diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 4bc5d61f86..9e07262fa7 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,8 +1,10 @@ # [Windows 10 for education](index.md) ## [Change history for Windows 10 for Education](change-history-edu.md) -## [Take tests in Windows 10](take-tests-in-windows-10.md) -### [Set up Take a Test on a single PC](take-a-test-single-pc.md) -### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) -### [Take a Test app technical reference](take-a-test-app-technical.md) +## [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) +## [Technical reference for the Set up School PCs app (Preview)](set-up-school-pcs-technical.md) +## [Take tests in Windows 10 (Preview)](take-tests-in-windows-10.md) +### [Set up Take a Test on a single PC (Preview)](take-a-test-single-pc.md) +### [Set up Take a Test on multiple PCs (Preview)](take-a-test-multiple-pcs.md) +### [Take a Test app technical reference (Preview)](take-a-test-app-technical.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index 7926bc8c25..49e7b6303a 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -15,6 +15,8 @@ This topic lists new and updated topics in the [Windows 10 for Education](index. | New or changed topic | Description | |----------------------|-------------| -| [Take tests in Windows 10](take-tests-in-windows-10.md)
[Set up Take a Test on a single PC](take-a-test-single-pc.md)
[Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
[Take a Test app technical reference](take-a-test-app-technical.md) | New | +| [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) | New | +| [Set up School PCs app technical reference (Preview)](set-up-school-pcs-technical.md) | New | +| [Take tests in Windows 10 (Preview)](take-tests-in-windows-10.md)
[Set up Take a Test on a single PC (Preview)](take-a-test-single-pc.md)
[Set up Take a Test on multiple PCs (Preview)](take-a-test-multiple-pcs.md)
[Take a Test app technical reference (Preview)](take-a-test-app-technical.md) | New | | [Chromebook migration guide](chromebook-migration-guide.md) | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in November 2015 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in May 2016 | \ No newline at end of file diff --git a/education/windows/images/app1.jpg b/education/windows/images/app1.jpg index cb7f499183..aef6c5c22e 100644 Binary files a/education/windows/images/app1.jpg and b/education/windows/images/app1.jpg differ diff --git a/education/windows/images/choose-package.png b/education/windows/images/choose-package.png new file mode 100644 index 0000000000..868407df56 Binary files /dev/null and b/education/windows/images/choose-package.png differ diff --git a/education/windows/images/connect-aad.png b/education/windows/images/connect-aad.png new file mode 100644 index 0000000000..8583866165 Binary files /dev/null and b/education/windows/images/connect-aad.png differ diff --git a/education/windows/images/express-settings.png b/education/windows/images/express-settings.png new file mode 100644 index 0000000000..99e9c4825a Binary files /dev/null and b/education/windows/images/express-settings.png differ diff --git a/education/windows/images/license-terms.png b/education/windows/images/license-terms.png new file mode 100644 index 0000000000..8dd34b0a18 Binary files /dev/null and b/education/windows/images/license-terms.png differ diff --git a/education/windows/images/sign-in-prov.png b/education/windows/images/sign-in-prov.png new file mode 100644 index 0000000000..55c9276203 Binary files /dev/null and b/education/windows/images/sign-in-prov.png differ diff --git a/education/windows/images/signinprov.jpg b/education/windows/images/signinprov.jpg deleted file mode 100644 index dccd7e98e2..0000000000 Binary files a/education/windows/images/signinprov.jpg and /dev/null differ diff --git a/education/windows/images/trust-package.png b/education/windows/images/trust-package.png new file mode 100644 index 0000000000..8a293ea4da Binary files /dev/null and b/education/windows/images/trust-package.png differ diff --git a/education/windows/images/who-owns-pc.png b/education/windows/images/who-owns-pc.png new file mode 100644 index 0000000000..d3ce1def8d Binary files /dev/null and b/education/windows/images/who-owns-pc.png differ diff --git a/education/windows/index.md b/education/windows/index.md index cc96968ca3..26974a5cdc 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -16,6 +16,8 @@ author: jdeckerMS |Topic |Description | |------|------------| +| [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) | Learn how the Set up School PCs app works and how to use it. | +| [Technical reference for the Set up School PCs app (Preview)](set-up-school-pcs-technical.md) | See the changes that the Set up School PCs app makes to a PC. | | [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md new file mode 100644 index 0000000000..515f82d2d3 --- /dev/null +++ b/education/windows/set-up-school-pcs-technical.md @@ -0,0 +1,262 @@ +--- +title: Set up School PCs app technical reference +description: Describes the changes that the Set up School PCs app makes to a PC. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Technical reference for the Set up School PCs app (Preview) +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode, available in Windows 10, version 1607. **Set up School PCs** also configures school-specific settings and policies, described in this topic. + +If your school uses Azure Active Directory (Azure AD) or Office 365, the **Set up School PCs** app will create a setup file that connects the computer to your subscription. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. + +The following table tells you what you get using the **Set up School PCs** app in your school. + +| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | +| --- | :---: | :---: | :---: | :---: | +| **Fast sign-in**
Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | +| **Custom Start experience**\*
The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | +| **Temporary access, no sign-in required**
This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | +| **School policies**\*
Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | +| **Azure AD Join**
The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | +| **Single sign-on to Office 365**
By signing on with student IDs, students have fast access to Office 365 web apps. | | | X | X | +| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | +| | | | | | +\* Feature applies to Windows 10 Pro, Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU + +> **Note**: If your school uses Active Directory, use Windows Imaging and Configuration Designer to configure your PCs to join the domain. You can only use the **Set up School PCs** app to set up PCs that are not connected to your traditional domain. + +## Prerequisites for IT + +* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give the teacher appropriate privileges for joining devices or make a special account. +* Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) +* If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) +* After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System (SIS). + + +## Information about Windows Update + +Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the **Set up School PCs** app, shared PC mode sets the power states and Windows Update to: +* Wake nightly +* Check and install updates +* Forcibly reboot if necessary to finish applying updates + +The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. + +## Guidance for accounts on shared PCs + +* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. +* When a PC is set up in shared PC mode, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Start without an account** will also be deleted automatically at sign out. +* On a Windows PC joined to Azure Active Directory: + * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. + * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. +* If admin accounts are necessary on the PC + * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or + * Create admin accounts before setting up shared PC mode, or + * Create exempt accounts before signing out. +* The account management service supports accounts that are exempt from deletion. + * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. + * To add the account SID to the registry key using PowerShell: + ``` + $adminName = "LocalAdmin" + $adminPass = 'Pa$$word123' + iex "net user /add $adminName $adminPass" + $user = New-Object System.Security.Principal.NTAccount($adminName) + $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $sid = $sid.Value; + New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force + ``` + + +## Custom images +Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the **Set up School PCs** provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). + +## Provisioning package details + +The **Set up School PCs** app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). + +### Education customizations + +- Saving content locally to the PC is disabled. This prevents data loss by forcing students to save to the cloud. +- A custom Start layout and sign in background image are set. +- Prohibits Microsoft Accounts (MSAs) from being created. +- Prohibits unlocking the PC to developer mode. +- Prohibits untrusted Windows Store apps from being installed. +- Prohibits students from removing MDM. +- Prohibits students from adding new provisioning packages. +- Prohibits student from removing existing provisioning packages (including the one set by **Set up School PCs**). +- Sets active hours from 6 AM to 6 PM. +- Sets Windows Update to update nightly. + + +### Uninstalled apps + +- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) +- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) +- Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) +- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) +- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) +- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) +- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) +- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) +- Groove Music (Microsoft.ZuneMusic_8wekyb3d8bbwe) +- Movies & TV (Microsoft.ZuneVideo_8wekyb3d8bbwe) +- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) + +### Local Group Policies + +> **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Policy path

Policy name

Value

Admin Templates > Control Panel > Personalization

Prevent enabling lock screen slide show

Enabled

Prevent changing lock screen and logon image

Enabled

Admin Templates > System > Power Management > Button Settings

Select the Power button action (plugged in)

Sleep

Select the Power button action (on battery)

Sleep

Select the Sleep button action (plugged in)

Sleep

Select the lid switch action (plugged in)

Sleep

Select the lid switch action (on battery)

Sleep

Admin Templates > System > Power Management > Sleep Settings

Require a password when a computer wakes (plugged in)

Enabled

Require a password when a computer wakes (on battery)

Enabled

Specify the system sleep timeout (plugged in)

1 hour

Specify the system sleep timeout (on battery)

1 hour

Turn off hybrid sleep (plugged in)

Enabled

Turn off hybrid sleep (on battery)

Enabled

Specify the unattended sleep timeout (plugged in)

1 hour

Specify the unattended sleep timeout (on battery)

1 hour

Allow standby states (S1-S3) when sleeping (plugged in)

Enabled

Allow standby states (S1-S3) when sleeping (on battery)

Enabled

Specify the system hibernate timeout (plugged in)

Enabled, 0

Specify the system hibernate timeout (on battery)

Enabled, 0

Admin Templates > System > Power Management > Video and Display Settings

Turn off the display (plugged in)

1 hour

Turn off the display (on battery

1 hour

Admin Templates > System > Logon

Show first sign-in animation

Disabled

Hide entry points for Fast User Switching

Enabled

Turn on convenience PIN sign-in

Disabled

Turn off picture password sign-in

Enabled

Turn off app notification on the lock screen

Enabled

Allow users to select when a password is required when resuming from connected standby

Disabled

Block user from showing account details on sign-in

Enabled

Admin Templates > System > User Profiles

Turn off the advertising ID

Enabled

Admin Templates > Windows Components

Do not show Windows Tips

Enabled

Turn off Microsoft consumer experiences

Enabled

Microsoft Passport for Work

Disabled

Prevent the usage of OneDrive for file storage

Enabled

Admin Templates > Windows Components > Biometrics

Allow the use of biometrics

Disabled

Allow users to log on using biometrics

Disabled

Allow domain users to log on using biometrics

Disabled

Admin Templates > Windows Components > Data Collection and Preview Builds

Toggle user control over Insider builds

Disabled

Disable pre-release features or settings

Disabled

Do not show feedback notifications

Enabled

Admin Templates > Windows Components > File Explorer

Show lock in the user tile menu

Disabled

Admin Templates > Windows Components > Maintenance Scheduler

Automatic Maintenance Activation Boundary

12am

Automatic Maintenance Random Delay

Enabled, 2 hours

Automatic Maintenance WakeUp Policy

Enabled

Admin Templates > Windows Components > Microsoft Edge

Open a new tab with an empty tab

Disabled

Configure corporate home pages

Enabled, about:blank

Admin Templates > Windows Components > Search

Allow Cortana

Disabled

Windows Settings > Security Settings > Local Policies > Security Options

Interactive logon: Do not display last user name

Enabled

Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

Disabled

Shutdown: Allow system to be shut down without having to log on

Disabled

User Account Control: Behavior of the elevation prompt for standard users

Auto deny



+ +## Related topics + +[Use Set up School PCs app](use-set-up-school-pcs-app.md) + + + + diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 3245416d58..149c29d066 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Take a Test app technical reference +# Take a Test app technical reference (Preview) **Applies to:** - Windows 10 Insider Preview @@ -46,11 +46,11 @@ When Take a Test is running, the following MDM policies are applied to lock down | Policy | Description | Value | |---|---|---| | AllowToasts | Disables toast notifications from being shown | 0 | -| AllAppStoreAutoUpdate | Disables automatic updates for Windows Store apps that are installed on the PC | 0 | +| AllowAppStoreAutoUpdate | Disables automatic updates for Windows Store apps that are installed on the PC | 0 | | AllowDeviceDiscovery | Disables UI for screen sharing | 0 | | AllowInput Panel | Disables the onscreen keyboard which will disable auto-fill | 0 | | AllowCortana | Disables Cortana functionality | 0 | -| AllAutoupdate | Disables Windows Update from starting OS updates | 5 | +| AllowAutoupdate | Disables Windows Update from starting OS updates | 5 | ## Allowed functionality @@ -62,20 +62,20 @@ When Take a Test is running, the following functionality is available to student - Magnifier is available through Windows key + "+" key -- Full screen mode is compatible + - Full screen mode is compatible - The student can press Alt+Tab when locked down. This results in the student being able to switch between the following: - Take a Test - Assistive technology that may be running - - Lock Screen + - Lock Screen (not available if student is using a dedicated test account) > **Note** The app will exit if the student signs in to an account from the lock screen. Progress made in the test may be lost or invalidated. - The student can exit the test by pressing one of the following key combinations: - Ctrl+Alt+Del - - Alt+F4 + - Alt+F4 (**Take a Test** will restart if the student is using a dedicated test account) diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 116da7017f..64dde75a76 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -8,10 +8,10 @@ ms.sitesec: library author: jdeckerMS --- -# Set up Take a Test on multiple PCs +# Set up Take a Test on multiple PCs (Preview) **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 724aa1066b..e1c6bb189c 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -8,10 +8,10 @@ ms.sitesec: library author: jdeckerMS --- -# Set up Take a Test on a single PC +# Set up Take a Test on a single PC (Preview) **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 09ed708476..7d15a79d72 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -8,17 +8,17 @@ ms.sitesec: library author: jdeckerMS --- -# Take tests in Windows 10 +# Take tests in Windows 10 (Preview) **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: -- A Microsoft Edge browser window opens, showing just the test and nothing else. +- **Take a Test** shows just the test and nothing else. - Students aren’t able to go to other websites. - Students can’t open or access other apps. - Students can't share, print, or record their screens. @@ -33,7 +33,7 @@ Many schools use online testing for formative and summative assessments. It's cr ![Use test account or test url in Take a Test](images/take-a-test-flow.png) -- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. - **Put a test URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. [Learn how to set up Take a Test on a single PC](take-a-test-single-pc.md) diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md new file mode 100644 index 0000000000..1e5af39910 --- /dev/null +++ b/education/windows/use-set-up-school-pcs-app.md @@ -0,0 +1,142 @@ +--- +title: Use Set up School PCs app +description: Learn how the Set up School PCs app works and how to use it. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Use the Set up School PCs app (Preview) +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + +![Run app, turn on PC, insert USB key](images/app1.jpg) + +## What does this app do? + +The Set up School PCs app helps you set up new computers running Windows 10, version 1607. Some benefits of using this app to set up your students' PCs: +* A computer set up this way is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + * Places tiles for OneNote, Office 365 web apps, Sway, and Microsoft Classroom on the Start menu + * Installs OneDrive for cloud-based documents and places it on the Start menu and taskbar + * Sets Microsoft Edge as the default browser + * Uninstalls apps not specific to education, such as Solitaire and Sports + * Turns off Offers and tips + * Prevents students from adding personal Microsoft accounts to the computer +* Significantly improves how fast students sign-in. +* The app connects the PCs to your school’s cloud so IT can manage them (optional). +* Windows 10 automatically manages accounts no matter how many students use the PC. +* Keeps computers up-to-date without interfering with class time using Windows Update and maintenance hours (by default, 12 AM). +* Customizes the sign-in screen to support students with IDs and temporary users. +* Locks down the computer to prevent mischievous activity: + * Prevents students from installing apps + * Prevents students from removing the computer from the school's device management system + * Prevents students from removing the Set up School PCs settings + + +## Tips for success + +* **Run the app at work**: For the best results, run the **Set up School PCs** app on your work device connected to your school's network. That way the app can gather accurate information about your wireless networks and cloud subscriptions. + > **Note**: Don't use **Set up Schools PCs** app for PCs that must connect to enterprise networks or to open wi-fi networks that require the user to accept Terms of Use. +* **Apply to new computers**: The setup file that the **Set up School PCs** app creates should be used on new computers that haven't been set up for accounts yet. If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. +> **Warning**: Only use the setup file on computers that you want to configure and lock down for students. After you apply the setup file to a computer, the computer must be reset to remove the settings. +* **Turn on student PCs and stay on first screen**: The computer must be on this screen when you insert the USB key. + +![The first screen to set up a new PC](images/oobe.jpg) + +If you have gone past this screen, you may have to reset your PC to start over. To reset your PC after you have completed the first run experience, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. +* **Use more than one USB key**: If you are setting up multiple PCs, you can set them up at the same time. Just run the **Set up School PCs** app again and save the same settings to another key. That way you can run set up on more than one PC at once. Create three keys and you can run it on three PCs at once, etc. +* **Start fresh**: If the PC has already been set up and you want to return to the first-run-experience to apply a new package, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. +* **Keep it clean**: We strongly recommend that IT avoid changes to policies unless absolutely necessary, as any changes can impair performance and sign-in time. Get more information at [Set up School PCs app technical reference](set-up-school-pcs-technical.md). + +## Set up School PCs app step-by-step + +What you need: + +- The **Set up School PCs** app, installed on your work computer, connected to your school's network +- A USB drive, 1 GB or larger + +### Create the setup file in the app + +The **Set up School PCs** app guides you through the configuration choices for the student PCs. + +1. Open the **Set up School PCs** app and select **Start**. + + ![select start](images/app1.jpg) + +2. Choose **No** to require students to sign in only with an account, or choose **Yes** to allow students to use the PC without an account too, and then select **Next**. + + ![account required?](images/setup-app-1-access.png) + +3. Choose a Wi-Fi network from the list and then select **Next**, or choose **Manually connect to a wireless network** to enter the network information yourself. + + ![choose network](images/setup-app-1-wifi.png) + + - For a manual network connection, enter the network name, security type, and password (if required), and then select **Next**. + + ![enter network information](images/setup-app-1-wifi-manual.png) + +4. Insert a USB drive, select it in the app, and then select **Save**. + + ![select usb drive](images/setup-app-1-usb.png) + + + +### Apply the setup file to PCs + +The setup file on your USB drive is named `SetupSchoolPCs.ppkg`, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. + +1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. + + ![The first screen to set up a new PC](images/oobe.jpg) + +2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. + + ![Set up device?](images/setupmsg.jpg) + +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. + + ![Provision this device](images/prov.jpg) + +4. Select `SetupSchoolPCs.ppkg` and tap **Next**. + + ![Choose a package](images/choose-package.png) + +5. Select **Yes, add it**. + + ![Do you trust this package?](images/trust-package.png) + +6. Read and accept the Microsoft Software License Terms. + + ![Sign in](images/license-terms.png) + +7. Select **Use Express settings**. + + ![Get going fast](images/express-settings.png) + +8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**. + + ![Who owns this PC?](images/who-owns-pc.png) + +9. On the **Choose how you'll connect** screen, select **Join Azure AD** and tap **Next**. + + ![Connect to Azure AD](images/connect-aad.png) + +10. Your last step is to sign in. Use your Azure AD or Office 365 account and password. When you see the progress ring, you can remove the USB drive. + + ![Sign in](images/sign-in-prov.png) + + +That's it! Sign out and the computer is now ready for students. + +## Learn more + +See [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md) for prerequisites and provisioning details. + diff --git a/windows/deploy/activate-forest-by-proxy-vamt.md b/windows/deploy/activate-forest-by-proxy-vamt.md index f178e14406..1e852d5221 100644 --- a/windows/deploy/activate-forest-by-proxy-vamt.md +++ b/windows/deploy/activate-forest-by-proxy-vamt.md @@ -2,7 +2,7 @@ title: Activate by Proxy an Active Directory Forest (Windows 10) description: Activate by Proxy an Active Directory Forest ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/activate-forest-vamt.md b/windows/deploy/activate-forest-vamt.md index 267e03be9c..082bac639c 100644 --- a/windows/deploy/activate-forest-vamt.md +++ b/windows/deploy/activate-forest-vamt.md @@ -2,7 +2,7 @@ title: Activate an Active Directory Forest Online (Windows 10) description: Activate an Active Directory Forest Online ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/activate-using-active-directory-based-activation-client.md b/windows/deploy/activate-using-active-directory-based-activation-client.md index 15ae96825a..dbf9a5a617 100644 --- a/windows/deploy/activate-using-active-directory-based-activation-client.md +++ b/windows/deploy/activate-using-active-directory-based-activation-client.md @@ -3,11 +3,11 @@ title: Activate using Active Directory-based activation (Windows 10) description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: CFaw +author: greg-lindsay --- # Activate using Active Directory-based activation diff --git a/windows/deploy/activate-using-key-management-service-vamt.md b/windows/deploy/activate-using-key-management-service-vamt.md index 4c5d735436..9681860156 100644 --- a/windows/deploy/activate-using-key-management-service-vamt.md +++ b/windows/deploy/activate-using-key-management-service-vamt.md @@ -3,7 +3,7 @@ title: Activate using Key Management Service (Windows 10) ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac description: keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/activate-windows-10-clients-vamt.md b/windows/deploy/activate-windows-10-clients-vamt.md index 91b743947e..2d77f355dc 100644 --- a/windows/deploy/activate-windows-10-clients-vamt.md +++ b/windows/deploy/activate-windows-10-clients-vamt.md @@ -3,7 +3,7 @@ title: Activate clients running Windows 10 (Windows 10) description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/active-directory-based-activation-overview.md b/windows/deploy/active-directory-based-activation-overview.md index 7f47592aa7..9a64d7572a 100644 --- a/windows/deploy/active-directory-based-activation-overview.md +++ b/windows/deploy/active-directory-based-activation-overview.md @@ -2,11 +2,11 @@ title: Active Directory-Based Activation Overview (Windows 10) description: Active Directory-Based Activation Overview ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: CFaw +author: greg-lindsay --- # Active Directory-Based Activation Overview diff --git a/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md index 13a328ea77..5a3eadbc33 100644 --- a/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md +++ b/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Add a Windows 10 operating system image using Configuration Manager (Windows 10) description: Operating system images are typically the production image used for deployment throughout the organization. ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b -keywords: ["image, deploy, distribute"] -ms.prod: W10 +keywords: image, deploy, distribute +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md index 8e72718b82..de701986b4 100644 --- a/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md +++ b/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager (Windows 10) description: In this topic, you will learn how to configure the Windows Preinstallation Environment (Windows PE) to include the network drivers required to connect to the deployment share and the storage drivers required to see the local storage on machines. ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c -keywords: ["deploy, task sequence"] -ms.prod: W10 +keywords: deploy, task sequence +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/add-manage-products-vamt.md b/windows/deploy/add-manage-products-vamt.md index 6bbbfaf218..88d5145472 100644 --- a/windows/deploy/add-manage-products-vamt.md +++ b/windows/deploy/add-manage-products-vamt.md @@ -2,7 +2,7 @@ title: Add and Manage Products (Windows 10) description: Add and Manage Products ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/add-remove-computers-vamt.md b/windows/deploy/add-remove-computers-vamt.md index eae34332f2..2ad22c3d7f 100644 --- a/windows/deploy/add-remove-computers-vamt.md +++ b/windows/deploy/add-remove-computers-vamt.md @@ -2,7 +2,7 @@ title: Add and Remove Computers (Windows 10) description: Add and Remove Computers ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS diff --git a/windows/deploy/add-remove-product-key-vamt.md b/windows/deploy/add-remove-product-key-vamt.md index 5776806c20..d659ae2507 100644 --- a/windows/deploy/add-remove-product-key-vamt.md +++ b/windows/deploy/add-remove-product-key-vamt.md @@ -2,7 +2,7 @@ title: Add and Remove a Product Key (Windows 10) description: Add and Remove a Product Key ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md index 8a21466ddb..39133a9d8c 100644 --- a/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md @@ -3,7 +3,7 @@ title: Appendix Information sent to Microsoft during activation (Windows 10) ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 description: keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md index dab995bb1e..1319888616 100644 --- a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md +++ b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md @@ -3,7 +3,7 @@ title: Assign applications using roles in MDT (Windows 10) description: This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. ms.assetid: d82902e4-de9c-4bc4-afe0-41d649b83ce7 keywords: settings, database, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md index 32a354ad0e..f015c71c1f 100644 --- a/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md +++ b/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md @@ -3,7 +3,7 @@ title: Build a distributed environment for Windows 10 deployment (Windows 10) description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c keywords: replication, replicate, deploy, configure, remote -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/change-history-for-deploy-windows-10.md b/windows/deploy/change-history-for-deploy-windows-10.md index 3ca65edd17..00404f4def 100644 --- a/windows/deploy/change-history-for-deploy-windows-10.md +++ b/windows/deploy/change-history-for-deploy-windows-10.md @@ -2,10 +2,10 @@ title: Change history for Deploy Windows 10 (Windows 10) description: This topic lists new and updated topics in the Deploy Windows 10 documentation for Windows 10 and Windows 10 Mobile. ms.assetid: 19C50373-6B25-4F5C-A6EF-643D36904349 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Change history for Deploy Windows 10 diff --git a/windows/deploy/configure-client-computers-vamt.md b/windows/deploy/configure-client-computers-vamt.md index b3618bac74..704c8d01f9 100644 --- a/windows/deploy/configure-client-computers-vamt.md +++ b/windows/deploy/configure-client-computers-vamt.md @@ -2,7 +2,7 @@ title: Configure Client Computers (Windows 10) description: Configure Client Computers ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/configure-mdt-2013-for-userexit-scripts.md b/windows/deploy/configure-mdt-2013-for-userexit-scripts.md index 590f112414..a94bee6b7b 100644 --- a/windows/deploy/configure-mdt-2013-for-userexit-scripts.md +++ b/windows/deploy/configure-mdt-2013-for-userexit-scripts.md @@ -3,7 +3,7 @@ title: Configure MDT for UserExit scripts (Windows 10) description: In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. ms.assetid: 29a421d1-12d2-414e-86dc-25b62f5238a7 keywords: rules, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/configure-mdt-2013-settings.md b/windows/deploy/configure-mdt-2013-settings.md index af41a8a1bb..ba84efd5c1 100644 --- a/windows/deploy/configure-mdt-2013-settings.md +++ b/windows/deploy/configure-mdt-2013-settings.md @@ -3,7 +3,7 @@ title: Configure MDT settings (Windows 10) description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) 2013 is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 keywords: customize, customization, deploy, features, tools -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/configure-mdt-deployment-share-rules.md b/windows/deploy/configure-mdt-deployment-share-rules.md index 908f92144b..5eeadbbfd6 100644 --- a/windows/deploy/configure-mdt-deployment-share-rules.md +++ b/windows/deploy/configure-mdt-deployment-share-rules.md @@ -3,7 +3,7 @@ title: Configure MDT deployment share rules (Windows 10) description: In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. ms.assetid: b5ce2360-33cc-4b14-b291-16f75797391b keywords: rules, configuration, automate, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md index 049c3e93c2..a5cbfb7886 100644 --- a/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md +++ b/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Create a custom Windows PE boot image with Configuration Manager (Windows 10) description: In Microsoft System Center 2012 R2 Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809 -keywords: ["tool, customize, deploy, boot image"] -ms.prod: W10 +keywords: tool, customize, deploy, boot image +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md b/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md index 03c856a7dc..0838ebde59 100644 --- a/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md +++ b/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md @@ -2,9 +2,10 @@ title: Create a task sequence with Configuration Manager and MDT (Windows 10) description: In this topic, you will learn how to create a Microsoft System Center 2012 R2 Configuration Manager task sequence with Microsoft Deployment Toolkit (MDT) integration using the MDT wizard. ms.assetid: 0b069bec-5be8-47c6-bf64-7a630f41ac98 -keywords: ["deploy, upgrade, task sequence, install"] -ms.prod: W10 +keywords: deploy, upgrade, task sequence, install +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: mdt ms.sitesec: library author: mtniehaus --- diff --git a/windows/deploy/create-a-windows-10-reference-image.md b/windows/deploy/create-a-windows-10-reference-image.md index f81f4eac9a..50ec7f2fcf 100644 --- a/windows/deploy/create-a-windows-10-reference-image.md +++ b/windows/deploy/create-a-windows-10-reference-image.md @@ -3,7 +3,7 @@ title: Create a Windows 10 reference image (Windows 10) description: Creating a reference image is important because that image serves as the foundation for the devices in your organization. ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa keywords: deploy, deployment, configure, customize, install, installation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md index c47ac7bc38..5dbd28f0c8 100644 --- a/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md +++ b/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Create an application to deploy with Windows 10 using Configuration Manager (Windows 10) description: Microsoft System Center 2012 R2 Configuration Manager supports deploying applications as part of the Windows 10 deployment process. ms.assetid: 2dfb2f39-1597-4999-b4ec-b063e8a8c90c -keywords: ["deployment, task sequence, custom, customize"] -ms.prod: W10 +keywords: deployment, task sequence, custom, customize +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-a-windows-10-image-using-mdt.md b/windows/deploy/deploy-a-windows-10-image-using-mdt.md index 23176dbd84..7f92cbc0d8 100644 --- a/windows/deploy/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deploy/deploy-a-windows-10-image-using-mdt.md @@ -2,8 +2,8 @@ title: Deploy a Windows 10 image using MDT 2013 Update 2 (Windows 10) description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c -keywords: [eployment, automate, tools, configure -ms.prod: W10 +keywords: deployment, automate, tools, configure +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md index 0cdf8e0509..2bc874cf8b 100644 --- a/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md +++ b/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -2,8 +2,8 @@ title: Deploy Windows 10 using PXE and Configuration Manager (Windows 10) description: In this topic, you will learn how to deploy Windows 10 using Microsoft System Center 2012 R2 Configuration Manager deployment packages and task sequences. ms.assetid: fb93f514-5b30-4f4b-99dc-58e6860009fa -keywords: ["deployment, image, UEFI, task sequence"] -ms.prod: W10 +keywords: deployment, image, UEFI, task sequence +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md b/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md index 32ee03ca6c..e3e558c24b 100644 --- a/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md +++ b/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md @@ -2,8 +2,8 @@ title: Deploy Windows 10 with System Center 2012 R2 Configuration Manager (Windows 10) description: If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. ms.assetid: eacd7b7b-dde0-423d-97cd-29bde9e8b363 -keywords: ["deployment, custom, boot"] -ms.prod: W10 +keywords: deployment, custom, boot +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md index 765f29c16d..93028930c5 100644 --- a/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md @@ -3,7 +3,7 @@ title: Deploy Windows 10 with the Microsoft Deployment Toolkit (Windows 10) description: This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. ms.assetid: 837f009c-617e-4b3f-9028-2246067ee0fb keywords: deploy, tools, configure, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-windows-to-go.md b/windows/deploy/deploy-windows-to-go.md index 609ae81687..b4e13c5b8c 100644 --- a/windows/deploy/deploy-windows-to-go.md +++ b/windows/deploy/deploy-windows-to-go.md @@ -2,10 +2,11 @@ title: Deploy Windows To Go in your organization (Windows 10) description: This topic helps you to deploy Windows To Go in your organization. ms.assetid: cfe550be-ffbd-42d1-ab4d-80efae49b07f -keywords: ["deployment, USB, device, BitLocker, workspace, security, data"] -ms.prod: W10 +keywords: deployment, USB, device, BitLocker, workspace, security, data +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mobility author: mtniehaus --- diff --git a/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md index 67136031be..2ed9de7378 100644 --- a/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md +++ b/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Finalize the operating system configuration for Windows 10 deployment with Configuration Manager (Windows 10) description: This topic walks you through the steps to finalize the configuration of your Windows 10 operating deployment, which includes enablement of the optional Microsoft Deployment Toolkit (MDT) monitoring for Microsoft System Center 2012 R2 Configuration Manager, logs folder creation, rules configuration, content distribution, and deployment of the previously created task sequence. ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e -keywords: ["configure, deploy, upgrade"] -ms.prod: W10 +keywords: configure, deploy, upgrade +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md index 57d9153cb2..85ad95c548 100644 --- a/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md @@ -3,7 +3,7 @@ title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 in particular, as part of a Windows operating system deployment. ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee keywords: deploy, image, feature, install, tools -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/getting-started-with-the-user-state-migration-tool.md b/windows/deploy/getting-started-with-the-user-state-migration-tool.md index d83c01ec2d..8dae688326 100644 --- a/windows/deploy/getting-started-with-the-user-state-migration-tool.md +++ b/windows/deploy/getting-started-with-the-user-state-migration-tool.md @@ -2,10 +2,10 @@ title: Getting Started with the User State Migration Tool (USMT) (Windows 10) description: Getting Started with the User State Migration Tool (USMT) ms.assetid: 506ff1d2-94b8-4460-8672-56aad963504b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Getting Started with the User State Migration Tool (USMT) diff --git a/windows/deploy/import-export-vamt-data.md b/windows/deploy/import-export-vamt-data.md index aff3d6376f..d33f27e139 100644 --- a/windows/deploy/import-export-vamt-data.md +++ b/windows/deploy/import-export-vamt-data.md @@ -2,7 +2,7 @@ title: Import and Export VAMT Data (Windows 10) description: Import and Export VAMT Data ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/index.md b/windows/deploy/index.md index a3b28ded45..0e5d1a0f8b 100644 --- a/windows/deploy/index.md +++ b/windows/deploy/index.md @@ -2,10 +2,10 @@ title: Deploy Windows 10 (Windows 10) description: Learn about deploying Windows 10 for IT professionals. ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Deploy Windows 10 diff --git a/windows/deploy/install-configure-vamt.md b/windows/deploy/install-configure-vamt.md index a660854f6f..49b3f8ec44 100644 --- a/windows/deploy/install-configure-vamt.md +++ b/windows/deploy/install-configure-vamt.md @@ -2,7 +2,7 @@ title: Install and Configure VAMT (Windows 10) description: Install and Configure VAMT ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/install-kms-client-key-vamt.md b/windows/deploy/install-kms-client-key-vamt.md index f1e5cd2769..9605053d6a 100644 --- a/windows/deploy/install-kms-client-key-vamt.md +++ b/windows/deploy/install-kms-client-key-vamt.md @@ -2,7 +2,7 @@ title: Install a KMS Client Key (Windows 10) description: Install a KMS Client Key ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/install-product-key-vamt.md b/windows/deploy/install-product-key-vamt.md index a3f4a3760e..71817b7b80 100644 --- a/windows/deploy/install-product-key-vamt.md +++ b/windows/deploy/install-product-key-vamt.md @@ -2,7 +2,7 @@ title: Install a Product Key (Windows 10) description: Install a Product Key ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/install-vamt.md b/windows/deploy/install-vamt.md index 02275fb993..07a9a72b5b 100644 --- a/windows/deploy/install-vamt.md +++ b/windows/deploy/install-vamt.md @@ -2,7 +2,7 @@ title: Install VAMT (Windows 10) description: Install VAMT ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/integrate-configuration-manager-with-mdt-2013.md b/windows/deploy/integrate-configuration-manager-with-mdt-2013.md index 1ad2dbc2bd..4a30f0f74c 100644 --- a/windows/deploy/integrate-configuration-manager-with-mdt-2013.md +++ b/windows/deploy/integrate-configuration-manager-with-mdt-2013.md @@ -4,7 +4,7 @@ description: This topic will help you understand the benefits of integrating the ms.assetid: 3bd1cf92-81e5-48dc-b874-0f5d9472e5a5 ms.pagetype: mdt keywords: deploy, image, customize, task sequence -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/introduction-vamt.md b/windows/deploy/introduction-vamt.md index ee0060ad4e..3d51c0dd02 100644 --- a/windows/deploy/introduction-vamt.md +++ b/windows/deploy/introduction-vamt.md @@ -2,7 +2,7 @@ title: Introduction to VAMT (Windows 10) description: Introduction to VAMT ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/key-features-in-mdt-2013.md b/windows/deploy/key-features-in-mdt-2013.md index 7982bb6d03..03f562ac8e 100644 --- a/windows/deploy/key-features-in-mdt-2013.md +++ b/windows/deploy/key-features-in-mdt-2013.md @@ -3,7 +3,7 @@ title: Key features in MDT 2013 Update 2 (Windows 10) description: The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. ms.assetid: 858e384f-e9db-4a93-9a8b-101a503e4868 keywords: deploy, feature, tools, upgrade, migrate, provisioning -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/kms-activation-vamt.md b/windows/deploy/kms-activation-vamt.md index 4cd554a80b..beed3fb86f 100644 --- a/windows/deploy/kms-activation-vamt.md +++ b/windows/deploy/kms-activation-vamt.md @@ -2,7 +2,7 @@ title: Perform KMS Activation (Windows 10) description: Perform KMS Activation ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/local-reactivation-vamt.md b/windows/deploy/local-reactivation-vamt.md index 2cd36eb80b..72b132e799 100644 --- a/windows/deploy/local-reactivation-vamt.md +++ b/windows/deploy/local-reactivation-vamt.md @@ -2,7 +2,7 @@ title: Perform Local Reactivation (Windows 10) description: Perform Local Reactivation ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/manage-activations-vamt.md b/windows/deploy/manage-activations-vamt.md index 1f15048dea..effac81fd1 100644 --- a/windows/deploy/manage-activations-vamt.md +++ b/windows/deploy/manage-activations-vamt.md @@ -2,7 +2,7 @@ title: Manage Activations (Windows 10) description: Manage Activations ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/manage-product-keys-vamt.md b/windows/deploy/manage-product-keys-vamt.md index fffe5de77e..a495718fe7 100644 --- a/windows/deploy/manage-product-keys-vamt.md +++ b/windows/deploy/manage-product-keys-vamt.md @@ -2,7 +2,7 @@ title: Manage Product Keys (Windows 10) description: Manage Product Keys ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/manage-vamt-data.md b/windows/deploy/manage-vamt-data.md index adbd4c4ec6..00bbd3982f 100644 --- a/windows/deploy/manage-vamt-data.md +++ b/windows/deploy/manage-vamt-data.md @@ -2,7 +2,7 @@ title: Manage VAMT Data (Windows 10) description: Manage VAMT Data ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/mdt-2013-lite-touch-components.md b/windows/deploy/mdt-2013-lite-touch-components.md index 6766bdc104..48f1a250ad 100644 --- a/windows/deploy/mdt-2013-lite-touch-components.md +++ b/windows/deploy/mdt-2013-lite-touch-components.md @@ -3,7 +3,7 @@ title: MDT 2013 Update 2 Lite Touch components (Windows 10) description: This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) 2013 Update 2 that support Lite Touch Installation (LTI) for Windows 10. ms.assetid: 7d6fc159-e338-439e-a2e6-1778d0da9089 keywords: deploy, install, deployment, boot, log, monitor -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/migrate-application-settings.md b/windows/deploy/migrate-application-settings.md index af79e440f7..6a8ffdc612 100644 --- a/windows/deploy/migrate-application-settings.md +++ b/windows/deploy/migrate-application-settings.md @@ -2,10 +2,10 @@ title: Migrate Application Settings (Windows 10) description: Migrate Application Settings ms.assetid: 28f70a83-0a3e-4a6b-968a-2b78ccd3cc07 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migrate Application Settings diff --git a/windows/deploy/migration-store-types-overview.md b/windows/deploy/migration-store-types-overview.md index cf0c52812e..9ee233402b 100644 --- a/windows/deploy/migration-store-types-overview.md +++ b/windows/deploy/migration-store-types-overview.md @@ -2,10 +2,10 @@ title: Migration Store Types Overview (Windows 10) description: Migration Store Types Overview ms.assetid: 3b6ce746-76c6-43ff-8cd5-02ed0ae0cf70 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migration Store Types Overview diff --git a/windows/deploy/monitor-activation-client.md b/windows/deploy/monitor-activation-client.md index 5a3050cb0b..26c8257cc3 100644 --- a/windows/deploy/monitor-activation-client.md +++ b/windows/deploy/monitor-activation-client.md @@ -3,11 +3,11 @@ title: Monitor activation (Windows 10) ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 description: keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: CFaw +author: greg-lindsay --- # Monitor activation diff --git a/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md b/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md index 7802d20b05..12aae5a28c 100644 --- a/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md +++ b/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Monitor the Windows 10 deployment with Configuration Manager (Windows 10) description: In this topic, you will learn how to monitor a Windows 10 deployment that was started previously using Microsoft System Center 2012 R2 Configuration Manager and the Microsoft Deployment Toolkit (MDT) Deployment Workbench. ms.assetid: 4863c6aa-6369-4171-8e1a-b052ca195fce -keywords: ["deploy, upgrade"] -ms.prod: W10 +keywords: deploy, upgrade +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/offline-migration-reference.md b/windows/deploy/offline-migration-reference.md index 6ad60f1704..f54d3b4c7b 100644 --- a/windows/deploy/offline-migration-reference.md +++ b/windows/deploy/offline-migration-reference.md @@ -2,10 +2,10 @@ title: Offline Migration Reference (Windows 10) description: Offline Migration Reference ms.assetid: f347547c-d601-4c3e-8f2d-0138edeacfda -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Offline Migration Reference diff --git a/windows/deploy/online-activation-vamt.md b/windows/deploy/online-activation-vamt.md index 5f537d3e20..65311aa3e8 100644 --- a/windows/deploy/online-activation-vamt.md +++ b/windows/deploy/online-activation-vamt.md @@ -2,7 +2,7 @@ title: Perform Online Activation (Windows 10) description: Perform Online Activation ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/plan-for-volume-activation-client.md b/windows/deploy/plan-for-volume-activation-client.md index 3247677c72..d5ed360f3e 100644 --- a/windows/deploy/plan-for-volume-activation-client.md +++ b/windows/deploy/plan-for-volume-activation-client.md @@ -3,7 +3,7 @@ title: Plan for volume activation (Windows 10) description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. ms.assetid: f84b005b-c362-4a70-a84e-4287c0d2e4ca keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md index a7b98b2ab3..8f2bbad1b9 100644 --- a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md +++ b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md @@ -3,7 +3,7 @@ title: Prepare for deployment with MDT 2013 Update 2 (Windows 10) description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT) 2013 Update 2. ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 keywords: deploy, system requirements -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md index d9735f4ee1..88a8cac968 100644 --- a/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md +++ b/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager (Windows 10) description: This topic will walk you through the process of integrating Microsoft System Center 2012 R2 Configuration Manager SP1 with Microsoft Deployment Toolkit (MDT) 2013 Update 2, as well as the other preparations needed to deploying Windows 10 via Zero Touch Installation. Additional preparations include the installation of hotfixes as well as activities that speed up the Pre-Boot Execution Environment (PXE). ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08 -keywords: ["install, configure, deploy, deployment"] -ms.prod: W10 +keywords: install, configure, deploy, deployment +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/proxy-activation-vamt.md b/windows/deploy/proxy-activation-vamt.md index c848bcd8ab..ab273007b8 100644 --- a/windows/deploy/proxy-activation-vamt.md +++ b/windows/deploy/proxy-activation-vamt.md @@ -2,7 +2,7 @@ title: Perform Proxy Activation (Windows 10) description: Perform Proxy Activation ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md index 7d5143cf31..68b0a74563 100644 --- a/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) description: This topic will show you how to use a previously created task sequence to refresh a Windows 7 SP1 client with Windows 10 using Microsoft System Center 2012 R2 Configuration Manager and Microsoft Deployment Toolkit (MDT) 2013 Update 2. ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7 -keywords: ["upgrade, install, installation, computer refresh"] -ms.prod: W10 +keywords: upgrade, install, installation, computer refresh +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md b/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md index 70dadf1711..f6ea4a2125 100644 --- a/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md +++ b/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md @@ -3,7 +3,7 @@ title: Refresh a Windows 7 computer with Windows 10 (Windows 10) description: This topic will show you how to use MDT 2013 Update 2 Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f keywords: reinstallation, customize, template, script, restore -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/remove-products-vamt.md b/windows/deploy/remove-products-vamt.md index 8dca272b68..da875ea27e 100644 --- a/windows/deploy/remove-products-vamt.md +++ b/windows/deploy/remove-products-vamt.md @@ -2,7 +2,7 @@ title: Remove Products (Windows 10) description: Remove Products ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md index 44bc003fca..b9f521531f 100644 --- a/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft System Center 2012 R2 Configuration Manager. ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36 -keywords: ["upgrade, install, installation, replace computer, setup"] -ms.prod: W10 +keywords: upgrade, install, installation, replace computer, setup +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md index bc78de5970..a862edf501 100644 --- a/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md +++ b/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -3,7 +3,7 @@ title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) description: A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10; however, because you are replacing a machine, you cannot store the backup on the old computer. ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a keywords: deploy, deployment, replace -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/scenario-kms-activation-vamt.md b/windows/deploy/scenario-kms-activation-vamt.md index a43796b90b..385af084f9 100644 --- a/windows/deploy/scenario-kms-activation-vamt.md +++ b/windows/deploy/scenario-kms-activation-vamt.md @@ -2,7 +2,7 @@ title: Scenario 3 KMS Client Activation (Windows 10) description: Scenario 3 KMS Client Activation ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/scenario-online-activation-vamt.md b/windows/deploy/scenario-online-activation-vamt.md index 69d308ee9c..41dda833ac 100644 --- a/windows/deploy/scenario-online-activation-vamt.md +++ b/windows/deploy/scenario-online-activation-vamt.md @@ -2,7 +2,7 @@ title: Scenario 1 Online Activation (Windows 10) description: Scenario 1 Online Activation ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/scenario-proxy-activation-vamt.md b/windows/deploy/scenario-proxy-activation-vamt.md index 8666ae35c6..2e475d02b4 100644 --- a/windows/deploy/scenario-proxy-activation-vamt.md +++ b/windows/deploy/scenario-proxy-activation-vamt.md @@ -2,7 +2,7 @@ title: Scenario 2 Proxy Activation (Windows 10) description: Scenario 2 Proxy Activation ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/set-up-mdt-2013-for-bitlocker.md b/windows/deploy/set-up-mdt-2013-for-bitlocker.md index 5af8715c60..7a76f8cdf7 100644 --- a/windows/deploy/set-up-mdt-2013-for-bitlocker.md +++ b/windows/deploy/set-up-mdt-2013-for-bitlocker.md @@ -3,7 +3,7 @@ title: Set up MDT for BitLocker (Windows 10) ms.assetid: 386e6713-5c20-4d2a-a220-a38d94671a38 description: keywords: disk, encryption, TPM, configure, secure, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/sideload-apps-in-windows-10.md b/windows/deploy/sideload-apps-in-windows-10.md index 63f3fe6fef..9af7d4e4bc 100644 --- a/windows/deploy/sideload-apps-in-windows-10.md +++ b/windows/deploy/sideload-apps-in-windows-10.md @@ -2,10 +2,10 @@ title: Sideload LOB apps in Windows 10 (Windows 10) description: Sideload line-of-business apps in Windows 10. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Sideload LOB apps in Windows 10 diff --git a/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md index a8391582fa..a6c8789efb 100644 --- a/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md +++ b/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -3,7 +3,7 @@ title: Simulate a Windows 10 deployment in a test environment (Windows 10) description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. ms.assetid: 2de86c55-ced9-4078-b280-35e0329aea9c keywords: deploy, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/understanding-migration-xml-files.md b/windows/deploy/understanding-migration-xml-files.md index 528c77f8d3..c03bc14e24 100644 --- a/windows/deploy/understanding-migration-xml-files.md +++ b/windows/deploy/understanding-migration-xml-files.md @@ -2,10 +2,10 @@ title: Understanding Migration XML Files (Windows 10) description: Understanding Migration XML Files ms.assetid: d3d1fe89-085c-4da8-9657-fd54b8bfc4b7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Understanding Migration XML Files diff --git a/windows/deploy/update-product-status-vamt.md b/windows/deploy/update-product-status-vamt.md index deca904c0c..0e7af45fec 100644 --- a/windows/deploy/update-product-status-vamt.md +++ b/windows/deploy/update-product-status-vamt.md @@ -2,7 +2,7 @@ title: Update Product Status (Windows 10) description: Update Product Status ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/update-windows-10-images-with-provisioning-packages.md b/windows/deploy/update-windows-10-images-with-provisioning-packages.md index 4a553d8b90..e9415d414b 100644 --- a/windows/deploy/update-windows-10-images-with-provisioning-packages.md +++ b/windows/deploy/update-windows-10-images-with-provisioning-packages.md @@ -2,8 +2,8 @@ title: Update Windows 10 images with provisioning packages (Windows 10) description: Use a provisioning package to apply settings, profiles, and file assets to a Windows 10 image. ms.assetid: 3CA345D2-B60A-4860-A3BF-174713C3D3A6 -keywords: ["provisioning", "bulk deployment", "image"] -ms.prod: W10 +keywords: provisioning, bulk deployment, image +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS diff --git a/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md b/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md index 030ab711f2..0f66363610 100644 --- a/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md +++ b/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md @@ -2,8 +2,8 @@ title: Upgrade to Windows 10 with System Center Configuration Manager (Windows 10) description: The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a System Center Configuration Manager task sequence to completely automate the process. ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 -keywords: ["upgrade, update, task sequence, deploy"] -ms.prod: W10 +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 ms.mktglfcycl: deploy author: mtniehaus --- diff --git a/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md index 35b90474ab..18dfaf7fdf 100644 --- a/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -3,7 +3,7 @@ title: Upgrade to Windows 10 with the Microsoft Deployment Toolkit (Windows 10) description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 keywords: upgrade, update, task sequence, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md b/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md index 229fb16df0..64e70ced04 100644 --- a/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md +++ b/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md @@ -3,7 +3,7 @@ title: Use Orchestrator runbooks with MDT (Windows 10) description: This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f keywords: web services, database -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md b/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md index 14749270e7..32208d3e25 100644 --- a/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md +++ b/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md @@ -4,7 +4,7 @@ description: This topic is designed to teach you how to use the MDT database to ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46 ms.pagetype: mdt keywords: database, permissions, settings, configure, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/use-the-volume-activation-management-tool-client.md b/windows/deploy/use-the-volume-activation-management-tool-client.md index 4303bd18a1..1e4f5c32b2 100644 --- a/windows/deploy/use-the-volume-activation-management-tool-client.md +++ b/windows/deploy/use-the-volume-activation-management-tool-client.md @@ -3,7 +3,7 @@ title: Use the Volume Activation Management Tool (Windows 10) description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. ms.assetid: b11f0aee-7b60-44d1-be40-c960fc6c4c47 keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/use-vamt-in-windows-powershell.md b/windows/deploy/use-vamt-in-windows-powershell.md index 1247d95759..01de72d0a6 100644 --- a/windows/deploy/use-vamt-in-windows-powershell.md +++ b/windows/deploy/use-vamt-in-windows-powershell.md @@ -2,7 +2,7 @@ title: Use VAMT in Windows PowerShell (Windows 10) description: Use VAMT in Windows PowerShell ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/use-web-services-in-mdt-2013.md b/windows/deploy/use-web-services-in-mdt-2013.md index 6fbe628335..1d8755df14 100644 --- a/windows/deploy/use-web-services-in-mdt-2013.md +++ b/windows/deploy/use-web-services-in-mdt-2013.md @@ -3,7 +3,7 @@ title: Use web services in MDT (Windows 10) description: In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. ms.assetid: 8f47535e-0551-4ccb-8f02-bb97539c6522 keywords: deploy, web apps -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: mdt ms.sitesec: library diff --git a/windows/deploy/usmt-best-practices.md b/windows/deploy/usmt-best-practices.md index b8772fe9f4..8da6b08353 100644 --- a/windows/deploy/usmt-best-practices.md +++ b/windows/deploy/usmt-best-practices.md @@ -2,10 +2,10 @@ title: USMT Best Practices (Windows 10) description: USMT Best Practices ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT Best Practices diff --git a/windows/deploy/usmt-choose-migration-store-type.md b/windows/deploy/usmt-choose-migration-store-type.md index 3e3f520ceb..5938b48748 100644 --- a/windows/deploy/usmt-choose-migration-store-type.md +++ b/windows/deploy/usmt-choose-migration-store-type.md @@ -2,10 +2,10 @@ title: Choose a Migration Store Type (Windows 10) description: Choose a Migration Store Type ms.assetid: 4e163e90-9c57-490b-b849-2ed52ab6765f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Choose a Migration Store Type diff --git a/windows/deploy/usmt-command-line-syntax.md b/windows/deploy/usmt-command-line-syntax.md index 8e62c88e30..22cf9c33aa 100644 --- a/windows/deploy/usmt-command-line-syntax.md +++ b/windows/deploy/usmt-command-line-syntax.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) description: User State Migration Tool (USMT) Command-line Syntax ms.assetid: f9d205c9-e824-46c7-8d8b-d7e4b52fd514 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Command-line Syntax diff --git a/windows/deploy/usmt-common-issues.md b/windows/deploy/usmt-common-issues.md index d1865b8873..88980d6d7b 100644 --- a/windows/deploy/usmt-common-issues.md +++ b/windows/deploy/usmt-common-issues.md @@ -2,10 +2,10 @@ title: Common Issues (Windows 10) description: Common Issues ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Common Issues diff --git a/windows/deploy/usmt-common-migration-scenarios.md b/windows/deploy/usmt-common-migration-scenarios.md index dd61667933..9262ef9b0f 100644 --- a/windows/deploy/usmt-common-migration-scenarios.md +++ b/windows/deploy/usmt-common-migration-scenarios.md @@ -2,10 +2,10 @@ title: Common Migration Scenarios (Windows 10) description: Common Migration Scenarios ms.assetid: 1d8170d5-e775-4963-b7a5-b55e8987c1e4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Common Migration Scenarios diff --git a/windows/deploy/usmt-configxml-file.md b/windows/deploy/usmt-configxml-file.md index dea99cd9e0..4484c03e2d 100644 --- a/windows/deploy/usmt-configxml-file.md +++ b/windows/deploy/usmt-configxml-file.md @@ -2,10 +2,10 @@ title: Config.xml File (Windows 10) description: Config.xml File ms.assetid: 9dc98e76-5155-4641-bcb3-81915db538e8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Config.xml File diff --git a/windows/deploy/usmt-conflicts-and-precedence.md b/windows/deploy/usmt-conflicts-and-precedence.md index 9de02f7dca..3b570d51e5 100644 --- a/windows/deploy/usmt-conflicts-and-precedence.md +++ b/windows/deploy/usmt-conflicts-and-precedence.md @@ -2,10 +2,10 @@ title: Conflicts and Precedence (Windows 10) description: Conflicts and Precedence ms.assetid: 0e2691a8-ff1e-4424-879b-4d5a2f8a113a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Conflicts and Precedence diff --git a/windows/deploy/usmt-custom-xml-examples.md b/windows/deploy/usmt-custom-xml-examples.md index c1fa2bd582..4d60c4903c 100644 --- a/windows/deploy/usmt-custom-xml-examples.md +++ b/windows/deploy/usmt-custom-xml-examples.md @@ -2,10 +2,10 @@ title: Custom XML Examples (Windows 10) description: Custom XML Examples ms.assetid: 48f441d9-6c66-43ef-91e9-7c78cde6fcc0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Custom XML Examples diff --git a/windows/deploy/usmt-customize-xml-files.md b/windows/deploy/usmt-customize-xml-files.md index 94619ce485..30930f05ad 100644 --- a/windows/deploy/usmt-customize-xml-files.md +++ b/windows/deploy/usmt-customize-xml-files.md @@ -2,10 +2,10 @@ title: Customize USMT XML Files (Windows 10) description: Customize USMT XML Files ms.assetid: d58363c1-fd13-4f65-8b91-9986659dc93e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Customize USMT XML Files diff --git a/windows/deploy/usmt-determine-what-to-migrate.md b/windows/deploy/usmt-determine-what-to-migrate.md index 24c81b0742..27ad2ea86d 100644 --- a/windows/deploy/usmt-determine-what-to-migrate.md +++ b/windows/deploy/usmt-determine-what-to-migrate.md @@ -2,10 +2,10 @@ title: Determine What to Migrate (Windows 10) description: Determine What to Migrate ms.assetid: 01ae1d13-c3eb-4618-b39d-ee5d18d55761 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Determine What to Migrate diff --git a/windows/deploy/usmt-estimate-migration-store-size.md b/windows/deploy/usmt-estimate-migration-store-size.md index 1dbd440416..a331a99c09 100644 --- a/windows/deploy/usmt-estimate-migration-store-size.md +++ b/windows/deploy/usmt-estimate-migration-store-size.md @@ -2,10 +2,10 @@ title: Estimate Migration Store Size (Windows 10) description: Estimate Migration Store Size ms.assetid: cfb9062b-7a2a-467a-a24e-0b31ce830093 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Estimate Migration Store Size diff --git a/windows/deploy/usmt-exclude-files-and-settings.md b/windows/deploy/usmt-exclude-files-and-settings.md index 99918b8c5c..e856679334 100644 --- a/windows/deploy/usmt-exclude-files-and-settings.md +++ b/windows/deploy/usmt-exclude-files-and-settings.md @@ -2,10 +2,10 @@ title: Exclude Files and Settings (Windows 10) description: Exclude Files and Settings ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Exclude Files and Settings diff --git a/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md index 8bd8e87680..c679d58b27 100644 --- a/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md @@ -2,10 +2,10 @@ title: Extract Files from a Compressed USMT Migration Store (Windows 10) description: Extract Files from a Compressed USMT Migration Store ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Extract Files from a Compressed USMT Migration Store diff --git a/windows/deploy/usmt-faq.md b/windows/deploy/usmt-faq.md index e69272bc26..715340a82d 100644 --- a/windows/deploy/usmt-faq.md +++ b/windows/deploy/usmt-faq.md @@ -2,10 +2,10 @@ title: Frequently Asked Questions (Windows 10) description: Frequently Asked Questions ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Frequently Asked Questions diff --git a/windows/deploy/usmt-general-conventions.md b/windows/deploy/usmt-general-conventions.md index ab6c9ad6b3..020557c402 100644 --- a/windows/deploy/usmt-general-conventions.md +++ b/windows/deploy/usmt-general-conventions.md @@ -2,10 +2,10 @@ title: General Conventions (Windows 10) description: General Conventions ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # General Conventions diff --git a/windows/deploy/usmt-hard-link-migration-store.md b/windows/deploy/usmt-hard-link-migration-store.md index afddeaf45d..e65487a0bd 100644 --- a/windows/deploy/usmt-hard-link-migration-store.md +++ b/windows/deploy/usmt-hard-link-migration-store.md @@ -2,10 +2,10 @@ title: Hard-Link Migration Store (Windows 10) description: Hard-Link Migration Store ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Hard-Link Migration Store diff --git a/windows/deploy/usmt-how-it-works.md b/windows/deploy/usmt-how-it-works.md index 8e6b12231e..0c274924a6 100644 --- a/windows/deploy/usmt-how-it-works.md +++ b/windows/deploy/usmt-how-it-works.md @@ -2,10 +2,10 @@ title: How USMT Works (Windows 10) description: How USMT Works ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # How USMT Works diff --git a/windows/deploy/usmt-how-to.md b/windows/deploy/usmt-how-to.md index 4baa318509..1a22d71262 100644 --- a/windows/deploy/usmt-how-to.md +++ b/windows/deploy/usmt-how-to.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) How-to topics (Windows 10) description: User State Migration Tool (USMT) How-to topics ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) How-to topics diff --git a/windows/deploy/usmt-identify-application-settings.md b/windows/deploy/usmt-identify-application-settings.md index ca14712f31..5fa216f2b3 100644 --- a/windows/deploy/usmt-identify-application-settings.md +++ b/windows/deploy/usmt-identify-application-settings.md @@ -2,10 +2,10 @@ title: Identify Applications Settings (Windows 10) description: Identify Applications Settings ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify Applications Settings diff --git a/windows/deploy/usmt-identify-file-types-files-and-folders.md b/windows/deploy/usmt-identify-file-types-files-and-folders.md index 3ab8ded02b..49766ca745 100644 --- a/windows/deploy/usmt-identify-file-types-files-and-folders.md +++ b/windows/deploy/usmt-identify-file-types-files-and-folders.md @@ -2,10 +2,10 @@ title: Identify File Types, Files, and Folders (Windows 10) description: Identify File Types, Files, and Folders ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify File Types, Files, and Folders diff --git a/windows/deploy/usmt-identify-operating-system-settings.md b/windows/deploy/usmt-identify-operating-system-settings.md index 232fabdc33..27fd8c0c25 100644 --- a/windows/deploy/usmt-identify-operating-system-settings.md +++ b/windows/deploy/usmt-identify-operating-system-settings.md @@ -2,10 +2,10 @@ title: Identify Operating System Settings (Windows 10) description: Identify Operating System Settings ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify Operating System Settings diff --git a/windows/deploy/usmt-identify-users.md b/windows/deploy/usmt-identify-users.md index 1f23cb942d..6d081727c3 100644 --- a/windows/deploy/usmt-identify-users.md +++ b/windows/deploy/usmt-identify-users.md @@ -2,10 +2,10 @@ title: Identify Users (Windows 10) description: Identify Users ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify Users diff --git a/windows/deploy/usmt-include-files-and-settings.md b/windows/deploy/usmt-include-files-and-settings.md index 6142749d13..411525684e 100644 --- a/windows/deploy/usmt-include-files-and-settings.md +++ b/windows/deploy/usmt-include-files-and-settings.md @@ -2,10 +2,10 @@ title: Include Files and Settings (Windows 10) description: Include Files and Settings ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Include Files and Settings diff --git a/windows/deploy/usmt-loadstate-syntax.md b/windows/deploy/usmt-loadstate-syntax.md index a82a0b4357..36c3dfb311 100644 --- a/windows/deploy/usmt-loadstate-syntax.md +++ b/windows/deploy/usmt-loadstate-syntax.md @@ -2,10 +2,10 @@ title: LoadState Syntax (Windows 10) description: LoadState Syntax ms.assetid: 53d2143b-cbe9-4cfc-8506-36e9d429f6d4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # LoadState Syntax diff --git a/windows/deploy/usmt-log-files.md b/windows/deploy/usmt-log-files.md index 89fc388cf9..9796591745 100644 --- a/windows/deploy/usmt-log-files.md +++ b/windows/deploy/usmt-log-files.md @@ -2,10 +2,10 @@ title: Log Files (Windows 10) description: Log Files ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Log Files diff --git a/windows/deploy/usmt-migrate-efs-files-and-certificates.md b/windows/deploy/usmt-migrate-efs-files-and-certificates.md index 43a57ddc5d..d4e2db536f 100644 --- a/windows/deploy/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deploy/usmt-migrate-efs-files-and-certificates.md @@ -2,10 +2,10 @@ title: Migrate EFS Files and Certificates (Windows 10) description: Migrate EFS Files and Certificates ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migrate EFS Files and Certificates diff --git a/windows/deploy/usmt-migrate-user-accounts.md b/windows/deploy/usmt-migrate-user-accounts.md index 25c9490cbc..6c87c9b043 100644 --- a/windows/deploy/usmt-migrate-user-accounts.md +++ b/windows/deploy/usmt-migrate-user-accounts.md @@ -2,10 +2,10 @@ title: Migrate User Accounts (Windows 10) description: Migrate User Accounts ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migrate User Accounts diff --git a/windows/deploy/usmt-migration-store-encryption.md b/windows/deploy/usmt-migration-store-encryption.md index bb6343401f..1e8ea1a8e0 100644 --- a/windows/deploy/usmt-migration-store-encryption.md +++ b/windows/deploy/usmt-migration-store-encryption.md @@ -2,10 +2,10 @@ title: Migration Store Encryption (Windows 10) description: Migration Store Encryption ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migration Store Encryption diff --git a/windows/deploy/usmt-overview.md b/windows/deploy/usmt-overview.md index f3d7f0b860..928044a3cf 100644 --- a/windows/deploy/usmt-overview.md +++ b/windows/deploy/usmt-overview.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Overview (Windows 10) description: User State Migration Tool (USMT) Overview ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Overview diff --git a/windows/deploy/usmt-plan-your-migration.md b/windows/deploy/usmt-plan-your-migration.md index eaed479359..2b6ce76d7f 100644 --- a/windows/deploy/usmt-plan-your-migration.md +++ b/windows/deploy/usmt-plan-your-migration.md @@ -2,10 +2,10 @@ title: Plan Your Migration (Windows 10) description: Plan Your Migration ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Plan Your Migration diff --git a/windows/deploy/usmt-recognized-environment-variables.md b/windows/deploy/usmt-recognized-environment-variables.md index 8246122fd9..edebf602f1 100644 --- a/windows/deploy/usmt-recognized-environment-variables.md +++ b/windows/deploy/usmt-recognized-environment-variables.md @@ -2,10 +2,10 @@ title: Recognized Environment Variables (Windows 10) description: Recognized Environment Variables ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Recognized Environment Variables diff --git a/windows/deploy/usmt-reference.md b/windows/deploy/usmt-reference.md index ffe3b71ef8..753146d6b9 100644 --- a/windows/deploy/usmt-reference.md +++ b/windows/deploy/usmt-reference.md @@ -2,10 +2,10 @@ title: User State Migration Toolkit (USMT) Reference (Windows 10) description: User State Migration Toolkit (USMT) Reference ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Toolkit (USMT) Reference diff --git a/windows/deploy/usmt-requirements.md b/windows/deploy/usmt-requirements.md index ace2abc84a..c8632b0b4a 100644 --- a/windows/deploy/usmt-requirements.md +++ b/windows/deploy/usmt-requirements.md @@ -2,10 +2,10 @@ title: USMT Requirements (Windows 10) description: USMT Requirements ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT Requirements diff --git a/windows/deploy/usmt-reroute-files-and-settings.md b/windows/deploy/usmt-reroute-files-and-settings.md index a948ee7c8c..99dd2eb09c 100644 --- a/windows/deploy/usmt-reroute-files-and-settings.md +++ b/windows/deploy/usmt-reroute-files-and-settings.md @@ -2,10 +2,10 @@ title: Reroute Files and Settings (Windows 10) description: Reroute Files and Settings ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Reroute Files and Settings diff --git a/windows/deploy/usmt-resources.md b/windows/deploy/usmt-resources.md index 0cb115c915..cc268ff816 100644 --- a/windows/deploy/usmt-resources.md +++ b/windows/deploy/usmt-resources.md @@ -2,10 +2,10 @@ title: USMT Resources (Windows 10) description: USMT Resources ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT Resources diff --git a/windows/deploy/usmt-return-codes.md b/windows/deploy/usmt-return-codes.md index 4354a11ca8..365b49b5c7 100644 --- a/windows/deploy/usmt-return-codes.md +++ b/windows/deploy/usmt-return-codes.md @@ -2,10 +2,10 @@ title: Return Codes (Windows 10) description: Return Codes ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Return Codes diff --git a/windows/deploy/usmt-scanstate-syntax.md b/windows/deploy/usmt-scanstate-syntax.md index ff2636ee8c..5083385534 100644 --- a/windows/deploy/usmt-scanstate-syntax.md +++ b/windows/deploy/usmt-scanstate-syntax.md @@ -2,10 +2,10 @@ title: ScanState Syntax (Windows 10) description: ScanState Syntax ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # ScanState Syntax diff --git a/windows/deploy/usmt-technical-reference.md b/windows/deploy/usmt-technical-reference.md index 232f27f2fa..5bdf666976 100644 --- a/windows/deploy/usmt-technical-reference.md +++ b/windows/deploy/usmt-technical-reference.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Technical Reference (Windows 10) description: The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. ms.assetid: f90bf58b-5529-4520-a9f8-b6cb4e4d3add -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Technical Reference diff --git a/windows/deploy/usmt-test-your-migration.md b/windows/deploy/usmt-test-your-migration.md index 05e999a34d..e460f17de8 100644 --- a/windows/deploy/usmt-test-your-migration.md +++ b/windows/deploy/usmt-test-your-migration.md @@ -2,10 +2,10 @@ title: Test Your Migration (Windows 10) description: Test Your Migration ms.assetid: 754af276-8386-4eac-8079-3d1e45964a0d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Test Your Migration diff --git a/windows/deploy/usmt-topics.md b/windows/deploy/usmt-topics.md index a58a88b007..4fe5cace86 100644 --- a/windows/deploy/usmt-topics.md +++ b/windows/deploy/usmt-topics.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Overview Topics (Windows 10) description: User State Migration Tool (USMT) Overview Topics ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Overview Topics diff --git a/windows/deploy/usmt-troubleshooting.md b/windows/deploy/usmt-troubleshooting.md index 576f9801c9..33296077f4 100644 --- a/windows/deploy/usmt-troubleshooting.md +++ b/windows/deploy/usmt-troubleshooting.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Troubleshooting (Windows 10) description: User State Migration Tool (USMT) Troubleshooting ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Troubleshooting diff --git a/windows/deploy/usmt-utilities.md b/windows/deploy/usmt-utilities.md index eb9081b082..08df5661f2 100644 --- a/windows/deploy/usmt-utilities.md +++ b/windows/deploy/usmt-utilities.md @@ -2,10 +2,10 @@ title: UsmtUtils Syntax (Windows 10) description: UsmtUtils Syntax ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # UsmtUtils Syntax diff --git a/windows/deploy/usmt-what-does-usmt-migrate.md b/windows/deploy/usmt-what-does-usmt-migrate.md index 83b3851c29..89ba8aa60b 100644 --- a/windows/deploy/usmt-what-does-usmt-migrate.md +++ b/windows/deploy/usmt-what-does-usmt-migrate.md @@ -2,10 +2,10 @@ title: What Does USMT Migrate (Windows 10) description: What Does USMT Migrate ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # What Does USMT Migrate? diff --git a/windows/deploy/usmt-xml-elements-library.md b/windows/deploy/usmt-xml-elements-library.md index 87ffc8c9c3..f4f412fc2a 100644 --- a/windows/deploy/usmt-xml-elements-library.md +++ b/windows/deploy/usmt-xml-elements-library.md @@ -2,10 +2,10 @@ title: XML Elements Library (Windows 10) description: XML Elements Library ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # XML Elements Library diff --git a/windows/deploy/usmt-xml-reference.md b/windows/deploy/usmt-xml-reference.md index 49d7403f8f..4023b52759 100644 --- a/windows/deploy/usmt-xml-reference.md +++ b/windows/deploy/usmt-xml-reference.md @@ -2,10 +2,10 @@ title: USMT XML Reference (Windows 10) description: USMT XML Reference ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT XML Reference diff --git a/windows/deploy/vamt-known-issues.md b/windows/deploy/vamt-known-issues.md index 1e014a3e46..4aa2185e8f 100644 --- a/windows/deploy/vamt-known-issues.md +++ b/windows/deploy/vamt-known-issues.md @@ -2,7 +2,7 @@ title: VAMT Known Issues (Windows 10) description: VAMT Known Issues ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/vamt-requirements.md b/windows/deploy/vamt-requirements.md index 9da49547b0..06a8615669 100644 --- a/windows/deploy/vamt-requirements.md +++ b/windows/deploy/vamt-requirements.md @@ -2,7 +2,7 @@ title: VAMT Requirements (Windows 10) description: VAMT Requirements ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/vamt-step-by-step.md b/windows/deploy/vamt-step-by-step.md index e886684243..5582bd3417 100644 --- a/windows/deploy/vamt-step-by-step.md +++ b/windows/deploy/vamt-step-by-step.md @@ -2,7 +2,7 @@ title: VAMT Step-by-Step Scenarios (Windows 10) description: VAMT Step-by-Step Scenarios ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md b/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md index 233beb97f0..ee16be2715 100644 --- a/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md @@ -2,10 +2,10 @@ title: Verify the Condition of a Compressed Migration Store (Windows 10) description: Verify the Condition of a Compressed Migration Store ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Verify the Condition of a Compressed Migration Store diff --git a/windows/deploy/volume-activation-management-tool.md b/windows/deploy/volume-activation-management-tool.md index 04af72f880..887c116352 100644 --- a/windows/deploy/volume-activation-management-tool.md +++ b/windows/deploy/volume-activation-management-tool.md @@ -2,7 +2,7 @@ title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) description: The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/volume-activation-windows-10.md b/windows/deploy/volume-activation-windows-10.md index e57043d4ca..eda56e2651 100644 --- a/windows/deploy/volume-activation-windows-10.md +++ b/windows/deploy/volume-activation-windows-10.md @@ -3,7 +3,7 @@ title: Volume Activation for Windows 10 (Windows 10) description: This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/windows-10-deployment-scenarios.md b/windows/deploy/windows-10-deployment-scenarios.md index 54221f9de3..e76d648bb0 100644 --- a/windows/deploy/windows-10-deployment-scenarios.md +++ b/windows/deploy/windows-10-deployment-scenarios.md @@ -2,8 +2,8 @@ title: Windows 10 deployment scenarios (Windows 10) description: To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 -keywords: ["upgrade, in-place, configuration, deploy"] -ms.prod: W10 +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/windows-10-deployment-tools-reference.md b/windows/deploy/windows-10-deployment-tools-reference.md index e71eedae97..597900fb82 100644 --- a/windows/deploy/windows-10-deployment-tools-reference.md +++ b/windows/deploy/windows-10-deployment-tools-reference.md @@ -2,10 +2,10 @@ title: Windows 10 deployment tools reference (Windows 10) description: Learn about the tools available to deploy Windows 10. ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows 10 deployment tools reference diff --git a/windows/deploy/windows-10-edition-upgrades.md b/windows/deploy/windows-10-edition-upgrades.md index 72baf3a243..21981254a9 100644 --- a/windows/deploy/windows-10-edition-upgrades.md +++ b/windows/deploy/windows-10-edition-upgrades.md @@ -2,10 +2,10 @@ title: Windows 10 edition upgrade (Windows 10) description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. ms.assetid: A7642E90-A3E7-4A25-8044-C4E402DC462A -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows 10 edition upgrade diff --git a/windows/deploy/windows-adk-scenarios-for-it-pros.md b/windows/deploy/windows-adk-scenarios-for-it-pros.md index 3fb2944f22..8821ada189 100644 --- a/windows/deploy/windows-adk-scenarios-for-it-pros.md +++ b/windows/deploy/windows-adk-scenarios-for-it-pros.md @@ -2,10 +2,10 @@ title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows ADK for Windows 10 scenarios for IT Pros diff --git a/windows/deploy/windows-deployment-scenarios-and-tools.md b/windows/deploy/windows-deployment-scenarios-and-tools.md index a66deb1389..ba4f22b7c5 100644 --- a/windows/deploy/windows-deployment-scenarios-and-tools.md +++ b/windows/deploy/windows-deployment-scenarios-and-tools.md @@ -2,8 +2,8 @@ title: Windows 10 deployment tools (Windows 10) description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 -keywords: ["deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS"] -ms.prod: W10 +keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/windows-upgrade-and-migration-considerations.md b/windows/deploy/windows-upgrade-and-migration-considerations.md index 2b5ee05766..7763b0502d 100644 --- a/windows/deploy/windows-upgrade-and-migration-considerations.md +++ b/windows/deploy/windows-upgrade-and-migration-considerations.md @@ -2,10 +2,10 @@ title: Windows Upgrade and Migration Considerations (Windows 10) description: Windows Upgrade and Migration Considerations ms.assetid: 7f85095c-5922-45e9-b28e-91b1263c7281 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows Upgrade and Migration Considerations diff --git a/windows/deploy/xml-file-requirements.md b/windows/deploy/xml-file-requirements.md index 50c5e1b161..100306e84d 100644 --- a/windows/deploy/xml-file-requirements.md +++ b/windows/deploy/xml-file-requirements.md @@ -2,10 +2,10 @@ title: XML File Requirements (Windows 10) description: XML File Requirements ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # XML File Requirements diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 45c0237c18..870a49c024 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -239,6 +239,10 @@ You can use System Information to ensure that Credential Guard is running on a P - Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. + +### Kerberos Considerations + +When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. You must use constrained or resource-based Kerberos delegation instead. ## Scenarios not protected by Credential Guard diff --git a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index cfd595104f..b7056845e4 100644 --- a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -2,34 +2,54 @@ title: Deploy AppLocker policies by using the enforce rules setting (Windows 10) description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + + # Deploy AppLocker policies by using the enforce rules setting + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. + ## Background and prerequisites + These procedures assume that you have already deployed AppLocker policies with the enforcement set to **Audit only**, and you have been collecting data through the AppLocker event logs and other channels to determine what effect these policies have on your environment and the policy's adherence to your application control design. + For info about the AppLocker policy enforcement setting, see [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md). + For info about how to plan an AppLocker policy deployment, see [AppLocker Design Guide](applocker-policies-design-guide.md). + ## Step 1: Retrieve the AppLocker policy + Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Using Group Policy, you can export the policy from the Group Policy Object (GPO) and then update the rule or rules by using AppLocker on your AppLocker reference or test PC. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). For local AppLocker policies, you can update the rule or rules by using the Local Security policy snap-in (secpol.msc) on your AppLocker reference or test PC. For the procedures to do this, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). + ## Step 2: Alter the enforcement setting + Rule enforcement is applied only to a collection of rules, not to individual rules. AppLocker divides the rules into collections: executable files, Windows Installer files, packaged apps, scripts, and DLL files. By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. For information about the enforcement setting, see [Understand AppLocker Enforcement Settings](understand-applocker-enforcement-settings.md). For the procedure to alter the enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). + ## Step 3: Update the policy -You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](http://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the Microsoft Desktop Optimization Pack. -**Caution**   -You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. + +You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](http://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the +Microsoft Desktop Optimization Pack. + +>**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.   For the procedure to update the GPO, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). + For the procedures to distribute policies for local PCs by using the Local Security Policy snap-in (secpol.msc), see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). + ## Step 4: Monitor the effect of the policy + When a policy is deployed, it is important to monitor the actual implementation of that policy. You can do this by monitoring your support organization's app access request activity and reviewing the AppLocker event logs. To monitor the effect of the policy, see [Monitor Application Usage with AppLocker](monitor-application-usage-with-applocker.md). + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md).     diff --git a/windows/keep-secure/executable-rules-in-applocker.md b/windows/keep-secure/executable-rules-in-applocker.md index b215d8ffe5..b74b7fe29a 100644 --- a/windows/keep-secure/executable-rules-in-applocker.md +++ b/windows/keep-secure/executable-rules-in-applocker.md @@ -2,55 +2,28 @@ title: Executable rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the executable rule collection. ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Executable rules in AppLocker + **Applies to** - Windows 10 + This topic describes the file formats and available default rules for the executable rule collection. + AppLocker defines executable rules as any files with the .exe and .com extensions that are associated with an app. Because all of the default rules for the executable rule collection are based on folder paths, all files under those paths will be allowed. The following table lists the default rules that are available for the executable rule collection. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PurposeNameUserRule condition type

Allow members of the local Administrators group access to run all executable files

(Default Rule) All files

BUILTIN\Administrators

Path: *

Allow all users to run executable files in the Windows folder

(Default Rule) All files located in the Windows folder

Everyone

Path: %windir%\*

Allow all users to run executable files in the Program Files folder

(Default Rule) All files located in the Program Files folder

Everyone

Path: %programfiles%\*

+ +| Purpose | Name | User | Rule condition type | +| - | - | - | - | +| Allow members of the local Administrators group access to run all executable files | (Default Rule) All files| BUILTIN\Administrators | Path: * | +| Allow all users to run executable files in the Windows folder| (Default Rule) All files located in the Windows folder| Everyone| Path: %windir%\*| +| Allow all users to run executable files in the Program Files folder | (Default Rule) All files located in the Program Files folder| Everyone | Path: %programfiles%\*|   ## Related topics -[Understanding AppLocker Default Rules](understanding-applocker-default-rules.md) -  -  + +- [Understanding AppLocker Default Rules](understanding-applocker-default-rules.md) diff --git a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md index 565c1d0597..90c10baeee 100644 --- a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md +++ b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md @@ -2,23 +2,28 @@ title: Export an AppLocker policy from a GPO (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Export an AppLocker policy from a GPO + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. + Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device + To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. + **Export the policy from the GPO** + 1. In the Group Policy Management Console (GPMC), open the GPO that you want to edit. 2. In the console tree under **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Application Control Policies**, click **AppLocker**. 3. Right-click **AppLocker**, and then click **Export Policy**. 4. In the **Export Policy** dialog box, type a name for the exported policy (for example, the name of the GPO), select a location to save the policy, and then click **Save**. 5. The **AppLocker** dialog box will notify you of how many rules were exported. Click **OK**. -  -  diff --git a/windows/keep-secure/security-options.md b/windows/keep-secure/security-options.md index d8d9dbe293..b9ddcb4bf8 100644 --- a/windows/keep-secure/security-options.md +++ b/windows/keep-secure/security-options.md @@ -77,7 +77,7 @@ For info about setting security policies, see [Configure security policy setting | [Network access: Do not allow anonymous enumeration of SAM accounts](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md)| Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts** security policy setting. | | [Network access: Do not allow anonymous enumeration of SAM accounts and shares](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md)| Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** security policy setting. | | [Network access: Do not allow storage of passwords and credentials for network authentication](network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Do not allow storage of passwords and credentials for network authentication** security policy setting. | -| [Network access: Let Everyone permissions apply to anonymous users](network-access-let-everyone-permissions-apply-to-anonmous-users.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. | +| [Network access: Let Everyone permissions apply to anonymous users](network-access-let-everyone-permissions-apply-to-anonymous-users.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. | | [Network access: Named Pipes that can be accessed anonymously](network-access-named-pipes-that-can-be-accessed-anonymously.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Named Pipes that can be accessed anonymously** security policy setting. | | [Network access: Remotely accessible registry paths](network-access-remotely-accessible-registry-paths.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting.| | [Network access: Remotely accessible registry paths and subpaths](network-access-remotely-accessible-registry-paths-and-subpaths.md)| Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting. | diff --git a/windows/keep-secure/take-ownership-of-files-or-other-objects.md b/windows/keep-secure/take-ownership-of-files-or-other-objects.md index 5274e1f278..255f2d4ff3 100644 --- a/windows/keep-secure/take-ownership-of-files-or-other-objects.md +++ b/windows/keep-secure/take-ownership-of-files-or-other-objects.md @@ -2,98 +2,106 @@ title: Take ownership of files or other objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Take ownership of files or other objects security policy setting. ms.assetid: cb8595d1-74cc-4176-bb15-d97663eebb2d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Take ownership of files or other objects + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Take ownership of files or other objects** security policy setting. + ## Reference + This policy setting determines which users can take ownership of any securable object in the device, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. + Every object has an owner, whether the object resides in an NTFS volume or Active Directory database. The owner controls how permissions are set on the object and to whom permissions are granted. + By default, the owner is the person who or the process which created the object. Owners can always change permissions to objects, even when they are denied all access to the object. + Constant: SeTakeOwnershipPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - Assigning this user right can be a security risk. Because owners of objects have full control of them, only assign this user right to trusted users. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Administrators

Stand-Alone Server Default Settings

Administrators

Domain Controller Effective Default Settings

Administrators

Member Server Effective Default Settings

Administrators

Client Computer Effective Default Settings

Administrators

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Ownership can be taken by: + - An administrator. By default, the Administrators group is given the **Take ownership of files or other objects** user right. - Anyone or any group who has the **Take ownership** user right on the object. - A user who has the **Restore files and directories** user right. + Ownership can be transferred in the following ways: + - The current owner can grant the **Take ownership** user right to another user if that user is a member of a group defined in the current owner's access token. The user must take ownership to complete the transfer. - An administrator can take ownership. - A user who has the **Restore files and directories** user right can double-click **Other users and groups** and choose any user or group to assign ownership to. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a denial-of-service condition. + +Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a +denial-of-service condition. + ### Countermeasure + Ensure that only the local Administrators group has the **Take ownership of files or other objects** user right. + ### Potential impact + None. Restricting the **Take ownership of files or other objects** user right to the local Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md index 09ccf98b7d..aa27d42260 100644 --- a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -2,28 +2,42 @@ title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Test an AppLocker policy by using Test-AppLockerPolicy + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. + The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collections will be blocked on your reference computer or the computer on which you maintain policies. Perform the following steps on any computer where the AppLocker policies are applied. + Any user account can be used to complete this procedure. + **To test an AppLocker policy by using Test-AppLockerPolicy** + 1. Export the effective AppLocker policy. To do this, you must use the **Get-AppLockerPolicy** Windows PowerShell cmdlet. + 1. Open a Windows PowerShell command prompt window as an administrator. 2. Use the **Get-AppLockerPolicy** cmdlet to export the effective AppLocker policy to an XML file: + `Get-AppLockerPolicy –Effective –XML > ` + 2. Use the **Get-ChildItem** cmdlet to specify the directory that you want to test, specify the **Test-AppLockerPolicy** cmdlet with the XML file from the previous step to test the policy, and use the **Export-CSV** cmdlet to export the results to a file to be analyzed: + `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy -User -Filter | Export-CSV ` + The following shows example input for **Test-AppLockerPolicy**: -`PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml` -`PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv` + +```syntax +PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml +PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv +``` + In the example, the effective AppLocker policy is exported to the file C:\\Effective.xml. The **Get-ChildItem** cmdlet is used to recursively gather path names for the .exe files in C:\\Program Files\\Microsoft Office\\. The XMLPolicy parameter specifies that the C:\\Effective.xml file is an XML AppLocker policy file. By specifying the User parameter, you can test the rules for specific users, and the **Export-CSV** cmdlet allows the results to be exported to a comma-separated file. In the example, `-FilterDenied,DeniedByDefault` displays only those files that will be blocked for the user under the policy. -  -  diff --git a/windows/keep-secure/test-and-update-an-applocker-policy.md b/windows/keep-secure/test-and-update-an-applocker-policy.md index 4ae1a87af2..cf77664f65 100644 --- a/windows/keep-secure/test-and-update-an-applocker-policy.md +++ b/windows/keep-secure/test-and-update-an-applocker-policy.md @@ -2,37 +2,61 @@ title: Test and update an AppLocker policy (Windows 10) description: This topic discusses the steps required to test an AppLocker policy prior to deployment. ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Test and update an AppLocker policy + **Applies to** - Windows 10 + This topic discusses the steps required to test an AppLocker policy prior to deployment. + You should test each set of rules to ensure that the rules perform as intended. If you use Group Policy to manage AppLocker policies, complete the following steps for each Group Policy Object (GPO) where you have created AppLocker rules. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules for simultaneous testing in all of your test GPOs. + ## Step 1: Enable the Audit only enforcement setting + By using the **Audit only** enforcement setting, you can ensure that the AppLocker rules that you have created are properly configured for your organization. This setting can be enabled on the **Enforcement** tab of the **AppLocker Properties** dialog box. For the procedure to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). + ## Step 2: Configure the Application Identity service to start automatically + Because AppLocker uses the Application Identity service to verify the attributes of a file, you must configure it to start automatically in any one GPO that applies AppLocker rules. For the procedure to do this, see [Configure the Application Identity Service](configure-the-application-identity-service.md). For AppLocker policies that are not managed by a GPO, you must ensure that the service is running on each PC in order for the policies to be applied. + ## Step 3: Test the policy + Test the AppLocker policy to determine if your rule collection needs to be modified. Because you have created AppLocker rules, enabled the Application Identity service, and enabled the **Audit only** enforcement setting, the AppLocker policy should be present on all client PC that are configured to receive your AppLocker policy. + The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference PCs. For the procedure to do this, see [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). + ## Step 4: Analyze AppLocker events You can either manually analyze AppLocker events or use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to automate the analysis. + **To manually analyze AppLocker events** + You can view the events either in Event Viewer or a text editor and then sort those events to perform an analysis, such as looking for patterns in application usage events, access frequencies, or access by user groups. If you have not configured an event subscription, then you will have to review the logs on a sampling of computers in your organization. For more information about using Event Viewer, see [Monitor application usage with AppLocker](monitor-application-usage-with-applocker.md). + **To analyze AppLocker events by using Get-AppLockerFileInformation** + You can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to analyze AppLocker events from a remote computer. If an app is being blocked and should be allowed, you can use the AppLocker cmdlets to help troubleshoot the problem. + For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** cmdlet to determine which files have been blocked or would have been blocked (if you are using the **Audit only** enforcement mode) and how many times the event has occurred for each file. For the procedure to do this, see [Monitor Application Usage with AppLocker](monitor-application-usage-with-applocker.md). + After using **Get-AppLockerFileInformation** to determine how many times that a file would have been blocked from running, you should review your rule list to determine whether a new rule should be created for the blocked file or whether an existing rule is too strictly defined. Ensure that you check which GPO is currently preventing the file from running. To determine this, you can use the Group Policy Results Wizard to view rule names. + ## Step 5: Modify the AppLocker policy + After you have identified which rules need to be edited or added to the policy, you can use the Group Policy Management Console to modify the AppLocker rules in the relevant GPOs. For AppLocker policies that are not managed by a GPO, you can use the Local Security Policy snap-in (secpol.msc). For info how to modify an AppLocker policy, see, [Edit an AppLocker policy](edit-an-applocker-policy.md). + ## Step 6: Repeat policy testing, analysis, and policy modification + Repeat the previous steps 3–5 until all the rules perform as intended before applying enforcement. + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md).     diff --git a/windows/keep-secure/tools-to-use-with-applocker.md b/windows/keep-secure/tools-to-use-with-applocker.md index ed1080877e..d0ffd99ac7 100644 --- a/windows/keep-secure/tools-to-use-with-applocker.md +++ b/windows/keep-secure/tools-to-use-with-applocker.md @@ -2,33 +2,52 @@ title: Tools to use with AppLocker (Windows 10) description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Tools to use with AppLocker + **Applies to** - Windows 10 + This topic for the IT professional describes the tools available to create and administer AppLocker policies. + The following tools can help you administer the application control policies created by using AppLocker on the local device or by using Group Policy. For info about the basic requirements for using AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + - **AppLocker Local Security Policy MMC snap-in** + The AppLocker rules can be maintained by using the Local Security Policy snap-in (secpol.msc) of the Microsoft Management Console (MMC). For procedures to create, modify, and delete AppLocker rules, see [Working with AppLocker rules](working-with-applocker-rules.md). + - **Generate Default Rules tool** + AppLocker includes default rules for each rule collection accessed through the Local Security Policy snap-in. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. For info about how to use this tool, see [Create AppLocker default rules](create-applocker-default-rules.md). + - **Automatically Generate AppLocker Rules wizard** + By using the Local Security Policy snap-in, you can automatically generate rules for all files within a folder. The wizard will scan the specified folder and create the condition types that you choose for each file in that folder. For info about how to use this wizard, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). + - **Group Policy** + You can edit an AppLocker policy by adding, changing, or removing rules by using the Group Policy Management Console (GPMC). + If you want additional features to manage AppLocker policies, such as version control, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. + - **Remote Server Administration Tools (RSAT)** + You can use a device with a supported operating system that has the Remote Server Administration Tools (RSAT) installed to create and maintain AppLocker policies. + - **Event Viewer** + The AppLocker log contains information about applications that are affected by AppLocker rules. For info about using Event Viewer to review the AppLocker logs, see [Using Event Viewer with AppLocker](using-event-viewer-with-applocker.md), and [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). + - **AppLocker PowerShell cmdlets** + The AppLocker Windows PowerShell cmdlets are designed to streamline the administration of AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Local Security Policy snap-in and the GPMC. For information about the cmdlets, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx). + ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) -  -  + +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index 26e6b4403e..c4fb6b2cc3 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -2,23 +2,34 @@ title: TPM fundamentals (Windows 10) description: This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # TPM fundamentals + **Applies to** - Windows 10 + This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. + A Trusted Platform Module (TPM) is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer, and it communicates with the remainder of the system by using a hardware bus. + Computers that incorporate a TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called wrapping or binding a key, can help protect the key from disclosure. Each TPM has a master wrapping key, called the storage root key, which is stored within the TPM itself. The private portion of a storage root key or endorsement key that is created in a TPM is never exposed to any other component, software, process, or user. + You can specify whether encryption keys that are created by the TPM can be migrated or not. If you specify that they can be migrated, the public and private portions of the key can be exposed to other components, software, processes, or users. If you specify that encryption keys cannot be migrated, the private portion of the key is never exposed outside the TPM. + Computers that incorporate a TPM can also create a key that has not only been wrapped, but is also tied to certain platform measurements. This type of key can be unwrapped only when those platform measurements have the same values that they had when the key was created. This process is referred to as “sealing the key to the TPM.” Decrypting the key is called unsealing. The TPM can also seal and unseal data that is generated outside the TPM. With this sealed key and software, such as BitLocker Drive Encryption, you can lock data until specific hardware or software conditions are met. + With a TPM, private portions of key pairs are kept separate from the memory that is controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system (assurances that define the trustworthiness of a system) can be made before the keys are unsealed and released for use. Because the TPM uses its own internal firmware and logic circuits to process instructions, it does not rely on the operating system, and it is not exposed to vulnerabilities that might exist in the operating system or application software. + For info about which versions of Windows support which versions of the TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md). The features that are available in the versions are defined in specifications by the Trusted Computing Group (TCG). For more info, see the Trusted Platform Module page on the Trusted Computing Group website: [Trusted Platform Module](http://www.trustedcomputinggroup.org/developers/trusted_platform_module). + The following sections provide an overview of the technologies that support the TPM: + - [TPM-based Virtual Smart Card](#bkmk-vsc) - [Measured Boot with support for attestation](#bkmk-measuredboot) - [Automated provisioning and management of the TPM](#bkmk-autoprov) @@ -32,156 +43,157 @@ The following sections provide an overview of the technologies that support the - [How the TPM mitigates dictionary attacks](#bkmk-howtpmmitigates) - [How do I check the state of my TPM?](#bkmk-checkstate) - [What can I do if my TPM is in reduced functionality mode?](#bkmk-fixrfm) + The following topic describes the TPM Services that can be controlled centrally by using Group Policy settings: [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) + ## Automated provisioning and management of the TPM + TPM provisioning can be streamlined to make it easier to deploy systems that are ready for BitLocker and other TPM-dependent features. These enhancements include simplifying the TPM state model to report **Ready**, **Ready with reduced functionality**, or **Not ready**. You can also automatically provision TPMs in the **Ready** state, remote provisioning to remove the requirement for the physical presence of a technician for the initial deployment. In addition, the TPM stack is available in the Windows Preinstallation Environment (Windows PE). + A number of management settings have been added for easier management and configuration of the TPM through Group Policy. The primary new settings include Active Directory-based backup of TPM owner authentication, the level of owner authentication that should be stored locally on the TPM, and the software-based TPM lockout settings for standard users. For more info about backing up owner authentication to Windows Server 2008 R2 AD DS domains, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + ## Measured Boot with support for attestation + The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components. Antimalware software can use the log to determine whether components that ran before it are trustworthy versus infected with malware. It can also send the Measured Boot logs to a remote server for evaluation. The remote server can initiate remediation actions by interacting with software on the client or through out-of-band mechanisms, as appropriate. + ## TPM-based Virtual Smart Card -The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a Virtual Smart Card must be issued to the user for each computer. A computer that is shared among multiple users can host multiple Virtual Smart Cards, one for each user. + +The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a +Virtual Smart Card must be issued to the user for each computer. A computer that is shared among multiple users can host multiple Virtual Smart Cards, one for each user. + ## TPM-based certificate storage + The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI. The TPM can also be used to protect certificates that are imported from an outside source. TPM-based certificates can be used exactly as standard certificates with the added functionality that the certificate can never leave the TPM from which the keys were generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](http://msdn.microsoft.com/library/windows/desktop/aa376210.aspx). + ## TPM Owner Authorization Value -For Windows 8 a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. + +For Windows 8 a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. +This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. + If your computer is not being joined to a domain the TPM owner authorization value will be stored in the local computer registry. Using BitLocker to encrypt the operating system drive will protect the owner authorization value from being disclosed when the computer is at rest, but there is a risk that a malicious user could obtain the TPM owner authorization value when the computer is unlocked. Therefore, we recommend that in this situation you configure your computer to automatically lock after 30 seconds of inactivity. If automatic locking is not used, then you should consider removing full owner authorization from the computer registry. + **Registry information** + Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM DWORD: OSManagedAuthLevel - ---- - - - - - - - - - - - - - - - - - - - - -
Value DataSetting

0

None

2

Delegated

4

Full

+ +| Value Data | Setting | +| - | - | +| 0 | None| +| 2 | Delegated| +| 4 | Full|   -**Note**   -If the operating system managed TPM authentication setting is changed from "Full" to "Delegated" the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed up to AD DS when it is changed. +>**Note:**  If the operating system managed TPM authentication setting is changed from "Full" to "Delegated" the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed up to AD DS when it is changed.   ## TPM Cmdlets + If you are using PowerShell to script and manage your computers, you can now manage the TPM using Windows PowerShell as well. To install the TPM cmdlets use the following command: -**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + +`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) + ## Physical presence interface -The TCG specifications for TPMs require physical presence to perform some TPM administrative functions, such as turning on and turning off the TPM. Physical presence means a person must physically interact with the system and the TPM interface to confirm or reject changes to TPM status. This typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. Here are some are examples of TPM administrative tasks that require physical presence: + +The TCG specifications for TPMs require physical presence to perform some TPM administrative functions, such as turning on and turning off the TPM. Physical presence means a person must physically interact with the system and the +TPM interface to confirm or reject changes to TPM status. This typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. Here are some are examples of TPM administrative tasks that require physical presence: + - Activating the TPM - Clearing the existing owner information from the TPM without the owner’s password - Deactivating the TPM - Disabling the TPM temporarily without the owner’s password + ## States of existence in a TPM + For each of these TPM 1.2 states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. + These states of existence do not apply for Trusted Platform Module 2.0 because it cannot be turned off from within the operating system environment. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
StateDescription

Enabled

Most features of the TPM are available.

-

The TPM can be enabled and disabled multiple times within a boot period, if ownership is taken.

Disabled

The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and perform hashing and basic initialization.

-

The TPM can be enabled and disabled multiple times within a start-up period.

Activated

Most features of the TPM are available. The TPM can be activated and deactivated only through physical presence, which requires a restart.

Deactivated

Similar to the disabled state, with the exception that ownership can be taken when the TPM is deactivated and enabled. The TPM can be activated and deactivated only through physical presence, which requires a restart.

Owned

Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.

Unowned

The TPM does not have a storage root key, and it may or may not have an endorsement key.

+ +| State | Description | +| - | - | +| Enabled| Most features of the TPM are available.
The TPM can be enabled and disabled multiple times within a boot period, if ownership is taken.| +| Disabled| The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and perform hashing and basic initialization.
The TPM can be enabled and disabled multiple times within a start-up period. | +| Activated| Most features of the TPM are available. The TPM can be activated and deactivated only through physical presence, which requires a restart.| +| Deactivated| Similar to the disabled state, with the exception that ownership can be taken when the TPM is deactivated and enabled. The TPM can be activated and deactivated only through physical presence, which requires a restart.| +| Owned| Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.| +| Unowned| The TPM does not have a storage root key, and it may or may not have an endorsement key.|   -**Important**   -Applications cannot use the TPM until the state is enabled, activated, and owned. All operations are available only when the TPM is in this state. +>**Important:**  Applications cannot use the TPM until the state is enabled, activated, and owned. All operations are available only when the TPM is in this state.   The state of the TPM exists independently of the computer’s operating system. When the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. + ## Endorsement keys -For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. If the TPM does not contain an endorsement key, the application might cause the TPM to generate one automatically as part of the setup. + +For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. If the +TPM does not contain an endorsement key, the application might cause the TPM to generate one automatically as part of the setup. An endorsement key can be created at various points in the TPM’s lifecycle, but it needs to be created only once for the lifetime of the TPM. The existence of an endorsement key is a requirement before TPM ownership can be taken. + ## Key attestation + TPM key attestation allows a certification authority to verify that a private key is actually protected by a TPM and that the TPM is one that the certification authority trusts. Endorsement keys which have been proven valid can be used to bind the user identity to a device. Moreover, the user certificate with a TPM attested key provides higher security assurance backed up by the non-exportability, anti-hammering, and isolation of keys provided by a TPM. + ## How the TPM mitigates dictionary attacks + When a TPM processes a command, it does so in a protected environment, for example, a dedicated microcontroller on a discrete chip or a special hardware-protected mode on the main CPU. A TPM can be used to create a cryptographic key that is not disclosed outside the TPM, but is able to be used in the TPM after the correct authorization value is provided. + TPMs have dictionary attack logic that is designed to prevent brute force attacks that attempt to determine authorization values for using a key. The basic approach is for the TPM to allow only a limited number of authorization failures before it prevents more attempts to use keys and locks. Providing a failure count for individual keys is not technically practical, so TPMs have a global lockout when too many authorization failures occur. + Because many entities can use the TPM, a single authorization success cannot reset the TPM’s dictionary attack logic. This prevents an attacker from creating a key with a known authorization value and then using it to reset the TPM’s dictionary attack logic. Generally TPMs are designed to forget about authorization failures after a period of time so the TPM does not enter a lockout state unnecessarily. A TPM owner password can be used to reset the TPM’s lockout logic. + ### TPM 2.0 dictionary attack behavior + TPM 2.0 has well defined dictionary attack logic behavior. This is in contrast to TPM 1.2 for which the dictionary attack logic was set by the manufacturer, and the logic varied widely throughout the industry. -**Warning**   -For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions. + +>**Warning:**  For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions.   For Windows 8 Certified Hardware systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every two hours. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. + Attempts to use a key with an authorization value for the next two hours would not return success or failure; instead the response indicates that the TPM is locked. After two hours, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31, so the TPM leaves the locked state and returns to normal operation. With the correct authorization value, keys could be used normally if no authorization failures occur during the next two hours. If a period of 64 hours elapses with no authorization failures, the TPM does not remember any authorization failures, and 32 failed attempts could occur again. + Windows 8 Certification does not require TPM 2.0 systems to forget about authorization failures when the system is fully powered off or when the system has hibernated. Windows does require that authorization failures are forgotten when the system is running normally, in a sleep mode, or in low power states other than off. If a Windows system with TPM 2.0 is locked, the TPM leaves lockout mode if the system is left on for two hours. + The dictionary attack logic for TPM 2.0 can be fully reset immediately by sending a reset lockout command to the TPM and providing the TPM owner password. By default, Windows automatically provisions TPM 2.0 and stores the TPM owner password for use by system administrators. + In some enterprise situations, the TPM owner authorization value is configured to be stored centrally in Active Directory, and it is not stored on the local system. An administrator can launch the TPM MMC and choose to reset the TPM lockout time. If the TPM owner password is stored locally, it is used to reset the lockout time. If the TPM owner password is not available on the local system, the administrator needs to provide it. If an administrator attempts to reset the TPM lockout state with the wrong TPM owner password, the TPM does not allow another attempt to reset the lockout state for 24 hours. + TPM 2.0 allows some keys to be created without an authorization value associated with them. These keys can be used when the TPM is locked. For example, BitLocker with a default TPM-only configuration is able to use a key in the TPM to start Windows, even when the TPM is locked. + ### Rationale behind the Windows 8.1 and Windows 8 defaults + Windows relies on the TPM 2.0 dictionary attack protection for multiple features. The defaults that are selected for Windows 8 balance trade-offs for different scenarios. For example, when BitLocker is used with a TPM plus PIN configuration, it needs the number of PIN guesses to be limited over time. If the computer is lost, someone could make only 32 PIN guesses immediately, and then only one more guess every two hours. This totals about 4415 guesses per year. This makes a good standard for system administrators to determine how many PIN characters to use for BitLocker deployments. + The Windows TPM-based smart card, which is a virtual smart card, can be configured to allow sign in to the system. In contrast with physical smart cards, the sign-in process uses a TPM-based key with an authorization value. The following list shows the advantages of virtual smart cards: + Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. With a virtual smart card, the TPM’s dictionary attack is not reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors. + Hardware manufacturers and software developers have the option to use the security features of the TPM to meet their requirements. + The intent of selecting 32 failures as the lock-out threshold is so users rarely lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must to wait two hours or use some other credential to sign in, such as a user name and password. + ## How do I check the state of my TPM? + You can check the state of the TPM on a PC by running the Trusted Platform Module snap-in (tpm.msc). The **Status** heading tells you the state of your TPM. The TPM can be in one of the following states: **Ready for use**, **Ready for use, with reduced functionality**, and **Not ready for use**. To take advantage of most of the TPM features in Windows 10, the TPM must be **Ready for use**. + ## What can I do if my TPM is in reduced functionality mode? -If your TPM is in reduced functionality mode, some features that rely on the TPM will not function correctly. This is most often caused by doing a clean installation of Windows 10 on a device where Windows 8.1, Windows 8, or Windows 7 had previously been installed on the same hardware. If your TPM is in reduced functionality mode, the Status heading in the Trusted Platform Module snap-in shows **The TPM is ready for use, with reduced functionality**. You can fix this by clearing the TPM. + +If your TPM is in reduced functionality mode, some features that rely on the TPM will not function correctly. This is most often caused by doing a clean installation of Windows 10 on a device where Windows 8.1, Windows 8, or Windows 7 had previously been installed on the same hardware. If your TPM is in reduced functionality mode, the Status heading in the Trusted Platform Module snap-in shows **The TPM is ready for use, with reduced functionality**. +You can fix this by clearing the TPM. + **To clear the TPM** + 1. Open the Trusted Platform Module snap-in (tpm.msc). 2. Click **Clear TPM**, and then click **Restart.** 3. When the PC is restarting, you might be prompted to press a button on the keyboard to clear the TPM. 4. After the PC restarts, your TPM will be automatically prepared for use by Windows 10. -**Note**   -Clearing the TPM causes you to lose all TPM keys and data protected by those keys, such as a virtual smart card. You should not perform this procedure on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator. + +>**Note:**  Clearing the TPM causes you to lose all TPM keys and data protected by those keys, such as a virtual smart card. You should not perform this procedure on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator.   ## Additional resources -[Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) -[Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) -[TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -[Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) -[TPM WMI providers](http://go.microsoft.com/fwlink/p/?LinkId=93478) -[Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -  -  + +- [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) +- [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) +- [TPM WMI providers](http://go.microsoft.com/fwlink/p/?LinkId=93478) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index b9e5bc42f5..9decdf047c 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -2,76 +2,116 @@ title: TPM recommendations (Windows 10) description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. ms.assetid: E85F11F5-4E6A-43E7-8205-672F77706561 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # TPM recommendations + **Applies to** - Windows 10 - Windows 10 Mobile - Windows Server 2016 Technical Preview - Windows 10 IoT Core (IoT Core) + This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. + ## Overview + Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. It has a security-related crypto-processor that is designed to carry out cryptographic operations in a variety of devices and form factors. It includes multiple physical security mechanisms to help prevent malicious software from tampering with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: + 1. Generate, store, use, and protected cryptographic keys, 2. Use TPM technology for platform device authentication by using a unique endorsement key (EK), and 3. Help enhance platform integrity by taking and storing security measurements. + The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. Traditionally, TPMs have been discrete chips soldered to a computer’s motherboard. Such implementations allow the computer’s original equipment manufacturer (OEM) to evaluate and certify the TPM separate from the rest of the system. Although discrete TPM implementations are still common, they can be problematic for integrated devices that are small or have low power consumption. Some newer TPM implementations integrate TPM functionality into the same chipset as other platform components while still providing logical separation similar to discrete TPM chips. + TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform’s owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows 10 automatically provisions a TPM, but if the user reinstalls the operating system, he or she may need to tell the operating system to explicitly provision the TPM again before it can use all the TPM’s features. + The Trusted Computing Group (TCG) is the nonprofit organization that publishes and maintains the TPM specification. The TCG exists to develop, define, and promote vendor-neutral, global industry standards that support a hardware-based root of trust for interoperable trusted computing platforms. The TCG also publishes the TPM specification as the international standard ISO/IEC 11889, using the Publicly Available Specification Submission Process that the Joint Technical Committee 1 defines between the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). + OEMs implement the TPM as a component in a trusted computing platform, such as a PC, tablet, or phone. Trusted computing platforms use the TPM to support privacy and security scenarios that software alone cannot achieve. For example, software alone cannot reliably report whether malware is present during the system startup process. The close integration between TPM and platform increases the transparency of the startup process and supports evaluating device health by enabling reliable measuring and reporting of the software that starts the device. Implementation of a TPM as part of a trusted computing platform provides a hardware root of trust—that is, it behaves in a trusted way. For example, if a key stored in a TPM has properties that disallow exporting the key, that key truly cannot leave the TPM. + The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not. -**Note**   -Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + +>**Note:**  Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.   ## TPM 1.2 vs. 2.0 comparison + From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM. + ## Why TPM 2.0? + TPM 2.0 products and systems have important security advantages over TPM 1.2, including: + - The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. - For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. - TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. + - TPM 2.0 supports SHA-256 as well as ECC, the latter being critical to drive signing and key generation performance. - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](http://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. + - TPM 2.0 offers a more **consistent experience** across different implementations. + - TPM 1.2 implementations across both discrete and firmware vary in policy settings. This may result in support issues as lockout policies vary. - TPM 2.0 standardized policy requirement helps establish a consistent lockout experience across devices, as such, Windows can offer a better user experience end to end. + - While TPM 1.2 parts were discrete silicon components typically soldered on the motherboard, TPM 2.0 is available both as a **discrete (dTPM)** silicon component and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on the system’s main SoC: + - On Intel chips, it is the Intel Management Engine (ME) or Converged Security Engine (CSE). - For AMD chips, it is the AMD Security Processor - For ARM chips, it is a Trustzone Trusted Application (TA). - In the case of firmware TPM for desktop Windows systems, the chip vendor provides the firmware TPM implementation along with the other chip firmware to OEMs. + ## Discrete or firmware TPM? + Windows uses discrete and firmware TPM in the same way. Windows gains no functional advantage or disadvantage from either option. + From a security standpoint, discrete and firmware share the same characteristics; + - Both use hardware based secure execution. - Both use firmware for portions of the TPM functionality. - Both are equipped with tamper resistance capabilities. - Both have unique security limitations/risks. + For more info, see [fTPM: A Firmware-based TPM 2.0 Implementation](http://research.microsoft.com/apps/pubs/?id=258236). + ## Is there any importance for TPM for consumer? + For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, secures streaming high quality 4K content and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. + ## TPM 2.0 Compliance for Windows 10 + ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) + - As of July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) ## Two implementation options: -• Discrete TPM chip as a separate discrete component -• Firmware TPM solution using Intel PTT (platform trust technology) or AMD + +- Discrete TPM chip as a separate discrete component +- Firmware TPM solution using Intel PTT (platform trust technology) or AMD + ### Windows 10 Mobile + - All devices shipping with Windows 10 Mobile must implement TPM 2.0 and ship with the TPM 2.0 enabled. + ### IoT Core + - TPM is optional on IoT Core. + ### Windows Server 2016 Technical Preview + - TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. + ## TPM and Windows Features + The following table defines which Windows features require TPM support. Some features are not applicable to Windows 7/8/8.1 and are noted accordingly. + @@ -255,9 +295,11 @@ There are a variety of TPM manufacturers for both discrete and firmware.
  ## OEM Feedback and Status on TPM 2.0 system availability + ### Certified TPM parts + Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. Discrete TPM 2.0 vendors have completion certification. + ### Windows 7 32-bit support + Even though Windows 7 shipped before the TPM 2.0 spec or products existed, Microsoft backported TPM 2.0 support to Windows 7 64-bit and released it in summer 2014 as a downloadable Windows hotfix for UEFI based Windows 7 systems. Microsoft is not currently planning to backport support to Windows 7 32-bit support. -  -  diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index 24182d9e16..f9c63208af 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -2,30 +2,41 @@ title: Troubleshoot Windows Defender in Windows 10 (Windows 10) description: IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jasesso --- + # Troubleshoot Windows Defender in Windows 10 + **Applies to** - Windows 10 + IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. + ## Windows Defender client event IDs + This section provides the following information about Windows Defender client events: + - The text of the message as it appears in the event - The name of the source of the message - The symbolic name that identifies each message in the programming source code - Additional information about the message + Use the information in this table to help troubleshoot Windows Defender client events; these are located in the **Windows Event Viewer**, under **Windows Logs**. + **To view a Windows Defender client event** + 1. Open **Event Viewer**. 2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**. 3. Double-click on **Operational**. 4. In the details pane, view the list of individual events to find your event. 5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs. + You can find a complete list of the Microsoft antimalware event IDs, the symbol, and the description of each ID in [Windows Server Antimalware Events TechNet](https://technet.microsoft.com/library/dn913615.aspx). + @@ -3257,8 +3268,8 @@ article.

Event ID: 1000
+ ## Related topics -[Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -[Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -  -  + +- [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) +- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) diff --git a/windows/keep-secure/trusted-platform-module-overview.md b/windows/keep-secure/trusted-platform-module-overview.md index 02ba8d12dc..03e37a250b 100644 --- a/windows/keep-secure/trusted-platform-module-overview.md +++ b/windows/keep-secure/trusted-platform-module-overview.md @@ -2,81 +2,75 @@ title: Trusted Platform Module Technology Overview (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. ms.assetid: face8932-b034-4319-86ac-db1163d46538 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Trusted Platform Module Technology Overview + **Applies to** - Windows 10 + This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. + ## Feature description + Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: + - Generate, store, and limit the use of cryptographic keys. - Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. - Help ensure platform integrity by taking and storing security measurements. + The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. + TPM-based keys can be configured in a variety of ways. One option is to make a TPM-based key unavailable outside the TPM. This is good to mitigate phishing attacks because it prevents the key from being copied and used without the TPM. TPM-based keys can also be configured to require an authorization value to use them. If too many incorrect authorization guesses occur, the TPM will activate its dictionary attack logic and prevent further authorization value guesses. + Different versions of the TPM are defined in specifications by the Trusted Computing Group (TCG). For more information, consult the TCG Web site (). + Windows can automatically provision and manage the TPM. Group Policy settings can be configured to control whether the TPM owner authorization value is backed up in Active Directory. Because the TPM state persists across operating system installations, TPM information is stored in a location in Active Directory that is separate from computer objects. Depending on an enterprise’s security goals, Group Policy can be configured to allow or prevent local administrators from resetting the TPM’s dictionary attack logic. Standard users can use the TPM, but Group Policy controls limit how many authorization failures standard users can attempt so that one user is unable to prevent other users or the administrator from using the TPM. TPM technology can also be used as a virtual smart card and for secure certificate storage. With BitLocker Network Unlock, domain-joined computers are not prompted for a BitLocker PIN. + ## Practical applications + Certificates can be installed or created on computers that are using the TPM. After a computer is provisioned, the RSA private key for a certificate is bound to the TPM and cannot be exported. The TPM can also be used as a replacement for smart cards, which reduces the costs associated with creating and disbursing smart cards. + Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. + Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. + The TPM has several Group Policy settings that can be used to manage how it is used. These settings can be used to manage the owner authorization value, the blocked TPM commands, the standard user lockout, and the backup of the TPM to AD DS. For more info, see [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). + ## New and changed functionality + For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](../whats-new/trusted-platform-module.md). + ## Device health attestation + Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. + Some things that you can check on the device are: + - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? -**Note**  The device must be running Windows 10 and it must support at least TPM 2.0. + +>**Note:**  The device must be running Windows 10 and it must support at least TPM 2.0.   ## Supported versions - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
TPM versionWindows 10Windows Server 2012 R2, Windows 8.1, and Windows RTWindows Server 2012, Windows 8, and Windows RTWindows Server 2008 R2 and Windows 7

TPM 1.2

X

X

X

X

TPM 2.0

X

X

X

X

-  + +| TPM version | Windows 10 | Windows Server 2012 R2, Windows 8.1, and Windows RT | Windows Server 2012, Windows 8, and Windows RT | Windows Server 2008 R2 and Windows 7 | +| - | - | - | - | - | +| TPM 1.2| X| X| X| X| +| TPM 2.0| X| X| X| X| + ## Additional Resources -[TPM Fundamentals](tpm-fundamentals.md) -[TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -[TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -[AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) -[Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) + +- [TPM Fundamentals](tpm-fundamentals.md) +- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx)     diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index 4b274eecc5..4ded5c4844 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -2,230 +2,188 @@ title: TPM Group Policy settings (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # TPM Group Policy settings + **Applies to** - Windows 10 + This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. + ## + The TPM Services Group Policy settings are located at: + **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingWindows 10Windows Server 2012 R2, Windows 8.1 and Windows RTWindows Server 2012, Windows 8 and Windows RTWindows Server 2008 R2 and Windows 7Windows Server 2008 and Windows Vista

[Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu)

X

X

X

X

X

[Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)

X

X

X

X

X

[Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb)

X

X

X

X

X

[Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb)

X

X

X

X

X

[Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)

X

X

X

[Standard User Lockout Duration](#bkmk-tpmgp-suld)

X

X

X

[Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)

X

X

X

[Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)

X

X

X

+ +| Setting | Windows 10 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | +| - | - | - | - | - | - | +| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | X| X| X| X| X| +| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| +| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| +| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| +| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| X| X| X||| +| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X||| +| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X||| +| [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X||||   ### Turn on TPM backup to Active Directory Domain Services + This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of TPM owner information. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can be run only by the TPM owner. This hash authorizes the TPM to run these commands. -**Important**   -To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + +>**Important:**  To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md).   The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, on a local computer at the command prompt, type **tpm.msc** to open the TPM Management Console and select the action to **Initialize TPM**. If the TPM owner information is lost or is not available, limited TPM management is possible by running **tpm.msc**. + If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. + If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. + ### Configure the list of blocked TPM commands + This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is **TPM\_OwnerReadInternalPub**, and command number 170 is **TPM\_FieldUpgrade**. To find the command number that is associated with each TPM command, at the command prompt, type **tpm.msc**to open the TPM Management Console and navigate to the **Command Management** section. + If you disable or do not configure this policy setting, only those TPM commands that are specified through the default or local lists can be blocked by Windows. The default list of blocked TPM commands is preconfigured by Windows. + - You can view the default list by typing **tpm.msc** at the command prompt, navigating to the **Command Management** section, and exposing the **On Default Block List** column. - The local list of blocked TPM commands is configured outside of Group Policy by running the TPM Management Console or scripting using the **Win32\_Tpm** interface. + For information how to enforce or ignore the default and local lists of blocked TPM commands, see + - [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) - [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) ### Ignore the default list of blocked TPM commands + This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column. Also see the related policy setting, [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc). + If you enable this policy setting, the Windows operating system will ignore the computer's default list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the local list. + If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to the commands that are specified by Group Policy and the local list of blocked TPM commands. + ### Ignore the local list of blocked TPM commands + This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.) Also see the related policy setting to **Configure the list of blocked TPM commands**. + If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list. + If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands. + ### Configure the level of TPM owner authorization information available to the operating system + This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. + - **Full**   This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. - **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. When you use this setting, we recommend using external or remote storage for the full TPM owner authorization value—for example, backing up the value in Active Directory Domain Services (AD DS). - **None**   This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. -**Note**   -If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed. + +>**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed.   **Registry information** + Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM + DWORD: OSManagedAuthLevel + The following table shows the TPM owner authorization values in the registry. - ---- - - - - - - - - - - - - - - - - - - - - -
Value DataSetting

0

None

2

Delegated

4

Full

+ +| Value Data | Setting | +| - | - | +| 0 | None| +| 2 | Delegated| +| 4 | Full|   If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose. -If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. + +If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not +configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. + ### Standard User Lockout Duration -This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require authorization to the TPM. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require +authorization to the TPM. + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. + The number of authorization failures that a TPM allows and how long it stays locked vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time, with fewer authorization failures, depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require that the system is on so enough clock cycles elapse before the TPM exits the lockout mode. + This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. + For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: + - [Standard User Individual Lockout Threshold](#bkmk-individual)   This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. - [Standard User Total Lockout Threshold](#bkmk-total)   This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. + An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. + If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used. + ### Standard User Individual Lockout Threshold + This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM). -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. + An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. + If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. + ### Standard User Total Lockout Threshold + This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration that is set for the **Standard User Lockout Duration** policy equals this value, all standard users are prevented from sending commands that require authorization to the Trusted Platform Module (TPM). -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + 1. The standard user individual lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. 2. The standard user total lockout threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. -The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption.. +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features +such as BitLocker Drive Encryption.. + The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. + If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. + ## Additional resources -[Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) -[TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -[Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -  -  + +- [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) diff --git a/windows/keep-secure/understand-applocker-enforcement-settings.md b/windows/keep-secure/understand-applocker-enforcement-settings.md index f62646c2e9..6ac72fe3f1 100644 --- a/windows/keep-secure/understand-applocker-enforcement-settings.md +++ b/windows/keep-secure/understand-applocker-enforcement-settings.md @@ -2,45 +2,28 @@ title: Understand AppLocker enforcement settings (Windows 10) description: This topic describes the AppLocker enforcement settings for rule collections. ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand AppLocker enforcement settings + **Applies to** - Windows 10 + This topic describes the AppLocker enforcement settings for rule collections. + Rule enforcement is applied only to a collection of rules, not to individual rules. AppLocker divides the rules into four collections: executable files, Windows Installer files, scripts, and DLL files. For more info about rule collections, see [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md). By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. The following table details the three AppLocker rule enforcement settings in Group Policy for each rule collection. - ---- - - - - - - - - - - - - - - - - - - - - -
Enforcement settingDescription

Not configured

By default, enforcement is not configured in a rule collection. If rules are present in the corresponding rule collection, they are enforced. If rule enforcement is configured in a higher-level linked Group Policy object (GPO), that enforcement value overrides the Not configured value.

Enforce rules

Rules are enforced for the rule collection, and all rule events are audited.

Audit only

Rule events are audited only. Use this value when planning and testing AppLocker rules.

+ +| Enforcement setting | Description | +| - | - | +| Not configured | By default, enforcement is not configured in a rule collection. If rules are present in the corresponding rule collection, they are enforced. If rule enforcement is configured in a higher-level linked Group Policy object (GPO), that enforcement value overrides the **Not configured** value.| +| Enforce rules | Rules are enforced for the rule collection, and all rule events are audited.| +| Audit only | Rule events are audited only. Use this value when planning and testing AppLocker rules.|   For the AppLocker policy to be enforced on a device, the Application Identity service must be running. For more info about the Application Identity service, see [Configure the Application Identity service](configure-the-application-identity-service.md). + When AppLocker policies from various GPOs are merged, the enforcement modes are merged by using the standard Group Policy order of inheritance, which is local, domain, site, and organizational unit (OU). The Group Policy setting that was last written or applied by order of inheritance is used for the enforcement mode, and all rules from linked GPOs are applied. -  -  diff --git a/windows/keep-secure/understand-applocker-policy-design-decisions.md b/windows/keep-secure/understand-applocker-policy-design-decisions.md index ea6833ec44..5687229616 100644 --- a/windows/keep-secure/understand-applocker-policy-design-decisions.md +++ b/windows/keep-secure/understand-applocker-policy-design-decisions.md @@ -2,123 +2,86 @@ title: Understand AppLocker policy design decisions (Windows 10) description: This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand AppLocker policy design decisions + **Applies to** - Windows 10 + This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. + When you begin the design and planning process, you should consider the ramifications of your design choices. The resulting decisions will affect your policy deployment scheme and subsequent application control policy maintenance. + You should consider using AppLocker as part of your organization's application control policies if all the following are true: + - You have deployed or plan to deploy the supported versions of Windows in your organization. For specific operating system version requirements, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). - You need improved control over the access to your organization's applications and the data your users access. - The number of applications in your organization is known and manageable. - You have resources to test policies against the organization's requirements. - You have resources to involve Help Desk or to build a self-help process for end-user application access issues. - The group's requirements for productivity, manageability, and security can be controlled by restrictive policies. + The following questions are not in priority or sequential order. They should be considered when you deploy application control policies (as appropriate for your targeted environment). + ### Which apps do you need to control in your organization? + You might need to control a limited number of apps because they access sensitive data, or you might have to exclude all applications except those that are sanctioned for business purposes. There might be certain business groups that require strict control, and others that promote independent application usage. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Control all apps

AppLocker policies control applications by creating an allowed list of applications by file type. Exceptions are also possible. AppLocker policies can only be applied to applications installed on computers running one of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).

Control specific apps

When you create AppLocker rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).

Control only Classic Windows applications, only Universal Windows apps, or both

AppLocker policies control apps by creating an allowed list of apps by file type. Because Universal Windows apps are categorized under the Publisher condition, Classic Windows applications and Universal Windows apps can be controlled together. AppLocker policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Windows Store, but Classic Windows applications can be controlled with AppLocker on all supported versions of Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.

-

For a comparison of Classic Windows applications and Universal Windows apps, see [Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions](#bkmk-compareclassicmetro) in this topic.

Control apps by business group and user

AppLocker policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). Individual AppLocker rules can be applied to individual users or to groups of users.

Control apps by computer, not user

AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.

Understand app usage, but there is no need to control any apps yet

AppLocker policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the AppLocker event log to create AppLocker policies.

+ +| Possible answers | Design considerations| +| - | - | +| Control all apps | AppLocker policies control applications by creating an allowed list of applications by file type. Exceptions are also possible. AppLocker policies can only be applied to applications installed on computers running one of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| +| Control specific apps | When you create AppLocker rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| +|Control only Classic Windows applications, only Universal Windows apps, or both| AppLocker policies control apps by creating an allowed list of apps by file type. Because Universal Windows apps are categorized under the Publisher condition, Classic Windows applications and Universal Windows apps can be controlled together. AppLocker policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Windows Store, but Classic Windows applications can be controlled with AppLocker on all supported versions of Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.
For a comparison of Classic Windows applications and Universal Windows apps, see [Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions](#bkmk-compareclassicmetro) in this topic.| +| Control apps by business group and user | AppLocker policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). Individual AppLocker rules can be applied to individual users or to groups of users.| +| Control apps by computer, not user | AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.| +|Understand app usage, but there is no need to control any apps yet | AppLocker policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the AppLocker event log to create AppLocker policies.|   -**Important**   -The following list contains files or types of files that cannot be managed by AppLocker: +>**Important:**  The following list contains files or types of files that cannot be managed by AppLocker: + - AppLocker does not protect against running 16-bit DOS binaries in a NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe. + - You cannot use AppLocker to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. + - AppLocker can only control VBScript, JScript, .bat files, .cmd files and Windows PowerShell scripts. It does not control all interpreted code that runs within a host process, for example Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To use AppLocker to control interpreted code, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision that is returned by AppLocker. Not all host processes call into AppLocker. Therefore, AppLocker cannot control every kind of interpreted code, for example Microsoft Office macros. - **Important**   - You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. + + >**Important:**  You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded.   - AppLocker rules allow or prevent an app from launching. AppLocker does not control the behavior of apps after they are launched. Applications could contain flags that are passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll file to be loaded. In practice, an app that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must follow a process that best suits your needs to thoroughly vet each app before allowing them to run using AppLocker rules. + For more info, see [Security considerations for AppLocker](security-considerations-for-applocker.md).   ### Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions + AppLocker policies for Universal Windows apps can only be applied to apps that are installed on computers running Windows operating systems that support Windows Store apps. However, Classic Windows applications can be controlled in Windows Server 2008 R2 and Windows 7, in addition to those computers that support Universal Windows apps. The rules for Classic Windows applications and Universal Windows apps can be enforced together. The differences you should consider for Universal Windows apps are: + - All Universal Windows apps can be installed by a standard user, whereas a number of Classic Windows applications require administrative credentials to install. So in an environment where most of the users are standard users, you might not need numerous exe rules, but you might want more explicit policies for packaged apps. - Classic Windows applications can be written to change the system state if they run with administrative credentials. Most Universal Windows apps cannot change the system state because they run with limited permissions. When you design your AppLocker policies, it is important to understand whether an app that you are allowing can make system-wide changes. - Universal Windows apps can be acquired through the Store, or they can be side-loaded by using Windows PowerShell cmdlets. If you use Windows PowerShell cmdlets, a special Enterprise license is required to acquire Universal Windows apps. Classic Windows applications can be acquired through traditional means, such as through software vendors or retail distribution. + AppLocker controls Universal Windows apps and Classic Windows applications by using different rule collections. You have the choice to control Universal Windows apps, Classic Windows applications, or both. + For more info, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md). + ### How do you currently control app usage in your organization? + Most organizations have evolved app control policies and methods over time. With heightened security concerns and an emphasis on tighter IT control over desktop use, your organization might decide to consolidate app control practices or design a comprehensive application control scheme. AppLocker includes improvements over SRP in the architecture and management of application control policies. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Security polices (locally set or through Group Policy)

Using AppLocker requires increased effort in planning to create correct policies, but this results in a simpler distribution method.

Non-Microsoft app control software

Using AppLocker requires a complete app control policy evaluation and implementation.

Managed usage by group or OU

Using AppLocker requires a complete app control policy evaluation and implementation.

Authorization Manager or other role-based access technologies

Using AppLocker requires a complete app control policy evaluation and implementation.

Other

Using AppLocker requires a complete app control policy evaluation and implementation.

+ +| Possible answers | Design considerations | +| - | - | +| Security polices (locally set or through Group Policy) | Using AppLocker requires increased effort in planning to create correct policies, but this results in a simpler distribution method.| +| Non-Microsoft app control software | Using AppLocker requires a complete app control policy evaluation and implementation.| +| Managed usage by group or OU | Using AppLocker requires a complete app control policy evaluation and implementation.| +| Authorization Manager or other role-based access technologies | Using AppLocker requires a complete app control policy evaluation and implementation.| +| Other | Using AppLocker requires a complete app control policy evaluation and implementation.|   ### Which Windows desktop and server operating systems are running in your organization? + If your organization supports multiple Windows operating systems, app control policy planning becomes more complex. Your initial design decisions should consider the security and management priorities of applications that are installed on each version of the operating system. @@ -172,259 +135,94 @@ If your organization supports multiple Windows operating systems, app control po
  ### Are there specific groups in your organization that need customized application control policies? + Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Yes

-

For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.

-

If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply AppLocker rules in a GPO to specific user groups.

No

AppLocker policies can be applied globally to applications that are installed on PCs running the supported versions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.

+ +| Possible answers | Design considerations | +| - | - | +| Yes | For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.
If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply AppLocker rules in a GPO to specific user groups.| +| No | AppLocker policies can be applied globally to applications that are installed on PCs running the supported versions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|   ### Does your IT department have resources to analyze application usage, and to design and manage the policies? + The time and resources that are available to you to perform the research and analysis can affect the detail of your plan and processes for continuing policy management and maintenance. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Yes

Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.

No

Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment.

+ +| Possible answers | Design considerations | +| - | - | +| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.| +| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. |   ### Does your organization have Help Desk support? + Preventing your users from accessing known, deployed, or personal applications will initially cause an increase in end-user support. It will be necessary to address the various support issues in your organization so security policies are followed and business workflow is not hampered. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Yes

Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications.

No

Invest time in developing online support processes and documentation before deployment.

+ +| Possible answers | Design considerations | +| - | - | +| Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. | +| No | Invest time in developing online support processes and documentation before deployment. | +   ### Do you know what applications require restrictive policies? Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Yes

You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies.

No

You will have to perform an audit and requirements gathering project to discover the application usage. AppLocker provides the means to deploy policies in Audit only mode, and tools to view the event logs.

+ +| Possible answers | Design considerations | +| - | - | +| Yes | You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies. | +| No | You will have to perform an audit and requirements gathering project to discover the application usage. AppLocker provides the means to deploy policies in **Audit only** mode, and tools to view the event logs.|   ### How do you deploy or sanction applications (upgraded or new) in your organization? + Implementing a successful application control policy is based on your knowledge and understanding of application usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the applications that access that data. Understanding the upgrade and deployment policy will help shape the construction of the application control policies. - ---- - - - - - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Ad hoc

You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.

Strict written policy or guidelines to follow

You need to develop AppLocker rules that reflect those policies, and then test and maintain the rules.

No process in place

You need to determine if you have the resources to develop an application control policy, and for which groups.

+ +| Possible answers | Design considerations | +| - | - | +| Ad hoc | You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.| +| Strict written policy or guidelines to follow | You need to develop AppLocker rules that reflect those policies, and then test and maintain the rules. | +| No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. | +   ### Does your organization already have SRP deployed? + Although SRP and AppLocker have the same goal, AppLocker is a major revision of SRP. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Yes

You cannot use AppLocker to manage SRP settings, but you can use SRP to manage application control policies on computers running on any of the supported operating systems listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). In addition, if AppLocker and SRP settings are configured in the same GPO, only the AppLocker settings will be enforced on computers running those supported operating systems.

-
-Note   -

If you are using the Basic User security level as assigned in SRP, those permissions are not supported on computers running the supported operating systems.

-
-
-  -

No

Policies that are configured for AppLocker can only be applied to computers running the supported operating systems, but SRP is also available on those operating systems.

+ +| Possible answers | Design considerations | +| - | - | +| Yes | You cannot use AppLocker to manage SRP settings, but you can use SRP to manage application control policies on computers running on any of the supported operating systems listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). In addition, if AppLocker and SRP settings are configured in the same GPO, only the AppLocker settings will be enforced on computers running those supported operating systems.

**Note:** If you are using the Basic User security level as assigned in SRP, those permissions are not supported on computers running the supported operating systems.| +| No | Policies that are configured for AppLocker can only be applied to computers running the supported operating systems, but SRP is also available on those operating systems. |   ### What are your organization's priorities when implementing application control policies? + Some organizations will benefit from application control policies as shown by an increase in productivity or conformance, while others will be hindered in performing their duties. Prioritize these aspects for each group to allow you to evaluate the effectiveness of AppLocker. - ---- - - - - - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Productivity: The organization assures that tools work and required applications can be installed.

To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress.

Management: The organization is aware of and controls the apps it supports.

In some business groups, application usage can be managed from a central point of control. AppLocker policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps

Security: The organization must protect data in part by ensuring that only approved apps are used.

AppLocker can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.

+ +| Possible answers | Design considerations | +| - | - | +| Productivity: The organization assures that tools work and required applications can be installed. | To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress. | +| Management: The organization is aware of and controls the apps it supports. | In some business groups, application usage can be managed from a central point of control. AppLocker policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps| +| Security: The organization must protect data in part by ensuring that only approved apps are used. | AppLocker can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.|   ### How are apps currently accessed in your organization? + AppLocker is very effective for organizations that have application restriction requirements if they have environments with a simple topography and application control policy goals that are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers that are connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is to achieve a detailed level of control on the desktop computers with a relatively small number of applications to manage, or when the applications are manageable with a small number of rules. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Users run without administrative rights.

-

Apps are installed by using an installation deployment technology.

AppLocker can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using AppLocker to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.

-
-Note   -

AppLocker can also be effective in helping create standardized desktops in organizations where users run as administrators. However, it is important to note that users with administrative credentials can add new rules to the local AppLocker policy.

-
-
-  -

Users must be able to install applications as needed.

-

Users currently have administrator access, and it would be difficult to change this.

Enforcing AppLocker rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using AppLocker or to implement the Audit only enforcement setting through AppLocker.

+ +| Possible answers | Design considerations | +| - | - | +| Users run without administrative rights. | Apps are installed by using an installation deployment technology.| +| AppLocker can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using AppLocker to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.
**Note: **AppLocker can also be effective in helping create standardized desktops in organizations where users run as administrators. However, it is important to note that users with administrative credentials can add new rules to the local AppLocker policy.| Users must be able to install applications as needed. +| Users currently have administrator access, and it would be difficult to change this.|Enforcing AppLocker rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using AppLocker or to implement the **Audit only** enforcement setting through AppLocker.|   ### Is the structure in Active Directory Domain Services based on the organization's hierarchy? -Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure. Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins. - ---- - - - - - - - - - - - - - - - - -
Possible answersDesign considerations

Yes

AppLocker rules can be developed and implemented through Group Policy, based on your AD DS structure.

No

The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.

+ +Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure. +Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins. + +| Possible answers | Design considerations | +| - | - | +| Yes | AppLocker rules can be developed and implemented through Group Policy, based on your AD DS structure.| +| No | The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.|   ## Record your findings + The next step in the process is to record and analyze your answers to the preceding questions. If AppLocker is the right solution for your goals, tyou can set your application control policy objectives and plan your AppLocker rules. This process culminates in creating your planning document. + - For info about setting your policy goals, see [Determine your application control objectives](determine-your-application-control-objectives.md). - For info about creating your planning document, see [Create your AppLocker planning document](create-your-applocker-planning-document.md). -  -  diff --git a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index c4438ba57b..066f32d60e 100644 --- a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -2,34 +2,43 @@ title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows 10) description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand AppLocker rules and enforcement setting inheritance in Group Policy + **Applies to** - Windows 10 + This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. + Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. + Group Policy merges AppLocker policy in two ways: + - **Rules.** Group Policy does not overwrite or replace rules that are already present in a linked Group Policy Object (GPO). For example, if the current GPO has 12 rules and a linked GPO has 50 rules, 62 rules are applied to all computers that receive the AppLocker policy. - **Important**   - When determining whether a file is permitted to run, AppLocker processes rules in the following order: + >**Important:**  When determining whether a file is permitted to run, AppLocker processes rules in the following order: + 1. **Explicit deny.** An administrator created a rule to deny a file. 2. **Explicit allow.** An administrator created a rule to allow a file. 3. **Implicit deny.** This is also called the default deny because all files that are not affected by an allow rule are automatically blocked.   - **Enforcement settings.** The last write to the policy is applied. For example, if a higher-level GPO has the enforcement setting configured to **Enforce rules** and the closest GPO has the setting configured to **Audit only**, **Audit only** is enforced. If enforcement is not configured on the closest GPO, the setting from the closest linked GPO will be enforced. Because a computer's effective policy includes rules from each linked GPO, duplicate rules or conflicting rules could be enforced on a user's computer. Therefore, you should carefully plan your deployment to ensure that only rules that are necessary are present in a GPO. + The following figure demonstrates how AppLocker rule enforcement is applied through linked GPOs. + ![applocker rule enforcement inheritance chart](images/applocker-plan-inheritance.gif) + In the preceding illustration, note that all GPOs linked to Contoso are applied in order as configured. The rules that are not configured are also applied. For example, the result of the Contoso and Human Resources GPOs is 33 rules enforced, as shown in the client HR-Term1. The Human Resources GPO contains 10 non-configured rules. When the rule collection is configured for **Audit only**, no rules are enforced. + When constructing the Group Policy architecture for applying AppLocker policies, it is important to remember: + - Rule collections that are not configured will be enforced. - Group Policy does not overwrite or replace rules that are already present in a linked GPO. - AppLocker processes the explicit deny rule configuration before the allow rule configuration. - For rule enforcement, the last write to the GPO is applied. -  -  diff --git a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md index 225dc8c0c2..76bbb8d904 100644 --- a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md +++ b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md @@ -2,21 +2,30 @@ title: Understand the AppLocker policy deployment process (Windows 10) description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand the AppLocker policy deployment process + **Applies to** - Windows 10 + This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. + To successfully deploy AppLocker policies, you need to identify your application control objectives and construct the policies for those objectives. The key to the process is taking an accurate inventory of your organization's applications, which requires investigation of all the targeted business groups. With an accurate inventory, you can create rules and set enforcement criteria that will allow the organization to use the required applications and allow the IT department to manage a controlled set of applications. + The following diagram shows the main points in the design, planning, and deployment process for AppLocker. + ![applocker quick reference guide](images/applocker-plandeploy-quickreference.gif) + ## Resources to support the deployment process + The following topics contain information about designing, planning, deploying, and maintaining AppLocker policies: + - For info about the AppLocker policy design and planning requirements and process, see [AppLocker Design Guide](applocker-policies-design-guide.md). - For info about the AppLocker policy deployment requirements and process, see [AppLocker deployment guide](applocker-policies-deployment-guide.md). - For info about AppLocker policy maintenance and monitoring, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md index 30f5de5bcc..b6d8502af0 100644 --- a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -2,52 +2,38 @@ title: Understanding AppLocker allow and deny actions on rules (Windows 10) description: This topic explains the differences between allow and deny actions on AppLocker rules. ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker allow and deny actions on rules + **Applies to** - Windows 10 + This topic explains the differences between allow and deny actions on AppLocker rules. + ## Allow action versus deny action on rules + Unlike Software Restriction Policies (SRP), each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection are allowed to run. This configuration makes it easier to determine what will occur when an AppLocker rule is applied. + You can also create rules that use the deny action. When applying rules, AppLocker first checks whether any explicit deny actions are specified in the rule list. If you have denied a file from running in a rule collection, the deny action will take precedence over any allow action, regardless of which Group Policy Object (GPO) the rule was originally applied in. Because AppLocker functions as an allowed list by default, if no rule explicitly allows or denies a file from running, AppLocker's default deny action will block the file. + ### Deny rule considerations + Although you can use AppLocker to create a rule to allow all files to run and then use rules to deny specific files, this configuration is not recommended. The deny action is generally less secure than the allow action because a malicious user could modify the file to invalidate the rule. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. The following table details security concerns for different rule conditions with deny actions. - ---- - - - - - - - - - - - - - - - - - - - - -
Rule conditionSecurity concern with deny action

Publisher

A user could modify the properties of a file (for example, re-signing the file with a different certificate).

File hash

A user could modify the hash for a file.

Path

A user could move the denied file to a different location and run it from there.

+ +| Rule condition | Security concern with deny action | +| - | - | +| Publisher | A user could modify the properties of a file (for example, re-signing the file with a different certificate).| +| File hash | A user could modify the hash for a file.| +| Path | A user could move the denied file to a different location and run it from there.|   -**Important**   -If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. +>**Important:**  If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running.   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-default-rules.md b/windows/keep-secure/understanding-applocker-default-rules.md index cf10480b26..76aa56e251 100644 --- a/windows/keep-secure/understanding-applocker-default-rules.md +++ b/windows/keep-secure/understanding-applocker-default-rules.md @@ -2,62 +2,45 @@ title: Understanding AppLocker default rules (Windows 10) description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker default rules + **Applies to** - Windows 10 + This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. -**Important**   -You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. + +>**Important:**  You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run.   -If you require additional app security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: +If you require additional app security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. +The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: + - Traverse Folder/Execute File - Create Files/Write Data - Create Folders/Append Data + These permissions settings are applied to this folder for app compatibility. However, because any user can create files in this location, allowing applications to be run from this location might conflict with your organization's security policy. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TopicDescription

[Executable rules in AppLocker](executable-rules-in-applocker.md)

This topic describes the file formats and available default rules for the executable rule collection.

[Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md)

This topic describes the file formats and available default rules for the Windows Installer rule collection.

[Script rules in AppLocker](script-rules-in-applocker.md)

This topic describes the file formats and available default rules for the script rule collection.

[DLL rules in AppLocker](dll-rules-in-applocker.md)

This topic describes the file formats and available default rules for the DLL rule collection.

[Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md)

This topic explains the AppLocker rule collection for packaged app installers and packaged apps.

+ +| Topic | Description | +| - | - | +| [Executable rules in AppLocker](executable-rules-in-applocker.md) | This topic describes the file formats and available default rules for the executable rule collection. | +| [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) | This topic describes the file formats and available default rules for the Windows Installer rule collection.| +| [Script rules in AppLocker](script-rules-in-applocker.md) | This topic describes the file formats and available default rules for the script rule collection.| +| [DLL rules in AppLocker](dll-rules-in-applocker.md) | This topic describes the file formats and available default rules for the DLL rule collection.| +| [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) | This topic explains the AppLocker rule collection for packaged app installers and packaged apps.|   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) + +- [How AppLocker works](how-applocker-works-techref.md)     diff --git a/windows/keep-secure/understanding-applocker-rule-behavior.md b/windows/keep-secure/understanding-applocker-rule-behavior.md index b065509210..2e1353c3ed 100644 --- a/windows/keep-secure/understanding-applocker-rule-behavior.md +++ b/windows/keep-secure/understanding-applocker-rule-behavior.md @@ -2,24 +2,29 @@ title: Understanding AppLocker rule behavior (Windows 10) description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule behavior + **Applies to** - Windows 10 + This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. + If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. + A rule can be configured to use either an allow or deny action: + - **Allow**. You can specify which files are allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Deny**. You can specify which files are not allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. -**Important**   -You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. + +>**Important:**  You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path.   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-rule-collections.md b/windows/keep-secure/understanding-applocker-rule-collections.md index 950a47ebfe..9c569f7f53 100644 --- a/windows/keep-secure/understanding-applocker-rule-collections.md +++ b/windows/keep-secure/understanding-applocker-rule-collections.md @@ -2,28 +2,34 @@ title: Understanding AppLocker rule collections (Windows 10) description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule collections + **Applies to** - Windows 10 + This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. + An AppLocker rule collection is a set of rules that apply to one of five types: + - Executable files: .exe and .com - Windows Installer files: .msi, mst, and .msp - Scripts: .ps1, .bat, .cmd, .vbs, and .js - DLLs: .dll and .ocx - Packaged apps and packaged app installers: .appx + If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. -**Important**   -Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. + +>**Important:**  Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default.   For info about how to enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-rule-condition-types.md b/windows/keep-secure/understanding-applocker-rule-condition-types.md index e6b6e8505a..d4e6ceaf84 100644 --- a/windows/keep-secure/understanding-applocker-rule-condition-types.md +++ b/windows/keep-secure/understanding-applocker-rule-condition-types.md @@ -2,39 +2,55 @@ title: Understanding AppLocker rule condition types (Windows 10) description: This topic for the IT professional describes the three types of AppLocker rule conditions. ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule condition types + **Applies to** - Windows 10 + This topic for the IT professional describes the three types of AppLocker rule conditions. + Rule conditions are criteria that the AppLocker rule is based on. Primary conditions are required to create an AppLocker rule. The three primary rule conditions are publisher, path, and file hash. + **Publisher** + To use a publisher condition, the files must be digitally signed by the software publisher, or you must do so by using an internal certificate. Rules that are specified to the version level might have to be updated when a new version of the file is released. For more info about this rule condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). + **Path** + Any file can be assigned this rule condition; however, because path rules specify locations within the file system, any subdirectory will also be affected by the rule (unless explicitly exempted). For more info about this rule condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + **File hash** + Any file can be assigned this rule condition; however, the rule must be updated each time a new version of the file is released because the hash value is unique to that the version of the file. For more info about this rule condition, see [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). + ### Considerations + Selecting the appropriate condition for each rule depends on the overall application control policy goals of the organization, the AppLocker rule maintenance goals, and the condition of the existing (or planned) application deployment. The following questions can help you decide which rule condition to use. + 1. Is the file digitally signed by a software publisher? + If the file is signed by a software publisher, we recommend that you create rules with publisher conditions. You may still create file hash and path conditions for signed files. However, if the file is not digitally signed by a software publisher, you can: + - Sign the file by using an internal certificate. - Create a rule by using a file hash condition. - Create a rule by using a path condition. - **Note**   - To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. + + >**Note:**  To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, + `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory.   2. What rule condition type does your organization prefer? + If your organization is already using Software Restriction Policies (SRP) to restrict what files users can run, rules using file hash or path conditions are probably already in place. - **Note**   - For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + + >**Note:**  For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md).   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-rule-exceptions.md b/windows/keep-secure/understanding-applocker-rule-exceptions.md index 0a89f17cc7..a99cb1f8cb 100644 --- a/windows/keep-secure/understanding-applocker-rule-exceptions.md +++ b/windows/keep-secure/understanding-applocker-rule-exceptions.md @@ -2,19 +2,24 @@ title: Understanding AppLocker rule exceptions (Windows 10) description: This topic describes the result of applying AppLocker rule exceptions to rule collections. ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule exceptions + **Applies to** - Windows 10 + This topic describes the result of applying AppLocker rule exceptions to rule collections. + You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. + For example, the rule "Allow Everyone to run Windows except Registry Editor" allows everyone in the organization to run Windows but does not allow anyone to run Registry Editor. The effect of this rule would prevent users such as help desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor. + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md index 1be8c8cc55..b778f3c76d 100644 --- a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md @@ -2,38 +2,28 @@ title: Understanding the file hash rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding the file hash rule condition in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. + File hash rules use a system-computed cryptographic hash of the identified file. For files that are not digitally signed, file hash rules are more secure than path rules. The following table describes the advantages and disadvantages of the file hash condition. - ---- - - - - - - - - - - - - -
File hash condition advantagesFile hash condition disadvantages

Because each file has a unique hash, a file hash condition applies to only one file.

Each time that the file is updated (such as a security update or upgrade), the file's hash will change. As a result, you must manually update file hash rules.

+ +| File hash condition advantages | File hash condition disadvantages | +| - | - | +| Because each file has a unique hash, a file hash condition applies to only one file. | Each time that the file is updated (such as a security update or upgrade), the file's hash will change. As a result, you must manually update file hash rules.|   For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md index 2adb70d6c6..d62cf0c8b6 100644 --- a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md @@ -2,18 +2,24 @@ title: Understanding the path rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding the path rule condition in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. + The path condition identifies an application by its location in the file system of the computer or on the network. + When creating a rule that uses a deny action, path conditions are less secure than publisher and file hash conditions for preventing access to a file because a user could easily copy the file to a different location than the location specified in the rule. Because path rules specify locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file under that location will be allowed to run, including within users' profiles. The following table describes the advantages and disadvantages of the path condition. + @@ -40,57 +46,22 @@ When creating a rule that uses a deny action, path conditions are less secure th
  AppLocker does not enforce rules that specify paths with short names. You should always specify the full path to a file or folder when creating path rules so that the rule will be properly enforced. + The asterisk (\*) wildcard character can be used within **Path** field. The asterisk (\*) character used by itself represents any path. When combined with any string value, the rule is limited to the path of the file and all the files under that path. For example, %ProgramFiles%\\Internet Explorer\\\* indicates that all files and subfolders within the Internet Explorer folder will be affected by the rule. + AppLocker uses path variables for well-known directories in Windows. Path variables are not environment variables. The AppLocker engine can only interpret AppLocker path variables. The following table details these path variables. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows directory or driveAppLocker path variableWindows environment variable

Windows

%WINDIR%

%SystemRoot%

System32

%SYSTEM32%

%SystemDirectory%

Windows installation directory

%OSDRIVE%

%SystemDrive%

Program Files

%PROGRAMFILES%

%ProgramFiles% and %ProgramFiles(x86)%

Removable media (for example, CD or DVD)

%REMOVABLE%

Removable storage device (for example, USB flash drive)

%HOT%

+ +| Windows directory or drive | AppLocker path variable | Windows environment variable | +| - | - | - | +| Windows | %WINDIR% | %SystemRoot% | +| System32 | %SYSTEM32%| %SystemDirectory%| +| Windows installation directory | %OSDRIVE%|%SystemDrive%| +| Program Files | %PROGRAMFILES%| %ProgramFiles% and %ProgramFiles(x86)%| +| Removable media (for example, CD or DVD) | %REMOVABLE%| | +| Removable storage device (for example, USB flash drive)| %HOT%|||   For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md index 053ee2e59c..34ac6444f3 100644 --- a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md @@ -2,18 +2,24 @@ title: Understanding the publisher rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding the publisher rule condition in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. + Publisher conditions can be made only for files that are digitally signed; this condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the app is part of and the version number of the app. The publisher may be a software development company, such as Microsoft, or the Information Technology department of your organization. -Publisher conditions are easier to maintain than file hash conditions and are generally more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages of the publisher condition. +Publisher conditions are easier to maintain than file hash conditions and are generally more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages +of the publisher condition. + @@ -42,70 +48,42 @@ Publisher conditions are easier to maintain than file hash conditions and are ge
  Wildcard characters can be used as values in the publisher rule fields according to the following specifications: + - **Publisher** + The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk is not treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name “\*x\*”. A question mark (?) is not a valid wildcard character in this field. + - **Product name** + The asterisk (\*) character used by itself represents any product name. When combined with any string value, the rule is limited to the product of the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk is not treated as a wildcard character if used with other characters in this field. A question mark (?) is not a valid wildcard character in this field. + - **File name** + Either the asterisk (\*) or question mark (?) characters used by themselves represent any and all file names. When combined with any string value, the string is matched with any file name containing that string. + - **File version** + The asterisk (\*) character used by itself represents any file version. If you want to limit the file version to a specific version or as a starting point, you can state the file version and then use the following options to apply limits: + - **Exactly**. The rule applies only to this version of the app - **And above**. The rule applies to this version and all later versions. - **And Below**. The rule applies to this version and all earlier versions. + The following table describes how a publisher condition is applied. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionThe publisher condition allows or denies…

All signed files

All files that are signed by a publisher.

Publisher only

All files that are signed by the named publisher.

Publisher and product name

All files for the specified product that are signed by the named publisher.

Publisher, product name, and file name

Any version of the named file for the named product that is signed by the publisher.

Publisher, product name, file name, and file version

Exactly

-

The specified version of the named file for the named product that is signed by the publisher.

Publisher, product name, file name, and file version

And above

-

The specified version of the named file and any new releases for the product that are signed by the publisher.

Publisher, product name, file name, and file version

And below

-

The specified version of the named file and any older versions for the product that are signed by the publisher.

Custom

You can edit the Publisher, Product name, File name, and Version fields to create a custom rule.

+ +| Option | The publisher condition allows or denies…| +| - | - | +| **All signed files** | All files that are signed by a publisher.| +| **Publisher only** | All files that are signed by the named publisher.| +| **Publisher and product name** | All files for the specified product that are signed by the named publisher.| +| **Publisher, product name, and file name** | Any version of the named file for the named product that is signed by the publisher.| +| **Publisher, product name, file name, and file version** | **Exactly**
The specified version of the named file for the named product that is signed by the publisher.| +| **Publisher, product name, file name, and file version** | **And above**
The specified version of the named file and any new releases for the product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **And below**
The specified version of the named file and any older versions for the product that are signed by the publisher.| +| **Custom** | You can edit the **Publisher**, **Product name**, **File name**, and **Version** fields to create a custom rule.|   For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index 4b888e3d71..e9c7b0645e 100644 --- a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -2,35 +2,46 @@ title: Use a reference device to create and maintain AppLocker policies (Windows 10) description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use a reference device to create and maintain AppLocker policies + **Applies to** - Windows 10 + This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. + ## Background and prerequisites + An AppLocker reference device is a baseline device you can use to configure policies and can subsequently be used to maintain AppLocker policies. For the procedure to configure a reference device, see [Configure the AppLocker reference device](configure-the-appLocker-reference-device.md). + An AppLocker reference device that is used to create and maintain AppLocker policies should contain the corresponding apps for each organizational unit (OU) to mimic your production environment. -**Important**   -The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + +>**Important:**  The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md).   You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement setting or Windows PowerShell cmdlets. You can also use the reference device as part of a testing configuration that includes policies that are created by using Software Restriction Policies. + ## Step 1: Automatically generate rules on the reference device + With AppLocker, you can automatically generate rules for all files within a folder. AppLocker scans the specified folder and creates the condition types that you choose for each file in that folder. For the procedure to do this, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). -**Note**   -If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. + +>**Note:**  If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules.   ## Step 2: Create the default rules on the reference device + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You must run the default rules for each rule collection. For info about default rules and considerations for using them, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md). For the procedure to create default rules, see [Create AppLocker default rules](create-applocker-default-rules.md). -**Important**   -You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. + +>**Important:**  You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules.   ## Step 3: Modify rules and the rule collection on the reference device + If AppLocker policies are currently running in your production environment, export the policies from the corresponding GPOs and save them to the reference device. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). If no AppLocker policies have been deployed, create the rules and develop the policies by using the following procedures: + - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) @@ -39,25 +50,34 @@ If AppLocker policies are currently running in your production environment, expo - [Delete an AppLocker rule](delete-an-applocker-rule.md) - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) - [Enforce AppLocker rules](enforce-applocker-rules.md) + ## Step 4: Test and update AppLocker policy on the reference device + You should test each set of rules to ensure that they perform as intended. The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference device. Perform the steps on each reference device that you used to define the AppLocker policy. Ensure that the reference device is joined to the domain and that it is receiving the AppLocker policy from the appropriate GPO. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules to simultaneously test all of your test GPOs. Use the following procedures to complete this step: + - [Test an AppLocker Policy with Test-AppLockerPolicy](http://technet.microsoft.com/library/ee791772(WS.10).aspx) - [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx) -**Caution**   -If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. + +>**Caution:**  If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect.   ## Step 5: Export and import the policy into production + When the AppLocker policy has been tested successfully, it can be imported into the GPO (or imported into individual computers that are not managed by Group Policy) and checked for its intended effectiveness. To do this, perform the following procedures: + - [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) - [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) or - [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx) + If the AppLocker policy enforcement setting is **Audit only** and you are satisfied that the policy is fulfilling your intent, you can change it to **Enforce rules**. For info about how to change the enforcement setting, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). + ## Step 6: Monitor the effect of the policy in production + If additional refinements or updates are necessary after a policy is deployed, use the appropriate following procedures to monitor and update the policy: + - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - [Edit an AppLocker policy](edit-an-applocker-policy.md) - [Refresh an AppLocker policy](refresh-an-applocker-policy.md) + ## See also -[Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) -  -  + +- [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) diff --git a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md index 01e857dfe3..ef970cd8df 100644 --- a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -2,18 +2,26 @@ title: Use AppLocker and Software Restriction Policies in the same domain (Windows 10) description: This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use AppLocker and Software Restriction Policies in the same domain + **Applies to** - Windows 10 + This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. + ## Using AppLocker and Software Restriction Policies in the same domain -AppLocker is supported on systems running Windows 7 and above. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It is recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. + +AppLocker is supported on systems running Windows 7 and above. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running +Windows Server 2008 R2, Windows 7 and later. It is recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, +Windows 7 and later, the SRP policies are ignored. + The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. diff --git a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md index 4ccedff7ca..cf988054c1 100644 --- a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md @@ -2,30 +2,51 @@ title: Use the AppLocker Windows PowerShell cmdlets (Windows 10) description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use the AppLocker Windows PowerShell cmdlets + **Applies to** - Windows 10 + This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. + ## AppLocker Windows PowerShell cmdlets -The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. -To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. + +The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the +Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. + +To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the +Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. + ### Retrieve application information -The [Get-AppLockerFileInformation](http://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. + +The [Get-AppLockerFileInformation](http://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. + +File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. + ### Set AppLocker policy + The [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx) cmdlet sets the specified GPO to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. + ### Retrieve an AppLocker policy + The [Get-AppLockerPolicy](http://technet.microsoft.com/library/hh847214.aspx) cmdlet gets the AppLocker policy from the local GPO, from a specified GPO, or from the effective AppLocker policy on the device. The output of the AppLocker policy is an AppLockerPolicy object or an XML-formatted string. + ### Generate rules for a given user or group -The [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the list of file information. + +The [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the +list of file information. + ### Test the AppLocker Policy against a file set + The [Test-AppLockerPolicy](http://technet.microsoft.com/library/hh847213.aspx) cmdlet uses the specified AppLocker policy to test whether a specified list of files are allowed to run or not on the local device for a specific user. + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -  -  diff --git a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md index cc7a0adbb4..060d693df1 100644 --- a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md +++ b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md @@ -2,22 +2,33 @@ title: Use Windows Event Forwarding to help with intrusion detection (Windows 10) description: Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. ms.assetid: 733263E5-7FD1-45D2-914A-184B9E3E6A3F -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: tedhardyMSFT --- + # Use Windows Event Forwarding to help with intrusion detection + **Applies to** - Windows 10 + Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. + Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server. -To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The Suspect subscription collects additional events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations. + +To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The +Suspect subscription collects additional events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations. + This implementation helps differentiate where events are ultimately stored. Baseline events can be sent to devices with online analytical capability, such as Security Event Manager (SEM), while also sending events to a MapReduce system, such as HDInsight or Hadoop, for long-term storage and deeper analysis. Events from the Suspect subscription are sent directly to a MapReduce system due to volume and lower signal/noise ratio, they are largely used for host forensic analysis. + An SEM’s strength lies in being able to inspect, correlate events, and generate alerts for known patterns manner and alert security staff at machine speed. + A MapReduce system has a longer retention time (years versus months for an SEM), larger ingress ability (hundreds of terabytes per day), and the ability to perform more complex operations on the data like statistical and trend analysis, pattern clustering analysis, or apply Machine Learning algorithms. + Here's an approximate scaling guide for WEF events: + | Events/second range | Data store | |---------------------|----------------------------| | 0 - 5,000 | SQL or SEM | @@ -25,54 +36,91 @@ Here's an approximate scaling guide for WEF events: | 50,000+ | Hadoop/HDInsight/Data Lake |   Event generation on a device must be enabled either separately or as part of the GPO for the baseline WEF implementation, including enabling of disabled event logs and setting channel permissions. For more info, see [Appendix C - Event channel settings (enable and channel access) methods](#bkmk-appendixc). This is because WEF is a passive system with regards to the event log. It cannot change the size of event log files, enable disabled event channels, change channel permissions, or adjust a security audit policy. WEF only queries event channels for existing events. Additionally, having event generation already occurring on a device allows for more complete event collection building a complete history of system activity. Otherwise, you'll be limited to the speed of GPO and WEF subscription refresh cycles to make changes to what is being generated on the device. On modern devices, enabling additional event channels and expanding the size of event log files has not resulted in noticeable performance differences. + For the minimum recommended audit policy and registry system ACL settings, see [Appendix A - Minimum recommended minimum audit policy](#bkmk-appendixa) and [Appendix B - Recommended minimum registry system ACL policy](#bkmk-appendixb). -**Note**   -These are only minimum values need to meet what the WEF subscription selects. + +>**Note:**  These are only minimum values need to meet what the WEF subscription selects.   From a WEF subscription management perspective, the event queries provided should be used in two separate subscriptions for ease of maintenance; only machines meeting specific criteria would be allowed access to the targeted subscription, this access would be determined by an algorithm or an analysts’ direction. All devices should have access to the Baseline subscription. + This means you would create two base subscriptions: + - **Baseline WEF subscription**. Events collected from all hosts, this includes some role-specific events, which will only be emitted by those machines. - **Targeted WEF subscription**. Events collected from a limited set of hosts due to unusual activity and/or heightened awareness for those systems. + Each using the respective event query below. Note that for the Targeted subscription enabling the “read existing events” option should be set to true to allow collection of existing events from systems. By default, WEF subscriptions will only forward events generated after the WEF subscription was received by the client. + In [Appendix E – Annotated Baseline Subscription Event Query](#bkmk-appendixe) and [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf), the event query XML is included when creating WEF subscriptions. These are annotated for query purpose and clarity. Individual <Query> element can be removed or edited without affecting the rest of the query. + ### Common WEF questions + This section addresses common questions from IT pros and customers. + ### Will the user notice if their machine is enabled for WEF or if WEF encounters an error? + The short answer is: No. + The longer answer is: The **Eventlog-forwardingPlugin/Operational** event channel logs the success, warning, and error events related to WEF subscriptions present on the device. Unless the user opens Event Viewer and navigates to that channel, they will not notice WEF either through resource consumption or Graphical User Interface pop-ups. Even if there is an issue with the WEF subscription, there is no user interaction or performance degradation. All success, warning, and failure events are logged to this operational event channel. + ### Is WEF Push or Pull? + A WEF subscription can be configured to be push or pull, but not both. The simplest, most flexible IT deployment with the greatest scalability can be achieved by using a push, or source initiated, subscription. WEF clients are configured by using a GPO and the built-in forwarding client is activated. For pull, collector initiated, the subscription on the WEC server is pre-configured with the names of the WEF Client devices from which events are to be selected. Those clients also have to be configured ahead of time to allow the credentials used in the subscription to access their event logs remotely (normally by adding the credential to the **Event Log Readers** built-in local security group.) A useful scenario: closely monitoring a specific set of machines. + ### Will WEF work over VPN or RAS? + WEF handles VPN, RAS, and DirectAccess scenarios well and will reconnect and send any accumulated backlog of events when the connection to the WEF Collector is re-established. + ### How is client progress tracked? -The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it is active. This heartbeat value can be individually configured for each subscription. + +The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a +WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it is active. This heartbeat value can be individually configured for each subscription. + ### Will WEF work in an IPv4, IPv6, or mixed IPv4/IPv6 environment? + Yes. WEF is transport agnostic and will work over IPv4 or IPv6. + ### Are WEF events encrypted? I see an HTTP/HTTPS option! + In a domain setting, the connection used to transmit WEF events is encrypted using Kerberos, by default (with NTLM as a fallback option, which can be disabled by using a GPO). Only the WEF collector can decrypt the connection. Additionally, the connection between WEF client and WEC server is mutually authenticated regardless of authentication type (Kerberos or NTLM.) There are GPO options to force Authentication to use Kerberos Only. + This authentication and encryption is performed regardless if HTTP or HTTPS is selected. + The HTTPS option is available if certificate based authentication is used, in cases where the Kerberos based mutual authentication is not an option. The SSL certificate and provisioned client certificates are used to provide mutual authentication. + ### Do WEF Clients have a separate buffer for events? + The WEF client machines local event log is the buffer for WEF for when the connection to the WEC server is lost. To increase the “buffer size”, increase the maximum file size of the specific event log file where events are being selected. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). + When the event log overwrites existing events (resulting in data loss if the device is not connected to the Event Collector), there is no notification sent to the WEF collector that events are lost from the client. Neither is there an indicator that there was a gap encountered in the event stream. + ### What format is used for forwarded events? -WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is “Events” (also sometimes referred to as “Binary” format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This is very compact and can more than double the event volume a single WEC server can accommodate. + +WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is +“Events” (also sometimes referred to as “Binary” format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This is very compact and can more than double the event volume a single WEC server can accommodate. + A subscription “testSubscription” can be configured to use the Events format through the WECUTIL utility: + ``` syntax @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss “testSubscription” /cf:Events ``` + ### How frequently are WEF events delivered? + Event delivery options are part of the WEF subscription configuration parameters – There are three built-in subscription delivery options: Normal, Minimize Bandwidth, and Minimize Latency. A fourth, catch-all called “Custom” is available but cannot be selected or configured through the WEF UI by using Event Ciewer. The Custom delivery option must be selected and configured using the WECUTIL.EXE command-line application. All subscription options define a maximum event count and maximum event age, if either limit is exceeded then the accumulated events are sent to the event collector. + This table outlines the built-in delivery options: -| Event delivery optimization options | Description | -|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | -| Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | -| Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. | + +| Event delivery optimization options | Description | +| - | - | +| Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | +| Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | +| Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. |   For more info about delivery options, see [Configure Advanced Subscription Settings](http://technet.microsoft.com/library/cc749167.aspx). + The primary difference is in the latency which events are sent from the client. If none of the built-in options meet your requirements you can set Custom event delivery options for a given subscription from an elevated command prompt: + ``` syntax @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss “SubscriptionNameGoesHere” /cm:Custom @@ -82,122 +130,209 @@ Wecutil ss “SubscriptionNameGoesHere” /dmi:1 Wecutil ss “SubscriptionNameGoesHere” /dmlt:10 ``` ### How do I control which devices have access to a WEF Subscription? + For source initiated subscriptions: Each WEF subscription on a WEC server has its own ACL for machine accounts or security groups containing machine accounts (not user accounts) that are explicitly allowed to participate in that subscription or are explicitly denied access. This ACL applies to only a single WEF subscription (since there can be multiple WEF subscriptions on a given WEC server), other WEF Subscriptions have their own separate ACL. + For collector initiated subscriptions: The subscription contains the list of machines from which the WEC server is to collect events. This list is managed at the WEC server, and the credentials used for the subscription must have access to read event logs from the WEF Clients – the credentials can be either the machine account or a domain account. + ### Can a client communicate to multiple WEF Event Collectors? + Yes. If you desire a High-Availability environment, simply configure multiple WEC servers with the same subscription configuration and publish both WEC Server URIs to WEF clients. WEF Clients will forward events simultaneously to the configured subscriptions on the WEC servers, if they have the appropriate access. + ### What are the WEC server’s limitations? + There are three factors that limit the scalability of WEC servers. The general rule for a stable WEC server on commodity hardware is “10k x 10k” – meaning, no more than 10,000 concurrently active WEF Clients per WEC server and no more than 10,000 events/second average event volume. + - **Disk I/O**. The WEC server does not process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. - **Network Connections**. While a WEF source does not maintain a permanent, persistent connection to the WEC server, it does not immediately disconnect after sending its events. This means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. - **Registry size**. For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this is not pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time. + - When a subscription has >1000 WEF sources connect to it over its operational lifetime, also known as lifetime WEF sources, Event Viewer can become unresponsive for a few minutes when selecting the **Subscriptions** node in the left-navigation, but will function normally afterwards. - At >50,000 lifetime WEF sources, Event Viewer is no longer an option and wecutil.exe (included with Windows) must be used to configure and manage subscriptions. - At >100,000 lifetime WEF sources, the registry will not be readable and the WEC server will likely have to be rebuilt. + ## Subscription information + Below lists all of the items that each subscription collects, the actual subscription XML is available in an Appendix. These are separated out into Baseline and Targeted. The intent is to subscribe all hosts to Baseline, and then enroll (and remove) hosts on an as needed basis to the Targeted subscription. + ### Baseline subscription + While this appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices – a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription does not require special configuration on client devices to enable event channels or modify channel permissions. + The subscription is essentially a collection of query statements applied to the Event Log. This means that it is modular in nature and a given query statement can be removed or changed without impacting other query statement in the subscription. Additionally, suppress statements which filter out specific events, only apply within that query statement and are not to the entire subscription. + ### Baseline subscription requirements + To gain the most value out of the baseline subscription we recommend to have the following requirements set on the device to ensure that the clients are already generating the required events to be forwarded off the system. + - Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A – Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This ensures that the security event log is generating the required events. - Apply at least an Audit-Only AppLocker policy to devices. + - If you are already whitelisting or blacklisting events by using AppLocker, then this requirement is met. - AppLocker events contain extremely useful information, such as file hash and digital signature information for executables and scripts. + - Enable disabled event channels and set the minimum size for modern event files. - Currently, there is no GPO template for enabling or setting the maximum size for the modern event files. This must be done by using a GPO. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). + The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Baseline Subscription Event Query](#bkmk-appendixf). + - Anti-malware events from Microsoft Antimalware or Windows Defender. This can be configured for any given anti-malware product easily if it writes to the Windows event log. - Security event log Process Create events. - AppLocker Process Create events (EXE, script, packaged App installation and execution). - Registry modification events. For more info, see [Appendix B – Recommended minimum Registry System ACL Policy](#bkmk-appendixb). - OS startup and shutdown + - Startup event include operating system version, service pack level, QFE version, and boot mode. + - Service install + - Includes what the name of the service, the image path, and who installed the service. + - Certificate Authority audit events + - This is only applicable on systems with the Certificate Authority role installed. - Logs certificate requests and responses. + - User profile events + - Use of a temporary profile or unable to create a user profile may indicate an intruder is interactively logging into a device but not wanting to leave a persistent profile behind. + - Service start failure + - Failure codes are localized, so you have to check the message DLL for values. + - Network share access events + - Filter out IPC$ and /NetLogon file shares, which are expected and noisy. + - System shutdown initiate requests + - Find out what initiated the restart of a device. + - User initiated interactive logoff event - Remote Desktop Services session connect, reconnect, or disconnect. - EMET events, if EMET is installed. - Event forwarding plugin events + - For monitoring WEF subscription operations, particularly Partial Success events. This is useful for diagnosing deployment issues. + - Network share create and delete + - Enables detection of unauthorized share creation. - **Note**  All shares are re-created when the device starts. + >**Note:**  All shares are re-created when the device starts.   - Logon sessions + - Logon success for interactive (local and Remote Interactive/Remote Desktop) - Logon success for services for non-built-in accounts, such as LocalSystem, LocalNetwork, and so on. - Logon success for batch sessions - Logon session close, which are logoff events for non-network sessions. + - Windows Error Reporting (Application crash events only) + - This can help detect early signs of intruder not familiar with enterprise environment using targeted malware. + - Event log service events + - Errors, start events, and stop events for the Windows Event Log service. + - Event log cleared (including the Security Event Log) + - This could indicate an intruder that are covering their tracks. + - Special privileges assigned to new logon + - This indicates that at the time of logon a user is either an Administrator or has the sufficient access to make themselves Administrator. + - Outbound Remote Desktop Services session attempts + - Visibility into potential beachhead for intruder + - System time changed - SMB Client (mapped drive connections) - Account credential validation + - Local accounts or domain accounts on domain controllers + - A user was added or removed from the local Administrators security group. - Crypto API private key accessed + - Associated with signing objects using the locally stored private key. + - Task Scheduler task creation and delete + - Task Scheduler allows intruders to run code at specified times as LocalSystem. + - Logon with explicit credentials + - Detect credential use changes by intruders to access additional resources. + - Smartcard card holder verification events + - This detects when a smartcard is being used. + ### Suspect subscription + This adds some possible intruder-related activity to help analyst further refine their determinations about the state of the device. + - Logon session creation for network sessions + - Enables time-series analysis of network graphs. + - RADIUS and VPN events + - Useful if you use a Microsoft IAS RADIUS/VPN implementation. It shows user-> IP address assignment with remote IP address connecting to the enterprise. + - Crypto API X509 object and build chain events + - Detects known bad certificate, CA, or sub-CA - Detects unusual process use of CAPI + - Groups assigned to local logon + - Gives visibility to groups which enable account wide access - Allows better planning for remediation efforts - Excludes well known, built-in system accounts. + - Logon session exit + - Specific for network logon sessions. + - Client DNS lookup events + - Returns what process performed a DNS query and the results returned from the DNS server. + - Process exit + - Enables checking for processes terminating unexpectedly. + - Local credential validation or logon with explicit credentials + - Generated when the local SAM is authoritative for the account credentials being authenticated. - Noisy on domain controllers - On client devices this is only generated when local accounts log on. + - Registry modification audit events + - Only when a registry value is being created, modified, or deleted. + - Wireless 802.1x authentication + - Detect wireless connection with a peer MAC address + - Windows PowerShell logging + - Covers Windows PowerShell 2.0 and later and includes the Windows PowerShell 5.0 logging improvements for in-memory attacks using Windows PowerShell. - Includes Windows PowerShell remoting logging + - User Mode Driver Framework “Driver Loaded” event + - Can possibly detect a USB device loading multiple device drivers. For example, a USB\_STOR device loading the keyboard or network driver. + ## Appendix A - Minimum recommended minimum audit policy + If your organizational audit policy enables additional auditing to meet its needs, that is fine. The policy below is the minimum audit policy settings needed to enable events collected by both baseline and targeted subscriptions. + | Category | Subcategory | Audit settings | |--------------------|---------------------------------|---------------------| | Account Logon | Credential Validation | Success and Failure | @@ -232,28 +367,46 @@ If your organizational audit policy enables additional auditing to meet its need | System | System Integrity | Success and Failure |   ## Appendix B - Recommended minimum registry system ACL policy + The Run and RunOnce keys are useful for intruders and malware persistence. It allows code to be run (or run only once then removed, respectively) when a user logs into the system. + This can easily be extended to other Auto-Execution Start Points keys in the registry. + Use the following figures to see how you can configure those registry keys. -![default acl for run key](images/runkey.png)![default acl for runonce key](images/runoncekey.png) + +![default acl for run key](images/runkey.png) + +![default acl for runonce key](images/runoncekey.png) + ## Appendix C - Event channel settings (enable and channel access) methods + Some channels are disabled by default and have to be enabled. Others, such as Microsoft-Windows-CAPI2/Operational must have the channel access modified to allow the Event Log Readers built-in security group to read from it. + The recommended and most effective way to do this is to configure the baseline GPO to run a scheduled task to configure the event channels (enable, set maximum size, and adjust channel access.) This will take effect at the next GPO refresh cycle and has minimal impact on the client device. + The following GPO snippet performs the following: + - Enables the **Microsoft-Windows-Capi2/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-Capi2/Operational** to 100MB. - Sets the maximum file size for **Microsoft-Windows-AppLocker/EXE and DLL** to 100MB. - Sets the maximum channel access for **Microsoft-Windows-Capi2/Operational** to include the built-in Event Log Readers security group. - Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50MB. + ![configure event channels](images/capi-gpo.png) + ## Appendix D - Minimum GPO for WEF Client configuration + Here are the minimum steps for WEF to operate: + 1. Configure the collector URI(s). 2. Start the WinRM service. 3. Add the Network Service account to the built-in Event Log Readers security group. This allows reading from secured event channel, such as the security event channel. + ![configure the wef client](images/wef-client-config.png) + ## Appendix E – Annotated baseline subscription event query + ``` syntax @@ -416,8 +569,11 @@ Here are the minimum steps for WEF to operate: ``` + ## Appendix F – Annotated Suspect Subscription Event Query + ``` syntax + @@ -486,10 +642,10 @@ Here are the minimum steps for WEF to operate: ``` ## Appendix G - Online resources + You can get more info with the following links: -- [Event Selection](http://msdn.microsoft.com/library/aa385231(VS.85).aspx) -- [Event Queries and Event XML](http://msdn.microsoft.com/library/bb399427(VS.90).aspx) -- [Event Query Schema](http://msdn.microsoft.com/library/aa385760(VS.85).aspx) + +- [Event Selection](http://msdn.microsoft.com/library/aa385231.aspx) +- [Event Queries and Event XML](http://msdn.microsoft.com/library/bb399427.aspx) +- [Event Query Schema](http://msdn.microsoft.com/library/aa385760.aspx) - [Windows Event Collector](http://msdn.microsoft.com/library/windows/desktop/bb427443.aspx) -  -  diff --git a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md index 9f31ef56eb..a4fbc0126b 100644 --- a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md +++ b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md @@ -2,87 +2,83 @@ title: User Account Control Admin Approval Mode for the Built-in Administrator account (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Admin Approval Mode for the Built-in Administrator account security policy setting. ms.assetid: d465fc27-1cd2-498b-9cf6-7ad2276e5998 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Admin Approval Mode for the Built-in Administrator account **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Admin Approval Mode for the Built-in Administrator account** security policy setting. + ## Reference + This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account. In this mode, any operation that requires elevation of privilege displays a prompt that allows the administrator to permit or deny the elevation of privilege. If Admin Approval Mode is not enabled, the built-in Administrator account logs on in Windows XP Mode, and it runs all applications by default with full administrative privileges. By default, this setting is set to **Disabled**. -**Note**   -If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled. + +>**Note:**  If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled.   ### Possible values + - Enabled + The built-in administrator account logs on in Admin Approval Mode so that any operation that requires elevation of privilege displays a prompt that provides the administrator the option to permit or deny the elevation of privilege. + - Disabled + The built-in administrator account logs on in Windows XP Mode, and it runs all applications by default with full administrative privileges. + ### Best practices + - Do not enable the built-in administrator account on the client computer, but use the standard user account and User Account Control (UAC). + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. -
---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Disabled

DC Effective Default Settings

Disabled

Member Server Effective Default Settings

Disabled

Client Computer Effective Default Settings

Disabled

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + One of the risks of the User Account Control (UAC) feature is that it is intended to mitigate malicious software running under elevated credentials without the user or administrator being aware of its activity. An attack vector for malicious programs is to discover the password of the administrator account because that user account was created for all installations of the Windows. To address this risk, the built-in administrator account is disabled in computers running at least Windows Vista. In computers running at least Windows Server 2008, the administrator account is enabled, and the password must be changed the first time the Administrator logs on. In a default installation of a computer running at least Windows Vista, accounts with administrative control over the computer are initially set up in one of two ways: + - If the computer is not joined to a domain, the first user account you create has the equivalent permissions as a local administrator. - If the computer is joined to a domain, no local administrator accounts are created. The enterprise or domain administrator must log on to the computer and create a local administrator account if one is warranted. + ### Countermeasure + Enable the **User Account Control: Admin Approval Mode for the Built-in Administrator account** setting if you have the built-in Administrator account enabled. + ### Potential impact + Users who log on by using the local administrator account are prompted for consent whenever a program requests an elevation in privilege. ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md index 3215dba248..cc8ebe93f3 100644 --- a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md +++ b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md @@ -2,104 +2,118 @@ title: User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop (Windows 10) description: Describes the best practices, location, values, and security considerations for the User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop security policy setting. ms.assetid: fce20472-3c93-449d-b520-13c4c74a9892 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** security policy setting. + ## Reference + This security setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts that are used by a standard user. -**Note**   -This setting does not change the behavior of the UAC elevation prompt for administrators. + +>**Note:**  This setting does not change the behavior of the UAC elevation prompt for administrators.   **Background** + User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI does not interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. + Microsoft UI Automation is the current model to support accessibility requirements in the Windows operating systems. Applications that are designed to support an accessible user experience control the behavior of other Windows applications on behalf of the user. When all applications on the automation client computer and server are running as a standard user (that is, at a medium integrity level), the UIPI restrictions do not interfere with the Microsoft UI automation model. + However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation cannot drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. -If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. + +If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy +checks before starting an application with UIAccess privilege. + 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local computer. 2. The application must be installed in a local folder that is writeable only by administrators, such as the Program Files directory. The allowed directories for UI automation applications are: + 1. %ProgramFiles% and its subdirectories. 2. %WinDir% and its subdirectories, except a few subdirectories that are excluded because standard users have write access. + **Resulting behavior** + When this setting is enabled, UIAccess programs (including Windows Remote Assistance) can automatically disable the secure desktop for elevation prompts. Unless you have also disabled elevation prompts, the prompts appear on the interactive user's desktop instead of on the secure desktop. The prompts also appear on the remote administrator's view of the desktop during a Windows Remote Assistance session, and the remote administrator can provide the appropriate credentials for elevation. + If you disable this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) setting, which by default is enabled. + ### Possible values + - Enabled + UIA programs can automatically disable the secure desktop for elevation prompts, and unless you have also disabled elevation prompts, the prompts appear on the interactive user's desktop instead of on the secure desktop. Prompts will also appear on the remote administrator's view of the desktop during a Windows Remote Assistance session, and the remote administrator can provide the appropriate credentials for elevation. + - Disabled + The secure desktop can be disabled only by the user of the interactive desktop or by disabling the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting. + ### Best practices + - Best practices are dependent on your security policies and your remote operational requirements. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Disabled

DC Effective Default Settings

Disabled

Member Server Effective Default Settings

Disabled

Client Computer Effective Default Settings

Disabled

+ +Server type or GPO| Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ### Policy interactions + If you plan to enable this setting, you should also review the effect of the [User Account Control: Behavior of the elevation prompt for standard users](user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) setting. If it is configured as **Automatically deny elevation requests**, elevation requests are not presented to the user. If you disable this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) setting, which by default is enabled. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + UIA programs are designed to interact with Windows and application programs on behalf of a user. This setting allows UIA programs to bypass the secure desktop to increase usability in certain cases, but it allows elevation requests to appear on the regular interactive desktop instead of on the secure desktop. This increases the risk that a malicious program could intercept data that is being transferred between the UI and the application. Because UIA programs must be able to respond to prompts regarding security issues, such as the UAC elevation prompt, UIA programs must be highly trusted. To be considered trusted, a UIA program must be digitally signed. By default, UIA programs can be run only from the following protected paths: + - ..\\Program Files\\ (and subfolders) - ..\\Program Files (x86)\\ (and subfolders, in 64-bit versions of Windows only) - ..\\Windows\\System32\\ + The requirement to be in a protected path can be disabled by the [User Account Control: Only elevate UIAccess applications that are installed in secure locations](user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) setting. Although this setting applies to any UIA program, it is used primarily in certain Windows Remote Assistance scenarios. + ### Countermeasure + Disable the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** setting. + ### Potential impact + If a user requests remote assistance from an administrator and the remote assistance session is established, elevation prompts appear on the interactive user's secure desktop and the administrator's remote session is paused. To avoid pausing the remote administrator’s session during elevation requests, the user can select the "Allow IT Expert to respond to User Account Control prompts" check box when setting up the remote assistance session. However, selecting this check box requires that the interactive user respond to an elevation prompt on the secure desktop. If the interactive user is a standard user, the user does not have the required credentials to allow elevation. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index 2f01c9ecc5..28718b33ae 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -2,94 +2,99 @@ title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting. ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** security policy setting. + ## Reference + This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials. + ### Possible values + - **Elevate without prompting** + Assumes that the administrator will permit an operation that requires elevation, and additional consent or credentials are not required. - **Note**   - Selecting **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. + >**Note:**  Selecting **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure.   - **Prompt for credentials on the secure desktop** + When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. + - **Prompt for consent on the secure desktop** + When an operation requires elevation of privilege, the user is prompted on the secure desktop to select **Permit** or **Deny**. If the user selects **Permit**, the operation continues with the user's highest available privilege. + - **Prompt for credential**s + An operation that requires elevation of privilege prompts the administrator to type the user name and password. If the administrator enters valid credentials, the operation continues with the applicable privilege. + - **Prompt for consent** + An operation that requires elevation of privilege prompts the administrator to select **Permit** or **Deny**. If the administrator selects **Permit**, the operation continues with the administrator's highest available privilege. + - **Prompt for consent for non-Windows binaries** + This is the default. When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select **Permit** or **Deny**. If the user selects **Permit**, the operation continues with the user's highest available privilege. + ### Best practices + - Selecting the option **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values -The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Prompt for consent for non-Windows binaries

DC Effective Default Settings

Prompt for consent for non-Windows binaries

Member Server Effective Default Settings

Prompt for consent for non-Windows binaries

Client Computer Effective Default Settings

Prompt for consent for non-Windows binaries

+ + +| Server type or GPO Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Prompt for consent for non-Windows binaries| +| DC Effective Default Settings | Prompt for consent for non-Windows binaries| +| Member Server Effective Default Settings | Prompt for consent for non-Windows binaries| +| Client Computer Effective Default Settings | Prompt for consent for non-Windows binaries|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + One of the risks that the UAC feature tries to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. This setting raises awareness to the administrator of elevated privilege operations, and it permits the administrator to prevent a malicious program from elevating its privilege when the program attempts to do so. + ### Countermeasure + Configure the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** setting to **Prompt for consent**. + ### Potential impact + Administrators should be made aware that they will be prompted for consent when all binaries attempt to run. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index 727d8b7ba1..e382611db9 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -2,86 +2,88 @@ title: User Account Control Behavior of the elevation prompt for standard users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for standard users security policy setting. ms.assetid: 1eae7def-8f6c-43b6-9474-23911fdc01ba -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Behavior of the elevation prompt for standard users + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for standard users** security policy setting. + ## Reference + This policy setting determines the behavior of the elevation prompt for standard users. + ### Possible values + - **Automatically deny elevation requests** + This option returns an “Access denied” error message to standard users when they try to perform an operation that requires elevation of privilege. Most organizations that run desktops as standard users configure this policy to reduce Help Desk calls. + - **Prompt for credentials on the secure desktop** + This is the default. When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + - **Prompt for credentials** + An operation that requires elevation of privilege prompts the user to type an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + ### Best practices + 1. Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. 2. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, set **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Prompt for credentials on the secure desktop

DC Effective Default Settings

Prompt for credentials on the secure desktop

Member Server Effective Default Settings

Prompt for credentials on the secure desktop

Client Computer Effective Default Settings

Prompt for credentials on the secure desktop

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Prompt for credentials on the secure desktop| +| DC Effective Default Settings | Prompt for credentials on the secure desktop| +| Member Server Effective Default Settings | Prompt for credentials on the secure desktop| +| Client Computer Effective Default Settings | Prompt for credentials on the secure desktop|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + One of the risks that the UAC feature tries to mitigate is that of malicious programs running under elevated credentials without the user or administrator being aware of their activity. This setting raises awareness to the user that a program requires the use of elevated privilege operations, and it requires that the user supply administrative credentials for the program to run. + ### Countermeasure + Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, we recommend setting **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. + ### Potential impact + Users must provide administrative passwords to run programs with elevated privileges. This could cause an increased load on IT staff while the programs that are affected are identified and standard operating procedures are modified to support least privilege operations. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md index 067ec3619c..178aa242b4 100644 --- a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md +++ b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md @@ -2,83 +2,81 @@ title: User Account Control Detect application installations and prompt for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Detect application installations and prompt for elevation security policy setting. ms.assetid: 3f8cb170-ba77-4c9f-abb3-c3ed1ef264fc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Detect application installations and prompt for elevation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Detect application installations and prompt for elevation** security policy setting. + ## Reference + This policy setting determines the behavior of application installation detection for the entire system. Some software might attempt to install itself after being given permission to run. The user may give permission for the program to run because the program is trusted. Then the user is prompted to install an unknown component. This security policy provides another way to identify and stop these attempted software installations before they can do damage. + ### Possible values + - **Enabled** + Application installation packages that require an elevation of privilege to install are detected and the user is prompted for administrative credentials. + - **Disabled** + Application installation packages that require an elevation of privilege to install are not detected and the user is not prompted for administrative credentials. + ### Best practices + 1. Installer detection is unnecessary when enterprises run standard user desktops that capitalize on delegated installation technologies like Group Policy Software Install (GPSI) or Configuration Manager. Therefore you can set this security policy to **Disabled**. 2. Enable the **User Account Control: Detect application installations and prompt for elevation** setting so standard users must provide administrative credentials before software is installed. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Enabled

DC Effective Default Settings

Enabled

Member Server Effective Default Settings

Enabled

Client Computer Effective Default Settings

Enabled

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Some malicious software might attempt to install itself after being given permission to run, for example, malicious software with a trusted application shell. The user may give permission for the program to run because the program is trusted. Then the user is prompted to install an unknown component. This policy provides another way to trap the software before it can do damage. + ### Countermeasure + Enable the **User Account Control: Detect application installations and prompt for elevation** setting. + ### Potential impact + Users must provide administrative passwords to install programs. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index 7c3f3ccfae..19768449e0 100644 --- a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -2,87 +2,89 @@ title: User Account Control Only elevate executables that are signed and validated (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate executables that are signed and validated security policy setting. ms.assetid: 64950a95-6985-4db6-9905-1db18557352d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Only elevate executables that are signed and validated + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate executables that are signed and validated** security policy setting. + ## Reference + This policy setting enforces public key infrastructure (PKI) signature checks on any interactive application that requests elevation of privilege. You can control the apps that are allowed to run through the population of certificates in the local computer's Trusted Publishers store. + A trusted publisher is a certificate issuer that the computer’s user has chosen to trust and that has certificate details that have been added to the store of trusted publishers. + Windows maintains certificates in certificate stores. These stores can be represented by containers in the file system or the registry, or they can be implemented as physical stores such as smart cards. Certificate stores are associated with the computer object or they are owned by a distinct user who has a security context and profile on that computer. In addition, services can have certificate stores. A certificate store will often contain numerous certificates, possibly issued from a number of different certification authorities (CAs). When certificate path discovery is initiated, Windows attempts to locate the issuing CA for the certificates, and it builds a certificate path to the trusted root certificate. Intermediate certificates are included as part of the application protocol or are picked up from Group Policy or through URLs that are specified in the Authority Information Access (AIA) extension. When the path is built, each certificate in the path is verified for validity with respect to various parameters, such as name, time, signature, revocation status, and other constraints. + ### Possible values + - **Enabled** + Enforces the PKI certificate chain validation of a given executable file before it is permitted to run. + - **Disabled** + Does not enforce PKI certificate chain validation before a given executable file is permitted to run. + ### Best practices + - Best practices are dependent on your security and performance goals. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Disabled

DC Effective Default Settings

Disabled

Member Server Effective Default Settings

Disabled

Client Computer Effective Default Settings

Disabled

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Intellectual property, personally identifiable information, and other confidential data are normally manipulated by applications on the computer, and elevated credentials are required to access the information. Users and administrators inherently trust applications that are used with these information sources, and they provide their credentials. If one of these applications is replaced by a rogue application that appears identical to the trusted application, the confidential data could be compromised and the user's administrative credentials would also be compromised. + ### Countermeasure + Enable the **User Account Control: Only elevate executables that are signed and validated**. + ### Potential impact + Enabling this setting requires that you have a PKI infrastructure and that your enterprise administrators have populated the Trusted Publishers store with the certificates for the allowed applications. Some older applications are not signed, and they cannot be used in an environment that is hardened with this setting. You should carefully test your applications in a preproduction environment before implementing this setting. Control over the applications that are installed on the desktops and the hardware that joins your domain should provide similar protection from the vulnerability that is addressed by this setting. Additionally, the level of protection that is provided by this setting is not an assurance that all rogue applications will be found. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md index b79b29a94b..890ec0f2ff 100644 --- a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md +++ b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md @@ -2,103 +2,111 @@ title: User Account Control Only elevate UIAccess applications that are installed in secure locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate UIAccess applications that are installed in secure locations security policy setting. ms.assetid: 4333409e-a5be-4f2f-8808-618f53abd22c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Only elevate UIAccess applications that are installed in secure locations + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** security policy setting. + ## Reference + This policy setting enforces the requirement that apps that request running with a UIAccess integrity level (by means of a marking of UIAccess=true in their app manifest), must reside in a secure location on the file system. Relatively secure locations are limited to the following directories: + - \\Program Files\\ including subdirectories - \\Windows\\system32\\ - \\Program Files (x86)\\ including subdirectories for 64-bit versions of Windows -**Note**   -Windows enforces a PKI signature check on any interactive application that requests running with a UIAccess integrity level, regardless of the state of this security setting. + +>**Note:**  Windows enforces a PKI signature check on any interactive application that requests running with a UIAccess integrity level, regardless of the state of this security setting.   **Background** + User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI does not interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. + Microsoft UI Automation is the current model to support accessibility requirements in the Windows operating systems. Applications that are designed to support an accessible user experience control the behavior of other Windows applications on behalf of the user. When all applications on the automation client computer and server are running as a standard user (that is, at a medium integrity level), the UIPI restrictions do not interfere with the Microsoft UI automation model. + However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation cannot drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. + If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. + 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local device 2. The application must be installed in a local folder that is writeable only by administrators, such as the Program Files directory. The allowed directories for UI automation applications are: + 1. %ProgramFiles% and its subdirectories. 2. %WinDir% and its subdirectories, except a few subdirectories that are excluded because standard users have write access. + ### Possible values + - **Enabled** + An application can start with UIAccess integrity only if it resides in a secure location in the file system. + - **Disabled** + An application can start with UIAccess integrity even if it does not reside in a secure location in the file system. + ### Best practices + - Set this policy to **Enabled** to permit applications that are located in one of the designated secure directories to run with UIAccess integrity. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Enabled

DC Effective Default Settings

Enabled

Member Server Effective Default Settings

Enabled

Client Computer Effective Default Settings

Enabled

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they aresaved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + UIAccess integrity allows an application to bypass User Interface Privilege Isolation (UIPI) restrictions when an application is elevated in privilege from a standard user to an administrator. When this setting is enabled, an application that has the UIAccess flag set to true in its manifest can interchange information with applications that are running at a higher privilege level, such as logon prompts and privilege elevation prompts. This ability is required to support accessibility features such as screen readers that are transmitting user interfaces to alternative forms, but it is not required by most applications. A process that is started with UIAccess rights has the following abilities: + - Set the foreground window. - Drive any application window by using the SendInput function. - Use read input for all integrity levels by using low-level hooks, raw input, GetKeyState, GetAsyncKeyState, and GetKeyboardInput. - Set journal hooks. - Use AttachThreadInput to attach a thread to a higher integrity input queue. + ### Countermeasure + Enable the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** setting. + ### Potential impact + If the application that requests UIAccess meets the UIAccess setting requirements, computers running at least the Windows Vista operating system start the application with the ability to bypass most of the UIPI restrictions. If the application does not meet the security restrictions, the application is started without UIAccess rights, and it can interact only with applications at the same or lower privilege level. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-overview.md b/windows/keep-secure/user-account-control-overview.md index f2eb1a4824..ccabf37ce1 100644 --- a/windows/keep-secure/user-account-control-overview.md +++ b/windows/keep-secure/user-account-control-overview.md @@ -2,24 +2,35 @@ title: User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. ms.assetid: 43ac4926-076f-4df2-84af-471ee7d20c38 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control + **Applies to** - Windows 10 - Windows Server 2016 Technical Preview + User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. + UAC allows all users to log on to their computers using a standard user account. Processes launched using a standard user token may perform tasks using access rights granted to a standard user. For instance, Windows Explorer automatically inherits standard user level permissions. Additionally, any apps that are started using Windows Explorer (for example, by double-clicking a shortcut) also run with the standard set of user permissions. Many apps, including those that are included with the operating system itself, are designed to work properly in this way. + Other apps, especially those that were not specifically designed with security settings in mind, often require additional permissions to run successfully. These types of apps are referred to as legacy apps. Additionally, actions such as installing new software and making configuration changes to the Windows Firewall, require more permissions than what is available to a standard user account. + When an app needs to run with more than standard user rights, UAC can restore additional user groups to the token. This enables the user to have explicit control of apps that are making system level changes to their computer or device. + ## Practical applications + Admin Approval Mode in UAC helps prevent malware from silently installing without an administrator's knowledge. It also helps protect from inadvertent system-wide changes. Lastly, it can be used to enforce a higher level of compliance where administrators must actively consent or provide credentials for each administrative process. + ## New and changed functionality + To find out what's new in UAC for Windows 10, see [User Account Control](../whats-new/user-account-control.md). + ## In this section | Topic | Description | | - | - | diff --git a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md index 0c53ba8b97..63ac1e4a65 100644 --- a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -2,86 +2,85 @@ title: User Account Control Run all administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Run all administrators in Admin Approval Mode security policy setting. ms.assetid: b838c561-7bfc-41ef-a7a5-55857259c7bf -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Run all administrators in Admin Approval Mode + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Run all administrators in Admin Approval Mode** security policy setting. + ## Reference + This policy setting determines the behavior of all User Account Control (UAC) policies for the entire system. This is the setting that turns UAC on or off. + ### Possible values + - **Enabled** + Admin Approval Mode and all other UAC policies are dependent on this option being enabled. Changing this setting requires restarting the system. + - **Disabled** + Admin Approval Mode and all related UAC policies are disabled. - **Note**   - If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced. + + >**Note:**  If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced.   ### Best practices + - Enable this policy to allow all other UAC features and policies to function. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Enabled

DC Effective Default Settings

Enabled

Member Server Effective Default Settings

Enabled

Client Computer Effective Default Settings

Enabled

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + A restart of the computer is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This is the setting that turns UAC on or off. If this setting is disabled, UAC is not used, and any security benefits and risk mitigations that are dependent on UAC are not present on the computer. + ### Countermeasure + Enable the **User Account Control: Run all users, including administrators, as standard users** setting. + ### Potential impact + Users and administrators must learn to work with UAC prompts and adjust their work habits to use least privilege operations. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-security-policy-settings.md b/windows/keep-secure/user-account-control-security-policy-settings.md index d1a286bf5e..569bf9892e 100644 --- a/windows/keep-secure/user-account-control-security-policy-settings.md +++ b/windows/keep-secure/user-account-control-security-policy-settings.md @@ -2,66 +2,95 @@ title: User Account Control security policy settings (Windows 10) description: You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control security policy settings + **Applies to** - Windows 10 + You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. + ## User Account Control: Admin Approval Mode for the Built-in Administrator account + This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. + - **Enabled** The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. - **Disabled** (Default) The built-in Administrator account runs all applications with full administrative privilege. + ## User Account Control: Allow UIAccess application to prompt for elevation without using the secure desktop + This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. + - **Enabled** UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. - **Disabled** (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. + ## User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode + This policy setting controls the behavior of the elevation prompt for administrators. + - **Elevate without prompting** Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. - **Note**  Use this option only in the most constrained environments. + + >**Note:**  Use this option only in the most constrained environments.   - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - **Prompt for consent on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - **Prompt for credentials** When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - **Prompt for consent** When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - **Prompt for consent for non-Windows binaries** (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. + ## User Account Control: Behavior of the elevation prompt for standard users + This policy setting controls the behavior of the elevation prompt for standard users. + - **Prompt for credentials** (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - **Automatically deny elevation requests** When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + ## User Account Control: Detect application installations and prompt for elevation + This policy setting controls the behavior of application installation detection for the computer. + - **Enabled** (Default) When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or System Center Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. + ## User Account Control: Only elevate executable files that are signed and validated + This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. + - **Enabled** Enforces the certificate certification path validation for a given executable file before it is permitted to run. - **Disabled** (Default) Does not enforce the certificate certification path validation before a given executable file is permitted to run. + ## User Account Control: Only elevate UIAccess applications that are installed in secure locations + This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - …\\Program Files\\, including subfolders - …\\Windows\\system32\\ - …\\Program Files (x86)\\, including subfolders for 64-bit versions of Windows -**Note**   -Windows enforces a digital signature check on any interactive app that requests to run with a UIAccess integrity level regardless of the state of this security setting. + +>**Note:**  Windows enforces a digital signature check on any interactive app that requests to run with a UIAccess integrity level regardless of the state of this security setting.   - **Enabled** (Default) If an app resides in a secure location in the file system, it runs only with UIAccess integrity. - **Disabled** An app runs with UIAccess integrity even if it does not reside in a secure location in the file system. + ## User Account Control: Turn on Admin Approval Mode + This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. + - **Enabled** (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - **Disabled** Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. + ## User Account Control: Switch to the secure desktop when prompting for elevation + This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. + - **Enabled** (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. - **Disabled** All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. ## User Account Control: Virtualize file and registry write failures to per-user locations + This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKLM\\Software. + - **Enabled** (Default) App write failures are redirected at run time to defined user locations for both the file system and registry. - **Disabled** Apps that write data to protected locations fail. -  -  diff --git a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md index 9475c83eba..ee510bb52e 100644 --- a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md +++ b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md @@ -2,85 +2,88 @@ title: User Account Control Switch to the secure desktop when prompting for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Switch to the secure desktop when prompting for elevation security policy setting. ms.assetid: 77a067db-c70d-4b02-9861-027503311b8b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Switch to the secure desktop when prompting for elevation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Switch to the secure desktop when prompting for elevation** security policy setting. + ## Reference + This policy setting determines whether the elevation request prompts on the interactive user desktop or on the secure desktop. + The secure desktop presents the logon UI and restricts functionality and access to the system until the logon requirements are satisfied. + The secure desktop’s primary difference from the user desktop is that only trusted processes running as SYSTEM are allowed to run here (that is, nothing is running at the user’s privilege level). The path to get to the secure desktop from the user desktop must also be trusted through the entire chain. + ### Possible values + - **Enabled** + All elevation requests by default go to the secure desktop. + - **Disabled** + All elevation requests go to the interactive user desktop. + ### Best practices -- Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. + +- Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system +processes. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Enabled

DC Effective Default Settings

Enabled

Member Server Effective Default Settings

Enabled

Client Computer Effective Default Settings

Enabled

+ +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Elevation prompt dialog boxes can be spoofed, causing users to disclose their passwords to malicious software. Mouse cursors can be spoofed by hiding the real cursor and replacing it with an offset so the cursor is actually pointing to the **Allow** button. + ### Countermeasure + Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md index ffb892226b..afc3766b73 100644 --- a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md +++ b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md @@ -2,85 +2,86 @@ title: User Account Control Virtualize file and registry write failures to per-user locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Virtualize file and registry write failures to per-user locations security policy setting. ms.assetid: a7b47420-cc41-4b1c-b03e-f67a05221261 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Virtualize file and registry write failures to per-user locations + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Virtualize file and registry write failures to per-user locations** security policy setting. + ## Reference + This policy setting enables or disables the redirection of the write failures of earlier applications to defined locations in the registry and the file system. This feature mitigates applications that historically ran as administrator and wrote runtime application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKEY\_LOCAL\_MACHINE\\Software\\. + This feature can be disabled for applications on devices running at least Windows Vista because it is unnecessary. + ### Possible values + - **Enabled** + Setting this value facilitates the runtime redirection of application write failures to defined user locations for the file system and the registry. + - **Disabled** + Applications that write data to protected locations fail. + ### Best practices + 1. If you run applications that are not Windows Vista-compliant, enable this security policy to prevent the possibility that these older applications could write data to unsecure locations. 2. If you only run at least Windows Vista–compliant applications, this feature is unnecessary so you can disable this policy. + ### Location + \\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Server type or GPODefault value

Default Domain Policy

Not defined

Default Domain Controller Policy

Not defined

Stand-Alone Server Default Settings

Enabled

DC Effective Default Settings

Enabled

Member Server Effective Default Settings

Enabled

Client Computer Effective Default Settings

Enabled

+ +| Server type or GPO | Default value| +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Earlier applications might not write data to secure locations. + ### Countermeasure + Enable the **User Account Control: Virtualize file and registry write failures to per-user locations** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-rights-assignment.md b/windows/keep-secure/user-rights-assignment.md index 3e96944b76..401613dde1 100644 --- a/windows/keep-secure/user-rights-assignment.md +++ b/windows/keep-secure/user-rights-assignment.md @@ -2,212 +2,75 @@ title: User Rights Assignment (Windows 10) description: Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. ms.assetid: 99340252-60be-4c79-b0a5-56fbe1a9b0c5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Rights Assignment + **Applies to** - Windows 10 + Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. User rights govern the methods by which a user can log on to a system. User rights are applied at the local device level, and they allow users to perform tasks on a device or in a domain. User rights include logon rights and permissions. Logon rights control who is authorized to log on to a device and how they can log on. User rights permissions control access to computer and domain resources, and they can override permissions that have been set on specific objects. User rights are managed in Group Policy under the **User Rights Assignment** item. -Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment**, or on the local device by using the Local Group Policy Editor (gpedit.msc). + +Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under +**Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment**, or on the local device by using the Local Group Policy Editor (gpedit.msc). + For information about setting security policies, see [Configure security policy settings](how-to-configure-security-policy-settings.md). + The following table links to each security policy setting and provides the constant name for each. Setting descriptions contain reference information, best practices for configuring the policy setting, default values, differences between operating system versions, and considerations for policy management and security. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Group Policy SettingConstant Name

[Access Credential Manager as a trusted caller](access-credential-manager-as-a-trusted-caller.md)

SeTrustedCredManAccessPrivilege

[Access this computer from the network](access-this-computer-from-the-network.md)

SeNetworkLogonRight

[Act as part of the operating system](act-as-part-of-the-operating-system.md)

SeTcbPrivilege

[Add workstations to domain](add-workstations-to-domain.md)

SeMachineAccountPrivilege

[Adjust memory quotas for a process](adjust-memory-quotas-for-a-process.md)

SeIncreaseQuotaPrivilege

[Allow log on locally](allow-log-on-locally.md)

SeInteractiveLogonRight

[Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md)

SeRemoteInteractiveLogonRight

[Back up files and directories](back-up-files-and-directories.md)

SeBackupPrivilege

[Bypass traverse checking](bypass-traverse-checking.md)

SeChangeNotifyPrivilege

[Change the system time](change-the-system-time.md)

SeSystemtimePrivilege

[Change the time zone](change-the-time-zone.md)

SeTimeZonePrivilege

[Create a pagefile](create-a-pagefile.md)

SeCreatePagefilePrivilege

[Create a token object](create-a-token-object.md)

SeCreateTokenPrivilege

[Create global objects](create-global-objects.md)

SeCreateGlobalPrivilege

[Create permanent shared objects](create-permanent-shared-objects.md)

SeCreatePermanentPrivilege

[Create symbolic links](create-symbolic-links.md)

SeCreateSymbolicLinkPrivilege

[Debug programs](debug-programs.md)

SeDebugPrivilege

[Deny access to this computer from the network](deny-access-to-this-computer-from-the-network.md)

SeDenyNetworkLogonRight

[Deny log on as a batch job](deny-log-on-as-a-batch-job.md)

SeDenyBatchLogonRight

[Deny log on as a service](deny-log-on-as-a-service.md)

SeDenyServiceLogonRight

[Deny log on locally](deny-log-on-locally.md)

SeDenyInteractiveLogonRight

[Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md)

SeDenyRemoteInteractiveLogonRight

[Enable computer and user accounts to be trusted for delegation](enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)

SeEnableDelegationPrivilege

[Force shutdown from a remote system](force-shutdown-from-a-remote-system.md)

SeRemoteShutdownPrivilege

[Generate security audits](generate-security-audits.md)

SeAuditPrivilege

[Impersonate a client after authentication](impersonate-a-client-after-authentication.md)

SeImpersonatePrivilege

[Increase a process working set](increase-a-process-working-set.md)

SeIncreaseWorkingSetPrivilege

[Increase scheduling priority](increase-scheduling-priority.md)

SeIncreaseBasePriorityPrivilege

[Load and unload device drivers](load-and-unload-device-drivers.md)

SeLoadDriverPrivilege

[Lock pages in memory](lock-pages-in-memory.md)

SeLockMemoryPrivilege

[Log on as a batch job](log-on-as-a-batch-job.md)

SeBatchLogonRight

[Log on as a service](log-on-as-a-service.md)

SeServiceLogonRight

[Manage auditing and security log](manage-auditing-and-security-log.md)

SeSecurityPrivilege

[Modify an object label](modify-an-object-label.md)

SeRelabelPrivilege

[Modify firmware environment values](modify-firmware-environment-values.md)

SeSystemEnvironmentPrivilege

[Perform volume maintenance tasks](perform-volume-maintenance-tasks.md)

SeManageVolumePrivilege

[Profile single process](profile-single-process.md)

SeProfileSingleProcessPrivilege

[Profile system performance](profile-system-performance.md)

SeSystemProfilePrivilege

[Remove computer from docking station](remove-computer-from-docking-station.md)

SeUndockPrivilege

[Replace a process level token](replace-a-process-level-token.md)

SeAssignPrimaryTokenPrivilege

[Restore files and directories](restore-files-and-directories.md)

SeRestorePrivilege

[Shut down the system](shut-down-the-system.md)

SeShutdownPrivilege

[Synchronize directory service data](synchronize-directory-service-data.md)

SeSyncAgentPrivilege

[Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md)

SeTakeOwnershipPrivilege

+ +| Group Policy Setting | Constant Name | +| - | - | +| [Access Credential Manager as a trusted caller](access-credential-manager-as-a-trusted-caller.md) | SeTrustedCredManAccessPrivilege| +| [Access this computer from the network](access-this-computer-from-the-network.md) | SeNetworkLogonRight| +| [Act as part of the operating system](act-as-part-of-the-operating-system.md) | SeTcbPrivilege| +| [Add workstations to domain](add-workstations-to-domain.md) | SeMachineAccountPrivilege| +| [Adjust memory quotas for a process](adjust-memory-quotas-for-a-process.md) | SeIncreaseQuotaPrivilege| +| [Allow log on locally](allow-log-on-locally.md) | SeInteractiveLogonRight| +| [Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md)| SeRemoteInteractiveLogonRight| +| [Back up files and directories](back-up-files-and-directories.md) | SeBackupPrivilege| +| [Bypass traverse checking](bypass-traverse-checking.md) | SeChangeNotifyPrivilege| +| [Change the system time](change-the-system-time.md) | SeSystemtimePrivilege| +| [Change the time zone](change-the-time-zone.md) | SeTimeZonePrivilege| +| [Create a pagefile](create-a-pagefile.md) | SeCreatePagefilePrivilege| +| [Create a token object](create-a-token-object.md) | SeCreateTokenPrivilege| +| [Create global objects](create-global-objects.md) | SeCreateGlobalPrivilege| +| [Create permanent shared objects](create-permanent-shared-objects.md) | SeCreatePermanentPrivilege| +| [Create symbolic links](create-symbolic-links.md) | SeCreateSymbolicLinkPrivilege| +| [Debug programs](debug-programs.md) | SeDebugPrivilege| +| [Deny access to this computer from the network](deny-access-to-this-computer-from-the-network.md)| SeDenyNetworkLogonRight | +| [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) | SeDenyBatchLogonRight| +| [Deny log on as a service](deny-log-on-as-a-service.md) | SeDenyServiceLogonRight | +| [Deny log on locally](deny-log-on-locally.md) | SeDenyInteractiveLogonRight| +| [Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md)| SeDenyRemoteInteractiveLogonRight| +| [Enable computer and user accounts to be trusted for delegation](enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)| SeEnableDelegationPrivilege| +| [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md) | SeRemoteShutdownPrivilege| +| [Generate security audits](generate-security-audits.md) | SeAuditPrivilege| +| [Impersonate a client after authentication](impersonate-a-client-after-authentication.md)| SeImpersonatePrivilege| +| [Increase a process working set](increase-a-process-working-set.md) | SeIncreaseWorkingSetPrivilege| +| [Increase scheduling priority](increase-scheduling-priority.md) | SeIncreaseBasePriorityPrivilege| +| [Load and unload device drivers](load-and-unload-device-drivers.md) | SeLoadDriverPrivilege| +| [Lock pages in memory](lock-pages-in-memory.md) | SeLockMemoryPrivilege| +| [Log on as a batch job](log-on-as-a-batch-job.md) | SeBatchLogonRight| +| [Log on as a service](log-on-as-a-service.md) | SeServiceLogonRight| +| [Manage auditing and security log](manage-auditing-and-security-log.md)| SeSecurityPrivilege| +| [Modify an object label](modify-an-object-label.md) | SeRelabelPrivilege| +| [Modify firmware environment values](modify-firmware-environment-values.md)| SeSystemEnvironmentPrivilege| +| [Perform volume maintenance tasks](perform-volume-maintenance-tasks.md) | SeManageVolumePrivilege| +| [Profile single process](profile-single-process.md) | SeProfileSingleProcessPrivilege| +| [Profile system performance](profile-system-performance.md) | SeSystemProfilePrivilege| +| [Remove computer from docking station](remove-computer-from-docking-station.md) | SeUndockPrivilege| +| [Replace a process level token](replace-a-process-level-token.md) | SeAssignPrimaryTokenPrivilege| +| [Restore files and directories](restore-files-and-directories.md) | SeRestorePrivilege | +| [Shut down the system](shut-down-the-system.md) | SeShutdownPrivilege| +| [Synchronize directory service data](synchronize-directory-service-data.md)| SeSyncAgentPrivilege| +| [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md) | SeTakeOwnershipPrivilege|   ## Related topics -[Security policy settings reference](security-policy-settings-reference.md) -  -  + +- [Security policy settings reference](security-policy-settings-reference.md) diff --git a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index fe7a396637..13d5fc93e5 100644 --- a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -2,71 +2,41 @@ title: Using advanced security auditing options to monitor dynamic access control objects (Windows 10) description: This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Using advanced security auditing options to monitor dynamic access control objects + **Applies to** - Windows 10 + This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. + These procedures can be deployed with the advanced security auditing capabilities described in [Deploy Security Auditing with Central Audit Policies (Demonstration Steps)](http://technet.microsoft.com/library/hh831542.aspx). + ## In this guide + Domain administrators can create and deploy expression-based security audit policies by using file classification information (resource attributes), user claims, and device claims to target specific users and resources to monitor potentially significant activities on one or more computers. These policies can be deployed centrally by using Group Policy, or directly on a computer, in a folder, or in individual files. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TopicDescription

[Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md)

This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management.

[Monitor the use of removable storage devices](monitor-the-use-of-removable-storage-devices.md)

This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects.

[Monitor resource attribute definitions](monitor-resource-attribute-definitions.md)

This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.

[Monitor central access policy and rule definitions](monitor-central-access-policy-and-rule-definitions.md)

This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects.

[Monitor user and device claims during sign-in](monitor-user-and-device-claims-during-sign-in.md)

This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects.

[Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md)

This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects.

[Monitor the central access policies associated with files and folders](monitor-the-central-access-policies-associated-with-files-and-folders.md)

This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects.

[Monitor claim types](monitor-claim-types.md)

This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.

+ +| Topic | Description | +| - | - | +| [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md) | This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management. | +| [Monitor the use of removable storage devices](monitor-the-use-of-removable-storage-devices.md) | This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. | +| [Monitor resource attribute definitions](monitor-resource-attribute-definitions.md)| This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.| +| [Monitor central access policy and rule definitions](monitor-central-access-policy-and-rule-definitions.md) | This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. | +| [Monitor user and device claims during sign-in](monitor-user-and-device-claims-during-sign-in.md)| This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. | +| [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md)| This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. | +| [Monitor the central access policies associated with files and folders](monitor-the-central-access-policies-associated-with-files-and-folders.md)| This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. | +| [Monitor claim types](monitor-claim-types.md) | This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.|   -**Important**   -This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment. +>**Important:**  This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment.   ## Related topics -[Security auditing](security-auditing-overview.md) -  -  + +- [Security auditing](security-auditing-overview.md) diff --git a/windows/keep-secure/using-event-viewer-with-applocker.md b/windows/keep-secure/using-event-viewer-with-applocker.md index 304915e207..dcee6821bc 100644 --- a/windows/keep-secure/using-event-viewer-with-applocker.md +++ b/windows/keep-secure/using-event-viewer-with-applocker.md @@ -2,145 +2,61 @@ title: Using Event Viewer with AppLocker (Windows 10) description: This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Using Event Viewer with AppLocker + **Applies to** - Windows 10 + This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. + The AppLocker log contains information about applications that are affected by AppLocker rules. Each event in the log contains detailed info about: + - Which file is affected and the path of that file - Which packaged app is affected and the package identifier of the app - Whether the file or packaged app is allowed or blocked - The rule type (path, file hash, or publisher) - The rule name - The security identifier (SID) for the user or group identified in the rule + Review the entries in the Event Viewer to determine if any applications are not included in the rules that you automatically generated. For instance, some line-of-business apps are installed to non-standard locations, such as the root of the active drive (for example: %SystemDrive%). + For info about what to look for in the AppLocker event logs, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). + **To review the AppLocker log in Event Viewer** + 1. Open Event Viewer. 2. In the console tree under **Application and Services Logs\\Microsoft\\Windows**, click **AppLocker**. + The following table contains information about the events that you can use to determine which apps are affected by AppLocker rules. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Event IDLevelEvent messageDescription

8000

Error

Application Identity Policy conversion failed. Status <%1>

Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes.

8001

Information

The AppLocker policy was applied successfully to this computer.

Indicates that the AppLocker policy was successfully applied to the computer.

8002

Information

<File name> was allowed to run.

Specifies that the .exe or .dll file is allowed by an AppLocker rule.

8003

Warning

<File name> was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Applied only when the Audit only enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the Enforce rules enforcement mode were enabled.

8004

Error

<File name> was not allowed to run.

Access to <file name> is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.

8005

Information

<File name> was allowed to run.

Specifies that the script or .msi file is allowed by an AppLocker rule.

8006

Warning

<File name> was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Applied only when the Audit only enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the Enforce rules enforcement mode were enabled.

8007

Error

<File name> was not allowed to run.

Access to <file name> is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.

8007

Error

AppLocker disabled on the SKU.

Added in Windows Server 2012 and Windows 8.

8020

Information

Packaged app allowed.

Added in Windows Server 2012 and Windows 8.

8021

Information

Packaged app audited.

Added in Windows Server 2012 and Windows 8.

8022

Information

Packaged app disabled.

Added in Windows Server 2012 and Windows 8.

8023

Information

Packaged app installation allowed.

Added in Windows Server 2012 and Windows 8.

8024

Information

Packaged app installation audited.

Added in Windows Server 2012 and Windows 8.

8025

Warning

Packaged app installation disabled.

Added in Windows Server 2012 and Windows 8.

8027

Warning

No Packaged app rule configured.

Added in Windows Server 2012 and Windows 8.

+ +| Event ID | Level | Event message | Description | +| - | - | - | - | +| 8000 | Error| Application Identity Policy conversion failed. Status *<%1> *| Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes.| +| 8001 | Information| The AppLocker policy was applied successfully to this computer.| Indicates that the AppLocker policy was successfully applied to the computer.| +| 8002 | Information| *<File name> * was allowed to run.| Specifies that the .exe or .dll file is allowed by an AppLocker rule.| +| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only ** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules ** enforcement mode were enabled. | +| 8004 | Error| *<File name> * was not allowed to run.| Access to *<file name> * is restricted by the administrator. Applied only when the **Enforce rules ** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.| +| 8005| Information| *<File name> * was allowed to run.| Specifies that the script or .msi file is allowed by an AppLocker rule.| +| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only ** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules ** enforcement mode were enabled. | +| 8007 | Error| *<File name> * was not allowed to run.| Access to *<file name> * is restricted by the administrator. Applied only when the **Enforce rules ** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.| +| 8007| Error| AppLocker disabled on the SKU.| Added in Windows Server 2012 and Windows 8.| +| 8020| Information| Packaged app allowed.| Added in Windows Server 2012 and Windows 8.| +| 8021| Information| Packaged app audited.| Added in Windows Server 2012 and Windows 8.| +| 8022| Information| Packaged app disabled.| Added in Windows Server 2012 and Windows 8.| +| 8023 | Information| Packaged app installation allowed.| Added in Windows Server 2012 and Windows 8.| +| 8024 | Information| Packaged app installation audited.| Added in Windows Server 2012 and Windows 8.| +| 8025 | Warning| Packaged app installation disabled.| Added in Windows Server 2012 and Windows 8.| +| 8027 | Warning| No Packaged app rule configured.| Added in Windows Server 2012 and Windows 8.|   ## Related topics -[Tools to use with AppLocker](tools-to-use-with-applocker.md) + +- [Tools to use with AppLocker](tools-to-use-with-applocker.md)     diff --git a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md index e07957331b..54b12a4568 100644 --- a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md @@ -2,76 +2,60 @@ title: Use Software Restriction Policies and AppLocker policies (Windows 10) description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use Software Restriction Policies and AppLocker policies + **Applies to** - Windows 10 + This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. + ## Understand the difference between SRP and AppLocker + You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). + ## Use SRP and AppLocker in the same domain + SRP and AppLocker use Group Policy for domain management. However, when policies are generated by SRP and AppLocker exist in the same domain, and they are applied through Group Policy, AppLocker policies take precedence over policies generated by SRP on computers that are running an operating system that supports AppLocker. For info about how inheritance in Group Policy applies to AppLocker policies and policies generated by SRP, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). -**Important**   -As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. + +>**Important:**  As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO.   The following scenario provides an example of how each type of policy would affect a bank teller software app, where the app is deployed on different Windows desktop operating systems and managed by the Tellers GPO. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Operating systemTellers GPO with AppLocker policyTellers GPO with SRPTellers GPO with AppLocker policy and SRP

Windows 10, Windows 8.1, Windows 8,and Windows 7

AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.

Local AppLocker policies supersede policies generated by SRP that are applied through the GPO.

AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.

Windows Vista

AppLocker policies are not applied.

Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies are not applied.

Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.

Windows XP

AppLocker policies are not applied.

Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies are not applied.

Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.

+ +| Operating system | Tellers GPO with AppLocker policy | Tellers GPO with SRP | Tellers GPO with AppLocker policy and SRP | +| - | - | - | - | +| Windows 10, Windows 8.1, Windows 8,and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| +| Windows Vista| AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| +| Windows XP| AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.|   -**Note**   -For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). +>**Note:**  For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md).   ## Test and validate SRPs and AppLocker policies that are deployed in the same environment + Because SRPs and AppLocker policies function differently, they should not be implemented in the same GPO. This makes testing the result of the policy straightforward, which is critical to successfully controlling application usage in the organization. Configuring a testing and policy distribution system can help you understand the result of a policy. The effects of policies generated by SRP and AppLocker policies need to be tested separately and by using different tools. + ### Step 1: Test the effect of SRPs + You can use the Group Policy Management Console (GPMC) or the Resultant Set of Policy (RSoP) snap-in to determine the effect of applying SRPs by using GPOs. + ### Step 2: Test the effect of AppLocker policies + You can test AppLocker policies by using Windows PowerShell cmdlets. For info about investigating the result of a policy, see: + - [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) + Another method to use when determining the result of a policy is to set the enforcement mode to **Audit only**. When the policy is deployed, events will be written to the AppLocker logs as if the policy was enforced. For info about using the **Audit only** mode, see: -[Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) -[Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) + +- [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) +- [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) + ## See also -[AppLocker deployment guide](applocker-policies-deployment-guide.md) -  -  + +- [AppLocker deployment guide](applocker-policies-deployment-guide.md) diff --git a/windows/keep-secure/view-the-security-event-log.md b/windows/keep-secure/view-the-security-event-log.md index 3c67e1191b..745195b4f3 100644 --- a/windows/keep-secure/view-the-security-event-log.md +++ b/windows/keep-secure/view-the-security-event-log.md @@ -2,19 +2,22 @@ title: View the security event log (Windows 10) description: The security log records each event as defined by the audit policies you set on each object. ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # View the security event log + **Applies to** - Windows 10 + The security log records each event as defined by the audit policies you set on each object. + **To view the security log** + 1. Open Event Viewer. 2. In the console tree, expand **Windows Logs**, and then click **Security**. The results pane lists individual security events. 3. If you want to see more details about a specific event, in the results pane, click the event. -  -  diff --git a/windows/keep-secure/what-is-applocker.md b/windows/keep-secure/what-is-applocker.md index cfa573d478..b4d758df7b 100644 --- a/windows/keep-secure/what-is-applocker.md +++ b/windows/keep-secure/what-is-applocker.md @@ -2,18 +2,24 @@ title: What Is AppLocker (Windows 10) description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # What Is AppLocker? + **Applies to** - Windows 10 + This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. + AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. + Using AppLocker, you can: + - Control the following types of apps: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). - Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. - Assign a rule to a security group or an individual user. @@ -21,11 +27,17 @@ Using AppLocker, you can: - Use audit-only mode to deploy the policy and understand its impact before enforcing it. - Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. - Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. + AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls that result from users running unapproved apps + For information about the application control scenarios that AppLocker addresses, see [AppLocker policy use scenarios](applocker-policy-use-scenarios.md). + ## What features are different between Software Restriction Policies and AppLocker? + **Feature differences** + The following table compares AppLocker to Software Restriction Policies. + @@ -99,6 +111,7 @@ The following table compares AppLocker to Software Restriction Policies.
  **Application control function differences** + The following table compares the application control functions of Software Restriction Policies (SRP) and AppLocker. @@ -167,6 +180,7 @@ The following table compares the application control functions of Software Restr
  ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) + +- [AppLocker technical reference](applocker-technical-reference.md)     diff --git a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md index 35a67350b8..c60d303826 100644 --- a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -2,25 +2,30 @@ title: Which editions of Windows support advanced audit policy configuration (Windows 10) description: This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Which editions of Windows support advanced audit policy configuration + **Applies to** - Windows 10 + This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. + Versions of the Windows operating system that cannot join a domain do not have access to these features. There is no difference in security auditing support between 32-bit and 64-bit versions. + ## Are there any special considerations? + In addition, the following special considerations apply to the various tasks associated with advanced security auditing enhancements: + - **Creating an audit policy.** To create an advanced security auditing policy, you must use a computer running any supported version of Windows. You can use the Group Policy Management Console (GPMC) on a computer running a supported version of the Windows client operating system after installing the Remote Server Administration Tools. - **Applying audit policy settings.** If you are using Group Policy to apply the advanced audit policy settings and global object access settings, client computers must be running any supported version of the Windows server operating system or Windows client operating system. In addition, only computers running any of these supported operating systems can provide "reason for access" reporting data. - **Developing an audit policy model.** To plan advanced security audit settings and global object access settings, you must use the GPMC that targets a domain controller running a supported version of the Windows server operating system. -- **Distributing the audit policy.** After a Group Policy Object (GPO) that includes advanced security auditing settings is developed, it can be distributed by using domain controllers running any Windows Server operating system. However, if you cannot put client computers running a supported version of the Windows client operating system into a separate organizational unit (OU), you should use Windows Management Instrumentation (WMI) filtering to ensure that the advanced security auditing policy settings are applied only to client computers running a supported version of the Windows client operating system. -**Important**   -Using both the basic auditing policy settings under **Local Policies\\Audit Policy** and the advanced auditing policy settings under **Advanced Audit Policy Configuration** can cause unexpected results in audit reporting. Therefore, the two sets of audit policy settings should not be combined. If you use advanced audit policy configuration settings, you should enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   -  -  -  +- **Distributing the audit policy.** After a Group Policy Object (GPO) that includes advanced security auditing settings is developed, it can be distributed by using domain controllers running any Windows Server operating system. +However, if you cannot put client computers running a supported version of the Windows client operating system into a separate organizational unit (OU), you should use Windows Management Instrumentation (WMI) filtering to ensure that the advanced security auditing policy settings are applied only to client computers running a supported version of the Windows client operating system. + +>**Important:**  Using both the basic auditing policy settings under **Local Policies\\Audit Policy** and the advanced auditing policy settings under **Advanced Audit Policy Configuration** can cause unexpected results in audit reporting. Therefore, the two sets of audit policy settings should not be combined. If you use advanced audit policy configuration settings, you should enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   diff --git a/windows/keep-secure/windows-installer-rules-in-applocker.md b/windows/keep-secure/windows-installer-rules-in-applocker.md index 05f9214263..b12d94b8ef 100644 --- a/windows/keep-secure/windows-installer-rules-in-applocker.md +++ b/windows/keep-secure/windows-installer-rules-in-applocker.md @@ -2,59 +2,36 @@ title: Windows Installer rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the Windows Installer rule collection. ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Windows Installer rules in AppLocker + **Applies to** - Windows 10 + This topic describes the file formats and available default rules for the Windows Installer rule collection. + AppLocker defines Windows Installer rules to include only the following file formats: + - .msi - .msp - .mst + The purpose of this collection is to allow you to control the installation of files on client computers and servers through Group Policy or the Local Security Policy snap-in. The following table lists the default rules that are available for the Windows Installer rule collection. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PurposeNameUserRule condition type

Allow members of the local Administrators group to run all Windows Installer files

(Default Rule) All Windows Installer files

BUILTIN\Administrators

Path: *

Allow all users to run Windows Installer files that are digitally signed

(Default Rule) All digitally signed Windows Installer files

Everyone

Publisher: * (all signed files)

Allow all users to run Windows Installer files that are located in the Windows Installer folder

(Default Rule) All Windows Installer files in %systemdrive%\Windows\Installer

Everyone

Path: %windir%\Installer\*

+ +| Purpose | Name | User | Rule condition type | +| - | - | - | - | +| Allow members of the local Administrators group to run all Windows Installer files| (Default Rule) All Windows Installer files| BUILTIN\Administrators| Path: *| +| Allow all users to run Windows Installer files that are digitally signed | (Default Rule) All digitally signed Windows Installer files| Everyone| Publisher: * (all signed files)| +| Allow all users to run Windows Installer files that are located in the Windows Installer folder | (Default Rule) All Windows Installer files in %systemdrive%\Windows\Installer| Everyone| Path: %windir%\Installer\*|   ## Related topics -[Understanding AppLocker default rules](understanding-applocker-default-rules.md) + +- [Understanding AppLocker default rules](understanding-applocker-default-rules.md)     diff --git a/windows/keep-secure/working-with-applocker-policies.md b/windows/keep-secure/working-with-applocker-policies.md index af1edcf35e..8963fa665b 100644 --- a/windows/keep-secure/working-with-applocker-policies.md +++ b/windows/keep-secure/working-with-applocker-policies.md @@ -2,83 +2,35 @@ title: Working with AppLocker policies (Windows 10) description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Working with AppLocker policies + **Applies to** - Windows 10 + This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TopicDescription

[Configure the Application Identity service](configure-the-application-identity-service.md)

This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.

[Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)

This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker.

[Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md)

This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.

[Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md)

This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.

[Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md)

This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.

[Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md)

This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.

[Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md)

This topic for IT professionals describes how to import an AppLocker policy.

[Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md)

This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).

[Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md)

This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).

[Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md)

This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.

[Merge AppLocker policies manually](merge-applocker-policies-manually.md)

This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).

[Refresh an AppLocker policy](refresh-an-applocker-policy.md)

This topic for IT professionals describes the steps to force an update for an AppLocker policy.

[Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md)

This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.

-  -  -  + +| Topic | Description | +| - | - | +| [Configure the Application Identity service](configure-the-application-identity-service.md) | This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.| +| [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) | This topic for IT professionals describes how to set AppLocker policies to **Audit only ** within your IT environment by using AppLocker.| +| [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) | This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.| +| [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md) | This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.| +| [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) | This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.| +| [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) | This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.| +| [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) | This topic for IT professionals describes how to import an AppLocker policy.| +| [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) | This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).| +| [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md) | This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).| +| [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) | This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.| +| [Merge AppLocker policies manually](merge-applocker-policies-manually.md) | This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).| +| [Refresh an AppLocker policy](refresh-an-applocker-policy.md) | This topic for IT professionals describes the steps to force an update for an AppLocker policy.| +| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| + diff --git a/windows/keep-secure/working-with-applocker-rules.md b/windows/keep-secure/working-with-applocker-rules.md index 9ee115544d..762d21c78a 100644 --- a/windows/keep-secure/working-with-applocker-rules.md +++ b/windows/keep-secure/working-with-applocker-rules.md @@ -2,338 +2,207 @@ title: Working with AppLocker rules (Windows 10) description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Working with AppLocker rules + **Applies to** - Windows 10 + This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TopicDescription

[Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md)

This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.

[Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md)

This topic for IT professionals shows how to create an AppLocker rule with a path condition.

[Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md)

This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.

[Create AppLocker default rules](create-applocker-default-rules.md)

This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.

[Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md)

This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.

[Create a rule for packaged apps](create-a-rule-for-packaged-apps.md)

This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.

[Delete an AppLocker rule](delete-an-applocker-rule.md)

This topic for IT professionals describes the steps to delete an AppLocker rule.

[Edit AppLocker rules](edit-applocker-rules.md)

This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.

[Enable the DLL rule collection](enable-the-dll-rule-collection.md)

This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.

[Enforce AppLocker rules](enforce-applocker-rules.md)

This topic for IT professionals describes how to enforce application control rules by using AppLocker.

[Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md)

This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.

+ +| Topic | Description | +| - | - | +| [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.| +| [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a path condition.| +| [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.| +| [Create AppLocker default rules](create-applocker-default-rules.md) | This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.| +| [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) | This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.| +| [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) | This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.| +| [Delete an AppLocker rule](delete-an-applocker-rule.md) | This topic for IT professionals describes the steps to delete an AppLocker rule.| +| [Edit AppLocker rules](edit-applocker-rules.md) | This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.| +| [Enable the DLL rule collection](enable-the-dll-rule-collection.md) | This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.| +| [Enforce AppLocker rules](enforce-applocker-rules.md) | This topic for IT professionals describes how to enforce application control rules by using AppLocker.| +| [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) | This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.|   The three AppLocker enforcement modes are described in the following table. The enforcement mode setting defined here can be overwritten by the setting derived from a linked Group Policy Object (GPO) with a higher precedence. - ---- - - - - - - - - - - - - - - - - - - - - -
Enforcement modeDescription

Not configured

This is the default setting which means that the rules defined here will be enforced unless a linked GPO with a higher precedence has a different value for this setting.

Enforce rules

Rules are enforced.

Audit only

Rules are audited but not enforced. When a user runs an app that is affected by an AppLocker rule, the app is allowed to run and the info about the app is added to the AppLocker event log. The Audit-only enforcement mode helps you determine which apps will be affected by the policy before the policy is enforced. When the AppLocker policy for a rule collection is set to Audit only, rules for that rule collection are not enforced

-  + +| Enforcement mode | Description | +| - | - | +| **Not configured** | This is the default setting which means that the rules defined here will be enforced unless a linked GPO with a higher precedence has a different value for this setting.| +| **Enforce rules** | Rules are enforced.| +| **Audit only** | Rules are audited but not enforced. When a user runs an app that is affected by an AppLocker rule, the app is allowed to run and the info about the app is added to the AppLocker event log. The Audit-only enforcement mode helps you determine which apps will be affected by the policy before the policy is enforced. When the AppLocker policy for a rule collection is set to **Audit only**, rules for that rule collection are not enforced| + When AppLocker policies from various GPOs are merged, the rules from all the GPOs are merged and the enforcement mode setting of the winning GPO is applied. ## Rule collections + The AppLocker console is organized into rule collections, which are executable files, scripts, Windows Installer files, packaged apps and packaged app installers, and DLL files. These collections give you an easy way to differentiate the rules for different types of apps. The following table lists the file formats that are included in each rule collection. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Rule collectionAssociated file formats

Executable files

.exe

-

.com

Scripts

.ps1

-

.bat

-

.cmd

-

.vbs

-

.js

Windows Installer files

.msi

-

.msp

-

.mst

Packaged apps and packaged app installers

.appx

DLL files

.dll

-

.ocx

+ +| Rule collection | Associated file formats | +| - | - | +| Executable files | .exe
.com| +| Scripts| .ps1
.bat
.cmd
.vbs
.js| +| Windows Installer files | .msi
.msp
.mst| +| Packaged apps and packaged app installers | .appx| +| DLL files | .dll
.ocx|   -**Important**   -If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. +>**Important:**  If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. + When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. + The DLL rule collection is not enabled by default. To learn how to enable the DLL rule collection, see [DLL rule collections](#bkmk-dllrulecollections).   ## Rule conditions + Rule conditions are criteria that help AppLocker identify the apps to which the rule applies. The three primary rule conditions are publisher, path, and file hash. + - [Publisher](#bkmk-publisher): Identifies an app based on its digital signature - [Path](#bkmk-path): Identifies an app by its location in the file system of the computer or on the network - [File hash](#bkmk-filehash): Represents the system computed cryptographic hash of the identified file + ### Publisher + This condition identifies an app based on its digital signature and extended attributes when available. The digital signature contains info about the company that created the app (the publisher). Executable files, dlls, Windows installers, packaged apps and packaged app installers also have extended attributes, which are obtained from the binary resource. In case of executable files, dlls and Windows installers, these attributes contain the name of the product that the file is a part of, the original name of the file as supplied by the publisher, and the version number of the file. In case of packaged apps and packaged app installers, these extended attributes contain the name and the version of the app package. -**Note**   -Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers. + +>**Note:**  Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers.   -**Note**   -Use a publisher rule condition when possible because they can survive app updates as well as a change in the location of files. +>**Note:**  Use a publisher rule condition when possible because they can survive app updates as well as a change in the location of files.   When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving the slider up or by using a wildcard character (\*) in the product, file name, or version number fields. -**Note**   -To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. + +>**Note:**  To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider.   The **File version** and **Package version** control whether a user can run a specific version, earlier versions, or later versions of the app. You can choose a version number and then configure the following options: + - **Exactly.** The rule applies only to this version of the app - **And above.** The rule applies to this version and all later versions. - **And below.** The rule applies to this version and all earlier versions. + The following table describes how a publisher condition is applied. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionThe publisher condition allows or denies…

All signed files

All files that are signed by any publisher.

Publisher only

All files that are signed by the named publisher.

Publisher and product name

All files for the specified product that are signed by the named publisher.

Publisher and product name, and file name

Any version of the named file or package for the named product that are signed by the publisher.

Publisher, product name, file name, and file version

Exactly

-

The specified version of the named file or package for the named product that are signed by the publisher.

Publisher, product name, file name, and file version

And above

-

The specified version of the named file or package and any new releases for the product that are signed by the publisher.

Publisher, product name, file name, and file version

And below

-

The specified version of the named file or package and any earlier versions for the product that are signed by the publisher.

Custom

You can edit the Publisher, Product name, File name, Version Package name, and Package version fields to create a custom rule.

-  + + +| Option | The publisher condition allows or denies… | +| **All signed files** | All files that are signed by any publisher.| +| **Publisher only**| All files that are signed by the named publisher.| +| **Publisher and product name**| All files for the specified product that are signed by the named publisher.| +| **Publisher and product name, and file name**| Any version of the named file or package for the named product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **Exactly**
The specified version of the named file or package for the named product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **And above**
The specified version of the named file or package and any new releases for the product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **And below**
The specified version of the named file or package and any earlier versions for the product that are signed by the publisher.| +| **Custom**| You can edit the **Publisher**, **Product name**, **File name**, **Version** **Package name**, and **Package version** fields to create a custom rule.| + ### Path + This rule condition identifies an application by its location in the file system of the computer or on the network. + AppLocker uses custom path variables for well-known paths, such as Program Files and Windows. + The following table details these path variables. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows directory or diskAppLocker path variableWindows environment variable

Windows

%WINDIR%

%SystemRoot%

System32

%SYSTEM32%

%SystemDirectory%

Windows installation directory

%OSDRIVE%

%SystemDrive%

Program Files

%PROGRAMFILES%

%ProgramFiles% and

-

%ProgramFiles(x86)%

Removable media (for example, a CD or DVD)

%REMOVABLE%

Removable storage device (for example, a USB flash drive)

%HOT%

+ +| Windows directory or disk | AppLocker path variable | Windows environment variable | +| - | - | - | +| Windows| %WINDIR%| %SystemRoot%| +| System32| %SYSTEM32%| %SystemDirectory%| +| Windows installation directory| %OSDRIVE%| %SystemDrive%| +| Program Files| %PROGRAMFILES%| %ProgramFiles% and %ProgramFiles(x86)% | +| Removable media (for example, a CD or DVD)| %REMOVABLE%| | +| Removable storage device (for example, a USB flash drive)| %HOT% | |   -**Important**   -Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. +>**Important:**  Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile.   ### File hash + When you choose the file hash rule condition, the system computes a cryptographic hash of the identified file. The advantage of this rule condition is that because each file has a unique hash, a file hash rule condition applies to only one file. The disadvantage is that each time the file is updated (such as a security update or upgrade) the file's hash will change. As a result, you must manually update file hash rules. + ## AppLocker default rules + AppLocker allows you to generate default rules for each rule collection. + Executable default rule types include: + - Allow members of the local **Administrators** group to run all apps. - Allow members of the **Everyone** group to run apps that are located in the Windows folder. - Allow members of the **Everyone** group to run apps that are located in the Program Files folder. + Script default rule types include: + - Allow members of the local **Administrators** group to run all scripts. - Allow members of the **Everyone** group to run scripts that are located in the Program Files folder. - Allow members of the **Everyone** group to run scripts that are located in the Windows folder. + Windows Installer default rule types include: + - Allow members of the local **Administrators** group to run all Windows Installer files. - Allow members of the **Everyone** group to run all digitally signed Windows Installer files. - Allow members of the **Everyone** group to run all Windows Installer files that are located in the Windows\\Installer folder. + DLL default rule types: + - Allow members of the local **Administrators** group to run all DLLs. - Allow members of the **Everyone** group to run DLLs that are located in the Program Files folder. - Allow members of the **Everyone** group to run DLLs that are located in the Windows folder. + Packaged apps default rule types: + - Allow members of the **Everyone** group to install and run all signed packaged apps and packaged app installers. + ## AppLocker rule behavior + If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. + A rule can be configured to use allow or deny actions: + - **Allow.** You can specify which files are allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Deny.** You can specify which files are *not* allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. -**Important**   -For a best practice, use allow actions with exceptions. You can use a combination of allow and deny actions but understand that deny actions override allow actions in all cases, and can be circumvented. + +>**Important:**  For a best practice, use allow actions with exceptions. You can use a combination of allow and deny actions but understand that deny actions override allow actions in all cases, and can be circumvented.   -**Important**   -If you join a computer running at least Windows Server 2012 or Windows 8 to a domain that already enforces AppLocker rules for executable files, users will not be able to run any packaged apps unless you also create rules for packaged apps. If you want to allow any packaged apps in your environment while continuing to control executable files, you should create the default rules for packaged apps and set the enforcement mode to Audit-only for the packaged apps rule collection. +>**Important:**  If you join a computer running at least Windows Server 2012 or Windows 8 to a domain that already enforces AppLocker rules for executable files, users will not be able to run any packaged apps unless you also create rules for packaged apps. If you want to allow any packaged apps in your environment while continuing to control executable files, you should create the default rules for packaged apps and set the enforcement mode to Audit-only for the packaged apps rule collection.   ## Rule exceptions + You can apply AppLocker rules to individual users or to a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. For example, the rule "Allow everyone to run Windows except Registry Editor" allows everyone in the organization to run the Windows operating system, but it does not allow anyone to run Registry Editor. + The effect of this rule would prevent users such as Help Desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Help Desk user group: "Allow Help Desk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Help Desk user group to run Registry Editor. + ## DLL rule collection + Because the DLL rule collection is not enabled by default, you must perform the following procedure before you can create and enforce DLL rules. + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To enable the DLL rule collection** + 1. Click **Start**, type **secpol.msc**, and then press ENTER. 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then click **Properties**. 4. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - **Important**   - Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. + + >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps.   ## AppLocker wizards + You can create rules by using two AppLocker wizards: + 1. The Create Rules Wizard enables you to create one rule at a time. 2. The Automatically Generate Rules Wizard allows you to create multiple rules at one time. You can either select a folder and let the wizard create rules for the relevant files within that folder or in case of packaged apps let the wizard create rules for all packaged apps installed on the computer. You can also specify the user or group to which to apply the rules. This wizard automatically generates allow rules only. + ## Additional considerations + - By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed. Administrators should maintain an up-to-date list of allowed applications. - There are two types of AppLocker conditions that do not persist following an update of an app: + - **A file hash condition** File hash rule conditions can be used with any app because a cryptographic hash value of the app is generated at the time the rule is created. However, the hash value is specific to that exact version of the app. If there are several versions of the application in use within the organization, you need to create file hash conditions for each version in use and for any new versions that are released. + - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule cannot persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. + - If an app is not digitally signed, you cannot use a publisher rule condition for that app. - AppLocker rules cannot be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. - The packaged apps and packaged apps installer rule collection is available on devices running at least Windows Server 2012 and Windows 8. @@ -341,5 +210,3 @@ You can create rules by using two AppLocker wizards: - When an AppLocker rule collection is set to **Audit only**, the rules are not enforced. When a user runs an application that is included in the rule, the app is opened and runs normally, and information about that app is added to the AppLocker event log. - A custom configured URL can be included in the message that is displayed when an app is blocked. - Expect an increase in the number of Help Desk calls initially because of blocked apps until users understand that they cannot run apps that are not allowed. -  -  diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 621ce3f5ca..9a7fe85b18 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -18,7 +18,7 @@ #### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) #### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) -### [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) +### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) ### [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) ### [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md) ### [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 6383bcab54..66f10dbf1e 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -1,11 +1,6 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. -ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -keywords: privacy, stop data flow to Microsoft -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services --- # Configure Windows 10 devices to stop data flow to Microsoft @@ -285,7 +280,7 @@ When you enable the **Don't search the web or display web results in Search** Gr - For **Remote port**, choose **All ports**. -> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. +> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. ### 1.2 Cortana MDM policies diff --git a/windows/manage/images/settings-table.png b/windows/manage/images/settings-table.png index 527d92d9b2..6b77ce6002 100644 Binary files a/windows/manage/images/settings-table.png and b/windows/manage/images/settings-table.png differ diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index 142d9f3824..61004d8822 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -47,7 +47,7 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

Use this article to make informed decisions about how you can configure Windows telemetry in your organization.

-

[Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md)

+

[Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)

Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.

diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md new file mode 100644 index 0000000000..616f93dc73 --- /dev/null +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -0,0 +1,1264 @@ +--- +title: Manage connections from Windows operating system components to Microsoft services (Windows 10) +description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. +ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 +keywords: privacy, manage connections to Microsoft +ms.prod: W10 +ms.mktglfcycl: manage +ms.sitesec: library +--- + +# Manage connections from Windows operating system components to Microsoft services + +**Applies to** + +- Windows 10 + +If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). + +Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. + +If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. + +Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. + +In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. + +We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. + +Here's what's covered in this article: + +- [Info management settings](#bkmk-othersettings) + + - [1. Cortana](#bkmk-cortana) + + - [1.1 Cortana Group Policies](#bkmk-cortana-gp) + + - [1.2 Cortana MDM policies](#bkmk-cortana-mdm) + + - [1.3 Cortana Windows Provisioning](#bkmk-cortana-prov) + + - [2. Date & Time](#bkmk-datetime) + + - [3. Device metadata retrieval](#bkmk-devinst) + + - [4. Font streaming](#font-streaming) + + - [5. Insider Preview builds](#bkmk-previewbuilds) + + - [6. Internet Explorer](#bkmk-ie) + + - [6.1 Internet Explorer Group Policies](#bkmk-ie-gp) + + - [6.2 ActiveX control blocking](#bkmk-ie-activex) + + - [7. Live Tiles](#live-tiles) + + - [8. Mail synchronization](#bkmk-mailsync) + + - [9. Microsoft Edge](#bkmk-edge) + + - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) + + - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) + + - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) + + - [10. Network Connection Status Indicator](#bkmk-ncsi) + + - [11. Offline maps](#bkmk-offlinemaps) + + - [12. OneDrive](#bkmk-onedrive) + + - [13. Preinstalled apps](#bkmk-preinstalledapps) + + - [14. Settings > Privacy](#bkmk-settingssection) + + - [14.1 General](#bkmk-priv-general) + + - [14.2 Location](#bkmk-priv-location) + + - [14.3 Camera](#bkmk-priv-camera) + + - [14.4 Microphone](#bkmk-priv-microphone) + + - [14.5 Speech, inking, & typing](#bkmk-priv-speech) + + - [14.6 Account info](#bkmk-priv-accounts) + + - [14.7 Contacts](#bkmk-priv-contacts) + + - [14.8 Calendar](#bkmk-priv-calendar) + + - [14.9 Call history](#bkmk-priv-callhistory) + + - [14.10 Email](#bkmk-priv-email) + + - [14.11 Messaging](#bkmk-priv-messaging) + + - [14.12 Radios](#bkmk-priv-radios) + + - [14.13 Other devices](#bkmk-priv-other-devices) + + - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) + + - [14.15 Background apps](#bkmk-priv-background) + + - [15. Software Protection Platform](#bkmk-spp) + + - [16. Sync your settings](#bkmk-syncsettings) + + - [17. Teredo](#bkmk-teredo) + + - [18. Wi-Fi Sense](#bkmk-wifisense) + + - [19. Windows Defender](#bkmk-defender) + + - [20. Windows Media Player](#bkmk-wmp) + + - [21. Windows spotlight](#bkmk-spotlight) + + - [22. Windows Store](#bkmk-windowsstore) + + - [23. Windows Update Delivery Optimization](#bkmk-updates) + + - [23.1 Settings > Update & security](#bkmk-wudo-ui) + + - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) + + - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) + + - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) + + - [24. Windows Update](#bkmk-wu) + +## What's new in Windows 10, version 1511 + + +Here's a list of changes that were made to this article for Windows 10, version 1511: + +- Added the following new sections: + + - [Mail synchronization](#bkmk-mailsync) + + - [Offline maps](#bkmk-offlinemaps) + + - [Windows spotlight](#bkmk-spotlight) + + - [Windows Store](#bkmk-windowsstore) + +- Added the following Group Policies: + + - Open a new tab with an empty tab + + - Configure corporate Home pages + + - Let Windows apps access location + + - Let Windows apps access the camera + + - Let Windows apps access the microphone + + - Let Windows apps access account information + + - Let Windows apps access contacts + + - Let Windows apps access the calendar + + - Let Windows apps access messaging + + - Let Windows apps control radios + + - Let Windows apps access trusted devices + + - Do not show feedback notifications + + - Turn off Automatic Download and Update of Map Data + + - Force a specific default lock screen image + +- Added the AllowLinguisticDataCollection MDM policy. + +- Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. + +- Changed the Windows Update section to apply system-wide settings, and not just per user. + +## Info management settings + + +This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. + +The settings in this section assume you are using Windows 10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. + +- [1. Cortana](#bkmk-cortana) + +- [2. Date & Time](#bkmk-datetime) + +- [3. Device metadata retrieval](#bkmk-devinst) + +- [4. Font streaming](#font-streaming) + +- [5. Insider Preview builds](#bkmk-previewbuilds) + +- [6. Internet Explorer](#bkmk-ie) + +- [7. Live Tiles](#live-tiles) + +- [8. Mail synchronization](#bkmk-mailsync) + +- [9. Microsoft Edge](#bkmk-edge) + +- [10. Network Connection Status Indicator](#bkmk-ncsi) + +- [11. Offline maps](#bkmk-offlinemaps) + +- [12. OneDrive](#bkmk-onedrive) + +- [13. Preinstalled apps](#bkmk-preinstalledapps) + +- [14. Settings > Privacy](#bkmk-settingssection) + +- [15. Software Protection Platform](#bkmk-spp) + +- [16. Sync your settings](#bkmk-syncsettings) + +- [17. Teredo](#bkmk-teredo) + +- [18. Wi-Fi Sense](#bkmk-wifisense) + +- [19. Windows Defender](#bkmk-defender) + +- [20. Windows Media Player](#bkmk-wmp) + +- [21. Windows spotlight](#bkmk-spotlight) + +- [22. Windows Store](#bkmk-windowsstore) + +- [23. Windows Update Delivery Optimization](#bkmk-updates) + +- [24. Windows Update](#bkmk-wu) + + +See the following table for a summary of the management settings. For more info, see its corresponding section. + +![Management settings table](images/settings-table.png) + +### 1. Cortana + +Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). + +### 1.1 Cortana Group Policies + +Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. + +| Policy | Description | +|------------------------------------------------------|---------------------------------------------------------------------------------------| +| Allow Cortana | Choose whether to let Cortana install and run on the device. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
Default: Disabled| +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | +| Set what information is shared in Search | Control what information is shared with Bing in Search. | + +When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. + +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. + +2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. + +3. On the **Rule Type** page, click **Program**, and then click **Next**. + +4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. + +5. On the **Action** page, click **Block the connection**, and then click **Next**. + +6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. + +7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** + +8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. + +9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. + + - For **Protocol type**, choose **TCP**. + + - For **Local port**, choose **All Ports**. + + - For **Remote port**, choose **All ports**. + +> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. + +### 1.2 Cortana MDM policies + +The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | +| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
Default: Allowed| + +### 1.3 Cortana Windows Provisioning + +To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. + +### 2. Date & Time + +You can prevent Windows from setting the time automatically. + +- To turn off the feature in the UI: **Settings** > **Time & language** > **Date & time** > **Set time automatically** + + -or- + +- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters** with a value of **NoSync**. + +### 3. Device metadata retrieval + +To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. + +### 4. Font streaming + +Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. + +To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. + +> **Note:** This may change in future versions of Windows. + +### 5. Insider Preview builds + +To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. + +- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + + -or- + +- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **0**. Users cannot make their devices available for downloading and installing preview software. + + - **1**. Users can make their devices available for downloading and installing preview software. + + - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. + + -or- + +- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where: + + - **0**. Users cannot make their devices available for downloading and installing preview software. + + - **1**. Users can make their devices available for downloading and installing preview software. + + - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. + +### 6. Internet Explorer + +Use Group Policy to manage settings for Internet Explorer. + +### 6.1 Internet Explorer Group Policies + +Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
Default: Enabled
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
Default: Enabled| +| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
Default: Disabled
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| +| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
Default: Enabled | +| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled| + +### 6.2 ActiveX control blocking + +ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). + +For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). + +### 7. Live Tiles + +To turn off Live Tiles: + +- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** + +### 8. Mail synchronization + +To turn off mail synchronization for Microsoft Accounts that are configured on a device: + +- In **Settings** > **Accounts** > **Your email and accounts**, remove any connected Microsoft Accounts. + + -or- + +- Remove any Microsoft Accounts from the Mail app. + + -or- + +- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device. + +To turn off the Windows Mail app: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** + +### 9. Microsoft Edge + +Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). + +### 9.1 Microsoft Edge Group Policies + +Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. + +> **Note:** The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn off autofill | Choose whether employees can use autofill on websites.
Default: Enabled | +| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
Default: Disabled | +| Turn off password manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled | +| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
Default: Enabled | +| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
Default: Enabled | +| Open a new tab with an empty tab | Choose whether a new tab page appears.
Default: Enabled | +| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
Set this to **about:blank** | + +### 9.2 Microsoft Edge MDM policies + +The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
Default: Allowed | +| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
Default: Not allowed | +| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
Default: Allowed | +| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
Default: Allowed | +| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
Default: Allowed | + +### 9.3 Microsoft Edge Windows Provisioning + +Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. + +For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). + +### 10. Network Connection Status Indicator + +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). + +You can turn off NCSI through Group Policy: + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** + +> **Note** After you apply this policy, you must restart the device for the policy setting to take effect. + +### 11. Offline maps + +You can turn off the ability to download and update offline maps. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** + +### 12. OneDrive + +To turn off OneDrive in your organization: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** + +### 13. Preinstalled apps + +Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. + +To remove the News app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage** + +To remove the Weather app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingWeather"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage** + +To remove the Money app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingFinance"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage** + +To remove the Sports app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingSports"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage** + +To remove the Twitter app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "\*.Twitter"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage** + +To remove the XBOX app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.XboxApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage** + +To remove the Sway app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.Sway"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage** + +To remove the OneNote app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.OneNote"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage** + +To remove the Get Office app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.MicrosoftOfficeHub"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage** + +To remove the Get Skype app: + +- Right-click the Sports app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.SkypeApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** + +### 14. Settings > Privacy + +Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. + +- [14.1 General](#bkmk-general) + +- [14.2 Location](#bkmk-priv-location) + +- [14.3 Camera](#bkmk-priv-camera) + +- [14.4 Microphone](#bkmk-priv-microphone) + +- [14.5 Speech, inking, & typing](#bkmk-priv-speech) + +- [14.6 Account info](#bkmk-priv-accounts) + +- [14.7 Contacts](#bkmk-priv-contacts) + +- [14.8 Calendar](#bkmk-priv-calendar) + +- [14.9 Call history](#bkmk-priv-callhistory) + +- [14.10 Email](#bkmk-priv-email) + +- [14.11 Messaging](#bkmk-priv-messaging) + +- [14.12 Radios](#bkmk-priv-radios) + +- [14.13 Other devices](#bkmk-priv-other-devices) + +- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) + +- [14.15 Background apps](#bkmk-priv-background) + +### 14.1 General + +**General** includes options that don't fall into other areas. + +To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: + +> **Note:** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). + +To turn off **Turn on SmartScreen Filter to check web content (URLs) that Windows Store apps use**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. + + Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. + + -or- + +- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. + + -or- + +- Create a provisioning package, using: + + - For Internet Explorer: **Runtime settings** > **Policies** > **Browser** > **AllowSmartScreen** + + - For Microsoft Edge: **Runtime settings** > **Policies** > **MicrosoftEdge** > **AllowSmartScreen** + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation**, with a value of 0 (zero). + +To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: + +> **Note: ** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. + + + +- Turn off the feature in the UI. + + -or- + +- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **0**. Not allowed + + - **1**. Allowed (default) + +To turn off **Let websites provide locally relevant content by accessing my language list**: + +- Turn off the feature in the UI. + + -or- + +- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. + +### 14.2 Location + +In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. + +To turn off **Location for this device**: + +- Click the **Change** button in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. + + -or- + +- Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Turned off and the employee can't turn it back on. + + - **1**. Turned on, but lets the employee choose whether to use it. (default) + + - **2**. Turned on and the employee can't turn it off. + + **Note** + You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where + + - **No**. Turns off location service. + + - **Yes**. Turns on location service. (default) + +To turn off **Location**: + +- Turn off the feature in the UI. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** + + - Set the **Select a setting** box to **Force Deny**. + + -or- + +To turn off **Location history**: + +- Erase the history using the **Clear** button in the UI. + +To turn off **Choose apps that can use your location**: + +- Turn off each app using the UI. + +### 14.3 Camera + +In the **Camera** area, you can choose which apps can access a device's camera. + +To turn off **Let apps use my camera**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the camera** + + - Set the **Select a setting** box to **Force Deny**. + + -or- + +- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Apps can't use the camera. + + - **1**. Apps can use the camera. + + **Note** + You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + + -or- + +- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: + + - **0**. Apps can't use the camera. + + - **1**. Apps can use the camera. + +To turn off **Choose apps that can use your camera**: + +- Turn off the feature in the UI for each app. + +### 14.4 Microphone + +In the **Microphone** area, you can choose which apps can access a device's microphone. + +To turn off **Let apps use my microphone**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the microphone** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can use your microphone**: + +- Turn off the feature in the UI for each app. + +### 14.5 Speech, inking, & typing + +In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. + +> **Note:** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. + + + +To turn off the functionality: + +- Click the **Stop getting to know me** button, and then click **Turn off**. + + -or- + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** + + -or- + +- Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). + + -and- + + Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). + +### 14.6 Account info + +In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. + +To turn off **Let apps access my name, picture, and other account info**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose the apps that can access your account info**: + +- Turn off the feature in the UI for each app. + +### 14.7 Contacts + +In the **Contacts** area, you can choose which apps can access an employee's contacts list. + +To turn off **Choose apps that can access contacts**: + +- Turn off the feature in the UI for each app. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.8 Calendar + +In the **Calendar** area, you can choose which apps have access to an employee's calendar. + +To turn off **Let apps access my calendar**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can access calendar**: + +- Turn off the feature in the UI for each app. + +### 14.9 Call history + +In the **Call history** area, you can choose which apps have access to an employee's call history. + +To turn off **Let apps access my call history**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access call history** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.10 Email + +In the **Email** area, you can choose which apps have can access and send email. + +To turn off **Let apps access and send email**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access email** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.11 Messaging + +In the **Messaging** area, you can choose which apps can read or send messages. + +To turn off **Let apps read or send messages (text or MMS)**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access messaging** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can read or send messages**: + +- Turn off the feature in the UI for each app. + +### 14.12 Radios + +In the **Radios** area, you can choose which apps can turn a device's radio on or off. + +To turn off **Let apps control radios**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can control radios**: + +- Turn off the feature in the UI for each app. + +### 14.13 Other devices + +In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. + +To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: + +- Turn off the feature in the UI. + +To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.14 Feedback & diagnostics + +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. + +To change how frequently **Windows should ask for my feedback**: + +**Note** +Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. + + + +- To change from **Automatically (Recommended)**, use the drop-down list in the UI. + + -or- + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** + + -or- + +- Create the registry keys (REG\_DWORD type): + + - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds + + - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod + + Based on these settings: + + | Setting | PeriodInNanoSeconds | NumberOfSIUFInPeriod | + |---------------|-----------------------------|-----------------------------| + | Automatically | Delete the registry setting | Delete the registry setting | + | Never | 0 | 0 | + | Always | 100000000 | Delete the registry setting | + | Once a day | 864000000000 | 1 | + | Once a week | 6048000000000 | 1 | + + + +To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: + +- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. + + > **Note:** You can't use the UI to change the telemetry level to **Security**. + + + + -or- + +- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** + + -or- + +- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Maps to the **Security** level. + + - **1**. Maps to the **Basic** level. + + - **2**. Maps to the **Enhanced** level. + + - **3**. Maps to the **Full** level. + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: + + - **0**. Maps to the **Security** level. + + - **1**. Maps to the **Basic** level. + + - **2**. Maps to the **Enhanced** level. + + - **3**. Maps to the **Full** level. + +### 14.15 Background apps + +In the **Background Apps** area, you can choose which apps can run in the background. + +To turn off **Let apps run in the background**: + +- Turn off the feature in the UI for each app. + +### 15. Software Protection Platform + +Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: + +**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** + +The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. + +### 16. Sync your settings + +You can control if your settings are synchronized: + +- In the UI: **Settings** > **Accounts** > **Sync your settings** + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync** + + -or- + +- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where + + - **No**. Settings are not synchronized. + + - **Yes**. Settings are synchronized. (default) + +To turn off Messaging cloud sync: + +- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). + +### 17. Teredo + +You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). + +- From an elevated command prompt, run **netsh interface teredo set state disabled** + +### 18. Wi-Fi Sense + +Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. + +To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: + +- Turn off the feature in the UI. + + -or- + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. + + -or- + +- Create a new REG\_DWORD registry setting called **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config**, with a value of 0 (zero). + + -or- + +- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). + + -or- + +- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). + +When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. + +### 19. Windows Defender + +You can disconnect from the Microsoft Antimalware Protection Service. + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** + + -or- + +- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + + -or- + +- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). + + -and- + + From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** + +You can stop sending file samples back to Microsoft. + +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. + + -or- + +- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Always prompt. + + - **1**. (default) Send safe samples automatically. + + - **2**. Never send. + + - **3**. Send all samples automatically. + + -or- + +- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send. + +You can stop downloading definition updates: + +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. + + -and- + +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. + +You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. + +### 20. Windows Media Player + +To remove Windows Media Player: + +- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. + + -or- + +- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** + +### 21. Windows spotlight + +Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. + +- Configure the following in **Settings**: + + - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Show me tips, tricks, and more on the lock screen**. + + - **Personalization** > **Start** > **Occasionally show suggestions in Start**. + + - **System** > **Notifications & actions** > **Show me tips about Windows**. + + -or- + +- Apply the Group Policies: + + - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. + - Add a location in the **Path to local lock screen image** box. + + - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. + + **Note** This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. + + + + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. + + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. + +For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). + +### 22. Windows Store + +You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. + +### 23. Windows Update Delivery Optimization + +Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. + +By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. + +Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. + +### 23.1 Settings > Update & security + +You can set up Delivery Optimization from the **Settings** UI. + +- Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. + +### 23.2 Delivery Optimization Group Policies + +You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. + +| Policy | Description | +|---------------------------|-----------------------------------------------------------------------------------------------------| +| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

  • None. Turns off Delivery Optimization.

  • Group. Gets or sends updates and apps to PCs on the same local network domain.

  • Internet. Gets or sends updates and apps to PCs on the Internet.

  • LAN. Gets or sends updates and apps to PCs on the same NAT only.

| +| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
** Note** This ID must be a GUID.| +| Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| +| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| +| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| + +### 23.3 Delivery Optimization MDM policies + +The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|---------------------------|-----------------------------------------------------------------------------------------------------| +| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

  • 0. Turns off Delivery Optimization.

  • 1. Gets or sends updates and apps to PCs on the same NAT only.

  • 2. Gets or sends updates and apps to PCs on the same local network domain.

  • 3. Gets or sends updates and apps to PCs on the Internet.

| +| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
**Note** This ID must be a GUID.| +| DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
The default value is 259200 seconds (3 days).| +| DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| +| DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| + + +### 23.4 Delivery Optimization Windows Provisioning + +If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies + +Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. + +1. Open Windows ICD, and then click **New provisioning package**. + +2. In the **Name** box, type a name for the provisioning package, and then click **Next.** + +3. Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**. + +4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. + +For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). + +### 24. Windows Update + +You can turn off Windows Update by setting the following registry entries: + +- Add a REG\_DWORD value called **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + + -and- + +- Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + +You can turn off automatic updates by doing one of the following. This is not recommended. + +- Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. + + -or- + +- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Notify the user before downloading the update. + + - **1**. Auto install the update and then notify the user to schedule a device restart. + + - **2** (default). Auto install and restart. + + - **3**. Auto install and restart at a specified time. + + - **4**. Auto install and restart without end-user control. + + - **5**. Turn off automatic updates. + +To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx).