select the package and select **Edit** in the **AD Access** pane. 2. Provision a security group for the package: - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. + 1. Go to the **Find valid Active Directory names and grant access** page. 1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**. >[!NOTE]   >Ensure that you provide an associated domain name for the group that you are searching for. -3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. +3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD entities with access** pane. -4. Select **Close** to accept the default configuration settings and close the AD ACCESS page. +4. Select **Close** to accept the default configuration settings and close the AD Access page. - To customize configurations for a specific group, select the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To make changes to your custom configurations, select **EDIT**. After you grant access, select **Close**. + To customize configurations for a specific group, select the **Assigned configurations** drop-down menu, then select **Custom**. To make changes to your custom configurations, select **Edit**. After you grant access, select **Close**. ## Remove access to an App-V package @@ -45,9 +45,9 @@ Use the following procedure to configure access to virtualized packages. 1. Open the App-V Management console. - 1. To display the **AD ACCESS** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **EDIT** in the **AD ACCESS** pane. + 1. To display the **AD Access** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **Edit** in the **AD Access** pane. -2. Select the group you want to remove, then select **DELETE**. +2. Select the group you want to remove, then select **Delete**. 3. Select **Close**. From c1e22d64cb659727e61d1f667154e46e5774a200 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 11:06:22 -0700 Subject: [PATCH 102/187] Spacing edit --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index b53a68364c..4d0eaf7540 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -27,5 +27,5 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/
configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From b83f8f41c34bc5136e6e2a2678d355293f3affe3 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Tue, 12 Jun 2018 11:26:02 -0700 Subject: [PATCH 103/187] Add new functionality for existing ASR rule. --- .../attack-surface-reduction-exploit-guard.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 5fcdb543ec..344fe9385a 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 05/30/2018 +ms.date: 06/12/2018 --- @@ -127,6 +127,8 @@ Office apps, such as Word or Excel, will not be allowed to create child processe This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. +In Windows 10, version 1803 and later, this rule also blocks suspicious apps from being launched through Outlook or Access. + ### Rule: Block Office applications from creating executable content This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique. From 9b80f217466ba7935adef9e180a6bf591f3f77ef Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Tue, 12 Jun 2018 11:47:21 -0700 Subject: [PATCH 104/187] Add reviewer changes. --- .../attack-surface-reduction-exploit-guard.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 344fe9385a..4085972ad5 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -123,12 +123,10 @@ This rule blocks the following file types from being run or launched from an ema ### Rule: Block Office applications from creating child processes -Office apps, such as Word or Excel, will not be allowed to create child processes. +Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, Outlook, and Access. This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. -In Windows 10, version 1803 and later, this rule also blocks suspicious apps from being launched through Outlook or Access. - ### Rule: Block Office applications from creating executable content This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique. From 3a2606394c93471343771cc38fcc355844beec6a Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 19:23:14 +0000 Subject: [PATCH 105/187] Updated inclusive-classroom-it-admin.md, fixed up the tables --- .../inclusive-classroom-it-admin.md | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 1367c70c95..0deaac12fc 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -18,37 +18,37 @@ ms.date: 03/18/2018 ## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | -|---|---|---|---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| | -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| | -| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| | -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | | -| Line focus mode |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | | -| Picture Dictionary |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | | +|---|---|---|---|---|---|---| +| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(Not including Outlook PC)

|

X

(Not including any OneNote apps or Outlook PC)

| +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(Not including any OneNote apps)

| +| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access)

|

X

(Not including Word iOS)

|

X

(Not including Word iOS)

|

X

(Not including any OneNote apps or Word iOS)

| +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| +| Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| +| Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|
-| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | -|---|---|---|---|---|---|---|---|---|---| -| Dictation |
  • OneNote 2016, OneNote for Windows 10
  • Word 2016
  • Outlook 2016
  • PowerPoint 2016
| |

X

|

X

| | | | | | -| Spelling suggestions for phonetic misspellings |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

|

X

| | | | | -| Synonyms alongside spelling suggestions that can be read aloud |
  • Word 2016
  • Outlook 2016
| |

X

|

X

|

X

| | | | | -| Grammar checks |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | | | | -| Customizable writing critiques |
  • Word 2016, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | | | | -| Tell me what you want to do |
  • Office 2016
  • Office Online
  • Office on iOS, Android, Windows 10
| |

X

|

X

|

X

| |

X

| | | -| Editor |
  • Word 2016
| |

X

|

X

| | | | | | +| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | +|---|---|---|---|---|---|---| +| Dictation |
  • OneNote 2016, OneNote for Windows 10
  • Word 2016
  • Outlook 2016
  • PowerPoint 2016
| |

X

|

X

| | | +| Spelling suggestions for phonetic misspellings |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

|

X

| | +| Synonyms alongside spelling suggestions that can be read aloud |
  • Word 2016
  • Outlook 2016
| |

X

|

X

|

X

| | +| Grammar checks |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | +| Customizable writing critiques |
  • Word 2016, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | +| Tell me what you want to do |
  • Office 2016
  • Office Online
  • Office on iOS, Android, Windows 10
| |

X

|

X

|

X

| | +| Editor |
  • Word 2016
| |

X

|

X

| | |
-| Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | -|---|---|---|---|---|---|---|---|---|---| -| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | | | | -| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | -| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | | | | -| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | -| Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | | | -| Ability to request accessible content |
  • Outlook Web Access
| | | | | | | | | +| Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | +|---|---|---|---|---|---|---| +| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | +| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | +| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | +| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | +| Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | +| Ability to request accessible content |
  • Outlook Web Access
| | | | | |
-| Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | -|---|---|---|---|---|---|---|---|---|---| -| Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in
|

X

|

X

|

X

|

X

|

X

| | | | +| Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | +|---|---|---|---|---|---|---| +| Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in)
|

X

|

X

|

X

|

X

|

X

|
\ No newline at end of file From 596329a76b5009bc00112ffbe93ceaa3bc68d3e8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 12:24:16 -0700 Subject: [PATCH 106/187] Edit spacing --- .../application-management/app-v/appv-available-mdm-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 4d0eaf7540..3c0cae1e21 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -28,4 +28,4 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/
configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From 267d6b1e42cb7642f7a1b5605075a2cac7d8cdb3 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 12 Jun 2018 19:44:52 +0000 Subject: [PATCH 107/187] Merged PR 9009: fix link --- devices/hololens/hololens-provisioning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index 86631b4976..c1a90edadb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -22,7 +22,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device -To create provisioning packages, you must install Windows Configuration Designer [from Microsoft Store]((https://www.microsoft.com/store/apps/9nblggh4tx22)) or [from the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configurations Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box. +To create provisioning packages, you must install Windows Configuration Designer [from Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) or [from the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configurations Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box. From 26a9473445983b5435f5f1ff17a105b4f4a6b8da Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 13:03:25 -0700 Subject: [PATCH 108/187] added new topic for isg --- .../TOC.md | 1 + ...control-with-intelligent-security-graph.md | 142 ++++++++++++++++++ 2 files changed, 143 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 4bf7c5ff89..1d9c033045 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -18,6 +18,7 @@ ### [Merge WDAC policies](merge-windows-defender-application-control-policies.md) ### [Enforce WDAC policies](enforce-windows-defender-application-control-policies.md) ### [Deploy WDAC with a managed installer](use-windows-defender-application-control-with-managed-installer.md) +### [Deploy WDAC with Intelligent Security Graph (ISG)](use-windows-defender-application-control-with-intelligent-security-graph.md) ### [Deploy WDAC policies using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md) ### [Deploy WDAC policies using Intune](deploy-windows-defender-application-control-policies-using-intune.md) ### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md new file mode 100644 index 0000000000..57f5838a42 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -0,0 +1,142 @@ +--- +title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10) +description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: high +author: mdsakibMSFT +ms.date: 03/01/2018 +--- + +# Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph + +**Applies to:** + +- Windows 10 +- Windows Server 2016 + + +```code + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Enable service enforcement in AppLocker policy + +Since many installation processes rely on services, it is typically necessary to enable tracking of services. +Correct tracking of services requires the presence of at least one rule in the rule collection – a simple audit only rule will suffice. +For example: + +```code + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +### Enable the managed installer option in WDAC policy + +In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your WDAC policy. +This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). +An example of the managed installer option being set in policy is shown below. + +```code + + + + + + + + + + + + + + + + + +``` + +## Security considerations with managed installer + +Since managed installer is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. +It is best suited for deployment to systems where each user is configured as a standard user and where all software is deployed and installed by a software distribution solution, such as System Center Configuration Manager. + +Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed. +If the authorized managed installer process performs installations in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. +Some application installers include an option to automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization may continue to apply to all files created during the first run of the application. This could result in over-authorization for executables that were not intended. +To avoid this, ensure that the application deployment solution being used as a managed installer limits running applications as part of installation. + +## Known limitations with managed installer + +- Application execution control based on managed installer does not support applications that self-update. +If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin information and will not be authorized to run. +Enterprises should deploy and install all application updates using the managed installer. +In some cases, it may be possible to also designate an application binary that performs the self-updates as a managed installer. +Proper review for functionality and security should be performed for the application before using this method. + +- Although WDAC policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments. +Using the managed installer option with WDAC policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode. + +- Modern apps deployed through a managed installer will not be tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy. + +- Executables that extract files and then attempt to execute may not be allowed by the managed installer heuristic. +In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer. +Proper review for functionality and security should be performed for the application before using this method. + +- The managed installer heuristic does not authorize drivers. +The WDAC policy must have rules that allow the necessary drivers to run. + +- In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. +Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. +Review for functionality and performance for the related applications using the native images maybe necessary in some cases. From 1b3717b4e850e9916028733b3cf8cd0f2e666b80 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 12 Jun 2018 13:27:24 -0700 Subject: [PATCH 109/187] fixing some typos --- windows/deployment/update/update-compliance-get-started.md | 2 +- windows/deployment/upgrade/upgrade-readiness-get-started.md | 2 +- windows/deployment/upgrade/upgrade-readiness-requirements.md | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 9887546277..9d1b01ce0f 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -30,7 +30,7 @@ Update Compliance is offered as a solution in the Microsoft Operations Managemen If you are already using OMS, skip to step **6** to add Update Compliance to your workspace. >[!NOTE] ->If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=WaaSUpdateInsights) to go directly to the Device Health solution and add it to your workspace. +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=WaaSUpdateInsights) to go directly to the Update Compliance solution and add it to your workspace. If you are not yet using OMS, use the following steps to subscribe to OMS Update Compliance: diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md index 3ee8a1a528..2972c0ff9c 100644 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md @@ -50,7 +50,7 @@ If you are already using OMS, you’ll find Upgrade Readiness in the Solutions G If you are not using OMS or Azure Log Analytics: 1. Go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. -2. Sign in to Operations Management Suite (OMS or Azure Log Analytics You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. +2. Sign in to Operations Management Suite (OMS) or Azure Log Analytics. You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. 3. Create a new workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. 4. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index 538d13cb2a..7695e28a28 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -21,7 +21,7 @@ To perform an in-place upgrade, user computers must be running the latest versio The compatibility update that sends diagnostic data from user computers to Microsoft data centers works with Windows 7 SP1 and Windows 8.1 only. Upgrade Readiness cannot evaluate Windows XP or Windows Vista for upgrade eligibility. - + If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Windows Update or download and deploy the applicable package from the Microsoft Download Center. @@ -44,7 +44,8 @@ If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Read If you are not using OMS or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. ->[!IMPORTANT] You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work >or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. +>[!IMPORTANT] +>You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. ## System Center Configuration Manager integration From 1e12726a502bb1f81f9de09cedeadf8a8c2cb2c8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:04:09 -0700 Subject: [PATCH 110/187] Finished cleanup --- ...y-the-deployment-configuration-file-with-powershell.md | 7 ++----- ...v-apply-the-user-configuration-file-with-powershell.md | 8 ++++---- .../app-v/appv-available-mdm-settings.md | 4 ++-- 3 files changed, 8 insertions(+), 11 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index a3958c5d49..f55d0d1e05 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -12,10 +12,7 @@ ms.date: 06/12/2018 >Applies to: Windows 10, version 1607 -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings of the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: - -* C:\\Packages\\Contoso\\MyApp.appv -* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml +When you add or set a package to a computer running the App-V client before it's been published, a dynamic deployment configuration file is applied to it. The dynamic deployment configuration file configures the default settings for the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. ## Apply the deployment configuration file with Windows PowerShell @@ -34,7 +31,7 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon ``` >[!NOTE] ->This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: +>This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: ```PowerShell Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index c115854e06..b51f7ac212 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -12,18 +12,18 @@ ms.date: 06/12/2018 >Applies to: Windows 10, version 1607 -The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. +When you publish a package to a specific user, you'll also need to specify a dynamic user configuration file to tell that package how to run. ## Apply a user configuration file -You can follow these steps to specify a user-specific configuration file: +Here's how to specify a user-specific configuration file: >[!NOTE] ->The following procedure uses the following example file path for its package: +>The following example cmdlets use this example file path for its package: > >* C:\\Packages\\Contoso\\MyApp.appv. > ->f your package file uses a different file path than the example, feel free to replace it as needed. +>If your package file uses a different file path than the example, feel free to replace it as needed. 1. Enter the following cmdlet in Windows PowerShell to add the package to the computer: diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 3c0cae1e21..9ccb2510ea 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -6,11 +6,11 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # Available Mobile Device Management (MDM) settings for App-V -With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps by using these Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. +With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps with the following Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| From 326a6637c42d37100cb6c98c2bee6e70a5ffb4c4 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:09:06 -0700 Subject: [PATCH 111/187] Attempt to fix cmdlet formatting --- ...ply-the-deployment-configuration-file-with-powershell.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index f55d0d1e05..1fe64baff9 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -33,9 +33,9 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` ## Have a suggestion for App-V? From bdbea031da2c54910b31f5f32ac28bbb108032ff Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:28:50 -0700 Subject: [PATCH 112/187] Attempt to fix formatting again for powershell cmdlet --- ...ply-the-deployment-configuration-file-with-powershell.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 1fe64baff9..220186db45 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -33,9 +33,9 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` ## Have a suggestion for App-V? From 2ca39b9ba2e77070b0894ef0fba582e6bdae0e4e Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:30:14 -0700 Subject: [PATCH 113/187] Attempt to fix formatting again with brackets --- ...y-the-deployment-configuration-file-with-powershell.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 220186db45..90a114d137 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -32,10 +32,10 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: - - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` +> +> ```PowerShell +> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml +> ``` ## Have a suggestion for App-V? From c0fa70b9c025b0cfb0377a9708071550d405376c Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 21:44:36 +0000 Subject: [PATCH 114/187] Updated inclusive-classroom-it-admin.md, added final 3 sections --- .../inclusive-classroom-it-admin.md | 36 ++++++++++++++++--- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 0deaac12fc..4daed3a54b 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -1,7 +1,7 @@ --- title: Inclusive Classroom IT Admin Guide description: Learning which Inclusive Classroom features are available in which apps and in which versions of Microsoft Office. -keywords: Test +keywords: Inclusive Classroom, Admin, Administrator, Microsoft Intune, Intune, Ease of Access, Office 365, account ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -11,12 +11,19 @@ ms.pagetype: edu ROBOTS: noindex,nofollow author: alhughes ms.author: alhughes -ms.date: 03/18/2018 +ms.date: 06/12/2018 --- # Inclusive Classroom IT Admin Guide +The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Office. +You will also learn how to deploy apps using Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. -## Inclusive Classroom features +1. [Inclusive Classroom features](#features) +2. [Deploying apps with Microsoft Intune](#intune) +3. [How to disable the Ease of Accesss settings for text in Windows 10](#ease) +4. [How to change your Office 365 account from monthly, semi-annual, or yearly](#account) + +## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| | Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(Not including Outlook PC)

|

X

(Not including any OneNote apps or Outlook PC)

| @@ -51,4 +58,25 @@ ms.date: 03/18/2018 | Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| | Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in)
|

X

|

X

|

X

|

X

|

X

| -
\ No newline at end of file +
+ +## Deploying apps with Microsoft Intune +Microsoft Intune can be used to deploy apps such as Immersive Reader and Mirosoft Translator to all the computers connected in the same groups. +1. Go to the Intune for Education portal and login with your account. +2. Select the **Apps** page. +3. Find the app your looking for either in the included list or if it's not there you can select **Add app** and download it from the Microsoft Store. +4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. + +## How to disable the Ease of Accesss settings for text in Windows 10 +The Ease of Access settings in Windows 10 are very useful accessibility tools, but not every one needs them activated for their computer. With the following instructions you can turn off users ability to get to the Ease of access settings. +1. Go to the Intune for Education portal and login with your account. +2. Select the **Groups** page and then select your desired group. +3. Select **Settings** and under the **User access and device settings** section you find the toggle to set Ease of access to **Blocked** or **Not blocked**. +4. Select **Save** after making your selection. + +## How to change your Office 365 account from monthly, semi-annual, or yearly +Depending on how you plan to do billing, you can have Office 365 accounts that are set to renew monthly, semi-annually, or yearly. +1. Sign in to your services and subscriptions with your Microsoft account. +2. Find the subscription in the list, then select **Change how you pay**. + >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires. +3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. \ No newline at end of file From 9a9257760d00e1b8a9e70a9431528ceeee2dcd32 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:58:38 -0700 Subject: [PATCH 115/187] Next attempt to fix formatting --- ...ply-the-deployment-configuration-file-with-powershell.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 90a114d137..9010d42763 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -33,9 +33,9 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: > -> ```PowerShell -> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml -> ``` +> ```PowerShell +> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml +> ``` ## Have a suggestion for App-V? From 750fbbabb8e7b7e8425a0952e168d68458bf673c Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 15:21:45 -0700 Subject: [PATCH 116/187] Fixed formatting and placement of related topics section for consistency --- .../app-v/appv-auto-clean-unpublished-packages.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index bb51d5cad8..25e56caeaf 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -51,12 +51,12 @@ Using Group Policy, you can turn on the **Enable automatic cleanup of unused App After your Group Policy updates and you reset the client, the setting will clean up any unpublished App-V packages on the App-V client. -### Related topics +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). + +## Related topics - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) - [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186) -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file +- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) \ No newline at end of file From d2bb6ad6664ece3cdacfe3b75056256968e7961c Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 23:40:56 +0000 Subject: [PATCH 117/187] Updated inclusive-classroom-it-admin.md --- .../get-started/inclusive-classroom-it-admin.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 4daed3a54b..e095d037d3 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -15,8 +15,8 @@ ms.date: 06/12/2018 --- # Inclusive Classroom IT Admin Guide -The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Office. -You will also learn how to deploy apps using Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. +The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Microsoft Office. +You will also learn how to deploy apps using Microsoft Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. 1. [Inclusive Classroom features](#features) 2. [Deploying apps with Microsoft Intune](#intune) @@ -64,19 +64,19 @@ You will also learn how to deploy apps using Intune, turn on or off Ease of acce Microsoft Intune can be used to deploy apps such as Immersive Reader and Mirosoft Translator to all the computers connected in the same groups. 1. Go to the Intune for Education portal and login with your account. 2. Select the **Apps** page. -3. Find the app your looking for either in the included list or if it's not there you can select **Add app** and download it from the Microsoft Store. +3. Find the app you're looking for either in the included list or, if it's not there, you can select **Add app** and download it from the Microsoft Store. 4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. -## How to disable the Ease of Accesss settings for text in Windows 10 +## How to disable the Ease of Access settings for text in Windows 10 The Ease of Access settings in Windows 10 are very useful accessibility tools, but not every one needs them activated for their computer. With the following instructions you can turn off users ability to get to the Ease of access settings. 1. Go to the Intune for Education portal and login with your account. 2. Select the **Groups** page and then select your desired group. -3. Select **Settings** and under the **User access and device settings** section you find the toggle to set Ease of access to **Blocked** or **Not blocked**. +3. Select **Settings** and under the **User access and device settings** section you will find the toggle to set **Ease of access** to **Blocked** or **Not blocked**. 4. Select **Save** after making your selection. ## How to change your Office 365 account from monthly, semi-annual, or yearly Depending on how you plan to do billing, you can have Office 365 accounts that are set to renew monthly, semi-annually, or yearly. -1. Sign in to your services and subscriptions with your Microsoft account. +1. Sign-in to your services and subscriptions with your Microsoft account. 2. Find the subscription in the list, then select **Change how you pay**. >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires. 3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. \ No newline at end of file From e2cb4b031ab11b5695b30b435ef8e6ba34d75011 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 12 Jun 2018 17:24:28 -0700 Subject: [PATCH 118/187] update applies to, fix char, modify console use --- ...evel-windows-defender-advanced-threat-protection.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md index a542df63b1..677d282889 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Onboard previous versions of Windows on Windows Defender ATP description: Onboard supported previous versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor -keywords: onboard, windows, 7, 8, oms, sp1, enterprise, pro, down level +keywords: onboard, windows, 7, oms, sp1, enterprise, pro, down level search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 06/11/2018 +ms.date: 06/17/2018 --- # Onboard Windows previous versions of Windows @@ -19,15 +19,13 @@ ms.date: 06/11/2018 - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro -- Windows 8.1 Enterprise -- Windows 8.1 Pro - Windows Defender Advanced Threat Protection (Windows Defender ATP) [!include[Prerelease information](prerelease.md)] -Windows Defender ATP extends support to also include down-level operating systems, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console. +Windows Defender ATP extends support to also include down-level operating systems, providing advanced attack detection and investigation capabilities on supported Windows versions. -To onboard down-level Windows client endpoints to Windows Defender ATP, youll need to: +To onboard down-level Windows client endpoints to Windows Defender ATP, you'll need to: - Configure and update System Center Endpoint Protection clients. - Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP as instructed below. From 99c0736647e9edddff7cbc6cfaec77009de4bbaa Mon Sep 17 00:00:00 2001 From: Martin Adler <1208749+EagleIJoe@users.noreply.github.com> Date: Wed, 13 Jun 2018 12:51:37 +0200 Subject: [PATCH 119/187] Corrected examples XML syntax Upper case boolean values caused parser error Ending XML closing tag invalidates file --- .../app-v/appv-auto-batch-updating.md | 92 +++++++++---------- 1 file changed, 45 insertions(+), 47 deletions(-) diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md index 1d96b18fb8..ff99b0273a 100644 --- a/windows/application-management/app-v/appv-auto-batch-updating.md +++ b/windows/application-management/app-v/appv-auto-batch-updating.md @@ -41,29 +41,28 @@ Updating multiple apps at the same time requires that you create a **ConfigFile* **Example:** ```XML - - - Skype for Windows Update - D:\Install\Update\SkypeforWindows - SkypeSetup.exe - /S - C:\App-V_Package\Microsoft_Apps\skypeupdate.appv - 20 - True - True - - - Microsoft Power BI Update - D:\Install\Update\PowerBI - PBIDesktop.msi - /S - C:\App-V_Package\MS_Apps\powerbiupdate.appv - 20 - True - True - - - + + + Skype for Windows Update + D:\Install\Update\SkypeforWindows + SkypeSetup.exe + /S + C:\App-V_Package\Microsoft_Apps\skypeupdate.appv + 20 + true + true + + + Microsoft Power BI Update + D:\Install\Update\PowerBI + PBIDesktop.msi + /S + C:\App-V_Package\MS_Apps\powerbiupdate.appv + 20 + true + true + + ``` 3. Save your completed file under the name **ConfigFile**. @@ -101,29 +100,28 @@ Updating multipe apps at the same time requires that you create a **ConfigFile** ```XML - - - Skype for Windows Update - D:\Install\Update\SkypeforWindows - SkypeSetup.exe - /S - C:\App-V_Package\Microsoft_Apps\skypeupdate.appv - 20 - False - True - - - Microsoft Power BI Update - D:\Install\Update\PowerBI - PBIDesktop.msi - /S - C:\App-V_Package\MS_Apps\powerbiupdate.appv - 20 - False - True - - - + + + Skype for Windows Update + D:\Install\Update\SkypeforWindows + SkypeSetup.exe + /S + C:\App-V_Package\Microsoft_Apps\skypeupdate.appv + 20 + false + true + + + Microsoft Power BI Update + D:\Install\Update\PowerBI + PBIDesktop.msi + /S + C:\App-V_Package\MS_Apps\powerbiupdate.appv + 20 + false + true + + ``` ### Start the App-V Sequencer interface and app installation process @@ -157,4 +155,4 @@ There are three types of log files that occur when you sequence multiple apps at ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). From 9ab71bdb870712272a40959d82dff6fa8c1d547b Mon Sep 17 00:00:00 2001 From: Frank Gorgenyi Date: Wed, 13 Jun 2018 12:37:34 +0000 Subject: [PATCH 120/187] Merged PR 9015: Change Quick Pair to Swift Pair. Change Quick Pair to Swift Pair. --- windows/client-management/mdm/policy-csp-bluetooth.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 519bdfeb1f..1fb3b009d6 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -236,14 +236,14 @@ The following list shows the supported values: -Added in Windows 10, version 1803. This policy allows the IT admin to block users on these managed devices from using Quick Pair and other proximity based scenarios. +Added in Windows 10, version 1803. This policy allows the IT admin to block users on these managed devices from using Swift Pair and other proximity based scenarios. The following list shows the supported values: -- 0 - Disallow. Block users on these managed devices from using Quick Pair and other proximity based scenarios -- 1 - Allow. Allow users on these managed devices to use Quick Pair and other proximity based scenarios +- 0 - Disallow. Block users on these managed devices from using Swift Pair and other proximity based scenarios +- 1 - Allow. Allow users on these managed devices to use Swift Pair and other proximity based scenarios From 18f3d7f9b13a10de950050a888ccd3deb47c0780 Mon Sep 17 00:00:00 2001 From: Christopher McClister Date: Wed, 13 Jun 2018 08:26:54 -0700 Subject: [PATCH 121/187] Added ms.collection meta data to Education hub per Lauren Moynihan --- education/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/education/index.md b/education/index.md index 424b52680d..c78b456b9e 100644 --- a/education/index.md +++ b/education/index.md @@ -6,6 +6,7 @@ description: Learn about product documentation and resources available for schoo author: CelesteDG ms.topic: hub-page ms.author: celested +ms.collection: ITAdminEDU ms.date: 10/30/2017 ---
From 79dfc736790d239eb0172e2ea9365323a5fc00f2 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 13 Jun 2018 08:52:54 -0700 Subject: [PATCH 122/187] Updated metadata dates --- ...v-apply-the-deployment-configuration-file-with-powershell.md | 2 +- .../appv-apply-the-user-configuration-file-with-powershell.md | 2 +- .../app-v/appv-auto-clean-unpublished-packages.md | 2 +- .../application-management/app-v/appv-available-mdm-settings.md | 2 +- ...-configure-access-to-packages-with-the-management-console.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 9010d42763..8d3a64000e 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # How to apply the deployment configuration file by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index b51f7ac212..d8a04ef887 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # How to apply the user configuration file by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 25e56caeaf..cd9c6096a7 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # Automatically clean up unpublished packages on the App-V client diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 9ccb2510ea..d254a8b4b7 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # Available Mobile Device Management (MDM) settings for App-V diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index f9a3d2bb7e..f44af0a19a 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # How to Configure Access to Packages by Using the Management Console From 436fe714e3178bc5f9be0c3b65482a4cacdac780 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Jun 2018 09:56:48 -0700 Subject: [PATCH 123/187] added bold to code snippet --- ...control-with-intelligent-security-graph.md | 151 ++++++------------ 1 file changed, 53 insertions(+), 98 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index 57f5838a42..c5c738cc8e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -15,11 +15,39 @@ ms.date: 03/01/2018 - Windows 10 - Windows Server 2016 +Application execution control can be difficult to implement in enterprises that do not have processes to effectively control the deployment of applications centrally through an IT managed system. +In such environments, users are empowered to acquire the applications they need for work, making accounting for all the applications that would need to be authorized for execution control a daunting task. -```code +Windows 10, version 1709 (also known as the Windows 10 Fall Creators Update) provides a new option, known as Intelligent Security Graph (ISG) authorization, that allows IT administrators to automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. The ISG option helps IT organizations take a significant first step towards going from having no application control at all to a simple means of preventing the execution of unknown and known bad software. + +## How does the integration between WDAC and the Intelligent Security Graph work? + +The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed the reputation data is used to help make the right policy authorization decision. + +After that initial download and installation, the WDAC component will check for the presence of the positive reputation information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the known good reputation classification. + +The reputation data on the client is rechecked periodically and enterprises can also specify that any cached reputation results are flushed on reboot. + +>[!NOTE] +>Admins needs to ensure that there is a WDAC policy in place to allow the system to boot and run any other authorized applications that may not be classified as being known good by the Intelligent Security Graph, for example custom line-of-business (LOB) apps. Since the Intelligent Security Graph is powered by global prevalence data, internal LOB apps may not be recognized as being known good. Other mechanisms like managed installer and explicit rules will help cover internal applications. Both System Center Configuration Manager (SCCM) and Microsoft Intune can be used to create and push a WDAC policy to your client machines. + +Other examples of WDAC policies are available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies and can help authorize Windows OS components, WHQL signed drivers and all Store apps. Admins can reference and customize them as needed for their Windows Defender Application Control deployment or [create a custom WDAC policy](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy). + +## Configuring Intelligent Security Graph authorization for Windows Defender Application Control + +Setting up the ISG authorization is easy regardless of what management solution you use. Configuring the ISG option involves these basic steps: + +- [Ensure that the ISG option is enabled in the WDAC policy XML](#ensure-that-the-intelligent-security-graph-option-is-enabled-in-the-wdac-policy-xml) +- [Enable the necessary services to allow WDAC to use the ISG correctly on the client](#enable-the-necessary-services-to-allow-wdac-to-use-the-isg-correctly-on-the-client) + +### Ensure that the Intelligent Security Graph option is enabled in the WDAC policy XML + +In order to enable trust for executables based on classifications in the ISG, the Enabled: Intelligent Security Graph authorization option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition it is recommended from a security perspective to also enable the Enabled:Invalidate EAs on Reboot option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. An example of both options being set is shown below. + +
  
      
-       
+       
      
      
        
@@ -27,12 +55,12 @@ ms.date: 03/01/2018
      
        
      
-     
-       
-     
-     
-       
-     
+     
+       
+     
+     
+       
+     
      
        
      
@@ -40,103 +68,30 @@ ms.date: 03/01/2018
        
      
  
+
+ +### Enable the necessary services to allow WDAC to use the ISG correctly on the client + +In order for the heuristics used by the ISG to function properly, a number of component in Windows need to be enabled. The easiest way to do this is to run the appidtel executable in c:\windows\system32. + +``` +appidtel start ``` -## Enable service enforcement in AppLocker policy +For WDAC policies deployed over MDM using the AppLocker CSP this step is not required as the CSP will enable the necessary components. ISG enabled through the SCCM WDAC UX will not need this step but if custom policies are being deployed outside of the WDAC UX through SCCM then this step is required. -Since many installation processes rely on services, it is typically necessary to enable tracking of services. -Correct tracking of services requires the presence of at least one rule in the rule collection – a simple audit only rule will suffice. -For example: +## Security considerations with using the Intelligent Security Graph -```code - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` +Since the ISG is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. It is best suited for deployment to systems where each user is configured as a standard user and there are other monitoring systems in place like Windows Defender Advanced Threat Protection to help provide optics into what users are doing. -### Enable the managed installer option in WDAC policy +Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of WDAC when the ISG option is allowed by circumventing or corrupting the heuristics used to assign reputation to application executables. The ISG option uses the same heuristic tracking as managed installer and so for application installers that include an option to automatically run the application at the end of the installation process the heuristic may over-authorize. -In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your WDAC policy. -This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). -An example of the managed installer option being set in policy is shown below. +## Known limitations with using the Intelligent Security Graph -```code - - - - - - - - - - - - - - - - - -``` +Since the ISG relies on identifying executables as being known good there are cases where it may classify legitimate executables as unknown leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in WDAC policy or by deployment through a WDAC managed installer. Typically this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG. -## Security considerations with managed installer +Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business it is straightforward to authorize modern apps with signer rules in the WDAC policy. -Since managed installer is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. -It is best suited for deployment to systems where each user is configured as a standard user and where all software is deployed and installed by a software distribution solution, such as System Center Configuration Manager. +The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. -Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed. -If the authorized managed installer process performs installations in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. -Some application installers include an option to automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization may continue to apply to all files created during the first run of the application. This could result in over-authorization for executables that were not intended. -To avoid this, ensure that the application deployment solution being used as a managed installer limits running applications as part of installation. - -## Known limitations with managed installer - -- Application execution control based on managed installer does not support applications that self-update. -If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin information and will not be authorized to run. -Enterprises should deploy and install all application updates using the managed installer. -In some cases, it may be possible to also designate an application binary that performs the self-updates as a managed installer. -Proper review for functionality and security should be performed for the application before using this method. - -- Although WDAC policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments. -Using the managed installer option with WDAC policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode. - -- Modern apps deployed through a managed installer will not be tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy. - -- Executables that extract files and then attempt to execute may not be allowed by the managed installer heuristic. -In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer. -Proper review for functionality and security should be performed for the application before using this method. - -- The managed installer heuristic does not authorize drivers. -The WDAC policy must have rules that allow the necessary drivers to run. - -- In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. -Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. -Review for functionality and performance for the related applications using the native images maybe necessary in some cases. +In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases. \ No newline at end of file From a33af7a063e817c9dd78174e6b196fd2c63e774d Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 13 Jun 2018 13:32:24 -0700 Subject: [PATCH 124/187] Corrected ASR rule functions. --- .../attack-surface-reduction-exploit-guard.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 4085972ad5..ef39fda490 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- @@ -174,7 +174,6 @@ This rule attempts to block Office files that contain macro code that is capable This rule blocks the following file types from being run or launched unless they meet prevalence or age criteria set by admins, or they are in a trusted list or exclusion list: - Executable files (such as .exe, .dll, or .scr) -- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) ### Rule: Use advanced protection against ransomware From e7903a90bbcc957f988d2d36f2e6274084f47ae4 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Jun 2018 13:52:18 -0700 Subject: [PATCH 125/187] fixed formatting --- ...control-with-intelligent-security-graph.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index c5c738cc8e..f5dfca7d37 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -22,7 +22,7 @@ Windows 10, version 1709 (also known as the Windows 10 Fall Creators Update) pro ## How does the integration between WDAC and the Intelligent Security Graph work? -The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed the reputation data is used to help make the right policy authorization decision. +The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed, the reputation data is used to help make the right policy authorization decision. After that initial download and installation, the WDAC component will check for the presence of the positive reputation information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the known good reputation classification. @@ -42,9 +42,9 @@ Setting up the ISG authorization is easy regardless of what management solution ### Ensure that the Intelligent Security Graph option is enabled in the WDAC policy XML -In order to enable trust for executables based on classifications in the ISG, the Enabled: Intelligent Security Graph authorization option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition it is recommended from a security perspective to also enable the Enabled:Invalidate EAs on Reboot option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. An example of both options being set is shown below. +In order to enable trust for executables based on classifications in the ISG, the **Enabled: Intelligent Security Graph authorization** option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition, it is recommended from a security perspective to also enable the **Enabled:Invalidate EAs on Reboot** option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. The following example shows both options being set. -
+```code
  
      
        
@@ -55,12 +55,12 @@ In order to enable trust for executables based on classifications in the ISG, th
      
        
      
-     
-       
-     
-     
-       
-     
+    
+      
+    
+    
+       
+    
      
        
      
@@ -68,7 +68,7 @@ In order to enable trust for executables based on classifications in the ISG, th
        
      
  
-
+``` ### Enable the necessary services to allow WDAC to use the ISG correctly on the client @@ -88,9 +88,9 @@ Users with administrator privileges or malware running as an administrator user ## Known limitations with using the Intelligent Security Graph -Since the ISG relies on identifying executables as being known good there are cases where it may classify legitimate executables as unknown leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in WDAC policy or by deployment through a WDAC managed installer. Typically this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG. +Since the ISG relies on identifying executables as being known good, there are cases where it may classify legitimate executables as unknown, leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in the WDAC policy or by deployment through a WDAC managed installer. Typically, this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG. -Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business it is straightforward to authorize modern apps with signer rules in the WDAC policy. +Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business. it is straightforward to authorize modern apps with signer rules in the WDAC policy. The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. From a84f2885449ccb019c65048e9c19d06cf8b925ca Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Jun 2018 13:56:08 -0700 Subject: [PATCH 126/187] fixed formatting --- ...ndows-defender-application-control-with-managed-installer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index efb071bcb1..badaf77f39 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: mdsakibMSFT -ms.date: 03/01/2018 +ms.date: 06/13/2018 --- # Deploy Managed Installer for Windows Defender Application Control From 1650ac230c4b901630c9680ebb31c309a2e57356 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 13 Jun 2018 14:01:22 -0700 Subject: [PATCH 127/187] Incorp review --- .../attack-surface-reduction-exploit-guard.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 4085972ad5..c1ad13b4dd 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- @@ -187,6 +187,9 @@ Local Security Authority Subsystem Service (LSASS) authenticates users who log i >[!IMPORTANT] >[Exclusions do not apply to this rule](customize-attack-surface-reduction.md#exclude-files-and-folders). + >[!NOTE] + >Some apps are coded to enumerate all running processes and to attempt opening them with exhaustive permissions. This results in the app accessing LSASS even when it's not necessary. ASR will deny the app's process open action and log the details to the security event log. Entry in the event log for access denial by itself is not an indication of the presence of a malicious threat. + ### Rule: Block process creations originating from PSExec and WMI commands This rule blocks processes through PsExec and WMI commands from running, to prevent remote code execution that can spread malware attacks. From facc92390c2c008d60e772efc1edc7fe874b90ec Mon Sep 17 00:00:00 2001 From: Zane <34351912+zburtondbrs@users.noreply.github.com> Date: Wed, 13 Jun 2018 16:02:17 -0500 Subject: [PATCH 128/187] Update set-the-default-browser-using-group-policy.md The KB does not specify that this is a computer policy. Since there is not an equivalent user policy, I think that this should be explicitly stated. --- .../set-the-default-browser-using-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 899c3da6e3..900f6cbb17 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -17,7 +17,7 @@ You can use the Group Policy setting, **Set a default associations configuration **To set the default browser as Internet Explorer 11** -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

+1. Open your Group Policy editor and go to the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). ![set default associations group policy setting](images/setdefaultbrowsergp.png) From 3f87dc491dbdba52acb699e5b5c0926809cefd10 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 13 Jun 2018 14:02:51 -0700 Subject: [PATCH 129/187] minor updates --- ...privacy-windows-defender-advanced-threat-protection.md | 6 +++--- ...censing-windows-defender-advanced-threat-protection.md | 2 +- ...rements-windows-defender-advanced-threat-protection.md | 6 +++--- ...ot-siem-windows-defender-advanced-threat-protection.md | 8 ++++---- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index 7a7abff824..1f6735881b 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 03/06/2018 +ms.date: 06/13/2018 --- # Windows Defender ATP data storage and privacy @@ -27,7 +27,7 @@ This section covers some of the most frequently asked questions regarding privac ## What data does Windows Defender ATP collect? -Microsoft will collect and store information from your configured machines in a database specific to the service for administration, tracking, and reporting purposes. +Windows Defender ATP will collect and store information from your configured machines in a customer dedicate and segregated tenant specific to the service for administration, tracking, and reporting purposes. Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version). @@ -51,7 +51,7 @@ In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wik ## Do I have the flexibility to select where to store my data? -When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the United Kingdom, Europe, or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States. +When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States. ## Is my data isolated from other customer data? Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides. diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md index e64acc561c..30c94ffd40 100644 --- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md @@ -66,7 +66,7 @@ When accessing the [Windows Defender ATP portal](https://SecurityCenter.Windows. You will need to set up your preferences for the Windows Defender ATP portal. -3. When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the United Kingdom, Europe, or The United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. +3. When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. > [!WARNING] > This option cannot be changed without completely offboarding from Windows Defender ATP and completing a new enrollment process. diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index c4a8127477..bd53b3a21d 100644 --- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -36,14 +36,14 @@ For more information, see [Windows 10 Enterprise edition](https://www.microsoft. ### Licensing requirements Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers: -- Windows 10 Enterprise E5 -- Windows 10 Education E5 +- Windows 10 Enterprise E5 +- Windows 10 Education E5 - Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2). ### Network and data storage and configuration requirements -When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the United Kingdom, Europe, or United States datacenter. +When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the European Union, the United Kingdom, or the United States datacenter. > [!NOTE] > - You cannot change your data storage location after the first-time setup. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index ba867a62e4..eb4b206317 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -63,10 +63,10 @@ If you encounter an error when trying to get a refresh token when using the thre - For Threat intelligence API: `https://WindowsDefenderATPCustomerTiConnector` 5. Add the following URL: - - For US: `https://winatpmanagement-us.securitycenter.windows.com/UserAuthenticationCallback`. - - For Europe: `https://winatpmanagement-eu.securitycenter.windows.com/UserAuthenticationCallback` - - For United Kingdom: `https://winatpmanagement-uk.securitycenter.windows.com/UserAuthenticationCallback` - + - For the European Union: `https://winatpmanagement-eu.securitycenter.windows.com/UserAuthenticationCallback` + - For the United Kingdom: `https://winatpmanagement-uk.securitycenter.windows.com/UserAuthenticationCallback` + - For the United States: `https://winatpmanagement-us.securitycenter.windows.com/UserAuthenticationCallback`. + 6. Click **Save**. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootsiem-belowfoldlink) From 71d2e1e786e30009f3965a6be272a1a3b8300ad6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 13 Jun 2018 14:17:05 -0700 Subject: [PATCH 130/187] typo --- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index 1f6735881b..872a54ee9b 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -27,7 +27,7 @@ This section covers some of the most frequently asked questions regarding privac ## What data does Windows Defender ATP collect? -Windows Defender ATP will collect and store information from your configured machines in a customer dedicate and segregated tenant specific to the service for administration, tracking, and reporting purposes. +Windows Defender ATP will collect and store information from your configured machines in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes. Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version). From 3d417b579cb5b4eb36bb5138848946614ce23637 Mon Sep 17 00:00:00 2001 From: Patti Short <35278231+shortpatti@users.noreply.github.com> Date: Wed, 13 Jun 2018 14:24:29 -0700 Subject: [PATCH 131/187] Revert "Update supl-ddf-file.md" --- .../client-management/mdm/supl-ddf-file.md | 198 +----------------- 1 file changed, 1 insertion(+), 197 deletions(-) diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 4ee4e4ad1d..e6ed98d713 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -171,7 +171,7 @@ The XML below is the current version for this CSP. - MCCMNCPairs + MCCMNPairs @@ -482,201 +482,6 @@ The XML below is the current version for this CSP. - - RootCertificate4 - - - - - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. - - - - - - - - - - - - - - - Name - - - - - - Specifies the name of the H-SLP root certificate as a string, in the format name.cer. - - - - - - - - - - - text/plain - - - - - Data - - - - - - The base 64 encoded blob of the H-SLP root certificate. - - - - - - - - - - - - - - - - - RootCertificate5 - - - - - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. - - - - - - - - - - - - - - - Name - - - - - - Specifies the name of the H-SLP root certificate as a string, in the format name.cer. - - - - - - - - - - - text/plain - - - - - Data - - - - - - The base 64 encoded blob of the H-SLP root certificate. - - - - - - - - - - - - - - - - - RootCertificate6 - - - - - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. - - - - - - - - - - - - - - - Name - - - - - - Specifies the name of the H-SLP root certificate as a string, in the format name.cer. - - - - - - - - - - - text/plain - - - - - Data - - - - - - The base 64 encoded blob of the H-SLP root certificate. - - - - - - - - - - - - - - - V2UPL1 @@ -857,7 +662,6 @@ The XML below is the current version for this CSP. - ```   From 57d57e319c5160365e228cfcea219843476ecf32 Mon Sep 17 00:00:00 2001 From: Luis Masieri <32968351+lmasieri@users.noreply.github.com> Date: Wed, 13 Jun 2018 14:29:15 -0700 Subject: [PATCH 132/187] Update whats-new-microsoft-store-business-education.md --- .../whats-new-microsoft-store-business-education.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index fc29d300b3..e2988a84c9 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -68,7 +68,7 @@ We’ve been working on bug fixes and performance improvements to provide you a - Bug fixes and performance improvements [October 2017](release-history-microsoft-store-business-education.md#october-2017) -- Bug fixes and permformance improvements +- Bug fixes and performance improvements [September 2017](release-history-microsoft-store-business-education.md#september-2017) - Manage Windows device deployment with Windows Autopilot Deployment From 8d57c7fd279afa47296b097d02db39f7b2052b9d Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Wed, 13 Jun 2018 22:38:16 +0000 Subject: [PATCH 133/187] Updated inclusive-classroom-it-admin.md, final changes before pull request --- .../inclusive-classroom-it-admin.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index e095d037d3..63c0d3cb23 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -20,18 +20,18 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea 1. [Inclusive Classroom features](#features) 2. [Deploying apps with Microsoft Intune](#intune) -3. [How to disable the Ease of Accesss settings for text in Windows 10](#ease) +3. [How to show/hide the Ease of Accesss settings for text in Windows 10](#ease) 4. [How to change your Office 365 account from monthly, semi-annual, or yearly](#account) ## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting |

  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(Not including Outlook PC)

|

X

(Not including any OneNote apps or Outlook PC)

| -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(Not including any OneNote apps)

| -| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access)

|

X

(Not including Word iOS)

|

X

(Not including Word iOS)

|

X

(Not including any OneNote apps or Word iOS)

| -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| -| Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| -| Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| +| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(N/A for Outlook PC)

|

X

(N/A for any OneNote apps or Outlook PC)

| +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(N/A for any OneNote apps)

| +| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access)

|

X

(N/A for Word iOS)

|

X

(N/A for Word iOS)

|

X

(N/A for any OneNote apps or Word iOS)

| +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(ot includingN any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| +| Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| +| Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|
| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | @@ -50,7 +50,7 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea | Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | | Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | -| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | +| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
  • Microsoft Stream (includes ability to have captions auto-generated for videos in English and Spanish)
| |

X

| | | | | Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | Ability to request accessible content |
  • Outlook Web Access
| | | | | |
@@ -61,14 +61,14 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea
## Deploying apps with Microsoft Intune -Microsoft Intune can be used to deploy apps such as Immersive Reader and Mirosoft Translator to all the computers connected in the same groups. -1. Go to the Intune for Education portal and login with your account. +Microsoft Intune can be used to deploy apps such as Immersive Reader and Microsoft Translator to all the devices connected in the same groups. +1. Go to the Intune for Education portal and log in with your account. 2. Select the **Apps** page. -3. Find the app you're looking for either in the included list or, if it's not there, you can select **Add app** and download it from the Microsoft Store. +3. Find the app you're looking for in the included list (if it's not there, you can select **Add app** and download it from the Microsoft Store). 4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. -## How to disable the Ease of Access settings for text in Windows 10 -The Ease of Access settings in Windows 10 are very useful accessibility tools, but not every one needs them activated for their computer. With the following instructions you can turn off users ability to get to the Ease of access settings. +## How to show/hide the Ease of access settings for text in Windows 10 +The Ease of access settings in Windows 10 are very useful accessibility tools, but having those options could be a bit much for everyone in a group to have in their device. With the following instructions you can chose to hide or show the Ease of access settings on users' devices. 1. Go to the Intune for Education portal and login with your account. 2. Select the **Groups** page and then select your desired group. 3. Select **Settings** and under the **User access and device settings** section you will find the toggle to set **Ease of access** to **Blocked** or **Not blocked**. From aee53922e55ffb6f767a3a81744308ceacfeafe4 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 14 Jun 2018 13:16:03 +0000 Subject: [PATCH 134/187] Merged PR 9058: fixing formatting --- windows/privacy/manage-windows-endpoints.md | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/windows/privacy/manage-windows-endpoints.md b/windows/privacy/manage-windows-endpoints.md index e43a9ddff4..ba3adcb3c4 100644 --- a/windows/privacy/manage-windows-endpoints.md +++ b/windows/privacy/manage-windows-endpoints.md @@ -34,7 +34,7 @@ We used the following methodology to derive these network endpoints: 2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. +5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -529,8 +529,7 @@ In addition to the endpoints listed for Windows 10 Enterprise, the following end | dual-a-0001.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. | | fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | -| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2/ -HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | +| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | | fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | | g.live.com/1rewlive5skydrive/ | HTTPS | Used by a redirection service to automatically update URLs. | @@ -552,11 +551,9 @@ HTTPS | Enables connections to Windows Update, Microsoft Update, and the online | pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | | pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. | | purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | -| ris.api.iris.microsoft.com.akadns.net | TLSv1.2/ -HTTPS | Used to retrieve Windows Spotlight metadata. | +| ris.api.iris.microsoft.com.akadns.net | TLSv1.2\/HTTPS | Used to retrieve Windows Spotlight metadata. | | settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. | -| sls.update.microsoft.com.nsatc.net | TLSv1.2/ -HTTPS | Enables connections to Windows Update. | +| sls.update.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update. | | star-mini.c10r.facebook.com | TLSv1.2 | Used for the Facebook Live Tile. | | storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. | | storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | @@ -578,8 +575,7 @@ HTTPS | Enables connections to Windows Update. | | **Destination** | **Protocol** | **Description** | | --- | --- | --- | | *.*.akamai.net | HTTP | Used to download content. | -| *.*.akamaiedge.net | HTTP/ -TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. | +| *.*.akamaiedge.net | TLSv1.2\/HTTP | Used to check for updates to maps that have been downloaded for offline use. | | *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. | | *.blob.core.windows.net | HTTPS | Used by Windows Update to update words used for language input methods. | | *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. | @@ -618,8 +614,7 @@ TLSv1.2 | Used to check for updates to maps that have been downloaded for offlin | evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office Online. | | fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | -| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2/ -HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | +| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe3.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | | fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | @@ -704,8 +699,7 @@ HTTPS | Enables connections to Windows Update, Microsoft Update, and the online | fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | | fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | -| g.msn.com.nsatc.net | HTTP/ -TLSv1.2 | Used to retrieve Windows Spotlight metadata. | +| g.msn.com.nsatc.net | TLSv1.2\/HTTP | Used to retrieve Windows Spotlight metadata. | | geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. | | geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. | From c7b5756f6843a2fece5d8b4a69c5b33cbe369f75 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Thu, 14 Jun 2018 14:42:13 +0000 Subject: [PATCH 135/187] Merged PR 9060: Fixed heading --- devices/hololens/hololens-kiosk.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 0abcc7ac79..745543c41c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -42,7 +42,8 @@ If you use [MDM, Microsoft Intune](#intune-kiosk), or a [provisioning package](# >[!NOTE] >Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. -### Start layout file for Intune + +### Start layout file for MDM (Intune and others) Save the following sample as an XML file. You will select this file when you configure the kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). From 719eeb5302d3965fcfb66f4146c873480c4b48ad Mon Sep 17 00:00:00 2001 From: JohnRajunas Date: Thu, 14 Jun 2018 12:38:36 -0400 Subject: [PATCH 136/187] Update windows-10-start-layout-options-and-policies.md I think adding the reference to CopyProfile not being supported will help insure IT Pros do not consider using it as a alternative to the options detailed here --- .../windows-10-start-layout-options-and-policies.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index 58bb51fd67..82f903e308 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -30,6 +30,8 @@ Organizations might want to deploy a customized Start and taskbar configuration >Start and taskbar configuration can be applied to devices running Windows 10 Pro, version 1703. > >Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/library/jj649079.aspx). +> +>Using CopyProfile for Start menu customization in Windows 10 isn't supported. For more information [Customize the Default User Profile by Using CopyProfile](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile) From 74700422bc9d02a594ddcacb94f21e06ff34a6c1 Mon Sep 17 00:00:00 2001 From: Paul Fitzgerald Date: Thu, 14 Jun 2018 11:38:46 -0500 Subject: [PATCH 137/187] Update upgrade-readiness-deployment-script.md Updated URL to point to new location for referenced information. --- .../deployment/upgrade/upgrade-readiness-deployment-script.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md index c28763cabf..774f54ce73 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md @@ -229,7 +229,7 @@ The deployment script displays the following exit codes to let you know if it wa 32 - Appraiser version on the machine is outdated. - The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://technet.microsoft.com/en-us/itpro/windows/deploy/upgrade-readiness-get-started#deploy-the-compatibility-update-and-related-kbs) for Windows 7 SP1/Windows 8.1. + The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/en-us/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. 33 - **CompatTelRunner.exe** exited with an exit code From 4e484666e0081fa699d83a97ed82149fc7d2bd30 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Thu, 14 Jun 2018 20:21:21 +0000 Subject: [PATCH 138/187] Merged PR 9074: update Intune kiosk instructions for HoloLens --- devices/hololens/hololens-kiosk.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 745543c41c..9b54f8a335 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -93,7 +93,7 @@ You will [create an XML file](#ppkg-kiosk) to define the kiosk configuration to ## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) -For HoloLens devices that are managed by Microsoft Intune, you [create a device restriction profile](https://docs.microsoft.com/intune/device-profile-create) and configure the [Kiosk (Preview) settings](https://docs.microsoft.com/intune/device-restrictions-windows-holographic#kiosk-preview). +For HoloLens devices that are managed by Microsoft Intune, you [create a device profile](https://docs.microsoft.com/intune/device-profile-create) and configure the [Kiosk settings](https://docs.microsoft.com/intune/kiosk-settings). For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. @@ -213,8 +213,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ## More information -Watch how to configure a kiosk in Microsoft Intune. ->[!VIDEO https://www.microsoft.com/videoplayer/embed/ce9992ab-9fea-465d-b773-ee960b990c4a?autoplay=false] + Watch how to configure a kiosk in a provisioning package. >[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false] \ No newline at end of file From b16e9511dadc13693353b005cc91c44179f0c52d Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Thu, 14 Jun 2018 20:56:50 +0000 Subject: [PATCH 139/187] Updated inclusive-classroom-it-admin.md, fixing text issue --- education/get-started/inclusive-classroom-it-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 63c0d3cb23..856e1c3a19 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -29,7 +29,7 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea | Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(N/A for Outlook PC)

|

X

(N/A for any OneNote apps or Outlook PC)

| | Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(N/A for any OneNote apps)

| | Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access)

|

X

(N/A for Word iOS)

|

X

(N/A for Word iOS)

|

X

(N/A for any OneNote apps or Word iOS)

| -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(ot includingN any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| | Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| | Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|
From eda252e46e8678735d766bd9d59dff4366b42805 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 14 Jun 2018 14:28:17 -0700 Subject: [PATCH 140/187] added new block list --- .../microsoft-recommended-block-rules.md | 549 +++++++++++++++++- ...control-with-intelligent-security-graph.md | 4 +- 2 files changed, 547 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index ae37d52989..0dbc282f16 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: jsuther1974 -ms.date: 06/08/2018 +ms.date: 06/14/2018 --- # Microsoft recommended block rules @@ -384,7 +384,278 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +