deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-07 18:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into vsts15845892

Browse Source
This commit is contained in:
Justin Hall 2018-02-15 13:43:48 -08:00
commit 97d4535ef8
2120 changed files with 6936 additions and 1251 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
.openpublishing.publish.config.json
View File

@ -1,6 +1,22 @@
{
"build_entry_point": "",
"docsets_to_publish": [
{
"docset_name": "bcs-VSTS",
"build_source_folder": "bcs",
"build_output_subfolder": "bcs-VSTS",
"locale": "en-us",
"monikers": [],
"moniker_ranges": [],
"open_to_public_contributors": false,
"type_mapping": {
"Conceptual": "Content",
"ManagedReference": "Content",
"RestApi": "Content"
},
"build_entry_point": "docs",
"template_folder": "_themes"
},
{
"docset_name": "education-VSTS",
"build_source_folder": "education",
@ -126,7 +142,7 @@
"locale": "en-us",
"monikers": [],
"moniker_ranges": [],
"open_to_public_contributors": false,
"open_to_public_contributors": true,
"type_mapping": {
"Conceptual": "Content",
"ManagedReference": "Content",

4674
.openpublishing.redirection.json
View File

File diff suppressed because it is too large Load Diff

1
bcs/TOC.md Normal file
View File

@ -0,0 +1 @@
# [Index](index.md)

3
bcs/breadcrumb/toc.yml Normal file
View File

@ -0,0 +1,3 @@
- name: Docs
tocHref: /
topicHref: /

45
bcs/docfx.json Normal file
View File

@ -0,0 +1,45 @@
{
"build": {
"content": [
{
"files": [
"**/*.md",
"**/*.yml"
],
"exclude": [
"**/obj/**",
"**/includes/**",
"_themes/**",
"_themes.pdf/**",
"README.md",
"LICENSE",
"LICENSE-CODE",
"ThirdPartyNotices"
]
}
],
"resource": [
{
"files": [
"**/*.png",
"**/*.jpg"
],
"exclude": [
"**/obj/**",
"**/includes/**",
"_themes/**",
"_themes.pdf/**"
]
}
],
"overwrite": [],
"externalReference": [],
"globalMetadata": {
"breadcrumb_path": "/microsoft-365/business/breadcrumb/toc.json",
"extendBreadcrumb": true
},
"fileMetadata": {},
"template": [],
"dest": "bcs-vsts"
}
}

3
bcs/index.md Normal file
View File

@ -0,0 +1,3 @@
---
redirect_url: /microsoft-365/business/
---

3
bcs/support/microsoft-365-business-faqs.md Normal file
View File

@ -0,0 +1,3 @@
---
redirect_url: https://docs.microsoft.com/microsoft-365/business/support/microsoft-365-business-faqs
---

3
bcs/support/transition-csp-subscription.md Normal file
View File

@ -0,0 +1,3 @@
---
redirect_url: https://docs.microsoft.com/microsoft-365/business/support/transition-csp-subscription
---

542
browsers/edge/available-policies.md
View File

@ -7,15 +7,14 @@ ms.mktglfcycl: explore
ms.sitesec: library
title: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros)
ms.localizationpriority: high
ms.date: 09/13/2017
ms.date: 09/13/2017 #Previsou release date
---
<!-- pashort 2/9/2018: as per Brian Atman, the documentation descrepancies must be addressed for RS5. Find out what those discrepancies are. Scenario 15403628 -->
# Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge
**Applies to:**
- Windows 10
- Windows 10 Mobile
> Applies to: Windows 10, Windows 10 Mobile
Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences.
@ -25,348 +24,359 @@ By using Group Policy and Intune, you can set up a policy setting once, and then
> For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=617924).
## Group Policy settings
Microsoft Edge works with the following Group Policy settings to help you manager your company's web browser configurations. The Group Policy settings are found in the Group Policy Editor in the following location:
`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`
<!-- original text
Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations:
-->
### Allow Address bar drop-down list suggestions
- **Supported versions:** Windows 10, version 1703
- **Description:** This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services.
- If you enable or don't configure this setting (default), employees can see the Address bar drop-down functionality in Microsoft Edge.
- If you disable this setting, employees won't see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type".
> [!Note]
> Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting.
>*Supporteded versions: Windows 10, version 1703*
This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services.
| If you... | Then... |
| --- | --- |
| Enable this setting (default) | Employees can see the Address bar drop-down functionality in Microsoft Edge. |
| Disable this setting | Employees do not see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type."<p>Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting. |
|
### Allow Adobe Flash
- **Supported versions:** Windows 10 or later
>*Supporteded version: Windows 10*
- **Description:** This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge.
- If you enable or don't configure this setting (default), employees can use Adobe Flash.
- If you disable this setting, employees can't use Adobe Flash.
This policy setting lets you decide whether employees can run Adobe Flash on Microsoft Edge.
| If you… | Then… |
| --- | --- |
| Enable or don’t configure this setting (default) | Employees can use Adobe Flash. |
| Disable this setting | Employees cannot use Adobe Flash. |
|
### Allow clearing browsing data on exit
- **Supported versions:** Windows 10, version 1703
>*Supporteded versions: Windows 10, version 1703*
- **Description:** This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes.
- If you enable this policy setting, clearing browsing history on exit is turned on.
- If you disable or don't configure this policy setting (default), it can be turned on and configured by the employee in the Clear browsing data options area, under Settings.
This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes.
| If you… | Then… |
| --- | --- |
| Enable this setting | Clear browsing history on exit is turned on. <!-- <span style="background: #ffff99;">[@Reviewer: can employees do anything to this setting at this point? Or is this controlled by the system administrator?]</span> --> |
| Disable or don’t configure this setting (default) | Employees can turn on and configure the Clear browsing data option under Settings. |
|
### Allow Developer Tools
- **Supported versions:** Windows 10, version 1511 or later
>*Supporteded versions: Windows 10, version 1511 or later*
- **Description:** This policy setting lets you decide whether F12 Developer Tools are available on Microsoft Edge.
- If you enable or don’t configure this setting (default), the F12 Developer Tools are available in Microsoft Edge.
- If you disable this setting, the F12 Developer Tools aren’t available in Microsoft Edge.
This policy setting lets you decide whether F12 Developer Tools are available on Microsoft Edge.
| If you… | Then… |
| --- | --- |
| Enable this setting (default) | F12 Developer Tools are available. |
| Disable this setting | F12 Developer Tools are not available. |
|
### Allow Extensions
- **Supported versions:** Windows 10, version 1607 or later
>*Supporteded versions: Windows 10, version 1607 or later*
- **Description:** This policy setting lets you decide whether employees can use Edge Extensions.
- If you enable or don’t configure this setting, employees can use Edge Extensions.
- If you disable this setting, employees can’t use Edge Extensions.
This policy setting lets you decide whether employees can use Edge Extensions.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees can use Edge Extensions. |
| Disable this setting | <!-- <span style="background: #ffff99;">[@Reviewer: why would a company disable this setting? Is this because of potential memory leaks?]</span> --> Employees cannot use Edge Extensions. |
|
### Allow InPrivate browsing
- **Supported versions:** Windows 10, version 1511 or later
>*Supporteded versions: Windows 10, version 1511 or later*
- **Description:** This policy setting lets you decide whether employees can browse using InPrivate website browsing.
- If you enable or don’t configure this setting (default), employees can use InPrivate website browsing.
- If you disable this setting, employees can’t use InPrivate website browsing.
This policy setting lets you decide whether employees can browse using InPrivate website browsing.
| If you… | Then… |
| --- | --- |
| Enable this setting (default) | Employees can use InPrivate website browsing. |
| Disable this setting | <!-- <span style="background: #ffff99;">[@Reviewer: why would a company disable this setting? Is this to discourage users from browser inappropriate websites? What are the use cases for having this turned off?]</span> --> Employees cannot use InPrivate website browsing. |
|
### Allow Microsoft Compatibility List
- **Supported versions:** Windows 10, version 1607 or later
>*Supporteded versions: Windows 10, version 1607 or later*
- **Description:** This policy setting lets you decide whether to use the Microsoft Compatibility List (a Microsoft-provided list that helps sites with known compatibility issues to display properly) in Microsoft Edge. By default, the Microsoft Compatibility List is enabled and can be viewed by visiting about:compat.
- If you enable or don’t configure this setting (default), Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation. Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site is automatically rendered as though it’s in whatever version of IE is necessary for it to appear properly.
- If you disable this setting, the Microsoft Compatibility List isn’t used during browser navigation.
This policy setting lets you decide whether to use the Microsoft Compatibility List (a Microsoft-provided list that helps sites with known compatibility issues to display properly) in Microsoft Edge. By default, the Microsoft Compatibility List is enabled and can be viewed by visiting about:compat. <!-- <span style="background: #ffff99;">[@Reviewer: Is this supposed to be a link to another topic? Is the topic Use Enterprise Mode to improve compatibility emie-to-improve-compatibility.md?]</span> -->
| If you… | Then… |
| --- | --- |
| Enable this setting (default) | Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation <!-- <span style="background: #ffff99;">[@Reviewer: are the updates really applied “during browser navigation?" shouldn't just be as simple as "...applying the updates automatically”?]</span> -->. Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site renders as though it’s in whatever version of IE is necessary for it to appear properly. |
| Disable this setting | Browser navigation does not use the Microsoft Compatibility List. |
|
### Allow search engine customization
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy setting lets you decide whether users can change their search engine.
This policy setting lets you decide whether users can change their search engine. Important. You can only use this setting with domain-joined or MDM-enrolled devices.
>[!Important]
>This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
For more info, see the [Microsoft browser extension policy](http://aka.ms/browserpolicy).
- If you enable or don't configure this policy (default), users can add new search engines and change the default used in the Address bar from within Microsoft Edge Settings.
- If you disable this setting, users can't add search engines or change the default used in the address bar.
| If you… | Then… |
| --- | --- |
| Enable or don’t configure this setting (default) | Employees can add new search engines and change the default used in the Address bar from within Microsoft Edge Settings. |
| Disable this setting | Employees cannot add search engines or change the default used in the Address bar. |
|
### Allow web content on New Tab page
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees can’t change it.
- If you enable this setting, Microsoft Edge opens a new tab with the New Tab page.
- If you disable this setting, Microsoft Edge opens a new tab with a blank page.
- If you don’t configure this setting (default), employees can choose how new tabs appears.
This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees can’t change it.
| If you… | Then… |
| --- | --- |
| Enable this setting | Microsoft Edge opens a new tab with the New Tab page. |
| Disable this setting | Microsoft Edge opens a new tab with a blank page. |
| Do not configure this setting (default) | Employees can choose how new tabs appear. |
|
### Configure additional search engines
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting.
> [!Important]
> This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
- If you enable this setting, you can add up to 5 additional search engines. For each additional engine, you must also add a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine, using this format:
<https://fabrikam.com/opensearch.xml>https://www.contoso.com/opensearch.xml
For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic.
- If you disable this setting (default), any added search engines are removed from your employee's devices.
- If you don't configure this setting, the search engine list is set to what is specified in App settings.
This policy setting lets you add up to 5 additional search engines, which cannot be removed by your employees but can make a personal default engine. This setting does not set the default search engine. For that, you must use the "Set default search engine" setting.
| If you… | Then… |
| --- | --- |
| Enable this setting | You can add up to 5 additional search engines. For each additional search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:<br><br> `<https://www.contoso.com/opensearch.xml>` <p>For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. | Disable this setting (default) | Any added search engines are removed from the employee’s device. <!-- <span style="background: #ffff99;">[@Reviewer: is this implying that Bing is the only search engine on the employee’s device?]</span> --> |
| Do not configure this setting | The search engine list is set to what is specified in App settings. <!-- <span style="background: #ffff99;">[@Reviewer: what’s the difference between “don’t configure this setting”, “Enable this setting”, and “Disable this setting”?]</span> --> |
|
### Configure Autofill
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. By default, employees can choose whether to use Autofill.
- If you enable this setting, employees can use Autofill to automatically fill in forms while using Microsoft Edge.
- If you disable this setting, employees can’t use Autofill to automatically fill in forms while using Microsoft Edge.
- If you don’t configure this setting (default), employees can choose whether to use Autofill to automatically fill in forms while using Microsoft Edge.
This policy setting lets you decide whether employees can use Autofill the form fields automatically while using Microsoft Edge. By default, employees can choose whether to use Autofill.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees can use Autofill to populate form fields automatically. |
| Disable this setting | Employees cannot use Autofill to populate form fields automatically. |
| Do not configure this setting (default) | Employees can choose whether to use Autofill to populate the form fields automatically. |
|
### Configure cookies
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This setting lets you configure how to work with cookies.
- If you enable this setting, you must also decide whether to:
- **Allow all cookies (default):** Allows all cookies from all websites.
- **Block all cookies:** Blocks all cookies from all websites.
- **Block only 3rd-party cookies:** Blocks only cookies from 3rd-party websites.
- If you disable or don't configure this setting, all cookies are allowed from all sites.
This setting lets you configure how to work with cookies.
| If you… | Then… |
| --- | --- |
| Enable this setting (default) | You must also decide whether to:<ul><li>**Allow all cookies (default)** from all websites.</li><li>**Block all cookies** from all websites.</li><li>**Block only 3rd-party cookies** from 3rd-party websites.</li></ul> |
| Disable or do not configure this setting | All cookies are allowed from all sites. |
|
### Configure Do Not Track
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you decide whether employees can send Do Not Track requests to websites that ask for tracking info. By default, Do Not Track requests aren’t sent, but employees can choose to turn on and send requests.
- If you enable this setting, Do Not Track requests are always sent to websites asking for tracking info.
- If you disable this setting, Do Not Track requests are never sent to websites asking for tracking info.
- If you don’t configure this setting (default), employees can choose whether to send Do Not Track requests to websites asking for tracking info.
This policy setting lets you decide whether employees can send Do Not Track requests to websites that ask for tracking info. By default, Do Not Track requests are never sent, but employees can choose to turn on and send requests.
| If you… | Then… |
| --- | --- |
| Enable this setting | Do Not Track requests are always sent to websites asking for tracking information. |
| Disable this setting | Do Not Track requests are never sent to websites asking for tracking information. |
| Do not configure this setting (default) | Employees can choose whether to send Do Not Track requests to websites asking for tracking information. |
|
### Configure Favorites
- **Supported versions:** Windows 10, version 1511 or later
>*Supported versions: Windows 10, version 1511 or later*
- **Description:** This policy setting lets you configure the default list of Favorites that appear for your employees. Employees can change their Favorites by adding or removing items at any time.
- If you enable this setting, you can configure what default Favorites appear for your employees. If this setting is enabled, you must also provide a list of Favorites in the Options section. This list is imported after your policy is deployed.
- If you disable or don’t configure this setting, employees will see the Favorites that they set in the Favorites hub.
This policy setting lets you configure the default list of Favorites that appear for your employees. Employees can change their Favorites by adding or removing items at any time. <!-- <span style="background: #ffff99;">[@Reviewer: what is the default setting, enabled or disabled? I’m guessing it’s Disabled is the default.]</span> -->
| If you… | Then… |
| --- | --- |
| Enable this setting | You must provide a list of Favorites in the Options section. The list imports automatically after you deploy this policy. |
| Disable or do not configure this setting | Employees will see the Favorites that they set in the Favorites hub. |
|
### Configure Password Manager
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on.
- If you enable this setting (default), employees can use Password Manager to save their passwords locally.
- If you disable this setting, employees can’t use Password Manager to save their passwords locally.
- If you don’t configure this setting, employees can choose whether to use Password Manager to save their passwords locally.
This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on.
| If you… | Then… |
| --- | --- |
| Enable this setting (default) | Employees can use Password Manager to save their passwords locally. |
| Disable this setting | Employees can’t use Password Manager to save their passwords locally. |
| Do not configure this setting | Employees can choose whether to use Password Manager to save their passwords locally. |
|
### Configure Pop-up Blocker
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on.
- If you enable this setting (default), Pop-up Blocker is turned on, stopping pop-up windows from appearing.
- If you disable this setting, Pop-up Blocker is turned off, letting pop-ups windows appear.
- If you don’t configure this setting, employees can choose whether to use Pop-up Blocker.
This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on.
| If you… | Then… |
| --- | --- |
| Enable this setting (default) | Pop-up Blocker is turned on, stopping pop-up windows from appearing. |
| Disable this setting | Pop-up Blocker is turned off, letting pop-up windows appear. |
| Do not configure this setting | Employees can choose whether to use Pop-up Blocker. |
|
### Configure search suggestions in Address bar
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.
- If you enable this setting, employees can see search suggestions in the Address bar of Microsoft Edge.
- If you disable this setting, employees can't see search suggestions in the Address bar of Microsoft Edge.
- If you don’t configure this setting (default), employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.
This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees can see search suggestions in the Address bar. |
| Disable this setting | Employees cannot see search suggestions in the Address bar. |
| Do not configure this setting (default) | Employees can choose whether search suggestions appear in the Address bar. |
|
### Configure Start pages
- **Supported versions:** Windows 10, version 1511 or later
>*Supported versions: Windows 10, version 1511 or later*
- **Description:** This policy setting lets you configure one or more Start pages, for domain-joined devices. Your employees won't be able to change this after you set it.
- If you enable this setting, you can configure one or more Start pages. If this setting is enabled, you must also include URLs to the pages, separating multiple pages by using angle brackets in this format:
<support.contoso.com><support.microsoft.com>
- If you disable or don’t configure this setting (default), your default Start page is the webpage specified in App settings.
This policy setting lets you configure one or more Start pages, for domain-joined devices. Your employees will not be able to change this after you set it.
| If you… | Then… |
| --- | --- |
| Enable this setting | You must include URLs to the pages, separating multiple pages by using angle brackets in this format: <br><br>`<support.contoso.com><support.microsoft.com>` |
| Disable or do not configure this setting (default) | The default Start page is the webpage specified in App settings. |
|
### Configure the Adobe Flash Click-to-Run setting
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy setting lets you decide whether employees must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash.
- If you enable or don’t configure the Adobe Flash Click-to-Run setting, an employee must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content.
- If you disable this setting, Adobe Flash content is automatically loaded and run by Microsoft Edge.
This policy setting lets you decide whether employees must take action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. <!-- <span style="background: #ffff99;">[@Reviewer: what is the default, enabled or disabled?]</span> -->
| If you… | Then… |
| --- | --- |
| Enable or don’t configure this setting< | Employees must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content. |
| Disable this setting | Adobe Flash loads automatically and runs in Microsoft Edge. |
|
### Configure the Enterprise Mode Site List
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.
This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.
| If you… | Then… |
| --- | --- |
| Enable this setting | You must add the location to your site list in the **{URI}** box. When configured, Microsoft Edge looks for the Enterprise Mode Site List XML file, which includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. |
Disable or do not configure this setting (default) | Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. |
|
- If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file, which includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. If you use this option, you must also add the location to your site list in the **{URI}** box. When configured, any site on the list will always open in Internet Explorer 11.
- If you disable or don’t configure this setting (default), Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps.
>[!Note]
>If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.<p>
>If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one.
>[!Note]
>If there is a .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server has a different version number than the version in the cache container, the server file is used and stored in the cache container.<br><br>
>If you already use a site list, enterprise mode continues to work during the 65-second wait; it just uses the existing site list instead of the new one.
### Configure Windows Defender SmartScreen
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on.
- If you enable this setting, Windows Defender SmartScreen is turned on and employees can’t turn it off.
- If you disable this setting, Windows Defender SmartScreen is turned off and employees can’t turn it on.
- If you don’t configure this setting (default), employees can choose whether to use Windows Defender SmartScreen.
This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on.
| If you… | Then… |
| --- | --- |
| Enable this setting | Windows Defender SmartScreen is turned on, and employees cannot turn it off. |
| Disable this setting | Windows Defender SmartScreen is turned off, and employees cannot turn it on. |
| Do not configure this setting | Employees can choose whether to use Windows Defender SmartScreen. |
|
### Disable lockdown of Start pages
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy setting lets you disable the lock down of Start pages, letting employees modify the Start pages when the "Configure Start pages" setting is in effect.
This policy setting lets you disable the lockdown of Start pages if the Configure Start pages setting is in effect <!-- <span style="background: #ffff99;">[@Reviewer: shouldn't this be “…is enabled” instead of "...is in effect"?]</span> -->. This setting only applies to domain-joined or MDM-enrolled devices.
>[!Important]
>This setting only applies when you're using the “Configure Start pages" setting and can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
- If you enable this setting, you can't lock down any Start pages that are configured using the "Configure Start pages" setting, which means that employees can modify them.
- If you disable or don't configure this setting (default), employees can't change any Start pages configured using the "Configure Start pages" setting, thereby locking down the Start pages.
For more info, see the [Microsoft browser extension policy](http://aka.ms/browserpolicy).
| If you… | Then… |
| --- | --- |
| Enable this setting | You cannot lock down Start pages that are configured using the “Configure Start pages” setting. Employees can, therefore, modify the pages. |
| Disable or do not configure this setting (default) | Employees cannot change Start pages configured using the “Configure Start pages” setting. |
|
### Keep favorites in sync between Internet Explorer and Microsoft Edge
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This setting lets you decide whether people can sync their favorites between Internet Explorer and Microsoft Edge, including additions, deletions, changes, and position.
This policy setting lets you decide whether people can sync their favorites between Internet Explorer and Microsoft Edge, including additions, deletions, changes, and position.
>[!Note]
>Enabling this setting stops Edge favorites from syncing between connected Windows 10 devices.
- If you enable this setting, employees can sync their favorites between Internet Explorer and Microsoft Edge.
- If you disable or don't configure this setting (default), employees can’t sync their favorites between Internet Explorer and Microsoft Edge.
<!--
<span style="background: #ffff99;">[@Reviewer: what is the default: enable or disable?]</span> -->
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees can sync their favorites between Internet Explorer and Microsoft Edge.<br><br>Enabling this setting stops Edge favorites from syncing between connected Windows 10 devices. <!-- <span style="background: #ffff99;">[@Reviewer: what does this mean? I want to know more about what this is saying. More details and maybe an example or scenario.]</span> --> |
| Disable or do not configure this setting | Employees cannot sync their favorites between Internet Explorer and Microsoft Edge. |
|
### Prevent access to the about:flags page
- **Supported versions:** Windows 10, version 1607 or later
>*Supported versions: Windows 10, version 1607 or later*
- **Description:** This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.
- If you enable this policy setting, employees can’t access the about:flags page.
- If you disable or don’t configure this setting (default), employees can access the about:flags page.
This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees cannot access the about:flags page. |
| Disable or do not configure this setting (default) | Employees can access the about:flags page. |
|
### Prevent bypassing Windows Defender SmartScreen prompts for files
- **Supported versions:** Windows 10, version 1511 or later
- **Description:** This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files.
- If you enable this setting, employees can’t ignore Windows Defender SmartScreen warnings and they’re blocked from downloading the unverified files.
- If you disable or don’t configure this setting (default), employees can ignore Windows Defender SmartScreen warnings and continue the download process.
>*Supported versions: Windows 10, version 1511 or later*
This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees cannot ignore Windows Defender SmartScreen warnings when downloading files. |
| Disable or do not configure this setting (default) | Employees can ignore Windows Defender SmartScreen warnings and can continue the download process. |
|
### Prevent bypassing Windows Defender SmartScreen prompts for sites
- **Supported versions:** Windows 10, version 1511 or later
>*Supported versions: Windows 10, version 1511 or later*
- **Description:** This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites.
- If you enable this setting, employees can’t ignore Windows Defender SmartScreen warnings and they’re blocked from continuing to the site.
- If you disable or don’t configure this setting (default), employees can ignore Windows Defender SmartScreen warnings and continue to the site.
This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees cannot ignore Windows Defender SmartScreen warnings and prevents them from continuing to the site. |
| Disable or do not configure this setting (default) | Employees can ignore Windows Defender SmartScreen warnings, allowing them to continue to the site. |
|
### Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu.
This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu.
| If you… | Then… |
| --- | --- |
| Enable this setting | Microsoft Edge does not gather the Live Tile metadata, providing a minimal experience. |
| Disable or do not configure this setting (default) | Microsoft Edge gathers the Live Tile metadata, providing a fuller and complete experience. |
|
- If you enable this setting, Microsoft Edge won't gather the Live Tile metadata, providing a minimal experience when a user pins a Live Tile to the Start menu.
- If you disable or don't configure this setting (default), Microsoft Edge gathers the Live Tile metadata, providing a fuller and more complete experience when a user pins a Live Tile to the Start menu.
### Prevent the First Run webpage from opening on Microsoft Edge
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time.
- If you enable this setting, employees won't see the First Run page when opening Microsoft Edge for the first time.
- If you disable or don't configure this setting (default), employees will see the First Run page when opening Microsoft Edge for the first time.
This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time.
| If you… | Then… |
| --- | --- |
| Enable this settin | Employees do not see the First Run page. |
| Disable or do not configure this setting (default) | Employees see the First Run page. |
|
### Prevent using Localhost IP address for WebRTC
- **Supported versions:** Windows 10, version 1511 or later
>*Supported versions: Windows 10, version 1511 or later*
- **Description:** This policy setting lets you decide whether an employee’s Localhost IP address shows while making calls using the WebRTC protocol. By default, this setting is turned off.
- If you enable this setting, Localhost IP addresses are hidden while making calls using the WebRTC protocol.
- If you disable or don’t configure this setting (default), Localhost IP addresses are shown while making calls using the WebRTC protocol.
This policy setting lets you decide whether localhost IP addresses are visible or hidden while making calls to the WebRTC protocol.
| If you… | Then… |
| --- | --- |
| Enable this setting | Localhost IP addresses are hidden. |
| Disable or do not configure this setting (default) | Localhost IP addresses are visible. |
|
### Send all intranet sites to Internet Explorer 11
- **Supported versions:** Windows 10 or later
>*Supported versions: Windows 10*
- **Description:** This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge.
- If you enable this setting, all intranet sites are automatically opened using Internet Explorer 11.
- If you disable or don’t configure this setting (default), all websites, including intranet sites, are automatically opened using Microsoft Edge.
This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge.
| If you… | Then… |
| --- | --- |
| Enable this setting | All intranet sites are opened in Internet Explorer 11 automatically. |
| Disable or do not configure this setting (default) | All websites, including intranet sites, open in Microsoft Edge. |
|
### Set default search engine
- **Supported versions:** Windows 10, version 1703
>*Supported versions: Windows 10, version 1703*
- **Description:** This policy setting lets you configure the default search engine for your employees. Employees can change the default search engine at any time unless you disable the "Allow search engine customization" setting, which restricts any changes.
This policy setting applies only to domain-joined or MDM-enrolled devices and lets you configure the default search engine for Microsoft Edge. Employees can change the default search engine at any time unless you disable the "Allow search engine customization" setting, which restricts any changes.
>[!Important]
>This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).<p>
>If you'd like your employees to use the default Microsoft Edge settings for each market, you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING.
For more info, see the [Microsoft browser extension policy](http://aka.ms/browserpolicy).
- If you enable this setting, you can choose a default search engine for your employees. To choose the default engine, you must add a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine, using this format:
https://fabrikam.com/opensearch.xml
- If you disable this setting, the policy-set default search engine is removed. If this is also the current in-use default, the engine changes to the Microsoft Edge specified engine for the market.
- If you don't configure this setting (default), the default search engine is set to the one specified in App settings.
| If you… | Then… |
| --- | --- |
| Enable this setting | To set a default search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:<br><br>`https://fabrikam.com/opensearch.xml` |
| Disable this setting | The policy-set default search engine is removed. If this is also the current in-use default, the search engine changes to the Microsoft Edge specified engine for the market <!-- <span style="background: #ffff99;">[@Reviewer: what does “market” mean in this context?]</span> -->. |
| Do not configure this setting | The default search engine is set to the one specified in App settings. |
|
>[!Important]
>If you'd like your employees to use the default Microsoft Edge settings for each market <!-- <span style="background: #ffff99;">[@Reviewer: what does “each market” refer to in this context?]</span> -->, you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING.
### Show message when opening sites in Internet Explorer
- **Supported versions:** Windows 10, version 1607 and later
>*Supported versions: Windows 10, version 1607 and later*
- **Description:** This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.
- If you enable this setting, employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.
- If you disable or don’t configure this setting (default), the default app behavior occurs and no additional page appears.
This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.
| If you… | Then… |
| --- | --- |
| Enable this setting | Employees see an additional page. |
| Disable or do not configure this setting (default) | No additional pages display. |
|
## Using Microsoft Intune to manage your Mobile Device Management (MDM) settings for Microsoft Edge
If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=722885) page.
@ -397,7 +407,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **1 (default).** Allowed. Address bar drop-down is enabled.
### AllowAutofill
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Desktop
@ -414,7 +424,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **1 (default).** Employees can use Autofill to complete form fields.
### AllowBrowser
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Mobile
@ -431,7 +441,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **1 (default).** Employees can use Microsoft Edge.
### AllowCookies
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Both
@ -462,12 +472,12 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **Allowed values:**
- **0.** Employees can't use the F12 Developer Tools.
- **0.** Employees cannot use the F12 Developer Tools.
- **1 (default).** Employees can use the F12 Developer Tools.
### AllowDoNotTrack
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Both
@ -501,7 +511,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **1 (default).** Employees can use Edge Extensions.
### AllowFlash
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Desktop
@ -564,12 +574,12 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **Allowed values:**
- **0.** Additional search engines aren't allowed and the default can’t be changed in the Address bar.
- **0.** Additional search engines are not allowed and the default can’t be changed in the Address bar.
- **1 (default).** Additional search engines are allowed and the default can be changed in the Address bar.
### AllowPasswordManager
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Both
@ -581,12 +591,12 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **Allowed values:**
- **0 (default).** Employees can't use Password Manager to save passwords locally.
- **0 (default).** Employees cannot use Password Manager to save passwords locally.
- **1.** Employees can use Password Manager to save passwords locally.
### AllowPopups
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Desktop
@ -621,7 +631,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
### AllowSearchSuggestionsinAddressBar
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Both
@ -638,7 +648,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **1.** Employees can see search suggestions in the Address bar of Microsoft Edge.
### AllowSmartScreen
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Both
@ -706,7 +716,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **1.** Disable lockdown of the Start pages and allow users to modify them.
### EnterpriseModeSiteList
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Desktop
@ -747,7 +757,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
<contoso.com>
<fabrikam.com>
URLs must be on separate lines and aren't shared between Microsoft Edge and Internet Explorer 11.
URLs must be on separate lines and are not shared between Microsoft Edge and Internet Explorer 11.
### FirstRunURL
- **Supported versions:** Windows 10, version 1511 or later
@ -802,7 +812,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **0 (default).** Employees can access the about:flags page in Microsoft Edge.
- **1.** Employees can't access the about:flags page in Microsoft Edge.
- **1.** Employees cannot access the about:flags page in Microsoft Edge.
### PreventFirstRunPage
- **Supported versions:** Windows 10, version 1703
@ -819,7 +829,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **0 (default).** Employees see the First Run webpage.
- **1.** Employees don't see the First Run webpage.
- **1.** Employees do not see the First Run webpage.
### PreventLiveTileDataCollection
- **Supported versions:** Windows 10, version 1703
@ -887,10 +897,10 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U
- **0 (default).** Shows an employee's LocalHost IP address while using the WebRTC protocol.
- **1.** Doesn't show an employee's LocalHost IP address while using the WebRTC protocol.
- **1.** Does not show an employee's LocalHost IP address while using the WebRTC protocol.
### SendIntranetTraffictoInternetExplorer
- **Supported versions:** Windows 10 or later
- **Supported versions:** Windows 10
- **Supported devices:** Desktop
@ -968,9 +978,9 @@ These are additional Windows 10-specific Group Policy settings that work with M
- **Description:** This policy settings lets you decide whether employees can use Cortana.
- If you enable or don't configure this setting, employees can use Cortana on their devices.
- If you enable or do not configure this setting, employees can use Cortana on their devices.
- If you disable this setting, employees won't be able to use Cortana on their devices.
- If you disable this setting, employees will not be able to use Cortana on their devices.
>[!Note]
>Employees can still perform searches even with Cortana turned off.
@ -982,7 +992,7 @@ These are additional Windows 10-specific Group Policy settings that work with M
- If you enable this setting, the Sync your Settings options are turned off and none of the Sync your Setting groups are synced on the device. You can use the Allow users to turn syncing on option to turn the feature off by default, but to let the employee change this setting.
- If you disable or don't configure this setting (default), the Sync your Settings options are turned on, letting employees pick what can sync on their device.
- If you disable or do not configure this setting (default), the Sync your Settings options are turned on, letting employees pick what can sync on their device.
### Do not sync browser settings
- **Location:** Computer Configuration\Administrative Templates\Windows Components\sync your settings\Do not sync browser settings
@ -991,7 +1001,7 @@ These are additional Windows 10-specific Group Policy settings that work with M
- If you enable this setting, the Sync your Settings options are turned off so that browser groups are unable to sync their settings and info. You can use the Allow users to turn browser syncing on option to turn the feature off by default, but to let the employee change this setting.
- If you disable or don't configure this setting (default), the Sync your Settings options are turned on, letting browser groups pick what can sync on their device.
- If you disable or do not configure this setting (default), the Sync your Settings options are turned on, letting browser groups pick what can sync on their device.
## Microsoft Edge and Windows 10-specific MDM policy settings

10
browsers/edge/emie-to-improve-compatibility.md
View File

@ -13,15 +13,15 @@ ms.date: 07/27/2017
# Use Enterprise Mode to improve compatibility
**Applies to:**
- Windows 10
> Applies to: Windows 10
If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11.
Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11.
> **Note**<br>
<!-- Will RS5 have the need for the following note? -->
[@Reviewer: will RS5 have the need for the following note?]
>[!NOTE]
>If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714).
## Fix specific websites
@ -98,7 +98,5 @@ You can add the **Send all intranet traffic over to Internet Explorer** Group Po
* [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714)
 
 

8
browsers/edge/hardware-and-software-requirements.md
View File

@ -13,15 +13,13 @@ ms.date: 07/27/2017
# Microsoft Edge requirements and language support
**Applies to:**
- Windows 10
- Windows 10 Mobile
>Applies to: Windows 10, Windows 10 Mobile
Microsoft Edge is pre-installed on all Windows 10-capable devices that meet the minimum system requirements and are on the supported language list.
>**Note**<br>The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don't include Microsoft Edge or many other Universal Windows Platform (UWP) apps. These apps and their services are frequently updated with new functionality, and can't be supported on systems running the LTSB operating systems. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11.
>[!NOTE]
>The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don't include Microsoft Edge or many other Universal Windows Platform (UWP) apps. These apps and their services are frequently updated with new functionality, and can't be supported on systems running the LTSB operating systems. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11.
## Minimum system requirements
Some of the components in this table might also need additional system resources. Check the component's documentation for more information.

5
browsers/edge/microsoft-edge-faq.md
View File

@ -12,10 +12,7 @@ ms.date: 09/19/2017
# Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros
**Applies to:**
- Windows 10
- Windows 10 Mobile
>Applies to: Windows 10, Windows 10 Mobile
**Q: What is the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use?**

13
browsers/edge/security-enhancements-microsoft-edge.md
View File

@ -11,19 +11,16 @@ ms.date: 10/16/2017
# Security enhancements for Microsoft Edge
**Applies to:**
- Windows 10
- Windows 10 Mobile
>Applies to: Windows 10, Windows 10 Mobile
Microsoft Edge is designed with significant security improvements, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows.
## Help to protect against web-based security threats
While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. Thieves by nature don’t care about rules, and will use any means to take advantage of victims, most often using trickery or hacking:
- **Trickery.** Means using things like “phishing” attacks to convince a person to enter a banking password into a website that looks like the bank, but isn’t.
- **Trickery** uses things like “phishing” attacks to convince a person to enter a banking password into a website that looks like the bank, but isn’t.
- **Hacking.** Means attacking a system through malformed content that exploits subtle flaws in a browser, or in various browser extensions, such as video decoders. This exploit lets an attacker run code on a device, taking over first a browsing session, and perhaps ultimately the entire device.
- **Hacking** attacks a system through malformed content that exploits subtle flaws in a browser, or in various browser extensions, such as video decoders. This exploit lets an attacker run code on a device, taking over first a browsing session, and perhaps ultimately the entire device.
While trickery and hacking are threats faced by every browser, it’s important that we explore how Microsoft Edge addresses these threats and is helping make the web a safer experience.
@ -55,8 +52,8 @@ The Microsoft EdgeHTML engine also helps to defend against hacking through these
- Support for the [HTTP Strict Transport Security (HSTS)](https://developer.microsoft.com/microsoft-edge/platform/documentation/dev-guide/security/HSTS/) security feature (IETF-standard compliant). This helps ensure that connections to important sites, such as to your bank, are always secured.
**Note**<br>
Both Microsoft Edge and Internet Explorer 11 support HSTS.
>[!NOTE]
>Both Microsoft Edge and Internet Explorer 11 support HSTS.
#### All web content runs in an app container sandbox
Internet Explorer 7 on Windows Vista was the first web browser to provide a browsing sandbox, called [Protected Mode](http://windows.microsoft.com/windows-vista/What-does-Internet-Explorer-protected-mode-do). Protected Mode forced the part of the browser that rendered web content to run with less privilege than the browser controls or the user, providing a level of isolation and protection should a malicious website attempt to exploit a bug in the browser or one of its plug-ins.

11
browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
View File

@ -191,6 +191,17 @@ The &lt;url&gt; attribute, as part of the &lt;site&gt; element in the v.2 versio
</thead>
<tbody>
<tr>
<td>allow-redirect</td>
<td>A boolean attribute of the &lt;open-in&gt; element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
<p><b>Example</b>
<pre class="syntax">
&lt;site url="contoso.com/travel"&gt;
&lt;open-in allow-redirect="true"&gt;IE11&lt;/open-in&gt;
&lt;/site&gt;</pre>
In this example, if http://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.</td>
<td>Internet Explorer 11 and Microsoft Edge</td>
</tr>
<tr>
<td>version</td>
<td>Specifies the version of the Enterprise Mode Site List. This attribute is supported for the &lt;site-list&gt; element.</td>
<td>Internet Explorer 11 and Microsoft Edge</td>

2
devices/hololens/hololens-enroll-mdm.md
View File

@ -12,7 +12,7 @@ ms.date: 07/27/2017
# Enroll HoloLens in MDM
You can manage multiple Microsoft HoloLens devices simultaneously using solutions like Microsoft Intune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens) and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies).
You can manage multiple Microsoft HoloLens devices simultaneously using solutions like Microsoft Intune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business), the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens), and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies).
>[!NOTE]
>Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md).

2
devices/surface-hub/connect-and-display-with-surface-hub.md
View File

@ -31,7 +31,7 @@ When connecting external devices and displays to a Surface Hub, there are severa
## Guest Mode
Guest Mode uses a wired connection, so people can display content from their devices to the Surface Hub. If the source device is Windows-based, that device can also provide Touchback and Inkback. Surface Hub's internal PC takes video and audio from the connected device and presents them on the Surface Hub. If Surface Hub encounters a High-Bandwidth Digital Content Protection (HDCP) signal, the source will be re-routed through an alternate path, allowing the source to be displayed full-screen without violating HDCP requirements.
Guest Mode uses a wired connection, so people can display content from their devices to the Surface Hub. If the source device is Windows-based, that device can also provide Touchback and Inkback. Surface Hub's internal PC takes video and audio from the connected device and presents them on the Surface Hub. If Surface Hub encounters a High-Bandwidth Digital Content Protection (HDCP) signal, the source will be be displayed as a black image. To display your content without violating HDCP requirements, use the keypad on the right side of the Surface Hub to directly choose the external source.
>[!NOTE]
>When an HDCP source is connected, use the side keypad to change source inputs.

2
devices/surface-hub/create-a-device-account-using-office-365.md
View File

@ -91,7 +91,7 @@ From here on, you'll need to finish the account creation process using PowerShel
In order to run cmdlets used by these PowerShell scripts, the following must be installed for the admin PowerShell console:
- [Microsoft Online Services Sign-In Assistant for IT Professionals BETA](https://go.microsoft.com/fwlink/?LinkId=718149)
- [Windows Azure Active Directory Module for Windows PowerShell](https://go.microsoft.com/fwlink/p/?linkid=236297)
- [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids)
- [Skype for Business Online, Windows PowerShell Module](http://www.microsoft.com/download/details.aspx?id=39366)
### Connecting to online services

8
devices/surface-hub/surface-hub-start-menu.md
View File

@ -28,7 +28,7 @@ The customized Start menu is defined in a Start layout XML file. You have two op
- Configure the desired Start menu on a desktop (pinning only apps that are available on Surface Hub), and then [export the layout](https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout#export-the-start-layout).
>[!TIP]
>To add a tile with a web link to your desktop start menu, go the the link in Microsoft Edge, select `...` in the top right corner, and select **Pin this page to Start**. See [a Start layout that includes a Microsoft Edge link](#edge) for an example of how links will appear in the XML.
>To add a tile with a web link to your desktop start menu, go to the link in Microsoft Edge, select `...` in the top right corner, and select **Pin this page to Start**. See [a Start layout that includes a Microsoft Edge link](#edge) for an example of how links will appear in the XML.
To edit the default XML or the exported layout, familiarize yourself with the [Start layout XML](https://docs.microsoft.com/en-us/windows/configuration/start-layout-xml-desktop). There are a few [differences between Start layout on a deskop and a Surface Hub.](#differences)
@ -176,4 +176,8 @@ This example shows a link to a website and a link to a .pdf file.
</DefaultLayoutOverride>
</LayoutModificationTemplate>
```
```
## More information
- [Blog post: Changing Surface Hub’s Start Menu](https://blogs.technet.microsoft.com/y0av/2018/02/13/47/)

10
devices/surface/change-history-for-surface.md
View File

@ -5,19 +5,25 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.date: 01/29/2018
ms.date: 02/12/2018
---
# Change history for Surface documentation
This topic lists new and updated topics in the Surface documentation library.
## February 2018
|New or changed topic | Description |
| --- | --- |
|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.46.0 information |
## January 2018
|New or changed topic | Description |
| --- | --- |
|[Windows AutoPilot and Surface devices](windows-autopilot-and-surface-devices.md) | New article |
|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.45 information |
|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.45.0 information |
|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Updated Current Branch (CB) or Current Branch for Business (CBB) servicing options with Semi-Annual Channel (SAC) information |
|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, Surface Pro with LTE Advanced, and Surface Pro information |

19
devices/surface/microsoft-surface-data-eraser.md
View File

@ -10,7 +10,7 @@ ms.pagetype: surface, devices, security
ms.sitesec: library
author: brecords
ms.author: jdecker
ms.date: 01/03/2018
ms.date: 02/12/2018
---
# Microsoft Surface Data Eraser
@ -139,25 +139,32 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
8. Click the **Yes** button to continue erasing data on the Surface device.
>[!NOTE]
>When you run Surface Data Eraser on the Surface Data Eraser USB drive, a log file is generated in the **SurfaceDataEraserLogs** folder.
## Changes and updates
Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following:
### Version 3.2.45
### Version 3.2.46.0
This version of Microsoft Surface Data Eraser adds support for the following:
- Surface Pro with LTE Advanced
### Version 3.2.45.0
This version of Microsoft Surface Data Eraser adds support for the following:
- Surface Book 2
- Surface Pro with LTE Advanced
- Surface Pro 1TB
>[!NOTE]
>Surface Data Eraser v3.2.45 and above can be used to restore Surface Pro or Surface Laptop devices with the 1TB storage option in the scenario that the device shows two separate 512GB volumes or encounters errors when attempting to deploy or install Windows 10. See [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/en-us/help/4046105/surface-pro-model-1796-and-surface-laptop-1tb-display-two-drives) for more information.
>Surface Data Eraser v3.2.45.0 and above can be used to restore Surface Pro or Surface Laptop devices with the 1TB storage option in the scenario that the device shows two separate 512GB volumes or encounters errors when attempting to deploy or install Windows 10. See [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/en-us/help/4046105/surface-pro-model-1796-and-surface-laptop-1tb-display-two-drives) for more information.
### Version 3.2.36
### Version 3.2.36.0
This version of Microsoft Surface Data Eraser adds support for the following:

7
education/get-started/configure-microsoft-store-for-education.md
View File

@ -23,7 +23,7 @@ You'll need to configure Microsoft Store for Education to accept the services ag
You can watch the video to see how this is done, or follow the step-by-step guide. </br>
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/Jnbssq0gC_g" frameborder="0" gesture="media" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/Jnbssq0gC_g]
You can watch the descriptive audio version here: [Microsoft Education: Configure Microsoft Store for Education (DA)](https://www.youtube.com/watch?v=bStgEpHbEXw)
@ -53,11 +53,6 @@ You can watch the descriptive audio version here: [Microsoft Education: Configur
Your Microsoft Store for Education account is now linked to Intune for Education so let's set that up next.
<!--
> [!div class="nextstepaction"]
> [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md)
-->
> [!div class="step-by-step"]
[<< Use School Data Sync to import student data](use-school-data-sync.md)
[Use Intune for Education to manage groups, apps, and settings >>](use-intune-for-education.md)

4
education/get-started/enable-microsoft-teams.md
View File

@ -46,10 +46,6 @@ To get started, IT administrators need to use the Office 365 Admin Center to ena
You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins* getting started guide in the <a href="https://aka.ms/MeetTeamsEdu" target="_blank">Meet Microsoft Teams</a> page.
<!--
> [!div class="nextstepaction"]
> [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md)
-->
> [!div class="step-by-step"]
[<< Use School Data Sync to import student data](use-school-data-sync.md)

4
education/get-started/finish-setup-and-other-tasks.md
View File

@ -26,7 +26,7 @@ Once you've set up your Windows 10 education device, it's worth checking to veri
You can watch the video to see how this is done, or follow the step-by-step guide. </br>
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/nhQ_4okWFmk" frameborder="0" gesture="media" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/nhQ_4okWFmk]
You can watch the descriptive audio version here: [Microsoft Education: Verify Windows 10 education devices are Azure AD joined and managed (DA)](https://www.youtube.com/watch?v=_hVIxaEsu2Y)
@ -78,7 +78,7 @@ You can follow the rest of the walkthrough to finish setup and complete other ta
You can watch the following video to see how to update group settings in Intune for Education and configure Azure settings. Or, you can follow the step-by-step guide for these tasks and the other tasks listed above.
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/M6-k73dZOfw" frameborder="0" gesture="media" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/M6-k73dZOfw]
You can watch the descriptive audio version here: [Microsoft Education: Update settings, apps, and Azure AD settings for your education tenant (DA)](https://www.youtube.com/watch?v=-Rz3VcDXbzs)

2
education/get-started/set-up-office365-edu-tenant.md
View File

@ -23,7 +23,7 @@ Schools can use Office 365 to save time and be more productive. Built with power
Don't have an Office 365 for Education verified tenant or just starting out? Follow these steps to set up an Office 365 for Education tenant. [Learn more about Office 365 for Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans). </br>
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/X7bscA-knaY" frameborder="0" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/X7bscA-knaY]
You can watch the descriptive audio version here: [Microsoft Education: Set up an Office 365 Education tenant (DA)](https://www.youtube.com/watch?v=d5tQ8KoB3ic)

2
education/get-started/set-up-windows-education-devices.md
View File

@ -19,7 +19,7 @@ If you are setting up a Windows 10 device invidividually, and network bandwidth
You can watch the video to see how this is done, or follow the step-by-step guide. </br>
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/nADWqBYvqXk" frameborder="0" gesture="media" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/nADWqBYvqXk]
You can watch the descriptive audio version here: [Microsoft Education: Set up a new Windows 10 education devices using the Windows setup experience (DA)](https://www.youtube.com/watch?v=_UtS1Cz2Pno)

2
education/get-started/use-intune-for-education.md
View File

@ -41,7 +41,7 @@ Note that for verified education tenants, Microsoft automatically provisions you
You can watch the video to see how this is done, or follow the step-by-step guide. </br>
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/c3BLoZZw3TQ" frameborder="0" gesture="media" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/c3BLoZZw3TQ]
You can watch the descriptive audio version here: [Microsoft Education: Use Intune for Education to manage groups, apps, and settings (DA)](https://youtu.be/Tejxfc4V7cQ)

2
education/get-started/use-school-data-sync.md
View File

@ -25,7 +25,7 @@ Follow all the steps in this section to use SDS and sample CSV files in a trial
You can watch the video to see how this is done, or follow the step-by-step guide.</br>
<center><iframe src="https://www.youtube.com/embed/ehSU8jr8T24" width="560" height="315" allowFullScreen frameBorder="0"></iframe></center>
> [!VIDEO https://www.youtube.com/embed/ehSU8jr8T24]
You can watch the descriptive audio version here: [Microsoft Education: Use School Data Sync to import student data (DA)](https://www.youtube.com/watch?v=l4b086IMtvc)

29
education/trial-in-a-box/educator-tib-get-started.md
View File

@ -31,10 +31,10 @@ ms.date: 01/12/2017
</br>
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/EDU-Get-Started" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
> [!VIDEO https://www.youtube.com/embed/3nqooY9Iqq4]
</br>
-->
![Log in to Device A and connect to the school network](images/edu-TIB-setp-1-jump.png)
## <a name="edu-task1"></a>1. Log in and connect to the school network
@ -49,10 +49,10 @@ To try out the educator tasks, start by logging in as a teacher.
![Improve student reading speed and comprehension](images/edu-TIB-setp-2-jump.png)
## <a name="edu-task2"></a>2. Significantly improve student reading speed and comprehension
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/EDU-Learning-Tools" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
> [!VIDEO https://www.youtube.com/embed/GCzSAslq_2Y]
</br>
-->
Learning Tools and the Immersive Reader can be used in the Microsoft Edge browser, Microsoft Word, and Microsoft OneNote to:
* Increase fluency for English language learners
@ -80,10 +80,10 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse
![Spark communication, critical thinking, and creativity with Microsoft Teams](images/edu-TIB-setp-3-jump.png)
## <a name="edu-task3"></a>3. Spark communication, critical thinking, and creativity in the classroom
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/EDU-Teams" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
> [!VIDEO https://www.youtube.com/embed/riQr4Dqb8B8]
</br>
-->
Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. This guided tour walks you through the essential teaching features of the app. Then, through interactive prompts, experience how you can use this tool in your own classroom to spark digital classroom discussions, respond to student questions, organize content, and more!
@ -99,10 +99,10 @@ Take a guided tour of Microsoft Teams and test drive this digital hub.
![Expand classroom collaboration and interaction with OneNote](images/edu-TIB-setp-4-jump.png)
## <a name="edu-task4"></a>4. Expand classroom collaboration and interaction between students
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/EDU-OneNote" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
> [!VIDEO https://www.youtube.com/embed/dzDSWMb_fIE]
</br>
-->
Microsoft OneNote organizes curriculum and lesson plans for teachers and students to work together and at their own pace. It provides a digital canvas to store text, images, handwritten drawings, attachments, links, voice, and video.
@ -130,10 +130,9 @@ See how a group project comes together with opportunities to interact with other
![Further collaborate and problem solve with Minecraft: Education Edition](images/edu-TIB-setp-5-jump.png)
## <a name="edu-task5"></a>5. Get kids to further collaborate and problem solve
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/EDU-Minecraft-EE" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
> [!VIDEO https://www.youtube.com/embed/QI_bRNUugog]
</br>
-->
Minecraft: Education Edition provides an immersive environment to develop creativity, collaboration, and problem-solving in an immersive environment where the only limit is your imagination.

6
education/trial-in-a-box/index.md
View File

@ -20,9 +20,9 @@ ms.date: 12/11/2017
</br>
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/edu-welcome" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
-->
> [!VIDEO https://www.youtube.com/embed/azoxUYWbeGg]
</br>
Welcome to Microsoft Education Trial in a Box. We built this trial to make it easy to try our latest classroom technologies. We have two scenarios for you to try: one for educators and one for IT. We recommend starting with Educators. To begin, click **Get started** below.

5
education/trial-in-a-box/itadmin-tib-get-started.md
View File

@ -35,9 +35,8 @@ To get the most out of Microsoft Education, we've pre-configured your tenant for
If you run into any problems while following the steps in this guide, or you have questions about Trial in a Box or Microsoft Education, see [Microsoft Education Trial in a Box Support](support-options.md).
</br>
<!-- hiding placeholder
<center><iframe width="560" height="315" src="https://aka.ms/EDU-IT-Admin-Setup" frameborder="3" allow="autoplay; encrypted-media" allowfullscreen></iframe></center>
-->
> [!VIDEO https://www.youtube.com/embed/cVVKCpO2tyI]
</br>

17
education/windows/use-set-up-school-pcs-app.md
View File

@ -42,7 +42,7 @@ Set up School PCs makes it easy to set up Windows 10 PCs with Microsoft's recomm
You can watch the video to see how to use the Set up School PCs app, or follow the step-by-step guide. </br>
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/2ZLup_-PhkA" frameborder="0" gesture="media" allow="encrypted-media" allowfullscreen></iframe>
> [!VIDEO https://www.youtube.com/embed/2ZLup_-PhkA]
You can watch the descriptive audio version here: [Microsoft Education: Use the Set up School PCs app (DA)](https://www.youtube.com/watch?v=qqe_T2LkGsI)
@ -89,9 +89,19 @@ You can watch the descriptive audio version here: [Microsoft Education: Use the
5. Click **Just remove my files**.
6. Click **Reset**.
* **Use an NTFS-formatted USB key**
If you're planning to install several apps, the Set up School PCs package may exceed 4 GB. Check if your USB drive format is FAT32. If it is, you won't be able to save more than 4 GB of data on the drive. To work around this, reformat the USB drive to use the NTFS format. To do this:
1. Insert the USB key into your computer.
2. Go to the Start menu and type **This PC** and then select the **This PC (Desktop app)** from the search results.
3. In the **Devices and drivers** section, find the USB drive, select and then right-click to bring up options.
4. Select **Format** from the list to bring up the **Format <DRIVE NAME>** window.
5. Set **File system** to **NTFS** and then click **Start** to format the drive.
* **Use more than one USB key**
If you are setting up multiple PCs, you can set them up at the same time. Just save the provisioning package to another USB drive. Create two keys and you can run it on two PCs at once, and so on.
If you are setting up multiple PCs, you can set them up at the same time. Just save the provisioning package to another USB drive. Create two keys and you can run it on two PCs at once, and so on.
* **Keep it clean**
@ -112,7 +122,8 @@ You can watch the descriptive audio version here: [Microsoft Education: Use the
- You must have the Microsoft Store for Education configured.
- You must be a global admin in the Microsoft Store for Education.
- It's best if you sign up for and [configure Intune for Education](../get-started/use-intune-for-education.md) before using the Set up School PCs app.
- Have a USB drive, 1 GB or larger, to save the provisioning package. We recommend an 8 GB or larger USB drive if you're installing Office.
- Have a USB drive, 1 GB or larger, to save the provisioning package. We recommend an 8 GB or larger USB drive if you're installing Office.
- Check the default file system format for your USB drive. You may need to set this to NTFS to save a provisioning package that's 4 GB or larger.
## Set up School PCs step-by-step

4
store-for-business/add-profile-to-devices.md
View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.author: TrudyHa
ms.date: 1/29/2018
ms.date: 2/9/2018
ms.localizationpriority: high
---
@ -20,7 +20,7 @@ Windows AutoPilot Deployment Program simplifies device set up for IT Admins. For
Watch this video to learn more about Windows AutoPilot in Micrsoft Store for Business. </br>
[!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false]
> [!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false]
## What is Windows AutoPilot Deployment Program?
In Microsoft Store for Business, you can manage devices for your organization and apply an *AutoPilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the AutoPilot deployment profile you applied to the device.

BIN
store-for-business/images/invite-people.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 6.7 KiB

BIN
store-for-business/images/mpsa-link.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 6.3 KiB

BIN
store-for-business/images/msfb-products-services.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 68 KiB

BIN
store-for-business/images/msfb-settings-icon.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

BIN
store-for-business/images/msfb-wn-1801-products-services.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 14 KiB

BIN
store-for-business/images/office-logo.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 5.1 KiB

BIN
store-for-business/images/product-and-service-icon.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 2.7 KiB

BIN
store-for-business/images/products-and-services-photoshop.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 21 KiB

BIN
store-for-business/images/products-and-services-ppt.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 22 KiB

6
store-for-business/release-history-microsoft-store-business-education.md
View File

@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.date: 1/8/2018
ms.date: 2/8/2018
---
# Microsoft Store for Business and Education release history
@ -15,6 +15,10 @@ Microsoft Store for Business and Education regularly releases new and improved f
Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md)
## December 2017
- Bug fixes and permformance improvements.
## November 2017
- **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file.

16
store-for-business/whats-new-microsoft-store-business-education.md
View File

@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: store
author: TrudyHa
ms.date: 1/8/2018
ms.date: 2/8/2018
---
# What's new in Microsoft Store for Business and Education
@ -15,9 +15,16 @@ Microsoft Store for Business and Education regularly releases new and improved f
## Latest updates for Store for Business and Education
**December 2017**
**January 2018**
| | |
|--------------------------------------|---------------------------------|
| ![Microsoft Store for Business Products &amp; services page.](images/product-and-service-icon.png) |**One place for apps, software, and subscriptions**<br /><br /> The new **Products &amp; services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. This includes Apps, Software, and Subscriptions that your organization acquired or manages through Microsoft Store for Business. This change centralizes these products, but the platform changes also improve overall performance. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
| ![Upgrade Office 365 trial subscription.](images/office-logo.png) |**Upgrade Office 365 trial subscription**<br /><br> Customers with Office 365 trials can now transition their trial to a paid subscription in Microsoft Store for Business. This works for trials you acquired from Microsoft Store for Business, or Office Admin Portal. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
| ![Image showing Settings icon.](images/mpsa-link.png) |**Supporting Microsoft Product and Services Agreement customers**<br /><br>If you are purchasing under the Microsoft Products and Services Agreement (MPSA), you can use Microsoft Store for Business. Here you will find access to Products & Services purchased, Downloads & Keys, Software Assurance benefits, Order history, and Agreement details. Also, we added the ability to associate your purchasing account to your tenant. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
| ![Image showing Settings icon.](images/invite-people.png) |**Microsoft Product and Services Agreement customers can invite people to take roles**<br /><br> MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role. <br /><br />**Applies to**:<br /> Microsoft Store for Business <br /> Microsoft Store for Education |
We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features!
<!---
We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features!
@ -30,6 +37,9 @@ We’ve been working on bug fixes and performance improvements to provide you a
## Previous releases and updates
[December 2017](release-history-microsoft-store-business-education.md#december-2017)
- Bug fixes and permformance improvements
[November 2017](release-history-microsoft-store-business-education.md#november-2017)
- Export list of Minecraft: Education Edition users
- Bug fixes and performance improvements

30
windows/access-protection/index.md
View File

@ -1,29 +1,3 @@
---
title: Access protection (Windows 10)
description: Learn more about access protection technologies in Windows 10 and Windows 10 Mobile.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
ms.date: 04/24/2017
---
# Access protection
Learn more about access protection technologies in Windows 10 and Windows 10 Mobile.
| Section | Description |
|-|-|
| [Access control](access-control/access-control.md) | Describes access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. Key concepts that make up access control are permissions, ownership of objects, inheritance of permissions, user rights, and object auditing. |
| [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. |
| [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. |
| [Protect derived domain credentials with Credential Guard](credential-guard/credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard helps prevent these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. |
| [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) | Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that's requesting the connection. |
| [User Account Control](user-account-control/user-account-control-overview.md)| Provides information about User Account Control (UAC), which helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. UAC can help block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.|
| [Virtual Smart Cards](virtual-smart-cards/virtual-smart-card-overview.md) | Provides information about deploying and managing virtual smart cards, which are functionally similar to physical smart cards and appear in Windows as smart cards that are always-inserted. Virtual smart cards use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. |
| [VPN technical guide](vpn/vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. |
| [Smart Cards](smart-cards/smart-card-windows-smart-card-technical-reference.md) | Provides a collection of references topics about smart cards, which are tamper-resistant portable storage devices that can enhance the security of tasks such as authenticating clients, signing code, securing e-mail, and signing in with a Windows domain account. |
| [Windows Hello for Business](hello-for-business/hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. |
| [Windows Firewall with Advanced Security](windows-firewall/windows-firewall-with-advanced-security.md) | Provides information about Windows Firewall with Advanced Security, which is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Firewall with Advanced Security blocks unauthorized network traffic flowing into or out of the local device. |
| [Windows 10 Credential Theft Mitigation Guide Abstract](windows-credential-theft-mitigation-guide-abstract.md) | Learn more about credential theft mitigation in Windows 10. |
redirect_url: https://docs.microsoft.com/windows/security/identity-protection/
---

8
windows/application-management/apps-in-windows-10.md
View File

@ -117,7 +117,7 @@ Here are the typical provisioned Windows apps in Windows 10 versions 1607, 1703,
| Get Skype/Skype (preview)/Skype | Microsoft.SkypeApp | x | x | x | Yes |
| Get Started/Tips | Microsoft.Getstarted | x | x | x | Yes |
| Groove | Microsoft.ZuneMusic | x | x | x | No |
| Mail and Calendar | Microsoft.windows communicationsapps | x | x | x | No |
| Mail and Calendar | microsoft.windowscommunicationsapps | x | x | x | No |
| Maps | Microsoft.WindowsMaps | x | x | x | No |
| Messaging | Microsoft.Messaging | x | x | x | No |
| Microsoft 3D Viewer | Microsoft.Microsoft3DViewer | | x | x | No |
@ -128,11 +128,11 @@ Here are the typical provisioned Windows apps in Windows 10 versions 1607, 1703,
| People | Microsoft.People | x | x | x | No |
| Photos | Microsoft.Windows.Photos | x | x | x | No |
| Print 3D | Microsoft.Print3D | | | x | No |
| Solitaire | Microsoft.Microsoft SolitaireCollection | x | x | x | Yes |
| Solitaire | Microsoft.MicrosoftSolitaireCollection | x | x | x | Yes |
| Sticky Notes | Microsoft.MicrosoftStickyNotes | x | x | x | No |
| Store | Microsoft.WindowsStore | x | x | x | No |
| Sway | Microsoft.Office.Sway | * | * | x | Yes |
| Voice Recorder | Microsoft.SoundRecorder | x | x | x | No |
| Voice Recorder                 | Microsoft.WindowsSoundRecorder        | x   | x   | x   | No                       |
| Wallet | Microsoft.Wallet | | x | x | No |
| Weather | Microsoft.BingWeather | x | x | x | Yes |
| Xbox | Microsoft.XboxApp | x | x | x | No |
@ -143,4 +143,4 @@ Here are the typical provisioned Windows apps in Windows 10 versions 1607, 1703,
| | Microsoft.XboxIdentityProvider | x | x | * | No |
| | Microsoft.XboxSpeech ToTextOverlay | | x | x | No |
\* moved from "provisioned" to "installed" in this version.
\* moved from "provisioned" to "installed" in this version.

10
windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
View File

@ -34,14 +34,18 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se
<a href="" id="clipboardfiletype"></a>**Settings/ClipboardFileType**
<p style="margin-left: 20px">Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
- 0 - Allow text copying.
- 1 - Allow text and image copying.
- 0 - Disables content copying.
- 1 - Allow text copying.
- 2 - Allow image copying.
- 3 - Allow text and image copying.
<a href="" id="clipboardsettings"></a>**Settings/ClipboardSettings**
<p style="margin-left: 20px">This policy setting allows you to decide how the clipboard behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete</p>
- 0 (default) - Completely turns Off the clipboard functionality for the Application Guard.
- 1 - Turns On the clipboard functionality and lets you choose whether to additionally enable copying of certain content from Application Guard into Microsoft Edge and enable copying of certain content from Microsoft Edge into Application Guard.
- 1 - Turns On clipboard operation from an isolated session to the host
- 2 - Turns On clipboard operation from the host to an isolated session
- 3 - Turns On clipboard operation in both the directions
> [!Important]
> Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.

5
windows/configuration/TOC.md
View File

@ -2,9 +2,10 @@
## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
## [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
## [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
## [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
## [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
## [Windows 10 diagnostic data for the Full diagnostic data level](windows-diagnostic-data-1703.md)
## [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
## [Windows 10, version 1709 diagnostic data for the Full telemetry level](windows-diagnostic-data.md)
## [Windows 10, version 1703 diagnostic data for the Full telemetry level](windows-diagnostic-data-1703.md)
## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)
## [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
## [Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md)

245
windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
View File

@ -1,5 +1,5 @@
---
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
description: Learn more about the Windows diagnostic data that is gathered at the basic level.
title: Windows 10, version 1709 basic diagnostic events and fields (Windows 10)
keywords: privacy, diagnostic data
ms.prod: w10
@ -9,7 +9,7 @@ ms.pagetype: security
localizationpriority: high
author: eross-msft
ms.author: lizross
ms.date: 10/26/2017
ms.date: 02/12/2018
---
@ -101,7 +101,7 @@ The following fields are available:
- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
- **seqNum** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue.  The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
- **iKey** Represents an ID for applications or other logical groupings of events.
- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experiences and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
- **os** Represents the operating system name.
- **osVer** Represents the OS version, and its format is OS dependent.
- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
@ -255,7 +255,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.RunContext
"This event indicates what should be expected in the data payload. "
This event indicates what should be expected in the data payload.
The following fields are available:
@ -1604,6 +1604,39 @@ The following fields are available:
- **SocketCount** Number of physical CPU sockets of the machine.
### Census.Security
This event provides information on about security settings used to help keep Windows up-to-date and secure.
- **AvailableSecurityProperties** Enumerates and reports state on the relevant security properties for Device Guard.
- **CGRunning** Is Credential Guard running?
- **DGState** A summary of the Device Guard state.
- **HVCIRunning** Is HVCI running?
- **IsSawGuest** Describes whether the device is running as a Secure Admin Workstation Guest.
- **IsSawHost** Describes whether the device is running as a Secure Admin Workstation Host.
- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
- **SecureBootCapable** Is this device capable of running Secure Boot?
- **VBSState** Is virtualization-based security enabled, disabled, or running?
### Census.Speech
This event is used to gather basic speech settings on the device.
The following fields are available:
- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
- **KWSEnabled** "Cortana setting that represents if a user has enabled the ""Hey Cortana"" keyword spotter (KWS)."
- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
### Census.Storage
This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date.
@ -1614,34 +1647,6 @@ The following fields are available:
- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
### Census.VM
This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
The following fields are available:
- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
- **isVDI** Is the device using Virtual Desktop Infrastructure?
- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#HASH#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#HASH#1 Hypervisors.
- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
### Census.Xbox
This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
The following fields are available:
- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
- **XboxLiveDeviceId** Retrieves the unique device id of the console.
- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
### Census.Userdefault
This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date.
@ -1664,6 +1669,25 @@ The following fields are available:
- **KeyboardInputLanguages** The Keyboard input languages installed on the device.
- **SpeechInputLanguages** The Speech Input languages installed on the device.
### Census.VM
This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
The following fields are available:
- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
- **isVDI** Is the device using Virtual Desktop Infrastructure?
- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#HASH#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#HASH#1 Hypervisors.
- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
### Census.WU
@ -1695,34 +1719,18 @@ The following fields are available:
- **WUPauseState** Retrieves WU setting to determine if updates are paused
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
### Census.Xbox
### Census.Speech
This event is used to gather basic speech settings on the device.
This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
The following fields are available:
- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
- **KWSEnabled** "Cortana setting that represents if a user has enabled the ""Hey Cortana"" keyword spotter (KWS)."
- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
- **XboxLiveDeviceId** Retrieves the unique device id of the console.
- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
### Census.Security
This event provides information on about security settings used to help keep Windows up-to-date and secure.
- **AvailableSecurityProperties** Enumerates and reports state on the relevant security properties for Device Guard.
- **CGRunning** Is Credential Guard running?
- **DGState** A summary of the Device Guard state.
- **HVCIRunning** Is HVCI running?
- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
- **SecureBootCapable** Is this device capable of running Secure Boot?
- **VBSState** Is virtualization-based security enabled, disabled, or running?
## Diagnostic data events
@ -1812,7 +1820,7 @@ The following fields are available:
- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experience and Telemetry component.
- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experiences and Telemetry component.
- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
@ -1990,8 +1998,9 @@ The following fields are available:
This event provides data on the installed Office Add-ins.
- **AddInCLSID** The CLSID key office the Office addin.
- **AddInId** The ID of the Office addin.
- **AddInCLSID** The CLSID key office for the Office addin.
- **AddInId** The identifier of the Office addin.
- **AddinType** The type of the Office addin.
- **BinFileTimestamp** The timestamp of the Office addin.
- **BinFileVersion** The version of the Office addin.
- **Description** The description of the Office addin.
@ -2004,8 +2013,58 @@ This event provides data on the installed Office Add-ins.
- **OfficeArchitecture** The architecture of the addin.
- **OfficeVersion** The Office version for this addin.
- **OutlookCrashingAddin** A boolean value that indicates if crashes have been found for this addin.
- **ProductCompany** The name of the company associated with the Office addin.
- **ProductName** The product name associated with the Office addin.
- **ProductVersion** The version associated with the Office addin.
- **ProgramId** The unique program identifier of the Office addin.
- **Provider** The provider name for this addin.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
This event provides insight data on the installed Office products.
The following fields are available:
- **OfficeApplication** The name of the Office application.
- **OfficeArchitecture** The bitness of the Office application.
- **OfficeVersion** The version of the Office application.
- **Value** The insights collected about this entity.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
This diagnostic event indicates that a new sync is being generated for this object type.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
This event describes various Office settings.
The following fields are available:
- **BrowserFlags** Browser flags for Office-related products.
- **ExchangeProviderFlags** Provider policies for Office Exchange.
- **SharedComputerLicensing** Office shared computer licensing policies.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
Diagnostic event to indicate a new sync is being generated for this object type.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
@ -2036,6 +2095,18 @@ The following fields are available:
- **Validation_x64** Count of files that require additional manual validation for 64-bit issues
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
There are no fields in this event.
### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent
@ -2412,6 +2483,66 @@ This event indicates that a new sync is being generated for this object type.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
This event provides data on the installed Office identifiers.
- **OAudienceData** The Office Audience descriptor.
- **OAudienceId** The Office Audience ID.
- **OMID** The Office machine ID.
- **OPlatform** The Office architecture.
- **OVersion** The Office version
- **OTenantId** The Office 365 Tenant GUID.
- **OWowMID** The Office machine ID.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
This event indicates that a new sync is being generated for this object type.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
This event provides data on the installed Office-related Internet Explorer features.
- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
This event indicates that a new sync is being generated for this object type.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
This event describes the Office products that are installed.
- **OC2rApps** The Office Click-to-Run apps.
- **OC2rSkus** The Office Click-to-Run products.
- **OMsiApps** The Office MSI apps.
- **OProductCodes** The Office MSI product code.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
This event indicates that a new sync is being generated for this object type.
There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
This event indicates that a new sync is being generated for this object type.

10
windows/configuration/change-history-for-configure-windows-10.md
View File

@ -8,13 +8,21 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: high
author: jdeckerms
ms.date: 01/31/2018
ms.date: 02/12/2018
---
# Change history for Configure Windows 10
This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile.
## February 2018
New or changed topic | Description
--- | ---
[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) | Added events and fields that were added in the February update.
[Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added steps for configuring a kiosk in Microsoft Intune.
[Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Updated the instructions for applying a customized Start layout using Microsoft Intune.
## January 2018
New or changed topic | Description

2
windows/configuration/configure-windows-10-taskbar.md
View File

@ -43,7 +43,7 @@ The following example shows how apps will be pinned: Windows default apps to the
3. Apply the layout modification XML file to devices using [Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) or a [provisioning package created in Windows Imaging and Configuration Designer (Windows ICD)](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md).
>[!IMPORTANT]
>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy.
>If you use a provisioning package or import-startlayout to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy.
>
>If you use Group Policy and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use Group Policy and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a [partial Start layout](https://technet.microsoft.com/itpro/windows/manage/customize-and-export-start-layout#configure-a-partial-start-layout), users can make changes to the taskbar and to tile groups not defined in the partial Start layout.

77
windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md
View File

@ -8,7 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: jdeckerms
ms.localizationpriority: medium
ms.date: 11/15/2017
ms.date: 02/08/2018
---
# Customize Windows 10 Start and taskbar with mobile device management (MDM)
@ -45,86 +45,37 @@ Two features enable Start layout control:
 
- In MDM, you set the path to the .xml file that defines the Start layout using an OMA-URI setting, which is based on the [Policy configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=623244).
- In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile.
## <a href="" id="bkmk-domaingpodeployment"></a>Create a policy for your customized Start layout
This example uses Microsoft Intune to configure an MDM policy that applies a customized Start layout. See the documentation for your MDM solution for help in applying the policy.
1. In the Start layout file created when you ran **Export-StartLayout**, replace markup characters with escape characters, and save the file. (You can replace the characters manually or use an online tool.)
1. In the Microsoft Azure portal, search for **Intune** or go to **More services** > **Intune**.
Example of a layout file produced by Export-StartLayout:
2. Select **Device configuration**.
<span codelanguage="XML"></span>
<table>
<colgroup>
<col width="100%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">XML</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left"><pre><code>&lt;LayoutModificationTemplate Version=&quot;1&quot; xmlns=&quot;http://schemas.microsoft.com/Start/2014/LayoutModification&quot;&gt;
&lt;DefaultLayoutOverride&gt;
&lt;StartLayoutCollection&gt;
&lt;defaultlayout:StartLayout GroupCellWidth=&quot;6&quot; xmlns:defaultlayout=&quot;http://schemas.microsoft.com/Start/2014/FullDefaultLayout&quot;&gt;
&lt;start:Group Name=&quot;Life at a glance&quot; xmlns:start=&quot;http://schemas.microsoft.com/Start/2014/StartLayout&quot;&gt;
&lt;start:Tile Size=&quot;2x2&quot; Column=&quot;0&quot; Row=&quot;0&quot; AppUserModelID=&quot;Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge&quot; /&gt;
&lt;start:Tile Size=&quot;2x2&quot; Column=&quot;4&quot; Row=&quot;0&quot; AppUserModelID=&quot;Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI&quot; /&gt;
&lt;start:Tile Size=&quot;2x2&quot; Column=&quot;2&quot; Row=&quot;0&quot; AppUserModelID=&quot;Microsoft.BingWeather_8wekyb3d8bbwe!App&quot; /&gt;
&lt;/start:Group&gt;
&lt;/defaultlayout:StartLayout&gt;
&lt;/StartLayoutCollection&gt;
&lt;/DefaultLayoutOverride&gt;
&lt;/LayoutModificationTemplate&gt;</code></pre></td>
</tr>
</tbody>
</table>
3. Select **Profiles**.
Example of the same layout file with escape characters replacing the markup characters:
4. Select **Create profile**.
```
&amp;lt;wdcml:p xmlns:wdcml=&amp;quot;http://microsoft.com/wdcml&amp;quot;&amp;gt;Example of a layout file produced by Export-StartLayout:&amp;lt;/wdcml:p&amp;gt;&amp;lt;wdcml:snippet xmlns:wdcml=&amp;quot;http://microsoft.com/wdcml&amp;quot;&amp;gt;&amp;lt;![CDATA[&amp;lt;LayoutModificationTemplate Version=&amp;quot;1&amp;quot; xmlns=&amp;quot;http://schemas.microsoft.com/Start/2014/LayoutModification&amp;quot;&amp;gt;
&amp;lt;DefaultLayoutOverride&amp;gt;
&amp;lt;StartLayoutCollection&amp;gt;
&amp;lt;defaultlayout:StartLayout GroupCellWidth=&amp;quot;6&amp;quot; xmlns:defaultlayout=&amp;quot;http://schemas.microsoft.com/Start/2014/FullDefaultLayout&amp;quot;&amp;gt;
&amp;lt;start:Group Name=&amp;quot;Life at a glance&amp;quot; xmlns:start=&amp;quot;http://schemas.microsoft.com/Start/2014/StartLayout&amp;quot;&amp;gt;
&amp;lt;start:Tile Size=&amp;quot;2x2&amp;quot; Column=&amp;quot;0&amp;quot; Row=&amp;quot;0&amp;quot; AppUserModelID=&amp;quot;Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge&amp;quot; /&amp;gt;
&amp;lt;start:Tile Size=&amp;quot;2x2&amp;quot; Column=&amp;quot;4&amp;quot; Row=&amp;quot;0&amp;quot; AppUserModelID=&amp;quot;Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI&amp;quot; /&amp;gt;
&amp;lt;start:Tile Size=&amp;quot;2x2&amp;quot; Column=&amp;quot;2&amp;quot; Row=&amp;quot;0&amp;quot; AppUserModelID=&amp;quot;Microsoft.BingWeather_8wekyb3d8bbwe!App&amp;quot; /&amp;gt;
&amp;lt;/start:Group&amp;gt;
&amp;lt;/defaultlayout:StartLayout&amp;gt;
&amp;lt;/StartLayoutCollection&amp;gt;
&amp;lt;/DefaultLayoutOverride&amp;gt;
&amp;lt;/LayoutModificationTemplate&amp;gt;]]&amp;gt;&amp;lt;/wdcml:snippet&amp;gt;
```
5. Enter a friendly name for the profile.
2. In the Microsoft Intune administration console, click **Policy** &gt; **Add Policy**.
6. Select **Windows 10 and later** for the platform.
3. Under **Windows**, choose a **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy.
7. Select **Device restrictions for the profile type.
4. Enter a name (mandatory) and description (optional) for the policy.
8. Select **Start**.
5. In the **OMA-URI Settings** section, click **Add.**
9. In **Start menu layout**, browse to and select your Start layout XML File.
6. In **Add or Edit OMA-URI Setting**, enter the following information.
10. Select **OK** twice, and then select **Create**.
| Item | Information |
|----|----|
| **Setting name** | Enter a unique name for the OMA-URI setting to help you identify it in the list of settings. |
| **Setting description** | Provide a description that gives an overview of the setting and other relevant information to help you locate it. |
| **Data type** | **String** |
| **OMA-URI (case sensitive)** | **./User/Vendor/MSFT/Policy/Config/Start/StartLayout** |
| **Value** | Paste the contents of the Start layout .xml file that you created. |
11. Assign the profile to a device group.
 
7. Click **OK** to save the setting and return to the **Create Policy** page.
For other MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=623244). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`.
8. Click **Save Policy**.
## Related topics

7
windows/configuration/index.md
View File

@ -22,9 +22,10 @@ Enterprises often need to apply custom configurations to devices for their users
| [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | Use this article to make informed decisions about how you can configure Windows diagnostic data in your organization. |
|[Diagnostic Data Viewer overview](diagnostic-data-viewer-overview.md) |Learn about the categories of diagnostic data your device is sending to Microsoft, along with how it's being used.|
| [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) | Learn about diagnostic data that is collected at the basic level in Windows 10, version 1709. |
|[Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)|Learn about diagnostic data that is collected by Windows Analytics.|
| [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Learn about diagnostic data that is collected at the basic level in Windows 10, version 1703. |
| [Windows 10 diagnostic data for the Full diagnostic data level](windows-diagnostic-data-1703.md) | Learn about the types of data that is collected at the full level in Windows 10, version 1703 and later. |
| [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)| Learn about diagnostic data that is collected at the basic level in Windows 10, version 1703.|
| [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)|Learn about diagnostic data that is collected by Windows Analytics.|
| [Windows 10, version 1709 diagnostic data for the Full telemetry level](windows-diagnostic-data.md) | Learn about diagnostic data that is collected at the full level in Windows 10, version 1709. |
| [Windows 10, version 1703 diagnostic data for the Full telemetry level](windows-diagnostic-data-1703.md) | Learn about diagnostic data that is collected at the full level in Windows 10, version 1703. |
|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)|Learn about Windows 10 and the upcoming GDPR-compliance requirements.|
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. |
| [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | Wi-Fi Sense automatically connects you to Wi-Fi, so you can get online quickly in more places. It can connect you to open Wi-Fi hotspots it knows about through crowdsourcing, or to Wi-Fi networks your contacts have shared with you by using Wi-Fi Sense. The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10. |

71
windows/configuration/lock-down-windows-10-to-specific-apps.md
View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu, security
author: jdeckerms
ms.localizationpriority: high
ms.date: 01/31/2018
ms.date: 02/08/2018
ms.author: jdecker
---
@ -20,21 +20,49 @@ ms.author: jdecker
- Windows 10
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using Microsoft Intune or a provisioning package.
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app.
The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
>[!WARNING]
>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](#policies-set-by-multi-app-kiosk-configuration) are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision).
<span id="intune"/>
## Configure a kiosk in Microsoft Intune
Watch how to use Intune to configure a multi-app kiosk.
>[!VIDEO https://www.microsoft.com/videoplayer/embed/ce9992ab-9fea-465d-b773-ee960b990c4a?autoplay=false]
>[!NOTE]
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
1. [Generate the Start layout for the kiosk device.](#startlayout)
2. In the Microsoft Azure portal, search for **Intune** or go to **More services** > **Intune**.
3. Select **Device configuration**.
4. Select **Profiles**.
5. Select **Create profile**.
6. Enter a friendly name for the profile.
7. Select **Windows 10 and later** for the platform.
8. Select **Device restrictions** for the profile type.
9. Select **Kiosk**.
10. In **Kiosk Mode**, select **Multi app kiosk**.
11. Select **Add** to define a configuration, which specifies the apps that will run and the layout for the Start menu.
12. Enter a friendly name for the configuration.
13. Select an app type, either **Win32 App** for a classic desktop application or **UWP App** for a Universal Windows Platform app.
- For **Win32 App**, enter the fully qualified pathname of the executable, with respect to the device.
- For **UWP App**, enter the Application User Model ID for an installed app.
14. Select whether to enable the taskbar.
15. Browse to and select the Start layout XML file that you generated in step 1.
16. Add one or more accounts. When the account signs in, only the apps defined in the configuration will be available.
17. Select **OK**. You can add additional configurations or finish.
18. Assign the profile to a device group to configure the devices in that group as kiosks.
The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
>[!WARNING]
>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
## Configure a kiosk using a provisioning package
Process:
1. [Create XML file](#create-xml-file)
2. [Add XML file to provisioning package](#add-xml)
@ -46,14 +74,15 @@ Watch how to use a provisioning package to configure a multi-app kiosk.
If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#alternate-methods) or you can configure assigned access using the [MDM Bridge WMI Provider](#bridge).
## Prerequisites
### Prerequisites
- Windows Configuration Designer (Windows 10, version 1709)
- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709
>[!NOTE]
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
## Create XML file
### Create XML file
Let's start by looking at the basic structure of the XML file.
@ -90,7 +119,7 @@ You can start your file by pasting the following XML (or any other examples in t
</AssignedAccessConfiguration>
```
### Profile
#### Profile
A profile section in the XML has the following entries:
@ -103,7 +132,7 @@ A profile section in the XML has the following entries:
- [**Taskbar**](#taskbar)
#### Id
##### Id
The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
@ -113,7 +142,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can
</Profiles>
```
#### AllowedApps
##### AllowedApps
**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps.
@ -155,7 +184,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula
</AllAppsList>
```
#### StartLayout
##### StartLayout
After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen.
@ -202,7 +231,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint,
![What the Start screen looks like when the XML sample is applied](images/sample-start.png)
#### Taskbar
##### Taskbar
Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
@ -221,7 +250,7 @@ The following example hides the taskbar:
>[!NOTE]
>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden.
### Configs
#### Configs
Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
@ -256,7 +285,7 @@ Before applying the multi-app configuration, make sure the specified user accoun
<span id="add-xml" />
## Add XML file to provisioning package
### Add XML file to provisioning package
Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md#xsd-for-assignedaccess-configuration-xml).
@ -317,12 +346,12 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
15. Copy the provisioning package to the root directory of a USB drive.
<span id="apply-ppkg" />
## Apply provisioning package to device
### Apply provisioning package to device
Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime").
### During initial setup, from a USB drive
#### During initial setup, from a USB drive
1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**.
@ -346,7 +375,7 @@ Provisioning packages can be applied to a device during the first-run experience
### After setup, from a USB drive, network folder, or SharePoint site
#### After setup, from a USB drive, network folder, or SharePoint site
1. Sign in with an admin account.
2. Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install.
@ -365,7 +394,7 @@ Provisioning packages can be applied to a device during the first-run experience
<span id="alternate-methods" />
## Use MDM to deploy the multi-app configuration
### Use MDM to deploy the multi-app configuration
Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.

3
windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
View File

@ -32,7 +32,8 @@ A single-use or *kiosk* device is easy to set up in Windows 10 for desktop edit
- For a kiosk device to run a Classic Windows application, use [Shell Launcher](#shell-launcher) to set a custom user interface as the shell (Windows 10 Enterprise or Education only).
To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access).
>[!TIP]
>To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access).
>[!NOTE]
>A Universal Windows app is built on the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. A Classic Windows application uses the Classic Windows Platform (CWP) (e.g., COM, Win32, WPF, WinForms, etc.) and is typically launched using an .EXE or .DLL file.

2
windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
View File

@ -51,7 +51,7 @@ The following policy settings can be configured for UE-V.
<td align="left"><p>The default is enabled.</p></td>
</tr>
<tr class="odd">
<td align="left"><p>Roam Windows settings</p></td>
<td align="left"><p>Synchronize Windows settings</p></td>
<td align="left"><p>Computers and Users</p></td>
<td align="left"><p>This Group Policy setting configures the synchronization of Windows settings.</p></td>
<td align="left"><p>Select which Windows settings synchronize between computers.</p>

1
windows/configuration/wcd/wcd-cellcore.md
View File

@ -425,6 +425,7 @@ The following table shows the scenarios supported by this customization:
Multivariant setting set?|SPN provisioned?|MSISDN (last 4 digits: 1234, for example) provisioned?|Default SIM name
--- | --- | --- | ---
Yes|Yes|Yes|*MultivariantProvisionedSPN*1234 or *MultivariantProvisionedSPN*" "1234
Yes|No|No|*MultivariantProvisionedSPN* (up to 16 characters)
Yes|Yes|No|*MultivariantProvisionedSPN* (up to 16 characters)

4
windows/configuration/windows-diagnostic-data-1703.md
View File

@ -8,13 +8,13 @@ ms.sitesec: library
ms.localizationpriority: high
author: eross-msft
ms.author: lizross
ms.date: 04/05/2017
ms.date: 11/28/2017
---
# Windows 10 diagnostic data for the Full diagnostic data level
**Applies to:**
- Windows 10, version 1703 and later
- Windows 10, version 1703
Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md).

262
windows/configuration/windows-diagnostic-data.md Normal file
View File

@ -0,0 +1,262 @@
---
title: Windows 10, version 1709 diagnostic data for the Full level (Windows 10)
description: Use this article to learn about the types of diagnostic data that is collected at the Full level.
keywords: privacy,Windows 10
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.localizationpriority: high
author: brianlic-msft
ms.author: brianlic
ms.date: 01/30/2018
---
# Windows 10, version 1709 diagnostic data for the Full level
Applies to:
- Windows 10, version 1709
Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md).
In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard.
The data covered in this article is grouped into the following types:
- Common data (diagnostic header information)
- Device, Connectivity, and Configuration data
- Product and Service Usage data
- Product and Service Performance data
- Software Setup and Inventory data
- Browsing History data
- Inking, Typing, and Speech Utterance data
## Common data
Most diagnostic events contain a header of common data. In each example, the info in parentheses provides the equivalent definition for ISO/IEC 19944:2017.
**Data Use for Common data**
Header data supports the use of data associated with all diagnostic events. Therefore, Common data is used to [provide](#provide) Windows 10, and may be used to [improve](#improve), [personalize](#personalize), [recommend](#recommend), [offer](#offer), or [promote](#promote) Microsoft and third-party products and services, depending on the uses described in the **Data Use** statements for each data category.
### Data Description for Common data type
|Sub-type|Description and examples|
|- |- |
|Common Data|Information that is added to most diagnostic events, if relevant and available:<ul><li>Diagnostic level -- Basic or Full, Sample level -- for sampled data, what sample level is this device opted into (8.2.3.2.4 Observed Usage of the Service Capability)</li><li>Operating system name, version, build, and locale (8.2.3.2.2 Telemetry data)</li><li>Event collection time (8.2.3.2.2 Telemetry data)</li><li>User ID -- a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic diagnostic data (8.2.5 Account data)</li><li>Xbox UserID (8.2.5 Account data)</li><li>Device ID -- This is not the user provided device name, but an ID that is unique for that device. (8.2.3.2.3 Connectivity data)</li><li>Device class -- Desktop, Server, or Mobile (8.2.3.2.3 Connectivity data)</li><li>Environment from which the event was logged -- Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time, such as the amount of time an app is running or between boots of the operating system (8.2.4 Cloud service provider data)</li><li>Diagnostic event name, Event ID, ETW opcode, version, schema signature, keywords, and flags (8.2.4 Cloud service provider data)</li><li>HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service (8.2.4 Cloud service provider data)</li><li>Various IDs that are used to correlate and sequence related events together (8.2.4 Cloud service provider data)</li></ul>|
## Device, Connectivity, and Configuration data
This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration Data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.3 Connectivity data.
### Data Use for Device, Connectivity, and Configuration data
**For Diagnostics:**<br>
[Pseudonymized](#pseudo) Device, Connectivity, and Configuration data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft products and services. For example:
- Device, Connectivity, and Configuration data is used to understand the unique device characteristics that can contribute to an error experienced on the device, to identify patterns, and to more quickly resolve problems that impact devices with unique hardware, capabilities, or settings. For example:
- Data about the use of cellular modems and their configuration on your devices is used to troubleshoot cellular modem issues.
- Data about the use of USB hubs use and their configuration on your devices is used to troubleshoot USB hub issues.
- Data about the use of connected Bluetooth devices is used to troubleshoot compatibility issues with Bluetooth devices.
- Data about device properties, such as the operating system version and available memory, is used to determine whether the device is due to, and able to, receive a Windows update.
- Data about device peripherals is used to determine whether a device has installed drivers that might be negatively impacted by a Windows update.
- Data about which devices, peripherals, and settings are most-used by customers, is used to prioritize Windows 10 improvements to determine the greatest positive impact to the most Windows 10 users.
**With (optional) Tailored experiences:**<br>
If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseudo) Device, Connectivity, and Configuration data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [Pseudonymized](#pseudo) Device, Connectivity, and Configuration data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example:
- Data about device properties and capabilities is used to provide tips about how to use or configure the device to get the best performance and user experience.
- Data about device capabilities, such as whether the device is pen-enabled, is used to recommend (Microsoft and third-party) apps that are appropriate for the device. These may be free or paid apps.
 
### Data Description for Device, Connectivity, and Configuration data type
|Sub-type|Description and examples|
|- |- |
|Device properties |Information about the operating system and device hardware, such as:<br><ul><li>Operating system - version name, edition</li><li>Installation type, subscription status, and genuine operating system status</li><li>Processor architecture, speed, number of cores, manufacturer, and model</li><li>OEM details --manufacturer, model, and serial number</li><li>Device identifier and Xbox serial number</li><li>Firmware/BIOS operating system -- type, manufacturer, model, and version</li><li>Memory -- total memory, video memory, speed, and how much memory is available after the device has reserved memory</li><li>Storage -- total capacity and disk type</li><li>Battery -- charge capacity and InstantOn support</li><li>Hardware chassis type, color, and form factor</li><li>Is this a virtual machine?</li></ul>|
|Device capabilities|Information about the specific device capabilities, such as:<br/><ul><li>Camera -- whether the device has a front facing camera, a rear facing camera, or both.</li><li>Touch screen -- Whether the device has a touch screen? If yes, how many hardware touch points are supported?</li><li>Processor capabilities -- CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2</li><li>Trusted Platform Module (TPM) -- whether a TPM exists and if yes, what version</li><li>Virtualization hardware -- whether an IOMMU exists, whether it includes SLAT support, and whether virtualization is enabled in the firmware</li><li>Voice -- whether voice interaction is supported and the number of active microphones</li><li>Number of displays, resolutions, and DPI</li><li>Wireless capabilities</li><li>OEM or platform face detection</li><li>OEM or platform video stabilization and quality-level set</li><li>Advanced Camera Capture mode (HDR versus Low Light), OEM versus platform implementation, HDR probability, and Low Light probability</li></ul>|
|Device preferences and settings |Information about the device settings and user preferences, such as:<br><ul><li>User Settings -- System, Device, Network &amp; Internet, Personalization, Cortana, Apps, Accounts, Time &amp; Language, Gaming, Ease of Access, Privacy, Update &amp; Security</li><li>User-provided device name</li><li>Whether device is domain-joined, or cloud-domain joined (for example, part of a company-managed network)</li><li>Hashed representation of the domain name</li><li>MDM (mobile device management) enrollment settings and status</li><li>BitLocker, Secure Boot, encryption settings, and status</li><li>Windows Update settings and status</li><li>Developer Unlock settings and status</li><li>Default app choices</li><li>Default browser choice</li><li>Default language settings for app, input, keyboard, speech, and display</li><li>App store update settings</li><li>Enterprise OrganizationID, Commercial ID</li></ul>|
|Device peripherals |Information about the device peripherals, such as:<br><ul><li>Peripheral name, device model, class, manufacturer, and description</li><li>Peripheral device state, install state, and checksum</li><li>Driver name, package name, version, and manufacturer</li><li>HWID - A hardware vendor-defined ID to match a device to a driver [INF file](https://msdn.microsoft.com/windows/hardware/drivers/install/hardware-ids)</li><li>Driver state, problem code, and checksum</li><li>Whether driver is kernel mode, signed, and image size</li></ul>|
|Device network info |Information about the device network configuration, such as:<br><ul><li>Network system capabilities</li><li>Local or Internet connectivity status</li><li>Proxy, gateway, DHCP, DNS details, and addresses</li><li>Whether it's a paid or free network</li><li>Whether the wireless driver is emulated</li><li>Whether it's access point mode-capable</li><li>Access point manufacturer, model, and MAC address</li><li>WDI Version</li><li>Name of networking driver service</li><li>Wi-Fi Direct details</li><li>Wi-Fi device hardware ID and manufacturer</li><li>Wi-Fi scan attempt and item counts</li><li>Whether MAC randomization is supported and enabled</li><li>Number of supported spatial streams and channel frequencies</li><li>Whether Manual or Auto-connect is enabled</li><li>Time and result of each connection attempt</li><li>Airplane mode status and attempts</li><li>Interface description provided by the manufacturer</li><li>Data transfer rates</li><li>Cipher algorithm</li><li>Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)</li><li>Mobile operator and service provider name</li><li>Available SSIDs and BSSIDs</li><li>IP Address type -- IPv4 or IPv6</li><li>Signal Quality percentage and changes</li><li>Hotspot presence detection and success rate</li><li>TCP connection performance</li><li>Miracast device names</li><li>Hashed IP address</li></ul>
## Product and Service Usage data
This type of data includes details about the usage of the device, operating system, applications and services. Product and Service Usage data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.4 Observed Usage of the Service Capability.
### Data Use for Product and Service Usage data
**For Diagnostics:**<br>
[Pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example:
- Data about the specific apps that are in-use when an error occurs is used to troubleshoot and repair issues with Windows features and Microsoft apps.
- Data about the specific apps that are most-used by customers, is used to prioritize Windows 10 improvements to determine the greatest positive impact to the most Windows 10 users.
- Data about whether devices have Suggestions turned off from the **Settings Phone** screen is to improve the Suggestions feature.
- Data about whether a user canceled the authentication process in their browser is used to help troubleshoot issues with and improve the authentication process.
- Data about when and what feature invoked Cortana is used to prioritize efforts for improvement and innovation in Cortana.
- Data about when a context menu in the photo app is closed is used to troubleshoot and improve the photo app.
**With (optional) Tailored experiences:**<br>
If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example:
- If data shows that a user has not used a particular feature of Windows, we may recommend that the user try that feature.
- Data about which apps are most-used on a device is used to provide recommendations for similar or complementary (Microsoft or third-party) apps. These may be free or paid apps.
### Data Description for Product and Service Usage data type
|Sub-type|Description and examples |
|- |- |
|App usage|Information about Windows and application usage, such as:<ul><li>Operating system component and app feature usage</li><li>User navigation and interaction with app and Windows features. This could potentially include user input, such as name of a new alarm set, user menu choices, or user favorites</li><li>Time of and count of app and component launches, duration of use, session GUID, and process ID</li><li>App time in various states –- running in the foreground or background, sleeping, or receiving active user interaction</li><li>User interaction method and duration –- whether the user used a keyboard, mouse, pen, touch, speech, or game controller, and for how long</li><li>Cortana launch entry point and reason</li><li>Notification delivery requests and status</li><li>Apps used to edit images and videos</li><li>SMS, MMS, VCard, and broadcast message usage statistics on primary or secondary lines</li><li>Incoming and outgoing calls and voicemail usage statistics on primary or secondary lines</li><li>Emergency alerts are received or displayed statistics</li><li>Content searches within an app</li><li>Reading activity -- bookmarked, printed, or had the layout changed</li></ul>|
|App or product state|Information about Windows and application state, such as:<ul><li>Start Menu and Taskbar pins</li><li>Online and offline status</li><li>App launch state –- with deep-links, such as Groove launching with an audio track to play or MMS launching to share a picture</li><li>Personalization impressions delivered</li><li>Whether the user clicked on, or hovered over, UI controls or hotspots</li><li>User provided feedback, such as Like, Dislike or a rating</li><li>Caret location or position within documents and media files -- how much has been read in a book in a single session, or how much of a song has been listened to.</li></ul>|
|Purchasing|Information about purchases made on the device, such as:<br><ul><li>Product ID, edition ID and product URI</li><li>Offer details -- price</li><li>Date and time an order was requested</li><li>Microsoft Store client type -- web or native client</li><li>Purchase quantity and price</li><li>Payment type -- credit card type and PayPal</li></ul> |
|Login properties|Information about logins on the device, such as:<ul><li>Login success or failure</li><li>Login sessions and state</li></ul>|
## Product and Service Performance data
This type of data includes details about the health of the device, operating system, apps, and drivers. Product and Service Performance data is equivalent to ISO/IEC 19944:2017 8.2.3.2.2 EUII Telemetry data.
### Data Use for Product and Service Performance data
**For Diagnostics:**<br>
[Pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example:
- Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/en-us/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations.
- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening peformance.
- Timing data about how quickly the facial recognition feature starts up and finishes is used to improve facial recognition performance.
- Data about when an Application Window fails to appear is used to investigate issues with Application Window reliability and performance.
**With (optional) Tailored experiences:**<br>
If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users.
- Data about battery performance on a device may be used to recommend settings changes that can improve battery performance.
- If data shows a device is running low on file storage, we may recommend Windows-compatible cloud storage solutions to free up space.
- If data shows the device is experiencing performance issues, we may provide recommendations for Windows apps that can help diagnose or resolve these issues. These may be free or paid apps.
**Microsoft doesn't use crash and hang dump data to [personalize](#personalize), [recommend](#recommend), [offer](#offer), or [promote](#promote) any product or service.**
### Data Description for Product and Service Performance data type
|Sub-type|Description and examples |
|- |- |
|Device health and crash data|Information about the device and software health, such as:<br><ul><li>Error codes and error messages, name and ID of the app, and process reporting the error</li><li>DLL library predicted to be the source of the error -- for example, xyz.dll</li><li>System generated files -- app or product logs and trace files to help diagnose a crash or hang</li><li>System settings, such as registry keys</li><li>User generated files -- files that are indicated as a potential cause for a crash or hang. For example, .doc, .ppt, .csv files</li><li>Details and counts of abnormal shutdowns, hangs, and crashes</li><li>Crash failure data -- operating system, operating system component, driver, device, and 1st and 3rd-party app data</li><li>Crash and hang dumps, including:<ul><li>The recorded state of the working memory at the point of the crash</li><li>Memory in-use by the kernel at the point of the crash.</li><li>Memory in-use by the application at the point of the crash</li><li>All the physical memory used by Windows at the point of the crash</li><li>Class and function name within the module that failed.</li></li></ul>|
|Device performance and reliability data|Information about the device and software performance, such as:<br><ul><li>User interface interaction durations -- Start menu display times, browser tab switch times, app launch and switch times, and Cortana and Search performance and reliability</li><li>Device on and off performance -- Device boot, shutdown, power on and off, lock and unlock times, and user authentication times (fingerprint and face recognition durations)</li><li>In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction</li><li>User input responsiveness -- onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score</li><li>UI and media performance and glitches versus smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance</li><li>Disk footprint -- Free disk space, out of memory conditions, and disk score</li><li>Excessive resource utilization -- components impacting performance or battery life through high CPU usage during different screen and power states</li><li>Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results</li><li>Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness, and environmental response times</li><li>Device setup -- first setup experience times (time to install updates, install apps, connect to network, and so on), time to recognize connected devices (printer and monitor), and time to set up a Microsoft Account</li><li>Power and Battery life -- power draw by component (Process/CPU/GPU/Display), hours of time the screen is off, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use while the screen is off, auto-brightness details, time device is plugged into AC versus battery, and battery state transitions</li><li>Service responsiveness -- Service URI, operation, latency, service success and error codes, and protocol</li><li>Diagnostic heartbeat -- regular signal used to validate the health of the diagnostics system</li></ul>|
|Movies|Information about movie consumption functionality on the device. This isn't intended to capture user viewing, listening, or habits.<ul><li>Video Width, height, color palette, encoding (compression) type, and encryption type</li><li>Instructions about how to stream content for the user -- the smooth streaming manifest of content file chunks that must be pieced together to stream the content based on screen resolution and bandwidth</li><li>URL for a specific two-second chunk of content if there is an error</li><li>Full-screen viewing mode details</li></ul>|
|Music &amp; TV|Information about music and TV consumption on the device. This isn't intended to capture user viewing, listening, or habits.<ul><li>Service URL for song being downloaded from the music service -- collected when an error occurs to facilitate restoration of service</li><li>Content type (video, audio, or surround audio)</li><li>Local media library collection statistics -- number of purchased tracks and number of playlists</li><li>Region mismatch -- User's operating system region and Xbox Live region</li></ul>|
|Reading|Information about reading consumption functionality on the device. This isn't intended to capture user viewing, listening, or habits.<ul><li>App accessing content and status and options used to open a Microsoft Store book</li><li>Language of the book</li><li>Time spent reading content</li><li>Content type and size details</li></ul>|
|Photos App|Information about photos usage on the device. This isn't intended to capture user viewing, listening, or habits.<ul><li>File source data -- local, SD card, network device, and OneDrive</li><li>Image and video resolution, video length, file sizes types, and encoding</li><li>Collection view or full screen viewer use and duration of view</li></ul>|
|On-device file query |Information about local search activity on the device, such as: <ul><li>Kind of query issued and index type (ConstraintIndex or SystemIndex)</li><li>Number of items requested and retrieved</li><li>File extension of search result with which the user interacted</li><li>Launched item type, file extension, index of origin, and the App ID of the opening app</li><li>Name of process calling the indexer and the amount of time to service the query</li><li>A hash of the search scope (file, Outlook, OneNote, or IE history). The state of the indices (fully optimized, partially optimized, or being built)</li></ul> |
|Entitlements |Information about entitlements on the device, such as:<ul><li>Service subscription status and errors</li><li>DRM and license rights details -- Groove subscription or operating system volume license</li><li>Entitlement ID, lease ID, and package ID of the install package</li><li>Entitlement revocation</li><li>License type (trial, offline versus online) and duration</li><li>License usage session</li></ul>|
## Software Setup and Inventory data
This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a sub-type of ISO/IEC 19944:2017 8.2.3.2.4 Observed Usage of the Service Capability.
### Data Use for Software Setup and Inventory data
**For Diagnostics:**<br>
[Pseudonymized](#pseudo) Software Setup and Inventory data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example:
- Data about the specific drivers that are installed on a device is used to understand whether there are any hardware or driver compatibility issues which should block or delay a Windows update.
- Data about when a download starts and finishes on a device is used to understand and address download problems.
- Data about the specific Microsoft Store apps that are installed on a device is used to determine which app updates to provide to the device.
- Data about the antimalware installed on a device is used to understand malware transmissions vectors.
**With (optional) Tailored experiences:**<br>
If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Software Setup and Inventory data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Software Setup and Inventory data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example:
- Data about the specific apps that are installed on a device is used to provide recommendations for similar or complementary apps in the Microsoft Store.
### Data Description for Software Setup and Inventory data type
|Sub-type|Description and examples |
|- |- |
|Installed Applications and Install History|Information about apps, drivers, update packages, or operating system components installed on the device, such as:<ul><li>App, driver, update package, or component’s Name, ID, or Package Family Name</li><li>Product, SKU, availability, catalog, content, and Bundle IDs</li><li>Operating system component, app or driver publisher, language, version and type (Win32 or UWP)</li><li>Install date, method, install directory, and count of install attempts</li><li>MSI package and product code</li><li>Original operating system version at install time</li><li>User, administrator, or mandatory installation or update</li><li>Installation type -- clean install, repair, restore, OEM, retail, upgrade, or update</li></ul>|
|Device update information |Information about Windows Update, such as:<ul><li>Update Readiness analysis of device hardware, operating system components, apps, and drivers (progress, status, and results)</li><li>Number of applicable updates, importance, and type</li><li>Update download size and source -- CDN or LAN peers</li><li>Delay upgrade status and configuration</li><li>Operating system uninstall and rollback status and count</li><li>Windows Update server and service URL</li><li>Windows Update machine ID</li><li>Windows Insider build details</li></ul>|
## Browsing History data
This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944:2017 8.2.3.2.8 Client side browsing history.
### Data Use for Browsing History data
**For Diagnostics:**<br>
[Pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example:
- Data about when the **Block Content** dialog box has been shown is used for investigations of blocked content.
- Data about potentially abusive or malicious domains is used to make updates to Microsoft Edge and Windows Defender SmartScreen to warn users about the domain.
- Data about when the **Address** bar is used for navigation purposes is used to improve the Suggested Sites feature and to understand and address problems arising from navigation.
- Data about when a Web Notes session starts is used to measure popular domains and URLs for the Web Notes feature.
- Data about when a default **Home** page is changed by a user is used to measure which default **Home** pages are the most popular and how often users change the default **Home** page.
**With (optional) Tailored experiences:**<br>
If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example:
- We may recommend that a user download a compatible app from the Microsoft Store if they have browsed to the related website. For example, if a user uses the Facebook website, we may recommend the Facebook app.
### Data Description for Browsing History data type
|Sub-type|Description and examples |
|- |- |
|Microsoft browser data|Information about **Address** bar and **Search** box performance on the device, such as:<ul><li>Text typed in **Address** bar and **Search** box</li><li>Text selected for an **Ask Cortana** search</li><li>Service response time</li><li>Auto-completed text, if there was an auto-complete</li><li>Navigation suggestions provided based on local history and favorites</li><li>Browser ID</li><li>URLs (may include search terms)</li><li>Page title</li></ul>|
## Inking Typing and Speech Utterance data
This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing and Speech Utterance data is a sub-type of ISO/IEC 19944:2017 8.2.3.2.1 End User Identifiable information.
### Data Use for Inking, Typing, and Speech Utterance data
**For Diagnostics:**<br>
[Anonymized](#anon) Inking, Typing, and Speech Utterance data from Windows 10 is used by Microsoft to [improve](#improve) natural language capabilities in Microsoft products and services. For example:
- Data about words marked as spelling mistakes and replaced with another word from the context menu is used to improve the spelling feature.
- Data about alternate words shown and selected by the user after right-clicking is used to improve the word recommendation feature.
- Data about auto-corrected words that were restored back to the original word by the user is used to improve the auto-correct feature.
- Data about whether Narrator detected and recognized a touch gesture is used to improve touch gesture recognition.
- Data about handwriting samples sent from the Handwriting Panel is used to help Microsoft improve handwriting recognition.
**With (optional) Tailored experiences:**
**Microsoft doesn't use Windows Inking, Typing, and Speech Utterance data for Tailored experiences.**
### Data Description for Inking, Typing, and Speech Utterance data type
|Sub-type|Description and examples |
|- |- |
|Voice, inking, and typing|Information about voice, inking and typing features, such as:<ul><li>Type of pen used (highlighter, ball point, or pencil), pen color, stroke height and width, and how long it is used</li><li>Pen gestures (click, double click, pan, zoom, or rotate)</li><li>Palm Touch x,y coordinates</li><li>Input latency, missed pen signals, number of frames, strokes, first frame commit time, and sample rate</li><li>Ink strokes written, text before and after the ink insertion point, recognized text entered, input language -- processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values), which could be used to reconstruct the original content or associate the input to the user</li><li>Text input from Windows 10 Mobile on-screen keyboards, except from password fields and private sessions -- processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values), which could be used to reconstruct the original content or associate the input to the user</li><li>Text of speech recognition results -- result codes and recognized text</li><li>Language and model of the recognizer and the System Speech language</li><li>App ID using speech features</li><li>Whether user is known to be a child</li><li>Confidence and success or failure of speech recognition</li></ul>|
## ISO/IEC 19944:2017-specific terminology
This table provides the ISO/IEC 19944:2017-specific definitions for use and de-identification qualifiers used in this article.
|Term |ISO/IEC 19944:2017 Reference |Microsoft usage notes |
|-|-|-|
|<a name="#provide">Provide</a> |9.3.2 Provide |Use of a specified data category by a Microsoft product or service to protect and provide the described service, including, (i) troubleshoot and fix issues with the product or service or (ii) provide product or service updates.|
|<a name="#improve">Improve</a> |9.3.3 Improve |Use of a specified data category to improve or increase the quality of a Microsoft product or service. Those improvements may be available to end users.|
|<a name="#personalize">Personalize</a> |9.3.4 Personalize |Use of the specified data categories to create a customized experience for the end user in any Microsoft product or service.|
|<a name="#recommend">Recommend</a> |9.3.4 Personalize |“Recommend” means use of the specified data categories to Personalize (9.3.4) the end user’s experience by recommending Microsoft products or services that can be accessed without the need to make a purchase or pay money.<br><br>Use of the specified data categories give recommendations about Microsoft products or services the end user may act on where the recommendation is (i) contextually relevant to the product or service in which it appears, (ii) that can be accessed without the need to make a purchase or pay money, and (iii) Microsoft receives no compensation for the placement.|
|<a name="#offer">Offer</a> |9.3.5 Offer upgrades or upsell |Implies the source of the data is Microsoft products and services, and the upgrades offered come from Microsoft products and services that are relevant to the context of the current capability. The target audience for the offer is Microsoft customers.<br><br>Specifically, use of the specified data categories to make an offer or upsell new capability or capacity of a Microsoft product or service which is (i) contextually relevant to the product or service in which it appears; (ii) likely to result in additional future revenue for Microsoft from end user; and (iii) Microsoft receives no consideration for placement.|
|<a name="#promote">Promote</a>|9.3.6 Market/advertise/promote|Use of the specified data categories to promote a product or service in or on a first-party Microsoft product or service.|
<br><br>
|Data identification qualifiers |ISO/IEC 19944:2017 Reference |Microsoft usage notes |
|-|-|-|
|<a name="#pseudo">Pseudonymized Data</a> |8.3.3 Pseudonymized data|As defined|
|<a name="#anon">Anonymized Data</a> |8.3.5 Anonymized data|As defined|
|<a name="#aggregate">Aggregated Data</a> |8.3.6 Aggregated data|As defined|

17
windows/deployment/mbr-to-gpt.md
View File

@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: deploy
author: greg-lindsay
ms.date: 10/27/2017
ms.date: 02/13/2018
ms.localizationpriority: high
---
@ -70,7 +70,7 @@ If any of these checks fails, the conversion will not proceed and an error will
|/disk:\<diskNumber\>| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as that used by the diskpart.exe tool **SELECT DISK SYSTEM** command.|
|/logs:\<logDirectory\>| Specifies the directory where MBR2GPT.exe logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.|
|/map:\<source\>=\<destination\>| Specifies additional partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexidecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. |
|/allowFullOS| By default, MBR2GPT.exe is blocked unless it is run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.|
|/allowFullOS| By default, MBR2GPT.exe is blocked unless it is run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment. <br>**Note**: Since the existing MBR system partition is in use while running the full Windows environment, it cannot be reused. In this case, a new ESP is created by shrinking the OS partition.|
## Examples
@ -236,15 +236,18 @@ The following steps illustrate high-level phases of the MBR-to-GPT conversion pr
For Windows to remain bootable after the conversion, an EFI system partition (ESP) must be in place. MBR2GPT creates the ESP using the following rules:
1. The existing MBR system partition is reused if it meets these requirements:
a. It is not also the OS or Windows Recovery Environment partition
b. It is at least 100MB (or 260MB for 4K sector size disks) in size
c. It is less than or equal to 1GB in size. This is a safety precaution to ensure it is not a data partition.
d. If the conversion is being performed from the full OS, the disk being converted is not the system disk.
1. The existing MBR system partition is reused if it meets these requirements:<br>
a. It is not also the OS or Windows Recovery Environment partition.<br>
b. It is at least 100MB (or 260MB for 4K sector size disks) in size.<br>
c. It is less than or equal to 1GB in size. This is a safety precaution to ensure it is not a data partition.<br>
d. The conversion is not being performed from the full OS. In this case, the existing MBR system partition is in use and cannot be repurposed.
2. If the existing MBR system partition cannot be reused, a new ESP is created by shrinking the OS partition. This new partition has a size of 100MB (or 260MB for 4K sector size disks) and is formatted FAT32.
If the existing MBR system partition is not reused for the ESP, it is no longer used by the boot process after the conversion. Other partitions are not modified.
>[!IMPORTANT]
>If the existing MBR system partition is not reused for the ESP, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter.
### Partition type mapping and partition attributes
Since GPT partitions use a different set of type IDs than MBR partitions, each partition on the converted disk must be assigned a new type ID. The partition type mapping follows these rules:

BIN
windows/deployment/update/images/SAC_vid_crop.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 20 KiB

BIN
windows/deployment/update/images/UC-vid-crop.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 37 KiB

10
windows/deployment/update/update-compliance-monitor.md
View File

@ -6,9 +6,9 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: deploy
author: DaniHalfin
ms.author: daniha
ms.date: 10/13/2017
author: Jaimeo
ms.author: jaimeo
ms.date: 02/09/2018
---
# Monitor Windows Updates and Windows Defender Antivirus with Update Compliance
@ -35,9 +35,9 @@ See the following topics in this guide for detailed information about configurin
- [Get started with Update Compliance](update-compliance-get-started.md): How to add Update Compliance to your environment.
- [Using Update Compliance](update-compliance-using.md): How to begin using Update Compliance.
<iframe width="560" height="315" align="center" src="https://www.youtube.com/embed/1cmF5c_R8I4" frameborder="0" allowfullscreen></iframe>
Click the following link to see a video demonstrating Update Compliance features.
An overview of the processes used by the Update Compliance solution is provided below.
[![YouTube video demonstrating Update Compliance](images/UC-vid-crop.jpg)](https://www.youtube.com/embed/1cmF5c_R8I4)
## Update Compliance architecture

11
windows/deployment/update/waas-overview.md
View File

@ -4,10 +4,10 @@ description: In Windows 10, Microsoft has streamlined servicing to make operatin
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
author: DaniHalfin
author: Jaimeo
ms.localizationpriority: high
ms.author: daniha
ms.date: 10/16/2017
ms.author: jaimeo
ms.date: 02/09/2018
---
# Overview of Windows as a service
@ -23,7 +23,10 @@ ms.date: 10/16/2017
The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
<iframe width="560" height="315" align="center" src="https://www.youtube.com/embed/qSAsiM01GOU" frameborder="0" allowfullscreen></iframe>
Click the following Microsoft Mechanics video for an overview of the release model, particularly the Semi-Annual Channel.
[![YouTube video of Michael Niehouse explaining how the Semi-Annual Channel works](images/SAC_vid_crop.jpg)](https://youtu.be/qSAsiM01GOU)
## Building

11
windows/deployment/update/waas-quick-start.md
View File

@ -4,10 +4,10 @@ description: In Windows 10, Microsoft has streamlined servicing to make operatin
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
author: DaniHalfin
author: Jaimeo
ms.localizationpriority: high
ms.author: daniha
ms.date: 07/27/2017
ms.author: jaimeo
ms.date: 02/09/2018
---
# Quick guide to Windows as a service
@ -58,7 +58,10 @@ See [Build deployment rings for Windows 10 updates](waas-deployment-rings-window
## Video: An overview of Windows as a service
<iframe width="560" height="315" src="https://www.youtube.com/embed/qSAsiM01GOU" frameborder="0" allowfullscreen></iframe>
Click the following Microsoft Mechanics video for an overview of the updated release model, particularly the Semi-Annual Channel.
[![YouTube video of Michael Niehouse explaining how the Semi-Annual Channel works](images/SAC_vid_crop.jpg)](https://youtu.be/qSAsiM01GOU)
## Learn more

3
windows/deployment/upgrade/upgrade-readiness-get-started.md
View File

@ -57,7 +57,6 @@ If you are not using OMS:
5. To add the Upgrade Readiness solution to your workspace, go to the **Solutions Gallery**. Select the **Upgrade Readiness** tile in the gallery and then select **Add** on the solution’s details page. The solution is now visible on your workspace. Note that you may need to scroll to find Upgrade Readiness.
### Copy your commercial ID key
Microsoft uses a unique commercial ID to map information from user computers to your OMS workspace. This should be generated for you automatically. Copy your commercial ID key in OMS and then deploy it to user computers.
@ -85,7 +84,7 @@ To enable data sharing, whitelist the following endpoints. Note that you may nee
| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Telemetry component endpoint for Windows 10 computers. User computers send data to Microsoft through this endpoint.
| `https://vortex-win.data.microsoft.com` | Connected User Experience and Telemetry component endpoint for operating systems older than Windows 10
| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft.
| `https://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. |
| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. |
Note: The compatibility update KB runs under the computer’s system account.

6
windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
View File

@ -35,7 +35,7 @@ The following color-coded status changes are reflected on the upgrade overview b
Click on a row to drill down and see details about individual computers. If KBs are missing, see [Deploy the compatibility update and related KBs](upgrade-readiness-get-started.md#deploy-the-compatibility-update-and-related-kbs) for information on required KBs.
In the following example, there is no delay in data processing, less than 4% of computers (6k\294k) have incomplete data, there are no pending user changes, and the currently selected target OS version is the same as the recommended version:
In the following example, there is no delay in data processing, more than 10% of computers (6k\8k) have incomplete data, more than 30% of computers (6k/8k) require a KB update, there are no pending user changes, and the currently selected target OS version is the same as the recommended version:
![Upgrade overview](../images/ur-overview.png)
@ -43,9 +43,9 @@ In the following example, there is no delay in data processing, less than 4% of
<img src="media/image3.png" width="214" height="345" />
-->
If data processing is delayed, you can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed. Data is typically refreshed and the display will return to normal again within 24 hours.
If data processing is delayed, the "Last updated" banner will indicate the date on which data was last updated. You can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed until data is refreshed. When your workspace is in this state, there is no action required; data is typically refreshed and the display will return to normal again within 24 hours.
If there are computers with incomplete data, verify that you have installed the latest compatibilty update and run the most recent [Update Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the Microsoft download center.
If there are computers with incomplete data, verify that you have installed the latest compatibilty update KBs. Install the updated KBs if necessary and then run the most recent [Update Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the Microsoft download center. The updated data payload should appear in Upgrade Readiness within 48 hours of a successful run on the deployment script.
Select **Total computers** for a list of computers and details about them, including:

37
windows/deployment/upgrade/windows-10-edition-upgrades.md
View File

@ -8,7 +8,7 @@ ms.localizationpriority: high
ms.sitesec: library
ms.pagetype: mobile
author: greg-lindsay
ms.date: 01/18/2018
ms.date: 02/9/2018
---
# Windows 10 edition upgrade
@ -20,7 +20,7 @@ ms.date: 01/18/2018
With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md).
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. Note that the reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
![not supported](../images/x_blk.png) (X) = not supported</br>
![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required</br>
@ -46,25 +46,28 @@ X = unsupported <BR>
| **Home > Pro for Workstations** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) |
| **Home > Pro Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Home > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **S > Pro** | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![supported, no reboot](../images/check_blu.png) (version 1709) |
| **S > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![supported, no reboot](../images/check_blu.png) (version 1709) |
| **S > Pro Education** | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) (version 1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![not supported](../images/x_blk.png) |
| **S > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **S > Enterprise** | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) (version 1703 - PC), (version 1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) (version 1709) | ![not supported](../images/x_blk.png) |
| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) |
| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)) (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) (version 1703 - PC), (version 1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) (MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)) (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) (version 1703 - PC), (version 1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)) (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)) (MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **S > Pro** | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![supported, no reboot](../images/check_blu.png) <br>(1709) |
| **S > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![supported, no reboot](../images/check_blu.png) <br>(1709) |
| **S > Pro Education** | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) <br>(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![not supported](../images/x_blk.png) |
| **S > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) <br>(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **S > Enterprise** | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![not supported](../images/x_blk.png) | ![supported, no reboot](../images/check_blu.png) <br>(1703 - PC)<br>(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) <br>(1709) | ![not supported](../images/x_blk.png) |
| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) <br>(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) |
| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) <br>(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) <br>(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) <br>(1703 - PC)<br>(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) <br>(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) <br>(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) <br>(1703 - PC)<br>(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) <br>(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) <br>(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Enterprise LTSC > Enterprise** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) <br>(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) |
| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) <br>(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) |
| **Mobile > Mobile Enterprise** | ![supported, no reboot](../images/check_blu.png) |![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) |
> [!NOTE]
> Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods.
> <br>
> <br>Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates.
## Upgrade using mobile device management (MDM)
- To upgrade desktop editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithProductKey** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907).

55
windows/deployment/upgrade/windows-10-upgrade-paths.md
View File

@ -20,14 +20,16 @@ ms.date: 01/18/2018
This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md).
>**Windows 10 LTSB**: The upgrade paths displayed below do not apply to Windows 10 LTSB. In-place upgrade from Windows 7 or Windows 8.1 to Windows 10 LTSB is not supported. (Note that Windows 10 LTSB 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSB 2016 release, which will now only allow data-only and clean install options.)
>**Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions.
>In-place upgrade from Windows 7, Windows 8.1, or Windows 10 semi-annual channel to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later.
>**Windows N/KN**: Windows "N" and "KN" SKUs follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
✔ = Full upgrade is supported including personal data, settings, and applications.<BR>
D = Edition downgrade; personal data is maintained, applications and settings are removed.
<table border="1" cellpadding="3">
<table border="0" cellpadding="1">
<tr>
<td>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
<td></td>
@ -36,6 +38,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>Windows 10 Pro Education</td>
<td>Windows 10 Education</td>
<td>Windows 10 Enterprise</td>
<td>Windows 10 Enterprise LTSC</td>
<td>Windows 10 Mobile</td>
<td>Windows 10 Mobile Enterprise</td>
</tr>
@ -51,6 +54,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Home Basic</td>
@ -61,6 +65,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Home Premium</td>
@ -71,6 +76,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional</td>
@ -81,6 +87,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Ultimate</td>
@ -91,6 +98,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Enterprise</td>
@ -101,6 +109,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="8" nowrap="nowrap">Windows 8</td>
@ -114,6 +123,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional</td>
@ -124,6 +134,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional WMC</td>
@ -134,6 +145,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Enterprise</td>
@ -144,6 +156,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Embedded Industry</td>
@ -154,6 +167,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows RT</td>
@ -164,6 +178,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows Phone 8</td>
@ -174,6 +189,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td rowspan="10" nowrap="nowrap">Windows 8.1</td>
@ -187,6 +203,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Connected</td>
@ -197,6 +214,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional</td>
@ -207,6 +225,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional Student</td>
@ -217,6 +236,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional WMC</td>
@ -227,6 +247,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Enterprise</td>
@ -237,6 +258,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Embedded Industry</td>
@ -247,6 +269,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows RT</td>
@ -257,6 +280,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows Phone 8.1</td>
@ -265,11 +289,12 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
<td>✔</td>
<td></td>
</tr>
<tr>
<td rowspan="7" nowrap="nowrap">Windows 10</td>
<td rowspan="8" nowrap="nowrap">Windows 10</td>
</tr>
<tr>
<td>Home</td>
@ -280,6 +305,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Professional</td>
@ -290,6 +316,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Education</td>
@ -300,6 +327,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>D</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Enterprise</td>
@ -310,6 +338,18 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td>✔</td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>Enterprise LTSC</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>✔</td>
<td>✔</td>
<td></td>
<td></td>
</tr>
<tr>
<td>Mobile</td>
@ -318,6 +358,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
<td>✔</td>
<td>✔</td>
</tr>
@ -328,16 +369,18 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
<td></td>
<td></td>
<td></td>
<td></td>
<td>D</td>
<td>✔</td>
</tr>
</table>
## Related Topics
[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)<BR>
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
 
[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)<br>
[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)<br>
[Windows 10 edition upgrade](windows-10-edition-upgrades.md)

2
windows/deployment/windows-10-enterprise-subscription-activation.md
View File

@ -68,7 +68,7 @@ With Windows 10 Enterprise, businesses can benefit from enterprise-level securit
You can benefit by moving to Windows as an online service in the following ways:
1. Licenses for Windows 10 Enterprise are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization.
2. Azure AD logon triggers a silent edition upgrade, with no reboot required
2. User logon triggers a silent edition upgrade, with no reboot required
3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys.
4. Compliance support via seat assignment.

52
windows/device-security/change-history-for-device-security.md
View File

@ -1,52 +0,0 @@
---
title: Change history for device security (Windows 10)
description: This topic lists new and updated topics in the Windows 10 device security documentation for Windows 10 and Windows 10 Mobile.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
ms.date: 11/27/2017
---
# Change history for device security
This topic lists new and updated topics in the [Device security](index.md) documentation.
## November 2017
|New or changed topic |Description |
|---------------------|------------|
| [How to enable virtualization-based protection of code integrity](enable-virtualization-based-protection-of-code-integrity.md)| New. Explains how to enable HVCI. |
## October 2017
|New or changed topic |Description |
|---------------------|------------|
| [TPM fundamentals](tpm/tpm-fundamentals.md)<br>[BitLocker Group Policy settings](bitlocker/bitlocker-group-policy-settings.md) | Explained the change to allow reducing the maximum PIN length from 6 characters to 4. |
| [Windows security baselines](windows-security-baselines.md) | New. Security baselines added for Windows 10, versions 1703 and 1709. |
| [Security Compliance Toolkit](security-compliance-toolkit-10.md) | New. Includes a link to tools for managing security baselines. |
| [Get support for security baselines](get-support-for-security-baselines.md) | New. Explains supported versions for security baselines and other support questions. |
## August 2017
|New or changed topic |Description |
|---------------------|------------|
| [BitLocker: Management recommendations for enterprises](bitlocker/bitlocker-management-for-enterprises.md) | New BitLocker security topic. |
| [Accounts: Block Microsoft accounts](security-policy-settings/accounts-block-microsoft-accounts.md) | Revised description |
## July 2017
|New or changed topic |Description |
|---------------------|------------|
| [How Windows 10 uses the Trusted Platform Module](tpm/how-windows-uses-the-tpm.md) | New TPM security topic. |
## May 2017
|New or changed topic |Description |
|---------------------|------------|
| [BitLocker Group Policy settings](bitlocker/bitlocker-group-policy-settings.md) | Changed startup PIN minimun length from 4 to 6. |
| [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) | New security policy setting. |
## March 2017
|New or changed topic |Description |
|---------------------|------------|
|[Requirements and deployment planning guidelines for Device Guard](device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md) | Updated to include additional security qualifications starting with Windows 10, version 1703.|

28
windows/device-security/index.md
View File

@ -1,27 +1,3 @@
---
title: Device Security (Windows 10)
description: Learn more about how to help secure your Windows 10 and Windows 10 Mobile devices.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
ms.date: 04/24/2017
---
# Device Security
Learn more about how to help secure your Windows 10 and Windows 10 Mobile devices.
| Section | Description |
|-|-|
| [AppLocker](applocker/applocker-overview.md)| Describes AppLocker, and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.|
| [BitLocker](bitlocker/bitlocker-overview.md)| Provides information about BitLocker, which is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. |
| [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) | Learn more about protecting high-value assets. |
| [Device Guard deployment guide](device-guard/device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. |
| [Encrypted Hard Drive](encrypted-hard-drive.md) | Provides information about Encrypted Hard Drive, which uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.|
| [Security auditing](auditing/security-auditing-overview.md)| Describes how the IT professional can use the security auditing features in Windows, and how organizations can benefit from using these technologies, to enhance the security and manageability of networks.|
| [Security policy settings](security-policy-settings/security-policy-settings.md)| Provides a collection of reference topics that describe the common scenarios, architecture, and processes for security settings.|
| [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Provides links to information about the Trusted Platform Module (TPM), which is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. |
| [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) | Learn more about securing your Windows 10 Mobile devices. |
| [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. |
redirect_url: https://docs.microsoft.com/windows/security/threat-protection/
---

6
windows/hub/TOC.md
View File

@ -5,8 +5,8 @@
## [Configuration](/windows/configuration)
## [Client management](/windows/client-management)
## [Application management](/windows/application-management)
## [Access protection](/windows/access-protection)
## [Device security](/windows/device-security)
## [Threat protection](/windows/threat-protection)
## [Identity and access management](/windows/security/identity-protection)
## [Information protection](/windows/security/information-protection)
## [Threat protection](/windows/security/threat-protection)
## [Troubleshooting](/windows/client-management/windows-10-support-solutions)
## [Other Windows client versions](https://docs.microsoft.com/previous-versions/windows)

67
windows/hub/breadcrumb/toc.yml
View File

@ -6,31 +6,42 @@
tocHref: /windows
topicHref: /windows/windows-10
items:
- name: What's new
tocHref: /windows/whats-new/
topicHref: /windows/whats-new/index
- name: Configuration
tocHref: /windows/configuration/
topicHref: /windows/configuration/index
- name: Deployment
tocHref: /windows/deployment/
topicHref: /windows/deployment/index
- name: Application management
tocHref: /windows/application-management/
topicHref: /windows/application-management/index
- name: Client management
tocHref: /windows/client-management/
topicHref: /windows/client-management/index
items:
- name: Mobile Device Management
tocHref: /windows/client-management/mdm
topicHref: /windows/client-management/mdm/index
- name: Access protection
tocHref: /windows/access-protection/
topicHref: /windows/access-protection/index
- name: Device security
tocHref: /windows/device-security/
topicHref: /windows/device-security/index
- name: Threat protection
tocHref: /windows/threat-protection/
topicHref: /windows/threat-protection/index
- name: What's new
tocHref: /windows/whats-new/
topicHref: /windows/whats-new/index
- name: Configuration
tocHref: /windows/configuration/
topicHref: /windows/configuration/index
- name: Deployment
tocHref: /windows/deployment/
topicHref: /windows/deployment/index
- name: Application management
tocHref: /windows/application-management/
topicHref: /windows/application-management/index
- name: Client management
tocHref: /windows/client-management/
topicHref: /windows/client-management/index
items:
- name: Mobile Device Management
tocHref: /windows/client-management/mdm/
topicHref: /windows/client-management/mdm/index
- name: Security
tocHref: /windows/security/
topicHref: /windows/security/index
items:
- name: Identity and access protection
tocHref: /windows/security/identity-protection/
topicHref: /windows/security/identity-protection/index
items:
- name: Windows Hello for Business
tocHref: /windows/security/identity-protection/hello-for-business
topicHref: /windows/security/identity-protection/hello-for-business/hello-identity-verification
- name: Threat protection
tocHref: /windows/security/threat-protection/
topicHref: /windows/security/threat-protection/index
- name: Information protection
tocHref: /windows/security/information-protection/
topicHref: /windows/security/information-protection/index
- name: Hardware-based protection
tocHref: /windows/security/hardware-protection/
topicHref: /windows/security/hardware-protection/index

6
windows/security/TOC.md
View File

@ -1 +1,5 @@
# [Index](index.md)
# [Security](index.yml)
## [Identity and access management](identity-protection/index.md)
## [Threat protection](threat-protection/index.md)
## [Information protection](information-protection/index.md)
## [Hardware-based protection](hardware-protection/index.md)

6
windows/security/docfx.json
View File

@ -20,7 +20,8 @@
{
"files": [
"**/*.png",
"**/*.jpg"
"**/*.jpg",
"**/*.gif"
],
"exclude": [
"**/obj/**",
@ -35,8 +36,7 @@
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
"ms.technology": "windows",
"ms.topic": "article",
"ms.author": "justinha",
"extendBreadcrumb": true
"ms.author": "justinha"
},
"fileMetadata": {},
"template": [],

21
windows/security/hardware-protection/TOC.md Normal file
View File

@ -0,0 +1,21 @@
# [Hardware-based protection](index.md)
## [Encrypted Hard Drive](encrypted-hard-drive.md)
## [How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md)
## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)
## [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)
### [Trusted Platform Module Overview](tpm/trusted-platform-module-overview.md)
### [TPM fundamentals](tpm/tpm-fundamentals.md)
### [How Windows 10 uses the TPM](tpm/how-windows-uses-the-tpm.md)
### [TPM Group Policy settings](tpm/trusted-platform-module-services-group-policy-settings.md)
### [Back up the TPM recovery information to AD DS](tpm/backup-tpm-recovery-information-to-ad-ds.md)
### [Manage TPM commands](tpm/manage-tpm-commands.md)
### [Manage TPM lockout](tpm/manage-tpm-lockout.md)
### [Change the TPM owner password](tpm/change-the-tpm-owner-password.md)
### [View status, clear, or troubleshoot the TPM](tpm/initialize-and-configure-ownership-of-the-tpm.md)
### [Understanding PCR banks on TPM 2.0 devices](tpm/switch-pcr-banks-on-tpm-2-0-devices.md)
### [TPM recommendations](tpm/tpm-recommendations.md)

0
windows/device-security/encrypted-hard-drive.md → windows/security/hardware-protection/encrypted-hard-drive.md
View File

0
windows/threat-protection/how-hardware-based-containers-help-protect-windows.md → windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md
View File

0
windows/threat-protection/images/application-guard-and-system-guard.png → windows/security/hardware-protection/images/application-guard-and-system-guard.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 40 KiB

After

Width:  |  Height:  |  Size: 40 KiB

0
windows/threat-protection/images/dn168167.boot_process(en-us,MSDN.10).png → windows/security/hardware-protection/images/dn168167.boot_process(en-us,MSDN.10).png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 38 KiB

After

Width:  |  Height:  |  Size: 38 KiB

0
windows/threat-protection/images/dn168167.measure_boot(en-us,MSDN.10).png → windows/security/hardware-protection/images/dn168167.measure_boot(en-us,MSDN.10).png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 14 KiB

After

Width:  |  Height:  |  Size: 14 KiB

0
windows/threat-protection/images/traditional-windows-software-stack.png → windows/security/hardware-protection/images/traditional-windows-software-stack.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 33 KiB

After

Width:  |  Height:  |  Size: 33 KiB

0
windows/threat-protection/images/windows-defender-system-guard.png → windows/security/hardware-protection/images/windows-defender-system-guard.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 69 KiB

After

Width:  |  Height:  |  Size: 69 KiB

21
windows/security/hardware-protection/index.md Normal file
View File

@ -0,0 +1,21 @@
---
title: Hardware-based Protection (Windows 10)
description: Learn more about how to help protect against threats in Windows 10 and Windows 10 Mobile.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
ms.date: 02/05/2018
---
# Hardware-based protection
Windows 10 leverages these hardware-based security features to protect and maintain system integrity.
| Section | Description |
|-|-|
| [Encrypted Hard Drive](encrypted-hard-drive.md) | Provides information about Encrypted Hard Drive, which uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.|
|[How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) |Learn about how hardware-based containers can isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.|
|[Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) |Learn about the Windows 10 security features that help to protect your PC from malware, including rootkits and other applications.|
| [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Provides links to information about the Trusted Platform Module (TPM), which is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. |

0
windows/threat-protection/secure-the-windows-10-boot-process.md → windows/security/hardware-protection/secure-the-windows-10-boot-process.md
View File

0
windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md → windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md
View File

0
windows/device-security/tpm/change-the-tpm-owner-password.md → windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md
View File

0
windows/device-security/tpm/how-windows-uses-the-tpm.md → windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md
View File

0
windows/device-security/tpm/images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png → windows/security/hardware-protection/tpm/images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 90 KiB

After

Width:  |  Height:  |  Size: 90 KiB

0
windows/device-security/tpm/images/tpm-capabilities.png → windows/security/hardware-protection/tpm/images/tpm-capabilities.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 88 KiB

After

Width:  |  Height:  |  Size: 88 KiB

0
windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md → windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md
View File

0
windows/device-security/tpm/manage-tpm-commands.md → windows/security/hardware-protection/tpm/manage-tpm-commands.md
View File

0
windows/device-security/tpm/manage-tpm-lockout.md → windows/security/hardware-protection/tpm/manage-tpm-lockout.md
View File

0
windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md → windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
View File

0
windows/device-security/tpm/tpm-fundamentals.md → windows/security/hardware-protection/tpm/tpm-fundamentals.md
View File

0
windows/device-security/tpm/tpm-recommendations.md → windows/security/hardware-protection/tpm/tpm-recommendations.md
View File

0
windows/device-security/tpm/trusted-platform-module-overview.md → windows/security/hardware-protection/tpm/trusted-platform-module-overview.md
View File

0
windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md → windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md
View File

0
windows/device-security/tpm/trusted-platform-module-top-node.md → windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md
View File

5
windows/access-protection/TOC.md → windows/security/identity-protection/TOC.md
View File

@ -1,4 +1,4 @@
# [Access protection](access-control/access-control.md)
# [Identity and access management](index.md)
## [Access Control Overview](access-control/access-control.md)
### [Dynamic Access Control Overview](access-control/dynamic-access-control.md)
@ -17,6 +17,8 @@
## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md)
## [How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md)
## [Protect derived domain credentials with Credential Guard](credential-guard/credential-guard.md)
### [How Credential Guard works](credential-guard/credential-guard-how-it-works.md)
### [Credential Guard Requirements](credential-guard/credential-guard-requirements.md)
@ -65,6 +67,7 @@
### [VPN auto-triggered profile options](vpn\vpn-auto-trigger-profile.md)
### [VPN security features](vpn\vpn-security-features.md)
### [VPN profile options](vpn\vpn-profile-options.md)
### [How to configure Diffie Hellman protocol over IKEv2 VPN connections](vpn\how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md)
### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md)

Some files were not shown because too many files have changed in this diff Show More