Merge remote-tracking branch 'refs/remotes/origin/master' into jd-sandbox

browsers/edge/Index.md

@@ -21,7 +21,11 @@ localizationpriority: high
 Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge also introduces new features like Web Note, Reading View, and Cortana that you can use along with your normal web browsing abilities.
 
 Microsoft Edge lets you stay up-to-date through the Windows Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools.
-<p>**Note**<br>This content isn't meant to be a step-by-step guide, so not everything that's talked about in this guide will be necessary for you to manage and deploy Microsoft Edge in your company.
+
+> **Note**<br>This content isn't meant to be a step-by-step guide, so not everything that's talked about in this guide will be necessary for you to manage and deploy Microsoft Edge in your company.
+
+
+> **Note**<br>For more info about the potential impact of using Microsoft Edge in a large organization, you can download an infographic from here: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892).
 
 ## In this section
 
@@ -58,3 +62,4 @@ You'll need to keep running them using IE11. If you don't have IE11 installed an
 - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760644)
 - [Internet Explorer 11 - FAQ for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760645)
 - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646)
+

browsers/edge/available-policies.md

@@ -19,7 +19,9 @@ localizationpriority: high
 Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences.
 
 By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain.
-<p>**Note**<br>For more info about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](https://go.microsoft.com/fwlink/p/?LinkId=617924).
+
+> **Note**<br>
+> For more info about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](https://go.microsoft.com/fwlink/p/?LinkId=617924).
 
 ## Group Policy settings
 Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations:
@@ -39,7 +41,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A
 |Configure Pop-up Blocker |Windows 10 or later |This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on.<p>If you enable this setting, Pop-up Blocker is turned on, stopping pop-up windows from appearing.<p>If you disable this setting, Pop-up Blocker is turned off, letting pop-ups windows appear.<p>If you don’t configure this setting, employees can choose whether to use Pop-up Blocker. |**Enabled or not configured (default):** Turns on Pop-up Blocker, stopping pop-up windows.<p>**Disabled:** Turns off Pop-up Blocker, allowing pop-up windows. |
 |Configure search suggestions in Address bar |Windows 10 or later |This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.<p>If you enable this setting, employees can see search suggestions in the Address bar of Microsoft Edge.<p>If you disable this setting, employees can't see search suggestions in the Address bar of Microsoft Edge.<p>If you don’t configure this setting, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge. |**Not configured (default):** Employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.<p>**Enabled:** Employees can see search suggestions in the Address bar of Microsoft Edge.<p>**Disabled:** Employees can’t see search suggestions in the Address bar of Microsoft Edge. |
 |Configure SmartScreen Filter |Windows 10 or later |This policy setting lets you configure whether to turn on SmartScreen Filter. SmartScreen Filter provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, SmartScreen Filter is turned on.<p>If you enable this setting, SmartScreen Filter is turned on and employees can’t turn it off.<p>If you disable this setting, SmartScreen Filter is turned off and employees can’t turn it on.<p>If you don’t configure this setting, employees can choose whether to use SmartScreen Filter. |**Not configured (default):** Employees can choose whether to use SmartScreen Filter.<p>**Enabled:** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.<p>**Disabled:** Turns off SmartScreen Filter. |
-|Configure the Enterprise Mode Site List |Windows 10 or later| This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.<p>If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode.<p>If you disable or don’t configure this setting, Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. |**Enabled:** Lets you use the Enterprise Mode Site List to address common compatibility problems with legacy apps, if it’s configured.<br>If you use this option, you must also add the location to your site list in the `{URI}` box. When configured, any site on the list will always open in Internet Explorer 11.<p>**Disabled or not configured (default):** You won't be able to use the Enterprise Mode Site List. |
+|Configure the Enterprise Mode Site List |Windows 10 or later| This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.<p>If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode.<p>If you disable or don’t configure this setting, Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps.<p>**Note**<br>If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.<p>If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.|**Enabled:** Lets you use the Enterprise Mode Site List to address common compatibility problems with legacy apps, if it’s configured.<p>If you use this option, you must also add the location to your site list in the `{URI}` box. When configured, any site on the list will always open in Internet Explorer 11.<p>**Disabled or not configured (default):** You won't be able to use the Enterprise Mode Site List.|
 |Prevent access to the about:flags page |Windows 10 Insider Preview |This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.<p>If you enable this policy setting, employees can’t access the about:flags page.<p>If you disable or don’t configure this setting, employees can access the about:flags page. |**Enabled:** Stops employees from using the about:flags page.<p>**Disabled or not configured (default):** Lets employees use the about:flags page. |
 |Prevent bypassing SmartScreen prompts for files |Windows 10, Version 1511 or later	|This policy setting lets you decide whether employees can override the SmartScreen Filter warnings about downloading unverified files.<p>If you enable this setting, employees can’t ignore SmartScreen Filter warnings and they’re blocked from downloading the unverified files.<p>If you disable or don’t configure this setting, employees can ignore SmartScreen Filter warnings and continue the download process. |**Enabled:** Stops employees from ignoring the SmartScreen Filter warnings about unverified files.<p>**Disabled or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about unverified files and lets them continue the download process. |
 |Prevent bypassing SmartScreen prompts for sites |Windows 10, Version 1511 or later |This policy setting lets you decide whether employees can override the SmartScreen Filter warnings about potentially malicious websites.<p>If you enable this setting, employees can’t ignore SmartScreen Filter warnings and they’re blocked from continuing to the site.<p>If you disable or don’t configure this setting, employees can ignore SmartScreen Filter warnings and continue to the site. |**Enabled:** Stops employees from ignoring the SmartScreen Filter warnings about potentially malicious sites.<p>**Disabled or not configured (default):** Lets employees ignore the SmartScreen Filter warnings about potentially malicious sites and continue to the site. |
@@ -50,7 +52,8 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A
 ##  Using Microsoft Intune to manage your Mobile Data Management (MDM) settings for Microsoft Edge
 If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=722885) page.
 
-<p>**Note**<br>The **Supports** column uses these options:
+> **Note**<br>
+> The **Supports** column uses these options:
 
 -   **Desktop.** Supports Windows 10 Pro and Windows 10 Enterprise computers that are enrolled with Intune only.
 
@@ -71,18 +74,18 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
 |AllowInPrivate |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowInPrivate</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0.** Employees can’t use InPrivate browsing.</li><li>**1 (default).** Employees can use InPrivate browsing.</li></ul></li></ul> |
 |AllowPasswordManager |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can't use Password Manager to save passwords locally.</li><li>**1.** Employees can use Password Manager to save passwords locally.</li></ul></li></ul> |
 |AllowPopups |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off Pop-up Blocker, allowing pop-up windows.</li><li>**1.** Turns on Pop-up Blocker, stopping pop-up windows.</li></ul></li></ul> |
-|AllowSearchSuggestionsinAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
+|AllowSearchSuggestions<br>inAddressBar |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge.</li><li>**1.** Employees can see search suggestions in the Address bar of Microsoft Edge.</li></ul></li></ul> |
 |AllowSmartScreen |Windows 10 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Turns off SmartScreen Filter.</li><li>**1.** Turns on SmartScreen Filter, providing warning messages to your employees about potential phishing scams and malicious software.</li></ul></li></ul> |
-|EnterpriseModeSiteList |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Not configured.</li><li>**1 (default).** Use the Enterprise Mode Site List, if configured.</li><li>**2.** Specify the location to the site list.</li></ul></li></ul> |
+|EnterpriseModeSiteList |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Not configured.</li><li>**1 (default).** Use the Enterprise Mode Site List, if configured.</li><li>**2.** Specify the location to the site list.</li></ul><p>**Note**<br>If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.<p>If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.</li></ul>|
 |Favorites |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/Favorites</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the **Favorite** URLs for your employees.<p>**Example:**<br>`<contoso.com>`<br>`<fabrikam.com>`<p>**Note**<br> URLs must be on separate lines and aren't shared between Microsoft Edge and Internet Explorer 11.</li></ul> |
 |FirstRunURL |Windows 10, Version 1511 or later |Mobile |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/FirstRunURL</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the first run URL for your employees.<p>**Example:**<br>`<contoso.one>`</li></ul></li></ul> |
 |HomePages |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/HomePages</li><li>**Data type.** String</li><li>**Allowed values:**<ul><li>Configure the Home page URLs for your employees.<p>**Example:**<br>`<contoso.com/support><fabrikam.com/support>`</li></ul></li></ul> |
-|PreventAccessToAboutFlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
+|PreventAccessToAbout<br>FlagsInMicrosoftEdge |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can access the about:flags page in Microsoft Edge.</li><li>**1.** Employees can't access the about:flags page in Microsoft Edge.</li></ul></li></ul> |
-|PreventSmartScreenPromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
+|PreventSmartScreen<br>PromptOverride |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings.</li><li>**1.** Employees can't ignore SmartScreen warnings.</li></ul></li></ul> |
-|PreventSmartScreenPromptOverrideForFiles |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
+|PreventSmartScreen<br>PromptOverrideFor<br>Files |Windows 10, Version 1511 or later |Both |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles </li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Employees can ignore SmartScreen warnings for files.</li><li>**1.** Employees can't ignore SmartScreen warnings for files.</li></ul></li></ul> |
-|PreventUsingLocalHostIPAddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
+|PreventUsingLocalHost<br>IPAddressForWebRTC |Windows 10, Version 1511 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.</li><li>**1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.</li></ul></li></ul> |
-|SendIntranetTraffictoInternetExplorer |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
+|SendIntranetTraffic<br>toInternetExplorer |Windows 10 or later |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Automatically opens all websites, including intranet sites, using Microsoft Edge.</li><li>**1.** Automatically opens all intranet sites using Internet Explorer 11.</li></ul></li></ul> |
-|ShowMessageWhenOpeningInteretExplorerSites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
+|ShowMessageWhen<br>OpeningInteretExplorer<br>Sites |Windows 10 Insider Preview |Desktop |<ul><li>**URI full path.** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInteretExplorer</li><li>**Data type.** Integer</li><li>**Allowed values:**<ul><li>**0 (default).** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li><li>**1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.</li></ul></li></ul> |
 
 ## Microsoft Edge and Windows 10-specific Group Policy settings
 These are additional Windows 10-specific Group Policy settings that work with Microsoft Edge.

browsers/edge/change-history-for-microsoft-edge.md

@@ -11,6 +11,15 @@ This topic lists new and updated topics in the Microsoft Edge documentation for
 
 For a detailed feature list of what's in the current Microsoft Edge releases, the Windows Insider Preview builds, and what was introduced in previous releases, see the [Microsoft Edge changelog](https://developer.microsoft.com/microsoft-edge/platform/changelog/).
 
+## November 2016
+|New or changed topic | Description |
+|----------------------|-------------|
+|[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added the infographic image and a download link.|
+|[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) |Added a note about the 65 second wait before checking for a newer version of the site list .XML file. |
+|[Available policies for Microsoft Edge](available-policies.md) |Added notes to the Configure the Enterprise Mode Site List Group Policy and the EnterpriseModeSiteList MDM policy about the 65 second wait before checking for a newer version of the site list .XML file. |
+|[Microsoft Edge - Deployment Guide for IT Pros](index.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. |
+|[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. |
+
 ## July 2016
 |New or changed topic | Description |
 |----------------------|-------------|

browsers/edge/emie-to-improve-compatibility.md

@@ -19,13 +19,15 @@ localizationpriority: high
 If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11.
 
 Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11.
-<p>**Note**<br>If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714).
+
+> **Note**<br>
+>If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714).
 
 ## Fix specific websites
 
 Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and need IE11, you can add them to the Enterprise Mode site list, using the Enterprise Mode Site List Manager.
 
-![](images/wedge.gif) **To add sites to your list**
+**To add sites to your list**
 
 1.  In the Enterprise Mode Site List Manager, click **Add**.<p>If you already have an existing site list, you can import it into the tool. After it's in the tool, the xml updates the list, checking **Open in IE** for each site. For info about importing the site list, see [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](https://go.microsoft.com/fwlink/p/?LinkId=618322).<p>![Enterprise Mode Site List Manager with Open in IE box](images/emie_open_in_ie.png)
 
@@ -43,7 +45,10 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip
 
 You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377).
 
-![](images/wedge.gif) **To turn on Enterprise Mode using Group Policy**
+> **Note**<br>
+> If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.<p>If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.
+
+**To turn on Enterprise Mode using Group Policy**
 
 1.  Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Allows you to configure the Enterprise Mode Site list** setting.<p>Turning this setting on also requires you to create and store a site list.<p>![Local Group Policy Editor for using a site list](images/edge-emie-grouppolicysitelist.png)
 
@@ -51,7 +56,7 @@ You must turn on the **Use Enterprise Mode Site List** Group Policy setting befo
 
 3.  Refresh your policy in your organization and then view the affected sites in Microsoft Edge.<p>The site shows a message in Microsoft Edge, saying that the page needs IE. At the same time, the page opens in IE11; in a new frame if it's not yet running, or in a new tab if it is.
 
-![](images/wedge.gif) **To turn on Enterprise Mode using the registry**
+**To turn on Enterprise Mode using the registry**
 
 1.  **To turn on Enterprise Mode for all users on the PC:** Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode`.
 
@@ -70,11 +75,15 @@ You must turn on the **Use Enterprise Mode Site List** Group Policy setting befo
 ## Fix your intranet sites
 
 You can add the **Send all intranet traffic over to Internet Explorer** Group Policy setting for Windows 10 so that all of your intranet sites open in IE11. This means that even if your employees are using Microsoft Edge, they will automatically switch to IE11 while viewing the intranet.
-<p>**Note**<br>If you want to use Group Policy to set IE as the default browser for Internet sites, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714).
 
-![](images/wedge.gif) **To turn on Sends all intranet traffic over to Internet Explorer using Group Policy**
+> **Note**<br>
+> If you want to use Group Policy to set IE as the default browser for Internet sites, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714).
 
-1.  Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Microsoft Edge\Sends all intranet traffic over to Internet Explorer` setting.<p>![Local Group Policy Editor with setting to send all intranet traffic to IE11](images/sendintranettoie.png)
+**To turn on Sends all intranet traffic over to Internet Explorer using Group Policy**
+
+1.  Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Microsoft Edge\Sends all intranet traffic over to Internet Explorer` setting.
+
+    ![Local Group Policy Editor with setting to send all intranet traffic to IE11](images/sendintranettoie.png)
 
 2.  Click **Enabled**.
 

browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md

@@ -25,6 +25,12 @@ Microsoft Edge is the default browser experience for Windows 10 and Windows 10 M
 
 We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10.
 
+If you're having trouble deciding whether Microsoft Edge is good for your organization, you can take a look at this infographic about the potential impact of using Microsoft Edge in an organization.
+
+![Microsoft Edge infographic](images/microsoft-edge-infographic-sm.png)<br>
+[Click to enlarge](img-microsoft-edge-infographic-lg.md)<br>
+[Click to download image](https://www.microsoft.com/en-us/download/details.aspx?id=53892)
+
 ### Microsoft Edge
 Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana.
 
@@ -44,6 +50,7 @@ IE11 offers enterprises additional security, manageability, performance, backwar
 -   **Administration.** IE11 can use the Internet Explorer Administration Kit (IEAK) 11 or MSIs for deployment, and includes more than 1,600 Group Policies and preferences for granular control.
 
 ## Related topics
+- [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892)
 - [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/en-us/browser/mt612809.aspx)
 - [Download Internet Explorer 11](http://windows.microsoft.com/en-US/internet-explorer/download-ie)
 - [Microsoft Edge - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/microsoft-edge/index)

browsers/edge/img-microsoft-edge-infographic-lg.md

@@ -0,0 +1,10 @@
+---
+description: A full-sized view of the Microsoft Edge infographic.
+title: Full-sized view of the Microsoft Edge infographic
+---
+
+Return to: [Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md)<br>
+Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892)
+
+![Full-sized Microsoft Edge infographic](images/img-microsoft-edge-infographic-lg.png)
+

browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md

@@ -11,6 +11,11 @@ ms.sitesec: library
 # Change history for Internet Explorer 11
 This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile.
 
+## November 2016
+|New or changed topic | Description |
+|----------------------|-------------|
+|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.|
+
 ## August 2016
 |New or changed topic | Description |
 |----------------------|-------------|

browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md

@@ -83,7 +83,8 @@ The codes in this table can tell you what document mode was set by IE for a webp
 |5 |Page is using an X-UA-compatible HTTP header. |
 |6 |Page appears on an active **Compatibility View** list. |
 |7 |Page is using native XML parsing. |
-|9 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. |
+|8 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. |
+|9 |Page state is set by the browser mode and the page's DOCTYPE.|
 
 #### Browser state reason
 The codes in this table can tell you why the browser is in its current state. Also called “browser mode”.<br>These codes only apply to Internet Explorer 10 and Internet Explorer 11.

browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md

@@ -20,8 +20,8 @@ Included examples:
 - [Example 4: Connect directly if the host is in specified subnet](#example-4-connect-directly-if-the-host-is-in-specified-subnet)
 - [Example 5: Determine the connection type based on the host domain](#example-5-determine-the-connection-type-based-on-the-host-domain)
 - [Example 6: Determine the connection type based on the protocol](#example-6-determine-the-connection-type-based-on-the-protocol)
-- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-IP-address)
+- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-ip-address)
-- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-IP-address-matches-the-specified-IP-address)
+- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-ip-address-matches-the-specified-ip-address)
 - [Example 9: Connect using a proxy server if there are periods in the host name](#example-9-connect-using-a-proxy-server-if-there-are-periods-in-the-host-name)
 - [Example 10: Connect using a proxy server based on specific days of the week](#example-10-connect-using-a-proxy-server-based-on-specific-days-of-the-week)
 

browsers/internet-explorer/index.md

@@ -6,6 +6,7 @@ ms.prod: IE11
 title: Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 assetid: be3dc32e-80d9-4d9f-a802-c7db6c50dbe0
 ms.sitesec: library
+localizationpriority: low
 ---
 
 

devices/hololens/TOC.md

@@ -1 +1,8 @@
-# [Placeholder](index.md)
+# [Microsoft HoloLens](index.md)
+## [HoloLens in the enterprise: requirements](hololens-requirements.md)
+## [Set up HoloLens](hololens-setup.md)
+## [Upgrade to Windows Holographic Enterprise](hololens-upgrade-enterprise.md) 
+## [Enroll HoloLens in MDM](hololens-enroll-mdm.md)
+## [Set up HoloLens in kiosk mode](hololens-kiosk.md)
+## [Configure HoloLens using a provisioning package](hololens-provisioning.md)
+## [Install apps on HoloLens](hololens-install-apps.md)

devices/hololens/hololens-checklist.md

@@ -1,30 +0,0 @@
----
-title: Checklist for HoloLens in the enterprise (HoloLens)
-description: tbd
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: hololens, devices
-ms.sitesec: library
-author: jdeckerMS
----
-
-# Checklist: HoloLens in the enterprise
-
-[Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers)
-
-
-Windows Store for Business 
-
-Requirements
-
-- IT Admins: Before you sign up for the Store for Business, at a minimum, you'll need an Azure Active Directory (AAD) account for your organization, and you'll need to be the global administrator for your organization. Once the Global Admin has signed in, they can give permissions to other employees.
-- End Users: Need Azure AD account when they access Store for Business content from Windows-based devices.
-
-[Getting started with Azure Active Directory Premium](https://azure.microsoft.com/en-us/documentation/articles/active-directory-get-started-premium/)
-
-[Get started with Intune](https://docs.microsoft.com/en-us/intune/understand-explore/get-started-with-a-30-day-trial-of-microsoft-intune)
-
-[Enroll devices for management in Intune](https://docs.microsoft.com/en-us/intune/deploy-use/enroll-devices-in-microsoft-intune#supported-device-platforms)
-
-[Azure AD editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)
-

devices/hololens/hololens-enroll-mdm.md

@@ -0,0 +1,38 @@
+---
+title: Enroll HoloLens in MDM (HoloLens)
+description: Enroll HoloLens in mobile device management (MDM) for easier management of multiple devices.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Enroll HoloLens in MDM
+
+You can manage multiple HoloLens devices simultaneously using solutions like Microsoft InTune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need.
+
+>[!NOTE]
+>Mobile device management (MDM) for Development Edition HoloLens does not include VPN, BitLocker, or kiosk mode. Those features are only available when you [upgrade to Windows Holographic Enterprise](hololens-upgrade-enterprise.md).
+
+
+## Requirements
+ Your organization will need to have mobile device management (MDM) set up in order to manage HoloLens devices. Your MDM provider can be Microsoft Intune or a 3rd party provider that uses Microsoft MDM APIs.
+
+## Auto-enrollment in MDM 
+
+If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and Airwatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) 
+
+When auto-enrollment is enabled, no additional manual enrollment is needed. When the user signs in with an Azure AD account, the device is enrolled in MDM after completing the first-run experience.
+
+## Enroll through Settings app
+
+ When the device is not enrolled in MDM during the first-run experience, the user can manually enroll the device with the organization's MDM server using the Settings app.
+ 
+1. Go to **Settings** > **Accounts** > **Work access**.
+
+2. Select **Enroll into device management** and enter your organizational account. You will be redirected to your organization's sign in page.
+
+4. Upon successful authentication to the MDM server, a success message is shown.
+
+Your device is now enrolled with your MDM server. The device will need to restart to acquire policies, certificates, and apps. The Settings app will now reflect that the device is enrolled in device management.

devices/hololens/hololens-install-apps.md

@@ -0,0 +1,86 @@
+---
+title: Install apps on HoloLens (HoloLens)
+description: The recommended way to install apps on HoloLens is to use Windows Store for Business.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Install apps on HoloLens
+
+The recommended way to install Universal Windows Platform (UWP) apps on HoloLens is to use Windows Store for Business. You can make your own [line-of-business application](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps) available through Windows Store for Business.
+
+You can also deploy apps using your mobile device management (MDM) provider or use the Windows Device Portal to install apps, if you enable **Developer Mode** on the HoloLens device.
+
+>[!IMPORTANT]
+    >When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device.** Developer Mode** on a device that has been upgraded to Windows Holographic Enterprise enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
+
+## Use Windows Store for Business to deploy apps to HoloLens
+
+Windows Store for Business is a private Windows Store for your enterprise. People in your organization can open the Store app and select your private Store to install apps that you have made available to them. 
+
+![How Windows Store for Business appears in Store app](images/wsfb-private.png)
+
+In your Windows Store for Business dashboard, you can also download apps to distribute to devices that aren't connected to the Internet, plus add line-of-business (LOB) apps for distribution. 
+
+### Requirements
+
+- You need to be a global administrator for your Azure Active Directory (Azure AD) tenant. 
+
+    >[!TIP]
+    >You can create an Azure AD account and tenant as part of the Store for Business sign-up process.
+     
+- End users need Azure AD accounts when they access Store for Business content from Windows-based devices.
+
+### Windows Store for Business process
+
+1. [Sign up for Windows Store for Business.](https://technet.microsoft.com/itpro/windows/manage/sign-up-windows-store-for-business)
+2. [Assign roles and permissions for managing your Store for Business.](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business)
+3. (Optional) [Configure Windows Store for Business to work with your MDM provider.](https://technet.microsoft.com/itpro/windows/manage/configure-mdm-provider-windows-store-for-business)
+3. [Get apps for your Store for Business.](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business)
+4. [Distribute apps to your employees.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-to-your-employees-windows-store-for-business)
+
+### Install apps on HoloLens from Windows Store for Business
+
+The method that you use to install an app from your Windows Store for Business on HoloLens depends on the the distribution method that you choose.
+
+| Distribution method | To install on HoloLens|
+| --- | --- |
+| Using private store | Open the Store app and select the tab for your organization to choose from available apps.  |
+| Using MDM | [You can configure MDM to synchronize your Store for Business inventory.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool)  |
+
+
+
+## Use MDM to deploy apps to HoloLens
+
+You can deploy UWP apps to HoloLens using your MDM provider. For Intune instructions, see [Deploy apps in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/add-apps).
+
+Using Intune, you can also [monitor your app deployment](https://docs.microsoft.com/intune/deploy-use/monitor-apps-in-microsoft-intune).
+
+
+## Use the Windows Device Portal to install apps on HoloLens.
+
+1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/holographic/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. 
+
+2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_usb).
+
+3. [Create a user name and password](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up.
+
+    >[!TIP]
+    >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#security_certificate). 
+
+4. In the Windows Device Portal, click **Apps**.
+
+    ![App Manager](images/apps.png)
+    
+5. In **Install app**, select an **app package** from a folder on your computer or network. If the app package requires additional software, click **Add dependency**.
+
+6. In **Deploy**, click **Go** to deploy the app package and added dependencies to the connected HoloLens.
+
+
+
+
+
+

devices/hololens/hololens-kiosk.md

@@ -0,0 +1,37 @@
+---
+title: Set up HoloLens in kiosk mode (HoloLens)
+description: Kiosk mode limits the user's ability to launch new apps or change the running app. 
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Set up HoloLens in kiosk mode
+
+
+
+Kiosk mode limits the user's ability to launch new apps or change the running app. When kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings.
+
+1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/holographic/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. 
+
+    >[!IMPORTANT]
+    >When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic Enterprise enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
+    
+2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_usb).
+
+3. [Create a user name and password](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up.
+
+    >[!TIP]
+    >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#security_certificate). 
+
+4. In the Windows Device Portal, click **Kiosk Mode**.
+
+    ![Kiosk Mode](images/kiosk.png)
+
+    >[!NOTE]
+    >The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has an [Enterprise license](hololens-upgrade-enterprise.md).
+
+5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**.
+

devices/hololens/hololens-provisioning.md

@@ -0,0 +1,120 @@
+---
+title: Configure HoloLens using a provisioning package (HoloLens)
+description: Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Configure HoloLens using a provisioning package
+
+Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. The Windows Assessment and Deployment Kit (ADK) for Windows 10 includes the Imaging and Configuration Designer (ICD), a tool for configuring images and runtime settings which are then built into provisioning packages. 
+
+Some of the HoloLens configurations that you can apply in a provisioning package: 
+- Upgrade to Windows Holographic Enterprise
+- Set up a local account
+- Set up a Wi-Fi connection
+- Apply certificatess to the device
+
+To install Windows ICD and create provisioning packages, you must [install the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).
+
+When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration Designer** from the **Select the features you want to install** dialog box.
+
+![Choose Configuration Designer](images/adk-install.png)
+
+> [!NOTE]
+> In previous versions of the Windows 10 ADK, you had to install additional features for Windows ICD to run. Starting in version 1607, you can install Windows ICD without other ADK features.
+
+
+## Create a provisioning package for HoloLens
+
+>[!NOTE]
+>Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic Enterprise or if [the device has already been upgraded to Windows Holographic Enterprise](hololens-upgrade-enterprise.md).
+
+1. On the Windows ICD start page, select **Advanced provisioning**.
+
+2. In the **Enter project details** window, specify a name for your project and the location for your project. Optionally, enter a brief description to describe your project.
+
+3. Click **Next**.
+
+4. In the **Choose which settings to view and configure** window, select **Windows 10 Holographic**, and then click **Next**.
+
+6. Click **Finish**.
+
+7. Expand **Runtime settings** and customize the package with any of the settings [described below](#what-you-can-configure).
+
+    >[!IMPORTANT]
+    >If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/holographic/reset_or_recover_your_hololens#perform_a_full_device_recovery).
+
+8. On the **File** menu, click **Save**. 
+
+4. Read the warning that project files may contain sensitive information, and click **OK**.
+
+    >[!IMPORTANT]
+    >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+    
+3. On the **Export** menu, click **Provisioning package**.
+
+4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**.
+
+5. Set a value for **Package Version**.
+
+    >[!TIP]
+    >You can make changes to existing packages and change the version number to update previously applied packages.
+
+6. On the **Select security details for the provisioning package**, click **Next**.
+
+7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
+
+    Optionally, you can click Browse to change the default output location.
+
+8. Click **Next**.
+
+9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
+
+10. When the build completes, click **Finish**. 
+
+
+## Apply a provisioning package to HoloLens
+
+1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of OOBE (the first page with the blue box).
+
+2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously.
+
+3. HoloLens will show up as a device in File Explorer on the PC.
+
+4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
+
+5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
+
+6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
+
+7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.
+
+>[!NOTE]
+>If the device was purchased before August 2016, you will need to sign into the device with aa Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
+
+## What you can configure
+
+Provisioning packages make use of configuration service providers (CSPs). If you're not familiar with CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers).
+
+In Windows ICD, when you create a provisioning package for Windows Holographic, the settings in **Available customizations** are based on [CSPs that are supported in Windows Holographic](https://msdn.microsoft.co/library/windows/hardware/dn920025.aspx#HoloLens). The following table describes settings that you might want to configure for HoloLens.
+
+![Common runtime settings for HoloLens](images/icd-settings.png)
+
+| Setting | Description |
+| --- | --- |
+| **Accounts**  | Create a local account. HoloLens currently supports a single user only. Creating multiple local accounts in a provisioning package is not supported. <br><br>**IMPORTANT**<br>If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/holographic/reset_or_recover_your_hololens#perform_a_full_device_recovery). |
+| **Certificates** | Deploy a certificate to HoloLens.  |
+| **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens.   |
+| **EditionUpgrade** | [Upgrade to Windows Holographic Enterprise.](hololens-upgrade-enterprise.md)  |
+| **Policies** | Allow or prevent developer mode on HoloLens.  |
+
+>[!NOTE]
+>App installation (**UniversalAppInstall**) using a provisioning package is not currently supported for HoloLens.
+
+
+
+

devices/hololens/hololens-requirements.md

@@ -0,0 +1,54 @@
+---
+title: HoloLens in the enterprise requirements (HoloLens)
+description: Requirements for general use, Wi-Fi, and device management for HoloLens in the enterprise.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Microsoft HoloLens in the enterprise: requirements
+
+When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/holographic/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below.
+
+## General use
+- Microsoft account or Azure Active Directory (Azure AD) account
+- Wi-Fi network to set up HoloLens
+
+>[!NOTE]
+>After you set up HoloLens, you can use it offline [with some limitations](https://support.microsoft.com/help/12645/hololens-use-hololens-offline).
+
+
+## Supported wireless network EAP methods 
+- PEAP-MS-CHAPv2
+- PEAP-TLS
+- TLS 
+- TTLS-CHAP
+- TTLS-CHAPv2
+- TTLS-MS-CHAPv2
+- TTLS-PAP
+- TTLS-TLS
+
+## Device management 
+   - Users have Azure AD accounts with [Intune license assigned](https://docs.microsoft.com/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune-step-4)
+   - Wi-Fi network
+   - Intune or a 3rd party mobile device management (MDM) provider that uses Microsoft MDM APIs
+   
+## Upgrade to Windows Holographic Enterprise 
+- HoloLens Enterprise license XML file
+
+
+
+
+
+## Related resources
+
+[Getting started with Azure Active Directory Premium](https://azure.microsoft.com/en-us/documentation/articles/active-directory-get-started-premium/)
+
+[Get started with Intune](https://docs.microsoft.com/en-us/intune/understand-explore/get-started-with-a-30-day-trial-of-microsoft-intune)
+
+[Enroll devices for management in Intune](https://docs.microsoft.com/en-us/intune/deploy-use/enroll-devices-in-microsoft-intune#supported-device-platforms)
+
+[Azure AD editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)
+

devices/hololens/hololens-setup.md

@@ -0,0 +1,43 @@
+---
+title: Set up HoloLens (HoloLens)
+description: The first time you set up HoloLens, you'll need a Wi-Fi network and either a Microsoft or Azure Active Directory account.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Set up HoloLens
+
+Before you get started setting up your HoloLens, make sure you have a Wi-Fi network and a Microsoft account or an Azure Active Directory (Azure AD) account. 
+
+## Network connectivity requirements
+
+The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. You need to connect HoloLens to a Wi-Fi network with Internet connectivity so that the user account can be authenticated.
+
+- It can be an open Wi-Fi or password-protected Wi-Fi network.
+- The Wi-Fi network cannot require you to navigate to a webpage to connect.
+- The Wi-Fi network cannot require certificates to connect.
+- The Wi-Fi network does not need to provide access to enterprise resources or intranet sites. 
+
+## HoloLens setup
+
+The HoloLens setup process combines a quick tutorial on using HoloLens with the steps needed to connect to the network and add an account.
+
+1. Be sure your HoloLens is [charged](https://support.microsoft.com/help/12627), then [adjust it](https://support.microsoft.com/help/12632) for a comfortable fit.
+2. [Turn on HoloLens](https://support.microsoft.com/help/12642). You will be guided through a calibration procedure and how to perform [the gestures](https://support.microsoft.com/help/12644/hololens-use-gestures) that you will use to operate HoloLens.
+3. Next, you'll be guided through connecting to a Wi-Fi network. 
+4. After HoloLens connects to the Wi-Fi network, you select between **My work or school owns it** and **I own it**. 
+    - When you choose **My work or school owns it**, you sign in with an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens will be enrolled in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app).
+        1. Enter your organizational account. 
+        2. Accept privacy statement.
+        3. Sign in using your Azure AD credentials. This may redirect to your organization's sign-in page.
+        4. Continue with device setup.
+    - When you choose **I own it**, you sign in with a Microsoft account. After setup is complete, you can [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app).
+        1. Enter your Microsoft account. 
+        2. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process. 
+5. The device sets your time zone based on information obtained from the Wi-Fi network. 
+6. Next, you learn how to perform the bloom gesture and how to select and place the Start screen. After you place the Start screen, setup is complete and you can begin using HoloLens.
+
+

devices/hololens/hololens-upgrade-enterprise.md

@@ -0,0 +1,136 @@
+---
+title: Upgrade to Windows Holographic Enterprise (HoloLens)
+description: HoloLens provides extra features designed for business when you upgrade to Windows Holographic Enterprise.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Upgrade to Windows Holographic Enterprise
+
+Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://developer.microsoft.com/windows/holographic/release_notes#introducing_microsoft_hololens_commercial_suite), which provides extra features designed for business. 
+
+When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic Enterprise. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package).
+
+>[!TIP]
+>You can tell that the HoloLens has been upgraded to the Enterprise edition in **Settings** > **Network & Internet**. The **VPN** option is only available in Windows Holographic Enterprise.
+
+
+
+## Edition upgrade using MDM 
+
+The enterprise license can be applied by any MDM provider that supports the [WindowsLicensing configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904983.aspx). The latest version of the Microsoft MDM API will support WindowsLicensing CSP.
+
+
+**Overview**
+
+1.	Set up the edition upgrade policy.
+2.	Deploy the policy.
+3.	[Enroll the device through the Settings app](hololens-enroll-mdm.md).
+
+The procedures in this topic use Microsoft Intune as an example. On other MDM providers, the specific steps for setting up and deploying the policy might vary.
+
+### Set up the Edition Upgrade policy
+
+1.	Sign into the Intune Dashboard with your Intune admin account.
+
+2.	In the **Policy** workspace, select **Configuration Policies** and then **Add**.
+
+    ![Click Add](images/intune1.png)
+
+3.	In **Create a new policy**, select the **Edition Upgrade Policy (Windows 10 Holographic and later** template, and click **Create Policy**.
+
+    ![Select template](images/intune2.png)
+
+4.	Enter a name for the policy. 
+
+5. In the **Edition Upgrade** section, in **License File**, browse to and select the XML license file that was provided when you purchased the Commercial Suite.
+
+    ![Enter the XML file name](images/intune3.png)
+ 
+5.	Click **Save Policy**.
+
+
+
+### Deploy the Edition Upgrade policy
+
+Next, you will assign the Edition Upgrade policy to selected groups.
+
+1. In the **Policy** workspace, select the Edition upgrade policy that you created, and then choose **Manage Deployment**.
+
+2. In the **Manage Deployment** dialog box, select one or more groups to which you want to deploy the policy, and then choose **Add** > **OK**.
+
+When these users enroll their devices in MDM, the Edition Upgrade policy will be applied. 
+
+
+For more information about groups, see [Use groups to manage users and devices in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/use-groups-to-manage-users-and-devices-with-microsoft-intune).
+
+## Edition upgrade using a provisioning package
+
+Provisioning packages are files created by the Windows Imaging and Configuration Designer (ICD) tool that apply a specified configuration to a device. 
+
+### Create a provisioning package that upgrades the Windows Holographic edition
+
+1.	[Create a provisioning package for HoloLens.](hololens-provisioning.md#create-a-provisioning-package-for-hololens)
+
+2.  Go to **Runtime settings** > **EditionUpgrade**, and select **EditionUpgradeWithLicense**.
+
+    ![Upgrade edition with license setting selected](images/icd1.png)
+
+2.	Browse to and select the XML license file that was provided when you purchased the Commercial Suite.
+
+    >[!NOTE]
+    >You can configure [additional settings in the provisioning package](hololens-provisioning.md).
+
+3. On the **File** menu, click **Save**. 
+
+4. Read the warning that project files may contain sensitive information, and click **OK**.
+
+    >[!IMPORTANT]
+    >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+    
+3. On the **Export** menu, click **Provisioning package**.
+
+4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**.
+
+5. Set a value for **Package Version**.
+
+    >[!TIP]
+    >You can make changes to existing packages and change the version number to update previously applied packages.
+
+6. On the **Select security details for the provisioning package**, click **Next**.
+
+7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
+
+    Optionally, you can click Browse to change the default output location.
+
+8. Click **Next**.
+
+9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
+
+10. When the build completes, click **Finish**. 
+
+
+### Apply the provisioning package to HoloLens
+
+1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of OOBE (the first page with the blue box).
+
+2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously.
+
+3. HoloLens will show up as a device in File Explorer on the PC.
+
+4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
+
+5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
+
+6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
+
+7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.
+
+>[!NOTE]
+>If the device was purchased before August 2016, you will need to sign into the device with aa Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. 
+
+
+

devices/hololens/index.md

@@ -1,3 +1,39 @@
 ---
-redirect_url: https://developer.microsoft.com/windows/holographic/commercial_features
+title: Microsoft HoloLens (HoloLens)
+description: HoloLens provides extra features designed for business in the Commercial Suite.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: hololens, devices
+ms.sitesec: library
+author: jdeckerMS
 ---
+
+# Microsoft HoloLens
+
+
+<table><tbody>
+<tr><td style="border: 0px;width: 75%;valign= top"><p>Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.</p><p> Microsoft HoloLens is available in the **Development Edition**, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the **Commercial Suite**, which runs Windows Holographic Enterprise when you apply the Enterprise license file to the device.</p></td><td align="left" style="border: 0px">![Hololens](images/hololens.png)</td></tr>
+</tbody></table>
+
+## In this section
+
+| Topic | Description |
+| --- | --- |
+| [HoloLens in the enterprise: requirements](hololens-requirements.md) | Lists requirements for general use, Wi-Fi, and device management |
+| [Set up HoloLens](hololens-setup.md) | How to set up HoloLens for the first time  |
+| [Upgrade to Windows Holographic Enterprise](hololens-upgrade-enterprise.md) | How to upgrade your Development Edition HoloLens to Windows Holographic Enterprise|
+| [Enroll HoloLens in MDM](hololens-enroll-mdm.md) | Manage multiple HoloLens devices simultaneously using solutions like Microsoft InTune |
+| [Set up HoloLens in kiosk mode](hololens-kiosk.md) | Enable kiosk mode for HoloLens, which limits the user's ability to launch new apps or change the running app  |
+| [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging |
+| [Install apps on HoloLens](hololens-install-apps.md) | Use Windows Store for Business, mobile device management (MDM), or the Windows Device Portal to install apps on HoloLens|
+</br>
+
+## Related resources
+
+- [Help for using HoloLens](https://support.microsoft.com/products/hololens)
+
+- [Documentation for Holographic app development](https://developer.microsoft.com/windows/holographic/documentation)
+
+- [HoloLens Commercial Suite](https://www.microsoft.com/microsoft-hololens/hololens-commercial)
+
+- [HoloLens release notes](https://developer.microsoft.com/en-us/windows/holographic/release_notes)

devices/surface-hub/TOC.md

@@ -35,4 +35,5 @@
 #### [Using a room control system](use-room-control-system-with-surface-hub.md)
 ### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)
 ### [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)
-### [Change history for Surface Hub](change-history-surface-hub.md)
+## [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md)
+## [Change history for Surface Hub](change-history-surface-hub.md)

devices/surface-hub/change-history-surface-hub.md

@@ -14,6 +14,12 @@ localizationpriority: medium
 
 This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
 
+## November 2016
+
+| New or changed topic | Description |
+| --- | --- |
+| [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | New |
+
 ## RELEASE: Windows Anniversary Update for Surface Hub (Windows 10, version 1607)
 The topics in this library have been updated for Windows 10, version 1607 (also known as Windows Anniversary Update for Surface Hub). These topics had significant updates for this release:
 - [Windows Updates (Surface Hub)](manage-windows-updates-for-surface-hub.md)

devices/surface-hub/connect-and-display-with-surface-hub.md

@@ -233,7 +233,7 @@ Surface Hub is compatible with a range of hardware. Choose the processor and mem
 
 ### Graphics adapter
 
-In replacement PC mode, Surface Hub supports any graphics adapter that can produce a DisplayPort signal. You'll improve your experience with a graphics adapter that can match Surface Hub's resolution and refresh rate. For example, though the best and recommended replacement PC experience on the Surface Hub is with a 120Hz video signal, 60Hz video signals are also supported.
+In replacement PC mode, Surface Hub supports any graphics adapter that can produce a DisplayPort signal. You'll improve your experience with a graphics adapter that can match Surface Hub's resolution and refresh rate. For example, the best and recommended replacement PC experience on the Surface Hub is with a 120Hz video signal.
 
 **55" Surface Hubs** - For best experience, use a graphics card capable of 1080p resolution at 120Hz.
 
@@ -295,7 +295,7 @@ Replacement PC ports on 55" Surface Hub.
 <tr class="odd">
 <td><p>PC video</p></td>
 <td><p>Video input</p></td>
-<td><p>DisplayPort 1.2</p></td>
+<td><p>DP 1.2</p></td>
 <td><ul>
 <li><p>Full screen display of 1080p at 120 Hz, plus audio</p></li>
 <li><p>HDCP compliant</p></li>
@@ -352,7 +352,7 @@ Replacement PC ports on 84" Surface Hub.
 <tr class="odd">
 <td><p>PC video</p></td>
 <td><p>Video input</p></td>
-<td><p>DisplayPort 1.2 (2x)</p></td>
+<td><p>DP 1.2 (2x)</p></td>
 <td><ul>
 <li><p>Full screen display of 2160p at 120 Hz, plus audio</p></li>
 <li><p>HDCP compliant</p></li>

devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md

@@ -0,0 +1,169 @@
+---
+title: Differences between Surface Hub and Windows 10 Enterprise
+description: This topic explains the differences between Windows 10 Team and Windows 10 Enterprise.
+keywords: change history
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: surfacehub
+author: isaiahng
+localizationpriority: medium
+---
+
+# Differences between Surface Hub and Windows 10 Enterprise
+
+The Surface Hub operating system, Windows 10 Team, is based on Windows 10 Enterprise, providing rich support for enterprise management, security, and other features. However, there are important differences between them. While the Enterprise edition is designed for PCs, Windows 10 Team is designed from the ground up for large screens and meeting rooms. When you evaluate security and management requirements for Surface Hub, it's best to consider it as a new operating system. This article is designed to help highlight the key differences between Windows 10 Team on Surface Hub and Windows 10 Enterprise, and what the differences mean for your organization.
+
+## User interface
+
+### Shell (OS user interface)
+
+The Surface Hub's shell is designed from the ground up to be large screen and touch optimized. It doesn't use the same shell as Windows 10 Enterprise.
+
+*Organization policies that this may affect:* <br> Settings related to controls in the Windows 10 Enterprise shell don't apply for Surface Hub.
+
+### Lock screen and screensaver
+
+Surface Hub doesn't have a lock screen or a screen saver, but it has a similar feature called the welcome screen. The welcome screen shows scheduled meetings from the device account's calendar, and easy entry points to the Surface Hub's top apps - Skype for Business, Whiteboard, and Connect.
+
+*Organization policies that this may affect:* <br> Settings for lock screen, screen timeout, and screen saver don't apply for Surface Hub.
+
+### User logon
+
+Surface Hub is designed to be used in communal spaces, such as meeting rooms. Unlike Windows PCs, anyone can walk up and use a Surface Hub without logging on. The system always runs as a local, auto logged-in, low-privilege user. It doesn't support logging in any additional users - including admin users.
+
+> [!NOTE]
+> Surface Hub supports signing in to Microsoft Edge and other apps. However, these credentials are deleted when users press **I'm done**. 
+
+*Organization policies that this may affect:* <br> Generally, Surface Hub uses lockdown features rather than user access control to enforce security. Policies related to password requirements, interactive logon, user accounts, and access control don't apply for Surface Hub.
+
+### Saving and browsing files
+
+Users have access to a limited set of directories on the Surface Hub:
+- Music
+- Videos
+- Documents
+- Pictures
+- Downloads
+
+Files saved locally in these directories are deleted when users press **I'm done**. To save content created during a meeting, users should save files to a USB drive or to OneDrive.
+
+*Organization policies that this may affect:* <br> Policies related to access permissions and ownership of files and folders don't apply for Surface Hub. Users can't browse and save files to system directories and network folders.
+
+## Applications
+
+### Default applications
+
+With few exceptions, the default Universal Windows Platform (UWP) apps on Surface Hub are also available on Windows 10 PCs.
+
+UWP apps pre-installed on Surface Hub:
+- Alarms & Clock
+- Calculator
+- Connect
+- Excel Mobile
+- Feedback Hub
+- File Explorer*
+- Get Started
+- Maps
+- Microsoft Edge
+- Microsoft Power BI
+- OneDrive
+- Photos
+- PowerPoint Mobile
+- Settings*
+- Skype for Business*
+- Store
+- Whiteboard*
+- Word Mobile
+
+*Apps with an asterisk (&ast;) are unique to Surface Hub*
+
+*Organization policies that this may affect:* <br> Use guidelines for Windows 10 Enterprise to determine the features and network requirements for default apps on the Surface Hub.
+
+### Installing apps, drivers, and services
+
+To help preserve the appliance-like nature of the device, Surface Hub only supports installing Universal Windows Platform (UWP) apps, and does not support installing classic Win32 apps, services and drivers. Furthermore, only admins have access to install UWP apps.
+
+*Organization policies that this may affect:* <br> Employees can only use the apps that have been installed by admins, helping mitigate against unintended use. Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools.
+
+## Security and lockdown
+
+For Surface Hub to be used in communal spaces, such as meeting rooms, its custom OS implements many of the security and lockdown features available in Windows 10.
+
+Surface Hub implements these Windows 10 security features:
+- [UEFI Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview)
+- [User Mode Code Integrity (UMCI) with Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies)
+- [Application restriction policies using AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview)
+- [BitLocker Drive Encryption](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview)
+- [Trusted Platform Module (TPM)](https://technet.microsoft.com/itpro/windows/keep-secure/trusted-platform-module-overview)
+- [Windows Defender](https://technet.microsoft.com/itpro/windows/keep-secure/windows-defender-in-windows-10)
+- [User Account Control (UAC)](https://technet.microsoft.com/itpro/windows/keep-secure/user-account-control-overview) for access to the Settings app
+
+These Surface Hub features provide additional security:
+- Custom UEFI firmware
+- Custom shell and Start menu limits device to meeting functions
+- Custom File Explorer only grants access to files and folders under My Documents
+- Custom Settings app only allows admins to modify device settings
+- Downloading advanced Plug and Play drivers is disabled
+
+*Organization policies that this may affect:* <br> Consider these features when performing your security assessment for Surface Hub.
+
+## Management
+
+### Device settings
+
+Device settings can be configured through the Settings app. The Settings app is customized for Surface Hub, but also contains many familiar settings from Windows 10 Desktop. A User Accounts Control (UAC) prompt appears when opening up the Settings app to verify the admin's credentials, but this does not log in the admin.
+
+*Organization policies that this may affect:* <br> Employees can use the Surface Hub for meetings, but cannot modify any device settings. In addition to lockdown features, this ensures that employees only use the device for meeting functions.
+
+### Administrative features
+
+The administrative features in Windows 10 Enterprise, such as the Microsoft Management Console, Run, Command Prompt, PowerShell, registry editor, event viewer, and task manager are not supported on Surface Hub. The Settings app contains all of the administrative features locally available on Surface Hub.
+
+*Organization policies that this may affect:* <br> Surface Hubs are not managed like traditional PCs. Use MDM to configure settings and OMS to monitor your Surface Hub.
+
+### Remote management and monitoring
+
+Surface Hub supports remote management through mobile device management (MDM), and monitoring through Operations Management Suite (OMS).
+
+*Organization policies that this may affect:* <br> Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools, such as System Center Operations Manager.
+
+### Group policy
+
+Surface Hub does not support group policy, including auditing. Instead, use MDM to apply policies to your Surface Hub. For more information about MDM, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md).
+
+*Organization policies that this may affect:* <br> Use MDM to manage Surface Hub rather than group policy.
+
+### Remote assistance
+
+Surface Hub does not support remote assistance.
+
+*Organization policies that this may affect:* <br> Policies related to remote assistance don't apply for Surface Hub.
+
+## Network
+
+### Domain join and Azure Active Directory (Azure AD) join 
+
+Surface Hub uses domain join and Azure AD join primarily to provide a directory-backed admin group. Users can't log in with a domain account. For more information, see [Admin group management](admin-group-management-for-surface-hub.md).
+
+*Organization policies that this may affect:* <br> Group policies are not applied when a Surface Hub is joined to your domain. Policies related to domain membership don't apply for Surface Hub.
+
+### Accessing domain resources
+
+Users can sign in to Microsoft Edge to access intranet sites and online resources (such as Office 365). If your Surface Hub is configured with a device account, the system uses it to access Exchange and Skype for Business. However, Surface Hub doesn't support accessing domain resources such as file shares and printers.
+
+*Organization policies that this may affect:* <br> Policies related to accessing domain objects don't apply for Surface Hub.
+
+<!--
+### Endpoints
+
+
+
+*Organization policies that this may affect:* <br> 
+-->
+
+### Telemetry
+
+The Surface Hub OS uses the Windows 10 Connected User Experience and Telemetry component to gather and transmit telemetry data. For more information, see [Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization).
+
+*Organization policies that this may affect:* <br> Configure telemetry levels for Surface Hub in the same way as you do for Windows 10 Enterprise.

devices/surface-hub/first-run-program-surface-hub.md

@@ -425,7 +425,7 @@ This page will attempt to create a new admin account using the credentials that
 
 In order to get the latest features and fixes, you should update your Surface Hub as soon as you finish all of the preceding first-run steps.
 
-1.  Make sure the device has access to the Windows Update servers or to Windows Server Update Services (WSUS). To configure WSUS, see [Using WSUS](manage-windows-updates-for-surface-hub.md#using-wsus).
+1.  Make sure the device has access to the Windows Update servers or to Windows Server Update Services (WSUS). To configure WSUS, see [Using WSUS](manage-windows-updates-for-surface-hub.md#use-windows-server-update-services).
 2.  Open Settings, click **Update & security**, then **Windows Update**, and then click **Check for updates**.
 3.  If updates are available, they will be downloaded. Once downloading is complete, click the **Update now** button to install the updates.
 4.  Follow the onscreen prompts after the updates are installed. You may need to restart the device.

devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md

@@ -12,7 +12,7 @@ localizationpriority: medium
 ---
 
 # Hybrid deployment (Surface Hub)
-A hybrid deployment requires special processing in order to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-prem](#hybrid-exchange-on-prem), and [Exchange hosted online](#hybrid-exchange-online). Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
+A hybrid deployment requires special processing in order to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-prem](#exchange-on-prem), and [Exchange hosted online](#exchange-online). Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
 
 ## Exchange on-prem
 Use this procedure if you use Exchange on-prem.

devices/surface-hub/index.md

@@ -34,5 +34,7 @@ Documents related to the Microsoft Surface Hub.
 <td align="left"><p>[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)</p></td>
 <td align="left"><p>This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers.</p></td>
 </tr>
+<tr><td>[Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md)</td><td>This topic explains the differences between the operating system on Surface Hub and Windows 10 Enterprise.</td></tr><tr>
+<td>[Change history for Surface Hub](change-history-surface-hub.md)</td><td>This topic lists new and updated topis in the Surface Hub documentation.</td></tr>
 </tbody>
 </table>

devices/surface-hub/manage-windows-updates-for-surface-hub.md

@@ -92,9 +92,9 @@ Once you've determined deployment rings for your Surface Hubs, configure update
 > If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates).
 
 
-## Use Windows Server Update Services (WSUS)
+## Use Windows Server Update Services
 
-You can connect Surface Hub to your WSUS server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them.
+You can connect Surface Hub to your indows Server Update Services (WSUS) server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them.
 
 **To manually connect a Surface Hub to a WSUS server:**
 1. Open **Settings** on your Surface Hub.

devices/surface-hub/online-deployment-surface-hub-device-accounts.md

@@ -57,17 +57,17 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
     Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
 
     ```PowerShell
-    Set-Mailbox $acctUpn -Type Regular
+    Set-Mailbox 'HUB01@contoso.com' -Type Regular
-    Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy.Id
+    Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id
-    Set-Mailbox $acctUpn -Type Room
+    Set-Mailbox 'HUB01@contoso.com' -Type Room
-    Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
+    Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword (ConvertTo-SecureString -String <password> -AsPlainText -Force) -EnableRoomMailboxAccount $true
     ```
 
 4.  Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
 
     ```PowerShell
-    Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
-    Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
+    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
     ```
 
 5.  Connect to Azure AD.
@@ -81,7 +81,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
 6.  If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
 
     ```PowerShell
-    Set-MsolUser -UserPrincipalName $acctUpn -PasswordNeverExpires $true
+    Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -PasswordNeverExpires $true
     ```
 
 7.  The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
@@ -91,9 +91,9 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
     Once you list out the SKUs, you can add a license using the `Set-MsolUserLicense` cmdlet. In this case, `$strLicense` is the SKU code that you see (for example, *contoso:STANDARDPACK*).
 
     ```PowerShell
-    Set-MsolUser -UserPrincipalName $acctUpn -UsageLocation "US"
+    Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -UsageLocation "US"
     Get-MsolAccountSku
-    Set-MsolUserLicense -UserPrincipalName $acctUpn -AddLicenses $strLicense
+    Set-MsolUserLicense -UserPrincipalName 'HUB01@contoso.com' -AddLicenses $strLicense
     ```
 
 8.  Enable the device account with Skype for Business.
@@ -118,14 +118,14 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow
     -   To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
 
         ```PowerShell
-        Enable-CsMeetingRoom -Identity $rm -RegistrarPool  
+        Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool  
         "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
         ```
 
         If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
 
         ```PowerShell
-        Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool*
+        Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool*
         ```
 
 9.  Assign Skype for Business license to your Surface Hub account.

devices/surface-hub/surface-hub-administrators-guide.md

@@ -16,7 +16,7 @@ localizationpriority: medium
 
 This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers.
 
-Before you power on Microsoft Surface Hub for the first time, make sure you've [completed the checklist](prepare-your-environment-for-surface-hub.md#prepare-checklist) at the end of the [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) section, and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct.
+Before you power on Microsoft Surface Hub for the first time, make sure you've [completed preparation items](prepare-your-environment-for-surface-hub.md), and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct.
 
 ## In this section
 

devices/surface/deploy-surface-app-with-windows-store-for-business.md

@@ -91,7 +91,7 @@ To download the required frameworks for the Surface app, follow these steps:
 
 ##Install Surface app on your computer with PowerShell
 The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards.
-1.	Using the procedure described in the [How to download Surface app from a Windows Store for Business account](#how-to-download-surface-app-from-a-windows-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. 
+1.	Using the procedure described in the [How to download Surface app from a Windows Store for Business account](#download-surface-app-from-a-windows-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. 
 2.	Begin an elevated PowerShell session.
 >**Note:**  If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app.
 3.	In the elevated PowerShell session, copy and paste the following command:
@@ -119,7 +119,7 @@ Before the Surface app is functional on the computer where it has been provision
 
 ##Install Surface app with MDT
 The following procedure uses MDT to automate installation of the Surface app at the time of deployment. The application is provisioned automatically by MDT during deployment and thus you can use this process with existing images. This is the recommended process to deploy the Surface app as part of a Windows deployment to Surface devices because it does not reduce the cross platform compatibility of the Windows image.
-1.	Using the procedure described [earlier in this article](#how-to-download-surface-app-from-a-windows-store-for-business-account), download the Surface app AppxBundle and license file. 
+1.	Using the procedure described [earlier in this article](#download-surface-app-from-a-windows-store-for-business-account), download the Surface app AppxBundle and license file. 
 2.	Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
 3.	On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows:
 

education/windows/TOC.md

@@ -5,6 +5,7 @@
 ### [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md)
 ### [Set up student PCs to join domain](set-up-students-pcs-to-join-domain.md)
 ### [Provision student PCs with apps](set-up-students-pcs-with-apps.md)
+## [Working with Windows Store for Business – education scenarios](education-scenarios-store-for-business.md)
 ## [Get Minecraft Education Edition](get-minecraft-for-education.md)
 ### [For teachers: get Minecraft Education Edition](teacher-get-minecraft.md)
 ### [For IT administrators: get Minecraft Education Edition](school-get-minecraft.md)

education/windows/change-history-edu.md

@@ -12,6 +12,14 @@ author: jdeckerMS
 
 This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation.
 
+## November 2016
+
+| New or changed topic | Description|
+| --- | --- |
+| [Working with Windows Store for Business – education scenarios](education-scenarios-store-for-business.md)  | New. Learn about education scenarios for Windows Store for Business.  |
+| [For teachers - get Minecraft: Education Edition](teacher-get-minecraft.md)  | Updates. Subscription support for Minecraft: Education Edition.  |
+| [For IT administrators - get Minecraft: Education Edition](school-get-minecraft.md)  | Updates. Subscription support for Minecraft: Education Edition.  |
+
 ## September 2016
 
 | New or changed topic | Description|

education/windows/deploy-windows-10-in-a-school-district.md

@@ -728,7 +728,7 @@ To implement this method, perform the following steps:
    Put the student information in the format the bulk-import feature requires.
 2. Bulk-import the student information into Azure AD.
 
-   For more information about how to perform this step, see the [Bulk-import user and group accounts in Office 365](#bulk-import-user-and-group-accounts-in-office-365) section.
+   For more information about how to perform this step, see the [Bulk-import user and group accounts into Office 365](#bulk-import-user-and-group-accounts-into-office-365) section.
 
 #### Summary
 

education/windows/education-scenarios-store-for-business.md

@@ -0,0 +1,180 @@
+---
+title: Education scenarios Windows Store for Business
+description: Learn how IT admins and teachers can use Windows Store for Business to acquire and manage apps in schools.
+keywords: ["school"]
+ms.prod: W10
+ms.mktglfcycl: plan
+ms.sitesec: library
+author: trudyha
+---
+
+# Working with Windows Store for Business – education scenarios
+
+Learn about education scenarios for Windows Store for Business. IT admins and teachers can use Windows Store for Business to find, acquire, distribute, and manage apps. 
+
+## Manage Windows Store for Business settings
+
+### Access to Windows Store for Business
+Applies to: IT admins
+
+By default, when a teacher with a work or school account acquires Minecraft: Education Edition,they are automatically signed up for Window Store for Business, and the **Basic Purchaser** role is assigned to them. **Basic Purchaser** role allows teachers to acquire Minecraft: Education Edition and to distribute it to students. 
+
+However, tenant admins can control whether or not teachers automatically sign up for Windows Store for Business, and get the **Basic Purchaser** role. You can configure this with **Allow educators in my organization to sign up for the Windows Store for Business.** You'll find this on the **Permissions** page. 
+
+**To manage educator access to Windows Store for Business**
+1.  In Windows Store for Business, click **Settings**, and then click **Permissions**. 
+
+    ![Permission page for Windows Store for Business](images/minecraft-admin-permissions.png)
+
+2. Select, or clear **Allow educators in my organization to sign up for the Windows Store for Business**.
+
+### Windows Store for Business permissions
+Applies to: IT admins
+
+**Minecraft: Education Edition** adds a new role for teachers: **Basic Purchaser**. As an Admin, you can assign this role to teachers in your organization. When a teacher has been granted this role, they can:
+- View the Minecraft: Education Edition product description page 
+- Acquire and manage Minecraft: Education Edition, and other apps from Store for Business
+- Use info on Support page (including links to documentation and access to support through customer service)
+
+    ![assign roles to manage Minecraft permissions](images/minecraft-perms.png)
+
+**To assign Basic Purchaser role**
+
+1. Sign in to Store for Business </br>
+
+    > [!NOTE]
+    > You need to be a Global Administrator, or have the Store for Business Admin role to access the **Permissions** page.
+    
+2. Click **Settings**, and then choose **Permissions**.
+
+    ![Permission page for Windows Store for Business](images/minecraft-admin-permissions.png)
+3. Click **Add people**, type a name, select the correct person, choose the role you want to assign, and click **Save**.
+
+    ![Permission page for Windows Store for Business](images/minecraft-assign-roles.png)
+    
+    Windows Store for Business updates the list of people and permissions. 
+    
+    ![Permission page for Windows Store for Business](images/minecraft-assign-roles-2.png)
+
+### Private store
+
+Applies to: IT admins
+
+When you create you Windows Store for Business account, you'll have a set of apps included for free in your private store. Apps in your private store are available for all people in your organization to install and use. 
+
+These apps will automatically be in your private store:
+- Word mobile
+- Excel mobile
+- PowerPoint mobile
+- OneNote
+- Sway
+- Fresh Paint
+- Minecraft: Education Edition
+
+As an admin, you can remove any of these apps from the private store if you'd prefer to control how apps are distributed.
+
+## Manage domain settings 
+
+Applies to: IT admins
+
+### Self-service sign up
+Self-service sign up makes it easier for teachers and students in your organization to get started with **Minecraft: Education Edition**. If you have self-service sign up enabled in your tenant, teachers can assign **Minecraft: Education Edition** to students before they have a work or school account. Students receive an email that steps them through the process of signing up for a work or school account. For more information on self-service sign up, see [Using self-service sign up in your organization](https://support.office.com/article/Using-self-service-sign-up-in-your-organization-4f8712ff-9346-4c6c-bb63-a21ad7a62cbd?ui=en-US&rs=en-US&ad=US).
+
+### Domain verification
+For education organizations, domain verification ensures you are on the academic verification list. As an admin, you might need to verify your domain using the Office 365 portal. For more information, see [Verify your Office 365 domain to prove ownership, nonprofit or education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-Yammer-87d1844e-aa47-4dc0-a61b-1b773fd4e590?ui=en-US&rs=en-US&ad=US).
+
+## Acquire apps
+Applies to: IT admins and teachers
+
+Find apps for your school using Windows Store for Business. Admins in an education setting can use the same processes as Admins in an enterprise setting to find and acquire apps.
+ 
+**To acquire apps**
+- For info on how to acquire apps, see [Acquire apps in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business#acquire-apps) 
+
+**To add a payment method**
+
+If you the app you purchase has a price, you’ll need to provide a payment method. 
+- Click **Get started! Add a way to pay.** Provide the info needed for your debit or credit card.
+ 
+For more information on payment options, see [payment options](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business#payment-options). 
+
+For more information on tax rates, see [tax information](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings#organization-tax-information). 
+
+### Get started with Minecraft: Education Edition
+Teachers and IT administrators can now get trials or subscriptions to Minecraft: Education Edition and add it to Windows Store for Business for distribution.
+- [Get started with Minecraft: Education Edition](https://technet.microsoft.com/edu/windows/get-minecraft-for-education)
+- [For IT admins – Minecraft: Education Edition](https://technet.microsoft.com/edu/windows/school-get-minecraft)
+- [For teachers – Minecraft: Education Edition](https://technet.microsoft.com/edu/windows/teacher-get-minecraft)
+
+
+## Manage WSfB inventory
+Applies to: IT admins and teachers
+
+### Manage purchases
+IT admins and teachers in educational settings can purchase apps from Windows Store for Business. Teachers need to have the Basic purchaser role, but if they've acquired Minecraft: Education Edition, they have the role by default. 
+
+While both groups can purchase apps, they can't manage purchases made by the other group. 
+
+Admins can:
+- Manage and distribute apps they purchased and apps that are purchased by other admins in the organization. 
+- View apps purchased by teachers.
+- View and manage apps on **Inventory**, under **Admin purchases**. 
+
+Teachers can:
+- Manage and distribute apps they purchased.
+- View and manage apps on **Inventory**, under **User purchases**. 
+
+> [!NOTE]
+> Teachers can't manage or view apps purchased by other teachers, or purchased by admins. Teachers can only work with the apps they purchased.
+ 
+
+### Distribute apps
+
+Manage and distribute apps to students and others in your organization. Different options are avaialble for admins and teachers. 
+
+Applies to: IT admins
+
+**To manage and distribute apps**
+- For info on how to distribute **Minecraft: Education Edition**, see [For IT admins – Minecraft: Education Edition](https://technet.microsoft.com/edu/windows/school-get-minecraft#distribute_minecraft)
+- For info on how to manage and distribute other apps, see [App inventory management - Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/app-inventory-management-windows-store-for-business)
+
+Applies to: Teachers
+
+For info on how to distribute **Minecraft: Education Edition**, see [For teachers – Minecraft: Education Edition](https://technet.microsoft.com/edu/windows/teacher-get-minecraft#distribute-minecraft). 
+
+**To assign an app to a student**
+
+1. Sign in to the Store for Business.
+2. Click **Manage**, and then choose **Inventory**.
+3. Find an app, click the ellipses under **Action**, and then choose **Assign to people**.
+4. Type the email address, or name for the student that you're assigning the app to, and click **Confirm**.
+
+Employees will receive an email with a link that will install the app on their device. Click the link to start the Windows Store app, and then click **Install**. Also, in the Windows Store app, they can find the app under **My Library**.
+
+### Purchase additional licenses
+Applies to: IT admins and teachers
+
+You can manage current app licenses, or purchase more licenses for apps in your inventory. 
+
+**To purchase additional app licenses**
+1. From **Inventory**, click an app. 
+2. On the app page, click **View app details**. 
+3. From this page, click **Buy more** to purchase more licenses</br>
+-OR-</br>
+Click **Manage** to distribute or reclaim current licenses. 
+
+You'll have a summary of current license availability.  
+
+**Minecraft: Education Edition subscriptions**
+
+Similarly, you can purchase additional subscriptions of **Minecraft: Education Edition** through Windows Store for Business. Find **Minecraft: Education Edition** in your inventory and use the previous steps for purchasing additional app licenses. 
+
+## Manage WSfB order history
+Applies to: IT admins and teachers
+
+You can manage your orders through Windows Store for Business. For info on order history and how to refund an order, see [Manage app orders in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/manage-orders-windows-store-for-business). 
+
+It can take up to 24 hours after a purchase, before a receipt is available on your **Order history page**. 
+
+> [!NOTE]
+For **Minecraft: Education Edition**, you can request a refund through Windows Store for Business for two months from the purchase date. After two months, refunds require a support call. 

education/windows/get-minecraft-for-education.md

@@ -8,7 +8,7 @@ ms.sitesec: library
 author: jdeckerMS
 ---
 
-# Get Minecraft Education Edition
+# Get Minecraft: Education Edition
 
 **Applies to:**
 
@@ -26,7 +26,7 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio
 ## Prerequisites
  
 - **Minecraft: Education Edition** requires Windows 10.
-- Early access to **Minecraft: Education Edition** is offered to education tenants that are managed by Azure Active Directory (Azure AD).
+- Trials or subscriptions of **Minecraft: Education Edition** are offered to education tenants that are managed by Azure Active Directory (Azure AD).
     - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**.
     * Office 365 Education, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan)
     * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/library/windows/hardware/mt703369%28v=vs.85%29.aspx)

education/windows/school-get-minecraft.md

@@ -8,13 +8,13 @@ ms.sitesec: library
 author: jdeckerMS
 ---
 
-# For IT administrators: get Minecraft: Education Edition
+# For IT administrators - get Minecraft: Education Edition
 
 **Applies to:**
 
 -   Windows 10  
 
-When you sign up for early access to [Minecraft: Education Edition](http://education.minecraft.net), Minecraft will be added to the inventory in your Windows Store for Business, a private version of Windows Store associated with your Azure Active Directory (Azure AD) tenant. Your Store for Business is only displayed to members of your organization.
+When you sign up for a [Minecraft: Education Edition](http://education.minecraft.net) trial, or purchase a [Minecraft: Education Edition](http://education.minecraft.net) subscription. Minecraft will be added to the inventory in your Windows Store for Business, a private version of Windows Store associated with your Azure Active Directory (Azure AD) tenant. Your Store for Business is only displayed to members of your organization.
 
 > **Note**: If you don't have an Azure AD or Office 365 tenant, you can set up a free Office 365 Education subscription when you request Minecraft: Education Edition. For more information see [Office 365 Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans). 
 
@@ -48,6 +48,8 @@ If you’ve been approved and are part of the Enrollment for Education Solutions
 
 Now that the app is in your Store for Business inventory, you can choose how to distribute Minecraft. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft).
 
+If you need additional licenses for **Minecraft: Education Edition**, see [Purchase additional licenses](https://technet.microsoft.com/edu/windows/education-scenarios-store-for-business#purchase-additional-licenses).
+
 ### <a href="" id="volume-license"></a>Minecraft: Education Edition - volume licensing
 
 Qualified education institutions can purchase Minecraft: Education Edition licenses through their Microsoft channel partner. Schools need to be part of the Enrollment for Education Solutions (EES) volume licensing program. Educational institutions should work with their channel partner to determine which Minecraft: Education Edition licensing offer is best for their institution. The process looks like this: 
@@ -68,7 +70,7 @@ Admins can also add Minecraft: Education Edition to the private store. This allo
 
 Here's the page you'll see for Minecraft: Education Edition licenses purchased directly through the Windows Store for Business. 
 
-![App distribution options - individual copies](images/mc-install-for-me-admin.png)
+![App distribution options - individual copies](images/mc-install-for-me-teacher.png)
 
 Here's the page you'll see for Minecraft: Education Edition licenses purchased through volume licensing.
 
@@ -78,24 +80,24 @@ Here's the page you'll see for Minecraft: Education Edition licenses purchased t
 You can install the app on your PC. This gives you a chance to test the app and know how you might help others in your organization use the app.   
 
 1. Sign in to Windows Store for Business. 
-2. Click **Manage**, and then click **Install for me**.
+2. Click **Manage**, and then click **Install**.
 
-    ![Minecraft Education Edition product page](images/mc-install-for-me-admin.png)
+    ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png)
 
 3. Click **Install**.  
 
 ### Assign to others
 Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more tech-savvy students who will always use the same PC at school. You can assign the app to individuals, groups, or add it to your private store, where students and teachers in your organization can download the app. 
 
+
 **To assign to others**
 1. Sign in to Windows Store for Business. 
 2. Click **Manage**.
 
-    ![Minecraft Education Edition product page](images/minecraft-assign-to-others.png)
+    ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png)
-3. Click **Assign to people**.
+3. Click **Invite people**.
  
-    ![Assign to people](images/minecraft-assign-to-people.png)
+4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. 
-4. Type the name, or email address of the student you want to assign the app to, and then click **Assign**.
 
     You can only assign the app to students with work or school accounts. If you don't find the student, you might need to add a work or school account for the student.    
    
@@ -150,7 +152,7 @@ You'll download a .zip file, extract the files, and then use one of the files to
 
 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**.
 
-    ![Windows Store app showing access to My Library](images/mc-dnld-others-admin.png)
+    ![Windows Store app showing access to My Library](images/mc-dnld-others-teacher.png)
  
 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**.
 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC.  
@@ -159,9 +161,9 @@ You'll download a .zip file, extract the files, and then use one of the files to
 6. **Restart**. Once installation is complete, restart each PC. Minecraft: Education Edition app is now ready for any student to use.
 
 
-## Manage Minecraft: Education Edition
+<!--- ## Manage Minecraft: Education Edition -->
 
-### Access to Windows Store for Business
+<!--- ### Access to Windows Store for Business
 By default, when a teacher with a work or school account acquires Minecraft: Education Edition, they are automatically signed up for Window Store for Business, and the **Basic Purchaser** role is assigned to them. **Basic Purchaser** role allows teachers to acquire Minecraft: Education Edition and to distribute it to students. 
 
 However, tenant admins can control whether or not teachers automatically sign up for Windows Store for Business, and get the **Basic Purchaser** role. You can configure this with the **Allow educators in my organization to sign up for the Windows Store for Business.** You'll find this on the **Permissions** page. 
@@ -173,7 +175,9 @@ To prevent educators from automatically signing up for Windows Store for Busines
 
 2. Click **Allow educators in my organization to sign up for the Windows Store for Business.**
 
-### Roles and permissions
+-->
+
+<!--- ### Roles and permissions
 Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. When a teacher has been granted this role, they can:
 - View the Minecraft product description page 
 - Acquire and manage the app
@@ -200,7 +204,9 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**.
     
     ![Permission page for Windows Store for Business](images/minecraft-assign-roles-2.png)
 
-## <a href="" id="private-store"></a>Private store
+-->
+
+<!--- ## <a href="" id="private-store"></a>Private store
 
 When you create you Windows Store for Business account, you'll have a set of apps included for free in your private store. Apps in your private store are available for all people in your organization to install and use. 
 
@@ -213,14 +219,16 @@ These apps will automatically be in your private store:
 - Fresh Paint
 - Minecraft: Education Edition
 
-As an admin, you can remove any of these apps from the private store if you'd prefer to control how apps are distributed.  
+As an admin, you can remove any of these apps from the private store if you'd prefer to control how apps are distributed. --> 
 
-<!-- ## Need more copies of Minecraft: Education Edition?
+<!--- ## Need more copies of Minecraft: Education Edition?
 You can purchase more licenses by working with your channel partner. Licenses are available at a lower rate than the price for individual copies that are available through Windows Store for Business. Individual copies are also available through Windows Store for Business. 
 
 If you’ve purchased a volume license, be sure to let other basic purchasers in your organization know about the volume license. That should help prevent unnecessary purchases of individual copies. -->
 
 ## Learn more
+[Working with Windows Store for Business – education scenarios](education-scenarios-store-for-business.md) </br>
+Learn about overall Windows Store for Business management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history.  
 
 [Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business)
 

education/windows/take-a-test-single-pc.md

@@ -25,11 +25,9 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme
 - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features.
 - Cortana is turned off.
 
-> **Tip!**
+> [!TIP]  
 > To exit **Take a Test**, press Ctrl+Alt+Delete. 
 
- 
-
 ## How you use Take a Test
 
 ![Use test account or test url in Take a Test](images/take-a-test-flow.png)
@@ -47,7 +45,10 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme
 1. Sign into the device with an administrator account.
 2. Go to **Settings** > **Accounts** > **Work or school access** > **Set up an account for taking tests**.
 3. Select an existing account to use as the dedicated testing account.
-    >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**.
+
+ > [!NOTE]  
+ > If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**.
+ 
 4. Specify an assessment URL.  
 
 5. Click **Save**.

education/windows/teacher-get-minecraft.md

@@ -8,7 +8,7 @@ ms.sitesec: library
 author: jdeckerMS
 ---
 
-# For teachers: get Minecraft: Education Edition
+# For teachers - get Minecraft: Education Edition
 
 **Applies to:**
 
@@ -38,6 +38,8 @@ Learn how teachers can get and distribute Minecraft: Education Edition.
 
     ![Get Minecraft app in Store](images/minecraft-get-the-app.png)
     
+If you need additional licenses for **Minecraft: Education Edition**, see [Purchase additional licenses](https://technet.microsoft.com/edu/windows/education-scenarios-store-for-business#purchase-additional-licenses).
+    
 ## Distribute Minecraft
 
 After Minecraft: Education Edition is added to your Windows Store for Business inventory, you have three options:
@@ -52,7 +54,7 @@ After Minecraft: Education Edition is added to your Windows Store for Business i
 You can install the app on your PC. This gives you a chance to work with the app before using it with your students.   
 
 1. Sign in to Windows Store for Business. 
-2. Click **Manage**, and then click **Install for me**.
+2. Click **Manage**, and then click **Install**.
 
     ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png)
 
@@ -65,18 +67,18 @@ Enter email addresses for your students, and each student will get an email with
 1. Sign in to Windows Store for Business. 
 2. Click **Manage**.
 
-    ![Minecraft Education Edition product page](images/mc-assign-to-others-teacher.png)
+    ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png)
 
-3. Click **Assign to people**.
+3. Click **Invite people**.
     
-    ![Assign to people](images/minecraft-assign-to-people.png)
+4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**.
-    
-4. Type the name, or email address of the student you want to assign the app to, and then click **Assign**.
-
-   You can only assign the app to students with work or school accounts. If you don't find the student, contact your IT admin to add a work or school account for the student.
 
    ![Assign to people showing student name](images/minecraft-assign-to-people-name.png)
    
+   You can assign the app to students with work or school accounts. </br>
+   If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Office 365 portal where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. 
+
+
 **To finish Minecraft install (for students)**
 
 Students will receive an email with a link that will install the app on their PC.
@@ -152,6 +154,9 @@ If you are still having trouble installing the app, you can get more help on our
 
 ## Related topics
 
+[Working with Windows Store for Business – education scenarios](education-scenarios-store-for-business.md) </br>
+Learn about overall Windows Store for Business management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history.
+
 [Get Minecraft: Education Edition](get-minecraft-for-education.md)
 
 [For IT admins: get Minecraft: Education Edition](school-get-minecraft.md)

mdop/appv-v5/about-app-v-50-sp3.md

@@ -109,7 +109,7 @@ Review the following information before you start the upgrade:
 <td align="left"><p>You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.0 SP3.</p>
 <p>For more information, see:</p>
 <ul>
-<li><p>[About App-V 5.0](about-app-v-50.md#bkmk-diffs-46-50)</p></li>
+<li><p>[About App-V 5.0](about-app-v-50.md) </p></li>
 <li><p>[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md)</p></li>
 </ul>
 <p></p></td>
@@ -521,7 +521,7 @@ You can manage connection groups more easily by using optional packages and othe
 <tbody>
 <tr class="odd">
 <td align="left"><p>Management console</p></td>
-<td align="left"><p>[How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md#bkmk-admin-pub-pkg-only-posh)</p></td>
+<td align="left"><p>[How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md)</p></td>
 </tr>
 <tr class="even">
 <td align="left"><p>PowerShell</p></td>

mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md

@@ -157,7 +157,6 @@ Complete the following steps to create an Office 2013 package for App-V 5.0 or l
 **Important**  
 In App-V 5.0 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
 
- 
 
 ### Review prerequisites for using the Office Deployment Tool
 
@@ -189,11 +188,9 @@ The computer on which you are installing the Office Deployment Tool must have:
 </tbody>
 </table>
 
- 
 
 **Note**  
 In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing.
-
  
 
 ### Create Office 2013 App-V Packages Using Office Deployment Tool
@@ -242,8 +239,6 @@ The XML file that is included in the Office Deployment Tool specifies the produc
         **Note**  
         The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
 
-         
-
         The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
 
         <table>
@@ -300,8 +295,6 @@ The XML file that is included in the Office Deployment Tool specifies the produc
         </tbody>
         </table>
 
-         
-
         After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
 
 2.  **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details:
@@ -811,7 +804,7 @@ The following table describes the requirements and options for deploying Visio 2
 <tr class="odd">
 <td align="left"><p>How do I package and publish Visio 2013 and Project 2013 with Office?</p></td>
 <td align="left"><p>You must include Visio 2013 and Project 2013 in the same package with Office.</p>
-<p>If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md#bkmk-pkg-pub-reqs).</p></td>
+<p>If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md).</p></td>
 </tr>
 <tr class="even">
 <td align="left"><p>How can I deploy Visio 2013 and Project 2013 to specific users?</p></td>

mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md

@@ -62,7 +62,6 @@ Use the following table to get information about supported versions of Office an
 </table>
 
  
-
 ### <a href="" id="bkmk-pkg-pub-reqs"></a>Packaging, publishing, and deployment requirements
 
 Before you deploy Office by using App-V, review the following requirements.
@@ -811,7 +810,7 @@ The following table describes the requirements and options for deploying Visio 2
 <tr class="odd">
 <td align="left"><p>How do I package and publish Visio 2013 and Project 2013 with Office?</p></td>
 <td align="left"><p>You must include Visio 2013 and Project 2013 in the same package with Office.</p>
-<p>If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md#bkmk-pkg-pub-reqs).</p></td>
+<p>If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md).</p></td>
 </tr>
 <tr class="even">
 <td align="left"><p>How can I deploy Visio 2013 and Project 2013 to specific users?</p></td>

mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md

@@ -11,8 +11,6 @@ ms.prod: w10
 
 
 # How to Create a Connection Group with User-Published and Globally Published Packages
-
-
 You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods:
 
 -   [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg)
@@ -46,8 +44,7 @@ You can create user-entitled connection groups that contain both user-published
 </table>
 
  
-
+<a href="" id="bkmk-posh-userentitled-cg"></a>**How to use PowerShell cmdlets to create user-entitled connection groups**
-**How to use PowerShell cmdlets to create user-entitled connection groups**
 
 1.  Add and publish packages by using the following commands:
 
@@ -67,7 +64,7 @@ You can create user-entitled connection groups that contain both user-published
 
     **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID**
 
-**How to use the App-V Server to create user-entitled connection groups**
+<a href="" id="bkmk-appvserver-userentitled-cg"></a>**How to use the App-V Server to create user-entitled connection groups**
 
 1.  Open the App-V 5.0 Management Console.
 

mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md

@@ -45,9 +45,7 @@ You can create user-entitled connection groups that contain both user-published
 </tbody>
 </table>
 
- 
+<a href="" id="bkmk-posh-userentitled-cg"></a>**How to use PowerShell cmdlets to create user-entitled connection groups**
-
-**How to use PowerShell cmdlets to create user-entitled connection groups**
 
 1.  Add and publish packages by using the following commands:
 
@@ -67,7 +65,7 @@ You can create user-entitled connection groups that contain both user-published
 
     **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID**
 
-**How to use the App-V Server to create user-entitled connection groups**
+<a href="" id="bkmk-appvserver-userentitled-cg"></a>**How to use the App-V Server to create user-entitled connection groups**
 
 1.  Open the App-V 5.1 Management Console.
 

mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md

@@ -15,7 +15,7 @@ ms.prod: w10
 
 Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer.
 
-**What to do before you start**
+<a href="" id="bkmk-clt-install-prereqs"></a>**What to do before you start**
 
 1.  Review and install the software prerequisites:
 
@@ -143,8 +143,6 @@ Use the following procedure to install the Microsoft Application Virtualization
     **Note**  
     The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter.
 
-     
-
     <table>
     <colgroup>
     <col width="50%" />

mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md

@@ -15,7 +15,7 @@ ms.prod: w10
 
 Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer.
 
-**What to do before you start**
+<a href="" id="bkmk-clt-install-prereqs"></a>**What to do before you start**
 
 1.  Review and install the software prerequisites:
 

mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md

@@ -88,12 +88,12 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 <td align="left"><p>Run the <strong>Set-AppvClientConfiguration</strong> cmdlet with the <strong>-RequirePublishAsAdmin</strong> parameter.</p></td>
 <td align="left"><ul>
 <li><p>[How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admin-only-posh-topic-cg)</p></li>
-<li><p>[How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs)</p></li>
+<li><p>[How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md)</p></li>
 </ul></td>
 </tr>
 <tr class="even">
 <td align="left"><p>Enable the “Require publish as administrator” Group Policy setting for App-V Clients.</p></td>
-<td align="left"><p>[How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md#bkmk-admin-pub-pkg-only-posh)</p></td>
+<td align="left"><p>[How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) </p></td>
 </tr>
 </tbody>
 </table>
@@ -105,8 +105,6 @@ Review the following requirements for using the App-V PowerShell cmdlets:
  
 
 ## <a href="" id="bkmk-load-cmdlets"></a>Loading the PowerShell cmdlets
-
-
 To load the PowerShell cmdlet modules:
 
 1.  Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).
@@ -143,8 +141,6 @@ To load the PowerShell cmdlet modules:
  
 
 ## <a href="" id="bkmk-get-cmdlet-help"></a>Getting help for the PowerShell cmdlets
-
-
 Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
 
 <table>
@@ -204,15 +200,13 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
  
 
 ## <a href="" id="bkmk-display-help-cmdlet"></a>Displaying the help for a PowerShell cmdlet
-
-
 To display help for a specific PowerShell cmdlet:
 
 1.  Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).
 
 2.  Type **Get-Help** &lt;*cmdlet*&gt;, for example, **Get-Help Publish-AppvClientPackage**.
 
-**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue**? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
  
 

mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md

@@ -88,12 +88,12 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 <td align="left"><p>Run the <strong>Set-AppvClientConfiguration</strong> cmdlet with the <strong>-RequirePublishAsAdmin</strong> parameter.</p></td>
 <td align="left"><ul>
 <li><p>[How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md#bkmk-admin-only-posh-topic-cg)</p></li>
-<li><p>[How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs)</p></li>
+<li><p>[How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md)</p></li>
 </ul></td>
 </tr>
 <tr class="even">
 <td align="left"><p>Enable the “Require publish as administrator” Group Policy setting for App-V Clients.</p></td>
-<td align="left"><p>[How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md#bkmk-admin-pub-pkg-only-posh)</p></td>
+<td align="left"><p>[How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md)</p></td>
 </tr>
 </tbody>
 </table>
@@ -106,7 +106,6 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
 ## <a href="" id="bkmk-load-cmdlets"></a>Loading the PowerShell cmdlets
 
-
 To load the PowerShell cmdlet modules:
 
 1.  Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).
@@ -140,11 +139,7 @@ To load the PowerShell cmdlet modules:
 </tbody>
 </table>
 
- 
-
 ## <a href="" id="bkmk-get-cmdlet-help"></a>Getting help for the PowerShell cmdlets
-
-
 Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
 
 <table>
@@ -201,11 +196,7 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
 </tbody>
 </table>
 
- 
-
 ## <a href="" id="bkmk-display-help-cmdlet"></a>Displaying the help for a PowerShell cmdlet
-
-
 To display help for a specific PowerShell cmdlet:
 
 1.  Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md

@@ -27,7 +27,7 @@ This topic explains the following procedures:
 
 -   [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg)
 
-**To add and publish the App-V packages in the connection group**
+<a href="" id="bkmk-add-pub-pkgs-in-cg"></a>**To add and publish the App-V packages in the connection group**
 
 1.  To add and publish the App-V 5.0 packages to the computer running the App-V client, type the following command:
 
@@ -35,7 +35,7 @@ This topic explains the following procedures:
 
 2.  Repeat **step 1** of this procedure for each package in the connection group.
 
-**To add and enable the connection group on the App-V client**
+<a href="" id="bkmk-add-enable-cg-on-clt"></a>**To add and enable the connection group on the App-V client**
 
 1.  Add the connection group by typing the following command:
 
@@ -47,7 +47,7 @@ This topic explains the following procedures:
 
     When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group.
 
-**To enable or disable a connection group for a specific user**
+<a href="" id="bkmk-enable-cg-for-user-poshtopic"></a>**To enable or disable a connection group for a specific user**
 
 1.  Review the parameter description and requirements:
 
@@ -88,9 +88,7 @@ This topic explains the following procedures:
     </tbody>
     </table>
 
-     
+<a href="" id="bkmk-admin-only-posh-topic-cg"></a>**To allow only administrators to enable connection groups**
-
-**To allow only administrators to enable connection groups**
 
 1.  Review the description and requirement for using this cmdlet:
 
@@ -126,8 +124,6 @@ This topic explains the following procedures:
     </tbody>
     </table>
 
-     
-
     **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics

mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md

@@ -27,7 +27,7 @@ This topic explains the following procedures:
 
 -   [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg)
 
-**To add and publish the App-V packages in the connection group**
+<a href="" id="bkmk-add-pub-pkgs-in-cg"></a>*To add and publish the App-V packages in the connection group**
 
 1.  To add and publish the App-V 5.1 packages to the computer running the App-V client, type the following command:
 
@@ -35,7 +35,7 @@ This topic explains the following procedures:
 
 2.  Repeat **step 1** of this procedure for each package in the connection group.
 
-**To add and enable the connection group on the App-V client**
+<a href="" id="bkmk-add-enable-cg-on-clt"></a>**To add and enable the connection group on the App-V client**
 
 1.  Add the connection group by typing the following command:
 
@@ -47,7 +47,7 @@ This topic explains the following procedures:
 
     When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group.
 
-**To enable or disable a connection group for a specific user**
+<a href="" id="bkmk-enable-cg-for-user-poshtopic"></a>**To enable or disable a connection group for a specific user**
 
 1.  Review the parameter description and requirements:
 
@@ -88,9 +88,7 @@ This topic explains the following procedures:
     </tbody>
     </table>
 
-     
+<a href="" id="bkmk-admin-only-posh-topic-cg"></a>**To allow only administrators to enable connection groups**
-
-**To allow only administrators to enable connection groups**
 
 1.  Review the description and requirement for using this cmdlet:
 

mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md

@@ -31,7 +31,7 @@ This topic explains how to:
 
 -   If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured.
 
-**Update an application in an existing virtual application package**
+<a href="" id="bkmk-update-app-in-pkg"></a>**Update an application in an existing virtual application package**
 
 1.  On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
@@ -46,8 +46,6 @@ This topic explains how to:
     **Important**  
     If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package.
 
-     
-
 6.  On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
 7.  On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
@@ -55,16 +53,12 @@ This topic explains how to:
     **Note**  
     The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard.
 
-     
-
 8.  On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**.
 
 9.  On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**.
 
     **Note**  
-    You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**.
+    You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**.   
-
-     
 
 10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**.
 
@@ -72,7 +66,7 @@ This topic explains how to:
 
 11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer.
 
-**Modify the properties associated with an existing virtual application package**
+<a href="" id="bkmk-chg-props-in-pkg"></a>**Modify the properties associated with an existing virtual application package**
 
 1.  On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
@@ -111,11 +105,9 @@ This topic explains how to:
         **Note**  
         To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page.
 
-         
-
 6.  When you finish changing the package properties, click **File** &gt; **Save** to save the package.
 
-**Add a new application to an existing virtual application package**
+<a href="" id="bkmk-add-app-to-pkg"></a>**Add a new application to an existing virtual application package**
 
 1.  On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
@@ -130,8 +122,6 @@ This topic explains how to:
     **Important**  
     If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package.
 
-     
-
 6.  On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
 7.  On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** &gt; **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package.
@@ -139,8 +129,6 @@ This topic explains how to:
     **Note**  
     The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard.
 
-     
-
 8.  On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
 9.  On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page.
@@ -154,8 +142,6 @@ This topic explains how to:
     **Note**  
     You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**.
 
-     
-
 12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**.
 
     To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**.
@@ -166,7 +152,6 @@ This topic explains how to:
 
 ## Related topics
 
-
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
  

mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md

@@ -31,7 +31,7 @@ This topic explains how to:
 
 -   If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured.
 
-**Update an application in an existing virtual application package**
+<a href="" id="bkmk-update-app-in-pkg"></a>**Update an application in an existing virtual application package**
 
 1.  On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
@@ -46,8 +46,6 @@ This topic explains how to:
     **Important**  
     If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package.
 
-     
-
 6.  On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
 7.  On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
@@ -55,8 +53,6 @@ This topic explains how to:
     **Note**  
     The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard.
 
-     
-
 8.  On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**.
 
 9.  On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**.
@@ -64,15 +60,13 @@ This topic explains how to:
     **Note**  
     You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**.
 
-     
-
 10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**.
 
     To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**.
 
 11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer.
 
-**Modify the properties associated with an existing virtual application package**
+<a href="" id="bkmk-chg-props-in-pkg"></a>**Modify the properties associated with an existing virtual application package**
 
 1.  On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
@@ -101,11 +95,9 @@ This topic explains how to:
         **Note**  
         To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page.
 
-         
-
 6.  When you finish changing the package properties, click **File** &gt; **Save** to save the package.
 
-**Add a new application to an existing virtual application package**
+<a href="" id="bkmk-add-app-to-pkg"></a>**Add a new application to an existing virtual application package**
 
 1.  On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
@@ -120,8 +112,6 @@ This topic explains how to:
     **Important**  
     If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package.
 
-     
-
 6.  On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
 7.  On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** &gt; **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package.
@@ -129,8 +119,6 @@ This topic explains how to:
     **Note**  
     The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard.
 
-     
-
 8.  On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
 9.  On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page.
@@ -144,8 +132,6 @@ This topic explains how to:
     **Note**  
     You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**.
 
-     
-
 12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**.
 
     To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**.
@@ -156,7 +142,6 @@ This topic explains how to:
 
 ## Related topics
 
-
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
  

mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md

@@ -30,7 +30,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi
 
  
 
-**To open the Administration and Monitoring Website**
+<a href="" id="bkmk-openadmin"></a>**To open the Administration and Monitoring Website**
 
 1.  Open a web browser and navigate to the Administration and Monitoring Website. The default URL for the Administration and Monitoring Website is:
 
@@ -47,7 +47,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi
 
      
 
-**To generate an Enterprise Compliance Report**
+<a href="" id="bkmk-enterprise"></a>**To generate an Enterprise Compliance Report**
 
 1.  From the Administration and Monitoring Website, select the **Reports** node from the left navigation pane, select **Enterprise Compliance Report**, and select the filters that you want to use. The available filters for the Enterprise Compliance Report are:
 
@@ -61,7 +61,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi
 
 4.  Select the plus sign (+) next to the computer name to view information about the volumes on the computer.
 
-**To generate a Computer Compliance Report**
+<a href="" id="bkmk-computercomp"></a>**To generate a Computer Compliance Report**
 
 1.  From the Administration and Monitoring Website, select the **Report** node from the left navigation pane, and then select **Computer Compliance Report**. Use the Computer Compliance Report to search for **User name** or **Computer name**.
 
@@ -74,9 +74,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi
     **Note**  
     An MBAM client computer is considered compliant if the computer matches or exceeds the requirements of the MBAM Group Policy settings.
 
-     
+<a href="" id="bkmk-recoverykey"></a>**To generate a Recovery Key Audit Report**
-
-**To generate a Recovery Key Audit Report**
 
 1.  From the Administration and Monitoring Website, select the **Report** node in the left navigation pane, and then select **Recovery Audit Report**. Select the filters for your Recovery Key Audit Report. The available filters for recovery key audits are as follows:
 

mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md

@@ -11,19 +11,11 @@ ms.prod: w10
 
 
 # How to Recover a Moved Drive
-
-
 This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to recover an operating system drive that was moved after being encrypted by Microsoft BitLocker Administration and Monitoring (MBAM). When a drive is moved, it no longer accepts the PIN that was used in the previous computer because the Trusted Platform Module (TPM) chip has changed. To recover the moved drive, you must obtain the recovery key ID to retrieve the recovery password.
 
 To recover a moved drive, you must use the **Drive Recovery** area of the Administration and Monitoring Website. To access the **Drive Recovery** area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. For more information about these roles, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles).
 
-**Note**  
-You may have given these roles different names when you created them. For more information, see [Access accounts for the Administration and Monitoring Website (Help Desk)](#bkmk-helpdesk-roles).
-
- 
-
 **To recover a moved drive**
-
 1.  On the computer that contains the moved drive, start the computer in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT).
 
 2.  After the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a fixed data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password.

mdop/mbam-v25/mbam-25-supported-configurations.md

@@ -283,16 +283,21 @@ MBAM supports the following versions of Configuration Manager.
 </thead>
 <tbody>
 <tr class="odd">
-<td align="left"><p>Microsoft System Center 2012 R2 Configuration Manager</p></td>
+<td align="left"><p>Microsoft System Center Configuration Manager (Current Branch), version 1606</p></td>
 <td align="left"><p></p></td>
 <td align="left"><p>64-bit</p></td>
 </tr>
 <tr class="even">
+<td align="left"><p>Microsoft System Center 2012 R2 Configuration Manager</p></td>
+<td align="left"><p></p></td>
+<td align="left"><p>64-bit</p></td>
+</tr>
+<tr class="odd">
 <td align="left"><p>Microsoft System Center 2012 Configuration Manager</p></td>
 <td align="left"><p>SP1</p></td>
 <td align="left"><p>64-bit</p></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td align="left"><p>Microsoft System Center Configuration Manager 2007 R2 or later</p></td>
 <td align="left"><p>SP1 or later</p></td>
 <td align="left"><p>64-bit</p>

mdop/mbam-v25/prerequisites-for-mbam-25-clients.md

@@ -72,8 +72,7 @@ Before you install the MBAM Client software on end users' computers, ensure that
  
 
 **Important**  
-If BitLocker was used without MBAM, you must decrypt the drive and then clear TPM using tpm.msc. MBAM cannot take ownership of TPM if the client PC is already encrypted and the TPM owner password created.
+If BitLocker was used without MBAM, MBAM can be installed and utilize the existing TPM information.
-
  
 
 ## Got a suggestion for MBAM?

mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md

@@ -66,7 +66,7 @@ Windows PowerShell Help for MBAM cmdlets is available in the following formats:
 <tbody>
 <tr class="odd">
 <td align="left"><p>At a Windows PowerShell command prompt, type <strong>Get-Help</strong> &lt;<em>cmdlet</em>&gt;</p></td>
-<td align="left"><p>To upload the latest Windows PowerShell cmdlets, follow the instructions in [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md#bkmk-loadposhhelp)</p></td>
+<td align="left"><p>To upload the latest Windows PowerShell cmdlets, follow the instructions in [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)</p></td>
 </tr>
 <tr class="even">
 <td align="left"><p>On TechNet as webpages</p></td>

mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md

@@ -51,7 +51,7 @@ Follow these steps to configure your MED-V image for running first time setup:
 
 After you have completed customization of your MED-V image, you are ready to seal the image by using Sysprep.
 
-**Sealing the MED-V Image by Using Sysprep**
+<a href="" id="bkmk-seal"></a>**Sealing the MED-V Image by Using Sysprep**
 
 1.  The System Preparation tool (Sysprep) is a technology that you can use to perform image-based installations throughout the network with minimal intervention by an administrator or IT-Professional.
 

mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md

@@ -29,7 +29,7 @@ You can add and remove URL redirection information by performing one of the foll
 
 -   [Edit the URL Redirection Text File and Rebuild the MED-V Workspace](#bkmk-edittext)
 
-**To update URL Redirection information by using Group Policy**
+<a href="" id="bkmk-editreg"></a>**To update URL Redirection information by using Group Policy**
 
 1.  Edit the registry key multi-string value that is named `RedirectUrls`. This value is typically located at:
 
@@ -44,7 +44,7 @@ This method of editing URL redirection information is a MED-V best practice.
 
  
 
-**To rebuild the MED-V workspace by using an updated URL text file**
+<a href="" id="bkmk-edittext"></a>**To rebuild the MED-V workspace by using an updated URL text file**
 
 -   Another method of adding and removing URLs from the redirection list is to update the URL redirection text file and then use it to build a new MED-V workspace. You can then redeploy the MED-V workspace as before, by using your standard process of deployment, such as an ESD system.
 

mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md

@@ -47,21 +47,15 @@ You must install the MED-V workspace packager and build your MED-V workspaces be
     3.  **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md).
 
         **Warning**  
-        Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.
+        Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.   
-
-         
 
     4.  **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
         **Important**  
         The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe.
 
-         
-
         **Tip**  
-        Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.
+        Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.       
-
-         
 
 3.  Configure the packages to run in silent mode (no user interaction is required).
 
@@ -70,15 +64,11 @@ You must install the MED-V workspace packager and build your MED-V workspaces be
     **Note**  
     Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [To install the MED-V components by using a batch file](#bkmk-batch). MED-V automatically starts when the computer is restarted.
 
-     
-
 4.  Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic.
 
     **Important**  
     Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart.
 
-     
-
 5.  Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space.
 
 6.  Assign the packages to the target set of computers/users.
@@ -91,7 +81,7 @@ You must install the MED-V workspace packager and build your MED-V workspaces be
 
 First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md).
 
-**To install the MED-V components by using a batch file**
+<a href="" id="bkmk-batch"></a>**To install the MED-V components by using a batch file**
 
 1.  Run the installation at a command prompt with administrative credentials.
 

mdop/medv-v2/how-to-test-application-publishing.md

@@ -15,7 +15,7 @@ ms.prod: w7
 
 After your test of first time setup finishes, you can verify that the application publishing functionality is working as expected by performing the following tasks.
 
-**To test application publishing**
+<a href="" id="bkmk-apppub"></a>**To test application publishing**
 
 1.  Verify that the applications that you specified for publishing are visible.
 
@@ -34,8 +34,6 @@ After your test of first time setup finishes, you can verify that the applicatio
     **Important**  
     Because Windows Virtual PC does not support creating a share from a folder that is already shared, redirection does not occur for any documents that open from a shared folder, such as a My Documents folder that is located on the network. For more information, see [Operations Troubleshooting](operations-troubleshooting-medv2.md).
 
-     
-
 After you have verified that published applications are installed and functioning correctly, you can test whether applications can be added or removed from the MED-V workspace.
 
 **To test that an application can be added or removed**
@@ -51,15 +49,12 @@ After you have verified that published applications are installed and functionin
 **Note**  
 If you encounter any problems when verifying your application publication settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md).
 
- 
-
 After you have completed testing application publishing, you can test other MED-V workspace configurations to verify that they function as intended.
 
 After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise.
 
 ## Related topics
 
-
 [How to Test URL Redirection](how-to-test-url-redirection.md)
 
 [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md)

mdop/medv-v2/how-to-test-url-redirection.md

@@ -18,9 +18,7 @@ After your test of first time setup finishes, you can verify that the URL redire
 **Important**  
 The MED-V Host Agent must be running for URL redirection to function correctly.
 
- 
+<a href="" id="bkmk-urlredir"></a>**To test URL Redirection**
-
-**To test URL Redirection**
 
 1.  Open an Internet Explorer browser in the host computer and enter a URL that you specified for redirection.
 
@@ -45,20 +43,15 @@ The MED-V Host Agent must be running for URL redirection to function correctly.
         **Note**  
         It can take several seconds for the URL redirection changes to take place.
 
-         
-
 **Note**  
 If you encounter any problems when verifying your URL redirection settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md).
 
- 
-
 After you have completed testing URL redirection in your MED-V workspace, you can test other configurations to verify that they function as intended.
 
 After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise.
 
 ## Related topics
 
-
 [How to Test Application Publishing](how-to-test-application-publishing.md)
 
 [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md)

mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md

@@ -103,9 +103,7 @@ It might be necessary to change the PowerShell execution policy to allow these s
 
 2.  In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass**
 
- 
+<a href="" id="create"></a>**Create the First UE-V Policy Configuration Item**
-
-**Create the First UE-V Policy Configuration Item**
 
 1.  Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console:
 
@@ -173,8 +171,6 @@ It might be necessary to change the PowerShell execution policy to allow these s
 3.  Reimport the CAB file. The version in ConfigMgr will be updated.
 
 ## Generate a UE-V Template Baseline
-
-
 UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality.
 
 The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters:

mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md

@@ -45,7 +45,7 @@ This workflow diagram provides a high-level understanding of a UE-V deployment a
 
 ![deploymentworkflow](images/deploymentworkflow.png)
 
-**Planning a UE-V deployment:** First, you want to do a little bit of planning so that you can determine which UE-V components you’ll be deploying. Planning a UE-V deployment involves these things:
+<a href="" id="planning"></a>**Planning a UE-V deployment:** First, you want to do a little bit of planning so that you can determine which UE-V components you’ll be deploying. Planning a UE-V deployment involves these things:
 
 -   [Decide whether to synchronize settings for custom applications](#deciding)
 

windows/deploy/activate-using-active-directory-based-activation-client.md

@@ -68,13 +68,13 @@ You must be a member of the local Administrators group on all computers mentione
     
 6.  Enter your KMS host key and (optionally) a display name (Figure 14).
 
-    ![Entering your KMS host key](images/volumeactivationforwindows81-14.jpg)
+    ![Choosing how to activate your product](images/volumeactivationforwindows81-15.jpg)
     
     **Figure 14**. Entering your KMS host key
     
 7.  Activate your KMS host key by phone or online (Figure 15).
 
-    ![Choosing how to activate your product](images/volumeactivationforwindows81-15.jpg)
+    ![Entering your KMS host key](images/volumeactivationforwindows81-14.jpg)
     
     **Figure 15**. Choosing how to activate your product
     

windows/deploy/introduction-vamt.md

@@ -22,18 +22,18 @@ VAMT can be installed on, and can manage, physical or virtual instances. VAMT ca
 -   [Enterprise Environment](#bkmk-enterpriseenvironment)
 -   [VAMT User Interface](#bkmk-userinterface)
 
-## Managing Multiple Activation Key (MAK) and Retail Activation
+## <a href="" id="bkmk-managingmak"></a>Managing Multiple Activation Key (MAK) and Retail Activation
 
 You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios:
 -   **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft.
 -   **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host.
 
-## Managing Key Management Service (KMS) Activation
+## <a href="" id="bkmk-managingkms"></a>Managing Key Management Service (KMS) Activation
 
 In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010.
 VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types.
 
-## Enterprise Environment
+## <a href="" id="bkmk-enterpriseenvironment"></a>Enterprise Environment
 
 VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab.
 
@@ -42,7 +42,7 @@ VAMT is commonly implemented in enterprise environments. The following illustrat
 In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection.
 The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab.
 
-## VAMT User Interface
+## <a href="" id="bkmk-userinterface"></a>VAMT User Interface
 
 The following screenshot shows the VAMT graphical user interface.
 

windows/deploy/resolve-windows-10-upgrade-errors.md

@@ -33,7 +33,7 @@ The following sections and procedures are provided in this guide:
     - [Log entry structure](#log-entry-structure): The format of a log entry is described.
     - [Analyze log files](#analyze-log-files): General procedures for log file analysis, and an example.
 - [Resolution procedures](#resolution-procedures): Causes and mitigation procedures associated with specific error codes.
-    - [0xC1900101](#0xC1900101): Information about the 0xC1900101 result code.
+    - [0xC1900101](#0xc1900101): Information about the 0xC1900101 result code.
     - [0x800xxxxx](#0x800xxxxx): Information about result codes that start with 0x800.
     - [Other result codes](#other-result-codes): Additional causes and mitigation procedures are provided for some result codes.
     - [Other error codes](#other-error-codes): Additional causes and mitigation procedures are provided for some error codes.
@@ -866,7 +866,7 @@ Alternatively, re-create installation media the [Media Creation Tool](https://ww
 <TD>[Analyze log files](#analyze-log-files) to determine the issue.</TD></TR>
 <TR><TD>0xC1900101 - 0x4001E
 <TD>Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation.
-<TD>This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xC1900101) section of this guide and review general troubleshooting procedures described in that section.</TD></TR>
+<TD>This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xc1900101) section of this guide and review general troubleshooting procedures described in that section.</TD></TR>
 <TR><TD>0x80070005 - 0x4000D
 <TD>The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data.
 <TD>[Analyze log files](#analyze-log-files) to determine the data point that is reporting access denied.</TD></TR>

windows/deploy/usmt-exclude-files-and-settings.md

@@ -32,7 +32,7 @@ If you specify an <exclude> rule, always specify a corresponding <inclu
 
 -   [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files)
 
--   [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-c-data-except-files-in-c-data-tmp)
+-   [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp)
 
 -   [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders)
 
@@ -246,7 +246,7 @@ The following .xml file unconditionally excludes the system folders of `C:\Windo
    </component>
 </migration>
 ```
-## Create a Config.xml File
+## Create a Config XML File
 You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows.
 
 -   **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the &lt;Applications&gt; section of the Config.xml file.

windows/deploy/windows-10-upgrade-paths.md

@@ -23,7 +23,7 @@ This topic provides a summary of available upgrade paths to Windows 10. You can
 
 >**Windows N/KN**: Windows "N" and "KN" editions follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.  
 
->**Free upgrade**: The Windows 10 free upgrade offer expired on July 29, 2016. For more information, see [Free upgrade paths](#Free-upgrade-paths).
+>**Free upgrade**: The Windows 10 free upgrade offer expired on July 29, 2016. For more information, see [Free upgrade paths](#free-upgrade-paths).
 
 ✔ = Full upgrade is supported including personal data, settings, and applications.<BR>
 D = Edition downgrade; personal data is maintained, applications and settings are removed.

windows/keep-secure/TOC.md

@@ -682,6 +682,18 @@
 ###### [Shut down the system](shut-down-the-system.md)
 ###### [Synchronize directory service data](synchronize-directory-service-data.md)
 ###### [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md)
+### [Smart Cards](smart-card-windows-smart-card-technical-reference.md)
+#### [How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md)
+##### [Smart Card Architecture](smart-card-architecture.md)
+##### [Certificate Requirements and Enumeration](smart-card-certificate-requirements-and-enumeration.md)
+##### [Smart Card and Remote Desktop Services](smart-card-and-remote-desktop-services.md)
+##### [Smart Cards for Windows Service](smart-card-smart-cards-for-windows-service.md)
+##### [Certificate Propagation Service](smart-card-certificate-propagation-service.md)
+##### [Smart Card Removal Policy Service](smart-card-removal-policy-service.md)
+#### [Smart Card Tools and Settings](smart-card-tools-and-settings.md)
+##### [Smart Cards Debugging Information](smart-card-debugging-information.md)
+##### [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md)
+##### [Smart Card Events](smart-card-events.md)
 ### [Trusted Platform Module](trusted-platform-module-overview.md)
 #### [TPM fundamentals](tpm-fundamentals.md)
 #### [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md)
@@ -697,6 +709,13 @@
 #### [How User Account Control works](how-user-account-control-works.md)
 #### [User Account Control security policy settings](user-account-control-security-policy-settings.md)
 #### [User Account Control Group Policy and registry key settings](user-account-control-group-policy-and-registry-key-settings.md)
+### [Virtual Smart Cards](virtual-smart-card-overview.md)
+#### [Understanding and Evaluating Virtual Smart Cards](virtual-smart-card-understanding-and-evaluating.md)
+##### [Get Started with Virtual Smart Cards: Walkthrough Guide](virtual-smart-card-get-started.md)
+##### [Use Virtual Smart Cards](virtual-smart-card-use-virtual-smart-cards.md)
+##### [Deploy Virtual Smart Cards](virtual-smart-card-deploy-virtual-smart-cards.md)
+##### [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md)
+#### [Tpmvscmgr](virtual-smart-card-tpmvscmgr.md)
 ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)
 #### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md)
 #### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)

windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md

@@ -37,7 +37,7 @@ In this topic:
 
 -   [Refresh Group Policy on the devices in the membership group](#to-refresh-group-policy-on-a-device)
 
--   [Check which GPOs apply to a device](#to-see-what-gpos-are-applied-to-a-device)
+-   [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device)
 
 ## To add domain devices to the GPO membership group
 

windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md

@@ -25,11 +25,11 @@ To complete these procedures, you must be a member of the Domain Administrators
 
 In this topic:
 
--   [Add the test devices to the GPO membership groups](#to-add-domain-devices-to-the-gpo-membership-group)
+-   [Add the test devices to the GPO membership groups](#to-add-test-devices-to-the-gpo-membership-groups)
 
 -   [Refresh Group Policy on the devices in each membership group](#to-refresh-group-policy-on-a-device)
 
--   [Check which GPOs apply to a device](#to-see-what-gpos-are-applied-to-a-device)
+-   [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device)
 
 ## To add test devices to the GPO membership groups
 

windows/keep-secure/advanced-security-audit-policy-settings.md

@@ -27,7 +27,7 @@ You can access these audit policy settings through the Local Security Policy sna
 These advanced audit policy settings allow you to select only the behaviors that you want to monitor. You can exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because security audit policies can be applied by using domain Group Policy Objects, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity.
 Audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** are available in the following categories:
 
-**Account Logon**
+## Account Logon
 
 Configuring policy settings in this category can help you document attempts to authenticate account data on a domain controller or on a local Security Accounts Manager (SAM). Unlike Logon and Logoff policy settings and events, which track attempts to access a particular computer, settings and events in this category focus on the account database that is used. This category includes the following subcategories:
 
@@ -36,7 +36,7 @@ Configuring policy settings in this category can help you document attempts to a
 -   [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md)
 -   [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md)
 
-**Account Management**
+## Account Management
 
 The security audit policy settings in this category can be used to monitor changes to user and computer accounts and groups. This category includes the following subcategories:
 
@@ -47,7 +47,7 @@ The security audit policy settings in this category can be used to monitor chang
 -   [Audit Security Group Management](audit-security-group-management.md)
 -   [Audit User Account Management](audit-user-account-management.md)
 
-**Detailed Tracking**
+## Detailed Tracking
 
 Detailed Tracking security policy settings and audit events can be used to monitor the activities of individual applications and users on that computer, and to understand how a computer is being used. This category includes the following subcategories:
 
@@ -57,7 +57,7 @@ Detailed Tracking security policy settings and audit events can be used to monit
 -   [Audit Process Termination](audit-process-termination.md)
 -   [Audit RPC Events](audit-rpc-events.md)
 
-**DS Access**
+## DS Access
 
 DS Access security audit policy settings provide a detailed audit trail of attempts to access and modify objects in Active Directory Domain Services (AD DS). These audit events are logged only on domain controllers. This category includes the following subcategories:
 
@@ -66,7 +66,7 @@ DS Access security audit policy settings provide a detailed audit trail of attem
 -   [Audit Directory Service Changes](audit-directory-service-changes.md)
 -   [Audit Directory Service Replication](audit-directory-service-replication.md)
 
-**Logon/Logoff**
+## Logon/Logoff
 
 Logon/Logoff security policy settings and audit events allow you to track attempts to log on to a computer interactively or over a network. These events are particularly useful for tracking user activity and identifying potential attacks on network resources. This category includes the following subcategories:
 
@@ -82,11 +82,11 @@ Logon/Logoff security policy settings and audit events allow you to track attemp
 -   [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md)
 -   [Audit Special Logon](audit-special-logon.md)
 
-**Object Access**
+## Object Access
 
 Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate object Aaccess auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses.
 
-Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#bkmk-globalobjectaccess).
+Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#global-object-access-auditing).
 
 This category includes the following subcategories:
 
@@ -105,7 +105,7 @@ This category includes the following subcategories:
 -   [Audit SAM](audit-sam.md)
 -   [Audit Central Access Policy Staging](audit-central-access-policy-staging.md)
 
-**Policy Change**
+## Policy Change
 
 Policy Change audit events allow you to track changes to important security policies on a local system or network. Because policies are typically established by administrators to help secure network resources, monitoring changes or attempts to change these policies can be an important aspect of security management for a network. This category includes the following subcategories:
 
@@ -116,7 +116,7 @@ Policy Change audit events allow you to track changes to important security poli
 -   [Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md)
 -   [Audit Other Policy Change Events](audit-other-policy-change-events.md)
 
-**Privilege Use**
+## Privilege Use
 
 Permissions on a network are granted for users or computers to complete defined tasks. Privilege Use security policy settings and audit events allow you to track the use of certain permissions on one or more systems. This category includes the following subcategories:
 
@@ -124,7 +124,7 @@ Permissions on a network are granted for users or computers to complete defined
 -   [Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md)
 -   [Audit Other Privilege Use Events](audit-other-privilege-use-events.md)
 
-**System**
+## System
 
 System security policy settings and audit events allow you to track system-level changes to a computer that are not included in other categories and that have potential security implications. This category includes the following subcategories:
 
@@ -134,7 +134,7 @@ System security policy settings and audit events allow you to track system-level
 -   [Audit Security System Extension](audit-security-system-extension.md)
 -   [Audit System Integrity](audit-system-integrity.md)
 
-**Global Object Access**
+## Global Object Access Auditing
 
 Global Object Access Auditing policy settings allow administrators to define computer system access control lists (SACLs) per object type for the file system or for the registry. The specified SACL is then automatically applied to every object of that type.
 Auditors will be able to prove that every resource in the system is protected by an audit policy by viewing the contents of the Global Object Access Auditing policy settings. For example, if auditors see a policy setting called "Track all changes made by group administrators," they know that this policy is in effect.

windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md

@@ -36,7 +36,7 @@ Highlighted area|Area name|Description
 :---|:---|:---
 (1)|**Alerts queue**| Select to show **New**, **In Progress**, or **Resolved alerts**
 (2)|Alerts|Each alert shows:<ul><li>The severity of an alert as a colored bar</li><li>A short description of the alert, including the name of the threat actor (in cases where the attribution is possible)</li><li>The last occurrence of the alert on any machine</li><li>The number of days the alert has been in the queue</li><li>The severity of the alert</li><li>The general category or type of alert, or the alert's kill-chain stage</li><li>The affected machine (if there are multiple machines, the number of affected machines will be shown)</li><li>A **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) that allows you to update the alert's status and add comments</li></ul>Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected.
-(3)|Alerts sorting and filters | You can sort alerts by: <ul><li>**Newest** (when the threat was last seen on your network)</li><li>**Time in queue** (how long the threat has been in your queue)</li><li>**Severity**</li></ul>You can also filter the displayed alerts by:<ul><li>Severity</li><li>Time period</li></ul>See [Windows Defender ATP alerts](use-windows-defender-advanced-threat-protection.md#windows-defender-atp-alerts) for more details.
+(3)|Alerts sorting and filters | You can sort alerts by: <ul><li>**Newest** (when the threat was last seen on your network)</li><li>**Time in queue** (how long the threat has been in your queue)</li><li>**Severity**</li></ul>You can also filter the displayed alerts by:<ul><li>Severity</li><li>Time period</li></ul>See [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) for more details.
 
 ##Sort and filter the Alerts queue
 You can filter and sort (or "pivot") the Alerts queue to identify specific alerts based on certain criteria.

windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md

@@ -117,7 +117,7 @@ When you need to recover the TPM owner information from AD DS and use it to man
 **To obtain TPM owner backup information from AD DS and create a password file**
 
 1.  Sign in to a domain controller by using domain administrator credentials.
-2.  Copy the sample script file, [Get-TPMOwnerInfo.vbs](#ms-tpm-ownerinformation), to a location on your computer.
+2.  Copy the sample script file, [Get-TPMOwnerInfo.vbs](#bkmk-get-tpmownerinfo), to a location on your computer.
 3.  Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step.
 4.  At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**.
 

windows/keep-secure/bitlocker-frequently-asked-questions.md

@@ -319,7 +319,7 @@ When an administrator selects the **Require BitLocker backup to AD DS** check b
 
 For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
 
-When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#bkmk-adretro) to capture the information after connectivity is restored.
+When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored.
 
 ## <a href="" id="bkmk-security"></a>Security
 

windows/keep-secure/change-history-for-keep-windows-10-secure.md

@@ -12,12 +12,19 @@ author: brianlic-msft
 # Change history for Keep Windows 10 secure
 This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
 
+## November 2016
+| New or changed topic | Description |
+| --- | --- |
+|[Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md), [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md), and [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |Added additional details about what happens when you turn off WIP. |
+|[Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md) |Changed WIPModeID to EDPModeID, to match the CSP. |
+
+
 ## October 2016
 
 | New or changed topic | Description |
 | --- | --- |
 |[List of enlightened Microsoft apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Added Microsoft Remote Desktop information. |
-|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about the icon overlay option. This icon now only appears on corporate files in the Save As and File Explore views |
+|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about where the optioanl icon overlay appears.|
 |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added content about using ActiveX controls.|
 |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |New |
 |[VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic |

windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md

@@ -67,7 +67,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
 
 4.  Click **Policies**, then **Administrative templates**.
 
-5.  Click **Windows components** and then **Windows Advanced Threat Protection**.
+5.  Click **Windows components** and then **Windows Defender ATP**.
 
 6.  Choose to enable or disable sample sharing from your endpoints.
 

windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md

@@ -28,12 +28,15 @@ The embedded Windows Defender ATP sensor runs in system context using the LocalS
 
 The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods:
 
-- Configure the proxy server manually using a static proxy
-
  - Auto-discovery methods:
     - Transparent proxy
+    - Web Proxy Auto-discovery Protocol (WPAD)
 
-    - Manual static proxy configuration
+> [!NOTE]
+> If you're using Transparent proxy or WPAD in your network topology, you don't need special endpoint configuration settings. For more information on Windows Defender ATP URL exclusions in the proxy, see [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
+
+
+ - Manual static proxy configuration:
     - WinHTTP configured using netsh command
     - Registry based configuration
 
@@ -77,12 +80,9 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
 
 Primary Domain Controller | .Microsoft.com DNS record
 :---|:---
- Central US | winatp-gw-cus.microsoft.com <br> us.vortex-win.data.microsoft.com <br> crl.microsoft.com <br>*.blob.core.windows.net
+ US |```*.blob.core.windows.net``` <br>```crl.microsoft.com```<br> ```us.vortex-win.data.microsoft.com```<br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com```
- East US (2)| winatp-gw-eus.microsoft.com <br> us.vortex-win.data.microsoft.com <br> crl.microsoft.com <br>*.blob.core.windows.net
+Europe |```*.blob.core.windows.net```<br>```crl.microsoft.com```<br> ```eu.vortex-win.data.microsoft.com```<br>```winatp-gw-neu.microsoft.com```<br> ```winatp-gw-weu.microsoft.com```<br>
- West Europe | winatp-gw-weu.microsoft.com <br> eu.vortex-win.data.microsoft.com <br> crl.microsoft.com <br>*.blob.core.windows.net
- North Europe | winatp-gw-neu.microsoft.com <br> eu.vortex-win.data.microsoft.com <br> crl.microsoft.com <br>*.blob.core.windows.net
 
- <br>
  If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP  sensor is connecting from system context, make sure anonymous traffic is permitted in the above listed URLs.
 
  If you selected US as your region, you should permit anonymous traffic for URLs listed in both Central US and East US (2).