From a5eb49416ffeb18810b3fb0a43999ee7a99e0f2a Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 17 Mar 2023 16:46:44 -0400
Subject: [PATCH 01/64] Remove unreleased SurfaceHub policies

---
 .../client-management/mdm/surfacehub-csp.md   | 163 +-----------------
 1 file changed, 1 insertion(+), 162 deletions(-)

diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md
index 1925bbdccc..c16d7da169 100644
--- a/windows/client-management/mdm/surfacehub-csp.md
+++ b/windows/client-management/mdm/surfacehub-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/17/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -28,10 +28,6 @@ The SurfaceHub configuration service provider (CSP) is used to configure Microso
 The following list shows the SurfaceHub configuration service provider nodes:
 
 - ./Vendor/MSFT/SurfaceHub
-  - [AutopilotSelfdeploy](#autopilotselfdeploy)
-    - [FriendlyName](#autopilotselfdeployfriendlyname)
-    - [Password](#autopilotselfdeploypassword)
-    - [UserPrincipalName](#autopilotselfdeployuserprincipalname)
   - [DeviceAccount](#deviceaccount)
     - [CalendarSyncEnabled](#deviceaccountcalendarsyncenabled)
     - [DomainName](#deviceaccountdomainname)
@@ -93,163 +89,6 @@ The following list shows the SurfaceHub configuration service provider nodes:
     - [VtcAppPackageId](#propertiesvtcapppackageid)
 <!-- SurfaceHub-Tree-End -->
 
-<!-- Device-AutopilotSelfdeploy-Begin -->
-## AutopilotSelfdeploy
-
-<!-- Device-AutopilotSelfdeploy-Applicability-Begin -->
-| Scope | Editions | Applicable OS |
-|:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
-<!-- Device-AutopilotSelfdeploy-Applicability-End -->
-
-<!-- Device-AutopilotSelfdeploy-OmaUri-Begin -->
-```Device
-./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy
-```
-<!-- Device-AutopilotSelfdeploy-OmaUri-End -->
-
-<!-- Device-AutopilotSelfdeploy-Description-Begin -->
-<!-- Description-Source-DDF -->
-Node for setting Autopilot self-deployment mode device account information. This information is stored and committed by the Autopilot client during the Enrollment Status Page phase of OOBE for Surface Hub devices that are using Autopilot self-deploying mode. These values should be set only during the first sync phase of enrollment and are ignored at any other time.
-<!-- Device-AutopilotSelfdeploy-Description-End -->
-
-<!-- Device-AutopilotSelfdeploy-Editable-Begin -->
-<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-Editable-End -->
-
-<!-- Device-AutopilotSelfdeploy-DFProperties-Begin -->
-**Description framework properties**:
-
-| Property name | Property value |
-|:--|:--|
-| Format | node |
-| Access Type | Get |
-| Case Sensitive | True |
-<!-- Device-AutopilotSelfdeploy-DFProperties-End -->
-
-<!-- Device-AutopilotSelfdeploy-Examples-Begin -->
-<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-Examples-End -->
-
-<!-- Device-AutopilotSelfdeploy-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Begin -->
-### AutopilotSelfdeploy/FriendlyName
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Applicability-Begin -->
-| Scope | Editions | Applicable OS |
-|:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Applicability-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-OmaUri-Begin -->
-```Device
-./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/FriendlyName
-```
-<!-- Device-AutopilotSelfdeploy-FriendlyName-OmaUri-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Description-Begin -->
-<!-- Description-Source-DDF -->
-The device friendly name set during Autopilot self-deploying mode on Surface Hub. Get is allowed here but only returns a blank.
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Description-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Editable-Begin -->
-<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Editable-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-DFProperties-Begin -->
-**Description framework properties**:
-
-| Property name | Property value |
-|:--|:--|
-| Format | chr (string) |
-| Access Type | Get, Replace |
-<!-- Device-AutopilotSelfdeploy-FriendlyName-DFProperties-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Examples-Begin -->
-<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-FriendlyName-Examples-End -->
-
-<!-- Device-AutopilotSelfdeploy-FriendlyName-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-Begin -->
-### AutopilotSelfdeploy/Password
-
-<!-- Device-AutopilotSelfdeploy-Password-Applicability-Begin -->
-| Scope | Editions | Applicable OS |
-|:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
-<!-- Device-AutopilotSelfdeploy-Password-Applicability-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-OmaUri-Begin -->
-```Device
-./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/Password
-```
-<!-- Device-AutopilotSelfdeploy-Password-OmaUri-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-Description-Begin -->
-<!-- Description-Source-DDF -->
-Password for the device account. Get is allowed here, but will always return a blank.
-<!-- Device-AutopilotSelfdeploy-Password-Description-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-Editable-Begin -->
-<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-Password-Editable-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-DFProperties-Begin -->
-**Description framework properties**:
-
-| Property name | Property value |
-|:--|:--|
-| Format | chr (string) |
-| Access Type | Get, Replace |
-<!-- Device-AutopilotSelfdeploy-Password-DFProperties-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-Examples-Begin -->
-<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-Password-Examples-End -->
-
-<!-- Device-AutopilotSelfdeploy-Password-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Begin -->
-### AutopilotSelfdeploy/UserPrincipalName
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Applicability-Begin -->
-| Scope | Editions | Applicable OS |
-|:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Applicability-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-OmaUri-Begin -->
-```Device
-./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/UserPrincipalName
-```
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-OmaUri-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Description-Begin -->
-<!-- Description-Source-DDF -->
-User principal name (UPN) of the device account. Autopilot on Surface Hub only supports Azure Active Directory, and this should specify the UPN of the device account. Get is allowed here but only returns a blank.
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Description-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Editable-Begin -->
-<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Editable-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-DFProperties-Begin -->
-**Description framework properties**:
-
-| Property name | Property value |
-|:--|:--|
-| Format | chr (string) |
-| Access Type | Get, Replace |
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-DFProperties-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Examples-Begin -->
-<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-Examples-End -->
-
-<!-- Device-AutopilotSelfdeploy-UserPrincipalName-End -->
-
 <!-- Device-DeviceAccount-Begin -->
 ## DeviceAccount
 

From e9df2acc54321f72407baa8dcd5de14292411558 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 17 Mar 2023 17:37:19 -0400
Subject: [PATCH 02/64] Update Surface Hub applicability article

---
 ...-in-policy-csp-supported-by-surface-hub.md | 625 +++++++++++++++---
 1 file changed, 536 insertions(+), 89 deletions(-)

diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index ce20ebe3db..dda5d64123 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -1,99 +1,546 @@
 ---
-title: Policies in Policy CSP supported by Microsoft Surface Hub
-description: Learn about the policies in Policy CSP supported by Microsoft Surface Hub.
-ms.reviewer:
+title: Policies in Policy CSP supported by Surface Hub
+description: Learn about the policies in Policy CSP supported by Surface Hub.
+author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.topic: article
+ms.date: 03/17/2023
+ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
-author: vinaypamnani-msft
-ms.localizationpriority: medium
-ms.date: 07/22/2020
+ms.topic: reference
 ---
 
-# Policies in Policy CSP supported by Microsoft Surface Hub
+<!-- Auto-Generated CSP Document -->
 
-- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#allowappstoreautoupdate)
-- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#allowdeveloperunlock)
-- [Accounts/AllowMicrosoftAccountConnection](./policy-csp-accounts.md#allowmicrosoftaccountconnection)
-- [Camera/AllowCamera](policy-csp-camera.md#allowcamera)
-- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#showappcellularaccessui)
-- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#allowfipsalgorithmpolicy)
-- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#tlsciphersuites)
-- [Defender/AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning)
-- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring)
-- [Defender/AllowCloudProtection](policy-csp-defender.md#allowcloudprotection)
-- [Defender/AllowEmailScanning](policy-csp-defender.md#allowemailscanning)
-- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives)
-- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning)
-- [Defender/AllowIOAVProtection](policy-csp-defender.md#allowioavprotection)
-- [Defender/AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection)
-- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring)
-- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles)
-- [Defender/AllowScriptScanning](policy-csp-defender.md#allowscriptscanning)
-- [Defender/AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess)
-- [Defender/AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor)
-- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware)
-- [Defender/ExcludedExtensions](policy-csp-defender.md#excludedextensions)
-- [Defender/ExcludedPaths](policy-csp-defender.md#excludedpaths)
-- [Defender/ExcludedProcesses](policy-csp-defender.md#excludedprocesses)
-- [Defender/PUAProtection](policy-csp-defender.md#puaprotection)
-- [Defender/RealTimeScanDirection](policy-csp-defender.md#realtimescandirection)
-- [Defender/ScanParameter](policy-csp-defender.md#scanparameter)
-- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime)
-- [Defender/ScheduleScanDay](policy-csp-defender.md#schedulescanday)
-- [Defender/ScheduleScanTime](policy-csp-defender.md#schedulescantime)
-- [Defender/SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval)
-- [Defender/SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent)
-- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction)
-- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#doabsolutemaxcachesize)
-- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#doallowvpnpeercaching)
-- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#dodownloadmode)
-- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#dogroupid)
-- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#domaxcacheage)
-- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#domaxcachesize)
-- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated)
-- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated)
-- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#dominbackgroundqos)
-- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#domindisksizeallowedtopeer)
-- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#dominfilesizetocache)
-- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#dominramallowedtopeer)
-- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#domodifycachedrive)
-- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#domonthlyuploaddatacap)
-- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated)
-- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#preventuserredirectionofprofilefolders)
-- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md#configuregroupmembership)
-- [System/AllowLocation](policy-csp-system.md#allowlocation)
-- [System/AllowStorageCard](policy-csp-system.md#allowstoragecard)
-- [System/AllowTelemetry](policy-csp-system.md#allowtelemetry)
-- [TextInput/AllowIMELogging](policy-csp-textinput.md#allowimelogging)
-- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#allowimenetworkaccess)
-- [TextInput/AllowInputPanel](policy-csp-textinput.md#allowinputpanel)
-- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#allowjapaneseimesurrogatepaircharacters)
-- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#allowjapaneseivscharacters)
-- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#allowjapanesenonpublishingstandardglyph)
-- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#allowjapaneseuserdictionary)
-- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#allowlanguagefeaturesuninstall)
-- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#excludejapaneseimeexceptjis0208)
-- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc)
-- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis)
-- [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#configuretimezone)
-- [Wifi/AllowInternetSharing](policy-csp-wifi.md#allowinternetsharing)
-- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#allowmanualwificonfiguration)
-- [Wifi/AllowWiFi](policy-csp-wifi.md#allowwifi)
-- [Wifi/AllowWiFiHotSpotReporting](policy-csp-wifi.md) (Deprecated)
-- [Wifi/WLANScanMode](policy-csp-wifi.md#wlanscanmode)
-- [Wifi/AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect)
-- [WirelessDisplay/AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement)
-- [WirelessDisplay/AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#allowmdnsdiscovery)
-- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay.md#allowprojectionfrompc)
-- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectionfrompcoverinfrastructure)
-- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay.md#allowprojectiontopc)
-- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectiontopcoverinfrastructure)
-- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#allowuserinputfromwirelessdisplayreceiver)
-- [WirelessDisplay/RequirePinForPairing](policy-csp-wirelessdisplay.md#requirepinforpairing)
+# Policies in Policy CSP supported by Surface Hub
 
-## Related topics
+This article lists the policies in Policy CSP that are applicable for Surface Hub.
 
-[Policy CSP](policy-configuration-service-provider.md)
+## Accounts
+
+- [AllowMicrosoftAccountConnection](policy-csp-accounts.md)
+
+## ApplicationDefaults
+
+- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md)
+
+## ApplicationManagement
+
+- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md)
+- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md)
+
+## Authentication
+
+- [AllowEAPCertSSO](policy-csp-authentication.md)
+- [AllowFastReconnect](policy-csp-authentication.md)
+- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md)
+- [AllowAadPasswordReset](policy-csp-authentication.md)
+- [EnableWebSignIn](policy-csp-authentication.md)
+- [EnableFastFirstSignIn](policy-csp-authentication.md)
+
+## Bluetooth
+
+- [Bluetooth](policy-csp-bluetooth.md)
+- [AllowAdvertising](policy-csp-bluetooth.md)
+- [AllowDiscoverableMode](policy-csp-bluetooth.md)
+- [AllowPrepairing](policy-csp-bluetooth.md)
+- [AllowPromptedProximalConnections](policy-csp-bluetooth.md)
+- [LocalDeviceName](policy-csp-bluetooth.md)
+- [ServicesAllowedList](policy-csp-bluetooth.md)
+- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md)
+
+## Browser
+
+- [AllowAddressBarDropdown](policy-csp-browser.md)
+- [AllowAutofill](policy-csp-browser.md)
+- [AllowBrowser](policy-csp-browser.md)
+- [AllowCookies](policy-csp-browser.md)
+- [AllowDeveloperTools](policy-csp-browser.md)
+- [AllowDoNotTrack](policy-csp-browser.md)
+- [AllowFlashClickToRun](policy-csp-browser.md)
+- [AllowMicrosoftCompatibilityList](policy-csp-browser.md)
+- [AllowPasswordManager](policy-csp-browser.md)
+- [AllowPopups](policy-csp-browser.md)
+- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md)
+- [AllowSmartScreen](policy-csp-browser.md)
+- [ClearBrowsingDataOnExit](policy-csp-browser.md)
+- [ConfigureAdditionalSearchEngines](policy-csp-browser.md)
+- [DisableLockdownOfStartPages](policy-csp-browser.md)
+- [EnterpriseModeSiteList](policy-csp-browser.md)
+- [HomePages](policy-csp-browser.md)
+- [PreventSmartScreenPromptOverride](policy-csp-browser.md)
+- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md)
+- [PreventLiveTileDataCollection](policy-csp-browser.md)
+- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md)
+- [SetDefaultSearchEngine](policy-csp-browser.md)
+- [AllowAddressBarDropdown](policy-csp-browser.md)
+- [AllowAutofill](policy-csp-browser.md)
+- [AllowBrowser](policy-csp-browser.md)
+- [AllowCookies](policy-csp-browser.md)
+- [AllowDeveloperTools](policy-csp-browser.md)
+- [AllowDoNotTrack](policy-csp-browser.md)
+- [AllowFlashClickToRun](policy-csp-browser.md)
+- [AllowMicrosoftCompatibilityList](policy-csp-browser.md)
+- [AllowPasswordManager](policy-csp-browser.md)
+- [AllowPopups](policy-csp-browser.md)
+- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md)
+- [AllowSmartScreen](policy-csp-browser.md)
+- [ClearBrowsingDataOnExit](policy-csp-browser.md)
+- [ConfigureAdditionalSearchEngines](policy-csp-browser.md)
+- [DisableLockdownOfStartPages](policy-csp-browser.md)
+- [EnterpriseModeSiteList](policy-csp-browser.md)
+- [HomePages](policy-csp-browser.md)
+- [PreventSmartScreenPromptOverride](policy-csp-browser.md)
+- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md)
+- [PreventLiveTileDataCollection](policy-csp-browser.md)
+- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md)
+- [SetDefaultSearchEngine](policy-csp-browser.md)
+
+## Camera
+
+- [Camera](policy-csp-camera.md)
+- [AllowCamera](policy-csp-camera.md)
+
+## Connectivity
+
+- [AllowBluetooth](policy-csp-connectivity.md)
+- [AllowConnectedDevices](policy-csp-connectivity.md)
+
+## Cryptography
+
+- [Cryptography](policy-csp-cryptography.md)
+- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md)
+- [TLSCipherSuites](policy-csp-cryptography.md)
+
+## Defender
+
+- [Defender](policy-csp-defender.md)
+- [AllowArchiveScanning](policy-csp-defender.md)
+- [AllowBehaviorMonitoring](policy-csp-defender.md)
+- [AllowCloudProtection](policy-csp-defender.md)
+- [AllowEmailScanning](policy-csp-defender.md)
+- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md)
+- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md)
+- [AllowIntrusionPreventionSystem](policy-csp-defender.md)
+- [AllowIOAVProtection](policy-csp-defender.md)
+- [AllowOnAccessProtection](policy-csp-defender.md)
+- [AllowRealtimeMonitoring](policy-csp-defender.md)
+- [AllowScanningNetworkFiles](policy-csp-defender.md)
+- [AllowScriptScanning](policy-csp-defender.md)
+- [AllowUserUIAccess](policy-csp-defender.md)
+- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md)
+- [AttackSurfaceReductionRules](policy-csp-defender.md)
+- [AvgCPULoadFactor](policy-csp-defender.md)
+- [CloudBlockLevel](policy-csp-defender.md)
+- [CloudExtendedTimeout](policy-csp-defender.md)
+- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md)
+- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md)
+- [SecurityIntelligenceLocation](policy-csp-defender.md)
+- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md)
+- [DaysToRetainCleanedMalware](policy-csp-defender.md)
+- [DisableCatchupFullScan](policy-csp-defender.md)
+- [DisableCatchupQuickScan](policy-csp-defender.md)
+- [EnableControlledFolderAccess](policy-csp-defender.md)
+- [EnableLowCPUPriority](policy-csp-defender.md)
+- [EnableNetworkProtection](policy-csp-defender.md)
+- [ExcludedPaths](policy-csp-defender.md)
+- [ExcludedExtensions](policy-csp-defender.md)
+- [ExcludedProcesses](policy-csp-defender.md)
+- [PUAProtection](policy-csp-defender.md)
+- [RealTimeScanDirection](policy-csp-defender.md)
+- [ScanParameter](policy-csp-defender.md)
+- [ScheduleQuickScanTime](policy-csp-defender.md)
+- [ScheduleScanDay](policy-csp-defender.md)
+- [ScheduleScanTime](policy-csp-defender.md)
+- [SignatureUpdateFallbackOrder](policy-csp-defender.md)
+- [SignatureUpdateFileSharesSources](policy-csp-defender.md)
+- [SignatureUpdateInterval](policy-csp-defender.md)
+- [SubmitSamplesConsent](policy-csp-defender.md)
+- [ThreatSeverityDefaultAction](policy-csp-defender.md)
+
+## DeliveryOptimization
+
+- [DeliveryOptimization](policy-csp-deliveryoptimization.md)
+- [DODownloadMode](policy-csp-deliveryoptimization.md)
+- [DOGroupId](policy-csp-deliveryoptimization.md)
+- [DOMaxCacheSize](policy-csp-deliveryoptimization.md)
+- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md)
+- [DOMaxCacheAge](policy-csp-deliveryoptimization.md)
+- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md)
+- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md)
+- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md)
+- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
+- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
+- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md)
+- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md)
+- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md)
+- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md)
+- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md)
+- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md)
+- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md)
+- [DOCacheHost](policy-csp-deliveryoptimization.md)
+- [DOCacheHostSource](policy-csp-deliveryoptimization.md)
+- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md)
+- [DOGroupIdSource](policy-csp-deliveryoptimization.md)
+- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md)
+- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md)
+- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md)
+- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md)
+- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md)
+- [DOVpnKeywords](policy-csp-deliveryoptimization.md)
+- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
+- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
+
+## Experience
+
+- [DoNotShowFeedbackNotifications](policy-csp-experience.md)
+
+## ExploitGuard
+
+- [ExploitGuard](policy-csp-exploitguard.md)
+- [ExploitProtectionSettings](policy-csp-exploitguard.md)
+
+## LocalUsersAndGroups
+
+- [LocalUsersAndGroups](policy-csp-localusersandgroups.md)
+- [Configure](policy-csp-localusersandgroups.md)
+
+## NetworkIsolation
+
+- [NetworkIsolation](policy-csp-networkisolation.md)
+- [EnterpriseCloudResources](policy-csp-networkisolation.md)
+- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md)
+- [EnterpriseIPRange](policy-csp-networkisolation.md)
+- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md)
+- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md)
+- [EnterpriseProxyServers](policy-csp-networkisolation.md)
+- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md)
+- [NeutralResources](policy-csp-networkisolation.md)
+
+## Privacy
+
+- [DisableAdvertisingId](policy-csp-privacy.md)
+- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md)
+- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsRunInBackground](policy-csp-privacy.md)
+- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [AllowInputPersonalization](policy-csp-privacy.md)
+- [LetAppsAccessAccountInfo](policy-csp-privacy.md)
+- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCalendar](policy-csp-privacy.md)
+- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCallHistory](policy-csp-privacy.md)
+- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCamera](policy-csp-privacy.md)
+- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessContacts](policy-csp-privacy.md)
+- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessEmail](policy-csp-privacy.md)
+- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessLocation](policy-csp-privacy.md)
+- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessMessaging](policy-csp-privacy.md)
+- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessMicrophone](policy-csp-privacy.md)
+- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessNotifications](policy-csp-privacy.md)
+- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessPhone](policy-csp-privacy.md)
+- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessRadios](policy-csp-privacy.md)
+- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessTasks](policy-csp-privacy.md)
+- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessTrustedDevices](policy-csp-privacy.md)
+- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsSyncWithDevices](policy-csp-privacy.md)
+- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsActivateWithVoice](policy-csp-privacy.md)
+- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md)
+
+## RestrictedGroups
+
+- [ConfigureGroupMembership](policy-csp-restrictedgroups.md)
+
+## Security
+
+- [RecoveryEnvironmentAuthentication](policy-csp-security.md)
+- [RequireProvisioningPackageSignature](policy-csp-security.md)
+- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md)
+- [RecoveryEnvironmentAuthentication](policy-csp-security.md)
+
+## Settings
+
+- [ConfigureTaskbarCalendar](policy-csp-settings.md)
+
+## Start
+
+- [Start](policy-csp-start.md)
+- [ForceStartSize](policy-csp-start.md)
+- [DisableContextMenus](policy-csp-start.md)
+- [ShowOrHideMostUsedApps](policy-csp-start.md)
+- [HideFrequentlyUsedApps](policy-csp-start.md)
+- [HideRecentlyAddedApps](policy-csp-start.md)
+- [HideRecentJumplists](policy-csp-start.md)
+- [HideAppList](policy-csp-start.md)
+- [HidePeopleBar](policy-csp-start.md)
+- [StartLayout](policy-csp-start.md)
+- [ConfigureStartPins](policy-csp-start.md)
+- [HideRecommendedSection](policy-csp-start.md)
+- [HideTaskViewButton](policy-csp-start.md)
+- [DisableControlCenter](policy-csp-start.md)
+- [Start](policy-csp-start.md)
+- [AllowPinnedFolderDocuments](policy-csp-start.md)
+- [AllowPinnedFolderDownloads](policy-csp-start.md)
+- [AllowPinnedFolderFileExplorer](policy-csp-start.md)
+- [AllowPinnedFolderHomeGroup](policy-csp-start.md)
+- [AllowPinnedFolderMusic](policy-csp-start.md)
+- [AllowPinnedFolderNetwork](policy-csp-start.md)
+- [AllowPinnedFolderPersonalFolder](policy-csp-start.md)
+- [AllowPinnedFolderPictures](policy-csp-start.md)
+- [AllowPinnedFolderSettings](policy-csp-start.md)
+- [AllowPinnedFolderVideos](policy-csp-start.md)
+- [ForceStartSize](policy-csp-start.md)
+- [DisableContextMenus](policy-csp-start.md)
+- [ShowOrHideMostUsedApps](policy-csp-start.md)
+- [HideFrequentlyUsedApps](policy-csp-start.md)
+- [HideRecentlyAddedApps](policy-csp-start.md)
+- [HideRecentJumplists](policy-csp-start.md)
+- [HideAppList](policy-csp-start.md)
+- [HideChangeAccountSettings](policy-csp-start.md)
+- [HideLock](policy-csp-start.md)
+- [HideSignOut](policy-csp-start.md)
+- [HideSwitchAccount](policy-csp-start.md)
+- [HideSleep](policy-csp-start.md)
+- [HideHibernate](policy-csp-start.md)
+- [HideShutDown](policy-csp-start.md)
+- [HideRestart](policy-csp-start.md)
+- [HideUserTile](policy-csp-start.md)
+- [HidePowerButton](policy-csp-start.md)
+- [ImportEdgeAssets](policy-csp-start.md)
+- [NoPinningToTaskbar](policy-csp-start.md)
+- [StartLayout](policy-csp-start.md)
+- [ConfigureStartPins](policy-csp-start.md)
+- [HideRecommendedSection](policy-csp-start.md)
+- [SimplifyQuickSettings](policy-csp-start.md)
+- [DisableEditingQuickSettings](policy-csp-start.md)
+- [HideTaskViewButton](policy-csp-start.md)
+
+## Storage
+
+- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md)
+- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md)
+- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md)
+- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md)
+
+## System
+
+- [AllowTelemetry](policy-csp-system.md)
+- [AllowBuildPreview](policy-csp-system.md)
+- [AllowExperimentation](policy-csp-system.md)
+- [AllowFontProviders](policy-csp-system.md)
+- [AllowLocation](policy-csp-system.md)
+- [AllowStorageCard](policy-csp-system.md)
+- [AllowTelemetry](policy-csp-system.md)
+
+## TextInput
+
+- [TextInput](policy-csp-textinput.md)
+- [AllowIMELogging](policy-csp-textinput.md)
+- [AllowIMENetworkAccess](policy-csp-textinput.md)
+- [AllowInputPanel](policy-csp-textinput.md)
+- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md)
+- [AllowJapaneseIVSCharacters](policy-csp-textinput.md)
+- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md)
+- [AllowJapaneseUserDictionary](policy-csp-textinput.md)
+- [AllowKeyboardTextSuggestions](policy-csp-textinput.md)
+- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md)
+- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md)
+- [AllowLinguisticDataCollection](policy-csp-textinput.md)
+- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md)
+- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md)
+- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md)
+- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md)
+- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md)
+- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md)
+- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md)
+- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md)
+- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md)
+- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md)
+- [ForceTouchKeyboardDockedState](policy-csp-textinput.md)
+- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md)
+- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md)
+- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md)
+- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md)
+- [ConfigureKoreanIMEVersion](policy-csp-textinput.md)
+- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md)
+
+## TimeLanguageSettings
+
+- [ConfigureTimeZone](policy-csp-timelanguagesettings.md)
+
+## Update
+
+- [Update](policy-csp-update.md)
+- [ActiveHoursEnd](policy-csp-update.md)
+- [ActiveHoursStart](policy-csp-update.md)
+- [ActiveHoursMaxRange](policy-csp-update.md)
+- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md)
+- [AutoRestartNotificationSchedule](policy-csp-update.md)
+- [SetAutoRestartNotificationDisable](policy-csp-update.md)
+- [ScheduleRestartWarning](policy-csp-update.md)
+- [ScheduleImminentRestartWarning](policy-csp-update.md)
+- [AllowAutoUpdate](policy-csp-update.md)
+- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md)
+- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md)
+- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md)
+- [EngagedRestartTransitionSchedule](policy-csp-update.md)
+- [EngagedRestartSnoozeSchedule](policy-csp-update.md)
+- [EngagedRestartDeadline](policy-csp-update.md)
+- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md)
+- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md)
+- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md)
+- [DetectionFrequency](policy-csp-update.md)
+- [ManagePreviewBuilds](policy-csp-update.md)
+- [BranchReadinessLevel](policy-csp-update.md)
+- [ProductVersion](policy-csp-update.md)
+- [TargetReleaseVersion](policy-csp-update.md)
+- [DisableWUfBSafeguards](policy-csp-update.md)
+- [AllowUpdateService](policy-csp-update.md)
+- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md)
+- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md)
+- [DeferUpdatePeriod](policy-csp-update.md)
+- [DeferUpgradePeriod](policy-csp-update.md)
+- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md)
+- [PauseDeferrals](policy-csp-update.md)
+- [PauseFeatureUpdates](policy-csp-update.md)
+- [PauseQualityUpdates](policy-csp-update.md)
+- [PauseFeatureUpdatesStartTime](policy-csp-update.md)
+- [PauseQualityUpdatesStartTime](policy-csp-update.md)
+- [PhoneUpdateRestrictions](policy-csp-update.md)
+- [RequireDeferUpgrade](policy-csp-update.md)
+- [AllowMUUpdateService](policy-csp-update.md)
+- [RequireUpdateApproval](policy-csp-update.md)
+- [ScheduledInstallDay](policy-csp-update.md)
+- [ScheduledInstallTime](policy-csp-update.md)
+- [ScheduledInstallEveryWeek](policy-csp-update.md)
+- [ScheduledInstallFirstWeek](policy-csp-update.md)
+- [ScheduledInstallSecondWeek](policy-csp-update.md)
+- [ScheduledInstallThirdWeek](policy-csp-update.md)
+- [ScheduledInstallFourthWeek](policy-csp-update.md)
+- [UpdateServiceUrl](policy-csp-update.md)
+- [UpdateServiceUrlAlternate](policy-csp-update.md)
+- [FillEmptyContentUrls](policy-csp-update.md)
+- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md)
+- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md)
+- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md)
+- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md)
+- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md)
+- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md)
+- [SetEDURestart](policy-csp-update.md)
+- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md)
+- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md)
+- [SetDisableUXWUAccess](policy-csp-update.md)
+- [SetDisablePauseUXAccess](policy-csp-update.md)
+- [UpdateNotificationLevel](policy-csp-update.md)
+- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md)
+- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md)
+- [IgnoreMOAppDownloadLimit](policy-csp-update.md)
+- [DisableDualScan](policy-csp-update.md)
+- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md)
+- [AutomaticMaintenanceWakeUp](policy-csp-update.md)
+- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md)
+- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md)
+- [ConfigureDeadlineGracePeriod](policy-csp-update.md)
+- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md)
+- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md)
+- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md)
+- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md)
+
+## Wifi
+
+- [AllowInternetSharing](policy-csp-wifi.md)
+- [AllowManualWiFiConfiguration](policy-csp-wifi.md)
+- [AllowWiFi](policy-csp-wifi.md)
+- [AllowWiFiDirect](policy-csp-wifi.md)
+- [WLANScanMode](policy-csp-wifi.md)
+
+## WindowsDefenderSecurityCenter
+
+- [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md)
+- [CompanyName](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md)
+- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md)
+- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md)
+- [Email](policy-csp-windowsdefendersecuritycenter.md)
+- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md)
+- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md)
+- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md)
+- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md)
+- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md)
+- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md)
+- [Phone](policy-csp-windowsdefendersecuritycenter.md)
+- [URL](policy-csp-windowsdefendersecuritycenter.md)
+
+## WirelessDisplay
+
+- [WirelessDisplay](policy-csp-wirelessdisplay.md)
+- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md)
+- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md)
+- [AllowProjectionToPC](policy-csp-wirelessdisplay.md)
+- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md)
+- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md)
+- [RequirePinForPairing](policy-csp-wirelessdisplay.md)
+- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md)
+- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md)
+- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md)
+- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md)
+- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md)
+
+## Related articles
+
+[Policy configuration service provider](policy-configuration-service-provider.md)

From a5bd9984a0806e7a3d6c5b208103a9c4e4d51371 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 17 Mar 2023 17:51:51 -0400
Subject: [PATCH 03/64] Sort policies

---
 ...-in-policy-csp-supported-by-surface-hub.md | 866 +++++++++---------
 1 file changed, 426 insertions(+), 440 deletions(-)

diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index dda5d64123..f426bbd777 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -19,527 +19,513 @@ This article lists the policies in Policy CSP that are applicable for Surface Hu
 
 ## Accounts
 
-- [AllowMicrosoftAccountConnection](policy-csp-accounts.md)
+- [AllowMicrosoftAccountConnection](policy-csp-accounts.md#allowmicrosoftaccountconnection)
 
 ## ApplicationDefaults
 
-- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md)
+- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md#defaultassociationsconfiguration)
 
 ## ApplicationManagement
 
-- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md)
-- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md)
+- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#allowappstoreautoupdate)
+- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#allowdeveloperunlock)
 
 ## Authentication
 
-- [AllowEAPCertSSO](policy-csp-authentication.md)
-- [AllowFastReconnect](policy-csp-authentication.md)
-- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md)
-- [AllowAadPasswordReset](policy-csp-authentication.md)
-- [EnableWebSignIn](policy-csp-authentication.md)
-- [EnableFastFirstSignIn](policy-csp-authentication.md)
+- [AllowAadPasswordReset](policy-csp-authentication.md#allowaadpasswordreset)
+- [AllowEAPCertSSO](policy-csp-authentication.md#alloweapcertsso)
+- [AllowFastReconnect](policy-csp-authentication.md#allowfastreconnect)
+- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md#allowsecondaryauthenticationdevice)
+- [EnableFastFirstSignIn](policy-csp-authentication.md#enablefastfirstsignin)
+- [EnableWebSignIn](policy-csp-authentication.md#enablewebsignin)
 
 ## Bluetooth
 
-- [Bluetooth](policy-csp-bluetooth.md)
-- [AllowAdvertising](policy-csp-bluetooth.md)
-- [AllowDiscoverableMode](policy-csp-bluetooth.md)
-- [AllowPrepairing](policy-csp-bluetooth.md)
-- [AllowPromptedProximalConnections](policy-csp-bluetooth.md)
-- [LocalDeviceName](policy-csp-bluetooth.md)
-- [ServicesAllowedList](policy-csp-bluetooth.md)
-- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md)
+- [AllowAdvertising](policy-csp-bluetooth.md#allowadvertising)
+- [AllowDiscoverableMode](policy-csp-bluetooth.md#allowdiscoverablemode)
+- [AllowPrepairing](policy-csp-bluetooth.md#allowprepairing)
+- [AllowPromptedProximalConnections](policy-csp-bluetooth.md#allowpromptedproximalconnections)
+- [LocalDeviceName](policy-csp-bluetooth.md#localdevicename)
+- [ServicesAllowedList](policy-csp-bluetooth.md#servicesallowedlist)
+- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#setminimumencryptionkeysize)
 
 ## Browser
 
-- [AllowAddressBarDropdown](policy-csp-browser.md)
-- [AllowAutofill](policy-csp-browser.md)
-- [AllowBrowser](policy-csp-browser.md)
-- [AllowCookies](policy-csp-browser.md)
-- [AllowDeveloperTools](policy-csp-browser.md)
-- [AllowDoNotTrack](policy-csp-browser.md)
-- [AllowFlashClickToRun](policy-csp-browser.md)
-- [AllowMicrosoftCompatibilityList](policy-csp-browser.md)
-- [AllowPasswordManager](policy-csp-browser.md)
-- [AllowPopups](policy-csp-browser.md)
-- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md)
-- [AllowSmartScreen](policy-csp-browser.md)
-- [ClearBrowsingDataOnExit](policy-csp-browser.md)
-- [ConfigureAdditionalSearchEngines](policy-csp-browser.md)
-- [DisableLockdownOfStartPages](policy-csp-browser.md)
-- [EnterpriseModeSiteList](policy-csp-browser.md)
-- [HomePages](policy-csp-browser.md)
-- [PreventSmartScreenPromptOverride](policy-csp-browser.md)
-- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md)
-- [PreventLiveTileDataCollection](policy-csp-browser.md)
-- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md)
-- [SetDefaultSearchEngine](policy-csp-browser.md)
-- [AllowAddressBarDropdown](policy-csp-browser.md)
-- [AllowAutofill](policy-csp-browser.md)
-- [AllowBrowser](policy-csp-browser.md)
-- [AllowCookies](policy-csp-browser.md)
-- [AllowDeveloperTools](policy-csp-browser.md)
-- [AllowDoNotTrack](policy-csp-browser.md)
-- [AllowFlashClickToRun](policy-csp-browser.md)
-- [AllowMicrosoftCompatibilityList](policy-csp-browser.md)
-- [AllowPasswordManager](policy-csp-browser.md)
-- [AllowPopups](policy-csp-browser.md)
-- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md)
-- [AllowSmartScreen](policy-csp-browser.md)
-- [ClearBrowsingDataOnExit](policy-csp-browser.md)
-- [ConfigureAdditionalSearchEngines](policy-csp-browser.md)
-- [DisableLockdownOfStartPages](policy-csp-browser.md)
-- [EnterpriseModeSiteList](policy-csp-browser.md)
-- [HomePages](policy-csp-browser.md)
-- [PreventSmartScreenPromptOverride](policy-csp-browser.md)
-- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md)
-- [PreventLiveTileDataCollection](policy-csp-browser.md)
-- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md)
-- [SetDefaultSearchEngine](policy-csp-browser.md)
+- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown)
+- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown)
+- [AllowAutofill](policy-csp-browser.md#allowautofill)
+- [AllowAutofill](policy-csp-browser.md#allowautofill)
+- [AllowBrowser](policy-csp-browser.md#allowbrowser)
+- [AllowBrowser](policy-csp-browser.md#allowbrowser)
+- [AllowCookies](policy-csp-browser.md#allowcookies)
+- [AllowCookies](policy-csp-browser.md#allowcookies)
+- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools)
+- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools)
+- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack)
+- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack)
+- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun)
+- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun)
+- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist)
+- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist)
+- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager)
+- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager)
+- [AllowPopups](policy-csp-browser.md#allowpopups)
+- [AllowPopups](policy-csp-browser.md#allowpopups)
+- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar)
+- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar)
+- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen)
+- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen)
+- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit)
+- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit)
+- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines)
+- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines)
+- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages)
+- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages)
+- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist)
+- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist)
+- [HomePages](policy-csp-browser.md#homepages)
+- [HomePages](policy-csp-browser.md#homepages)
+- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection)
+- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection)
+- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride)
+- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride)
+- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles)
+- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles)
+- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc)
+- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc)
+- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine)
+- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine)
 
 ## Camera
 
-- [Camera](policy-csp-camera.md)
-- [AllowCamera](policy-csp-camera.md)
+- [AllowCamera](policy-csp-camera.md#allowcamera)
 
 ## Connectivity
 
-- [AllowBluetooth](policy-csp-connectivity.md)
-- [AllowConnectedDevices](policy-csp-connectivity.md)
+- [AllowBluetooth](policy-csp-connectivity.md#allowbluetooth)
+- [AllowConnectedDevices](policy-csp-connectivity.md#allowconnecteddevices)
 
 ## Cryptography
 
-- [Cryptography](policy-csp-cryptography.md)
-- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md)
-- [TLSCipherSuites](policy-csp-cryptography.md)
+- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#allowfipsalgorithmpolicy)
+- [TLSCipherSuites](policy-csp-cryptography.md#tlsciphersuites)
 
 ## Defender
 
-- [Defender](policy-csp-defender.md)
-- [AllowArchiveScanning](policy-csp-defender.md)
-- [AllowBehaviorMonitoring](policy-csp-defender.md)
-- [AllowCloudProtection](policy-csp-defender.md)
-- [AllowEmailScanning](policy-csp-defender.md)
-- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md)
-- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md)
-- [AllowIntrusionPreventionSystem](policy-csp-defender.md)
-- [AllowIOAVProtection](policy-csp-defender.md)
-- [AllowOnAccessProtection](policy-csp-defender.md)
-- [AllowRealtimeMonitoring](policy-csp-defender.md)
-- [AllowScanningNetworkFiles](policy-csp-defender.md)
-- [AllowScriptScanning](policy-csp-defender.md)
-- [AllowUserUIAccess](policy-csp-defender.md)
-- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md)
-- [AttackSurfaceReductionRules](policy-csp-defender.md)
-- [AvgCPULoadFactor](policy-csp-defender.md)
-- [CloudBlockLevel](policy-csp-defender.md)
-- [CloudExtendedTimeout](policy-csp-defender.md)
-- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md)
-- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md)
-- [SecurityIntelligenceLocation](policy-csp-defender.md)
-- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md)
-- [DaysToRetainCleanedMalware](policy-csp-defender.md)
-- [DisableCatchupFullScan](policy-csp-defender.md)
-- [DisableCatchupQuickScan](policy-csp-defender.md)
-- [EnableControlledFolderAccess](policy-csp-defender.md)
-- [EnableLowCPUPriority](policy-csp-defender.md)
-- [EnableNetworkProtection](policy-csp-defender.md)
-- [ExcludedPaths](policy-csp-defender.md)
-- [ExcludedExtensions](policy-csp-defender.md)
-- [ExcludedProcesses](policy-csp-defender.md)
-- [PUAProtection](policy-csp-defender.md)
-- [RealTimeScanDirection](policy-csp-defender.md)
-- [ScanParameter](policy-csp-defender.md)
-- [ScheduleQuickScanTime](policy-csp-defender.md)
-- [ScheduleScanDay](policy-csp-defender.md)
-- [ScheduleScanTime](policy-csp-defender.md)
-- [SignatureUpdateFallbackOrder](policy-csp-defender.md)
-- [SignatureUpdateFileSharesSources](policy-csp-defender.md)
-- [SignatureUpdateInterval](policy-csp-defender.md)
-- [SubmitSamplesConsent](policy-csp-defender.md)
-- [ThreatSeverityDefaultAction](policy-csp-defender.md)
+- [AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning)
+- [AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring)
+- [AllowCloudProtection](policy-csp-defender.md#allowcloudprotection)
+- [AllowEmailScanning](policy-csp-defender.md#allowemailscanning)
+- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives)
+- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning)
+- [AllowIntrusionPreventionSystem](policy-csp-defender.md#allowintrusionpreventionsystem)
+- [AllowIOAVProtection](policy-csp-defender.md#allowioavprotection)
+- [AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection)
+- [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring)
+- [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles)
+- [AllowScriptScanning](policy-csp-defender.md#allowscriptscanning)
+- [AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess)
+- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions)
+- [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules)
+- [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor)
+- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md#checkforsignaturesbeforerunningscan)
+- [CloudBlockLevel](policy-csp-defender.md#cloudblocklevel)
+- [CloudExtendedTimeout](policy-csp-defender.md#cloudextendedtimeout)
+- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md#controlledfolderaccessallowedapplications)
+- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md#controlledfolderaccessprotectedfolders)
+- [DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware)
+- [DisableCatchupFullScan](policy-csp-defender.md#disablecatchupfullscan)
+- [DisableCatchupQuickScan](policy-csp-defender.md#disablecatchupquickscan)
+- [EnableControlledFolderAccess](policy-csp-defender.md#enablecontrolledfolderaccess)
+- [EnableLowCPUPriority](policy-csp-defender.md#enablelowcpupriority)
+- [EnableNetworkProtection](policy-csp-defender.md#enablenetworkprotection)
+- [ExcludedExtensions](policy-csp-defender.md#excludedextensions)
+- [ExcludedPaths](policy-csp-defender.md#excludedpaths)
+- [ExcludedProcesses](policy-csp-defender.md#excludedprocesses)
+- [PUAProtection](policy-csp-defender.md#puaprotection)
+- [RealTimeScanDirection](policy-csp-defender.md#realtimescandirection)
+- [ScanParameter](policy-csp-defender.md#scanparameter)
+- [ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime)
+- [ScheduleScanDay](policy-csp-defender.md#schedulescanday)
+- [ScheduleScanTime](policy-csp-defender.md#schedulescantime)
+- [SecurityIntelligenceLocation](policy-csp-defender.md#securityintelligencelocation)
+- [SignatureUpdateFallbackOrder](policy-csp-defender.md#signatureupdatefallbackorder)
+- [SignatureUpdateFileSharesSources](policy-csp-defender.md#signatureupdatefilesharessources)
+- [SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval)
+- [SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent)
+- [ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction)
 
 ## DeliveryOptimization
 
-- [DeliveryOptimization](policy-csp-deliveryoptimization.md)
-- [DODownloadMode](policy-csp-deliveryoptimization.md)
-- [DOGroupId](policy-csp-deliveryoptimization.md)
-- [DOMaxCacheSize](policy-csp-deliveryoptimization.md)
-- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md)
-- [DOMaxCacheAge](policy-csp-deliveryoptimization.md)
-- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md)
-- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md)
-- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md)
-- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
-- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
-- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md)
-- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md)
-- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md)
-- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md)
-- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md)
-- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md)
-- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md)
-- [DOCacheHost](policy-csp-deliveryoptimization.md)
-- [DOCacheHostSource](policy-csp-deliveryoptimization.md)
-- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md)
-- [DOGroupIdSource](policy-csp-deliveryoptimization.md)
-- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md)
-- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md)
-- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md)
-- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md)
-- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md)
-- [DOVpnKeywords](policy-csp-deliveryoptimization.md)
-- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
-- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md)
+- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#doabsolutemaxcachesize)
+- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#doallowvpnpeercaching)
+- [DOCacheHost](policy-csp-deliveryoptimization.md#docachehost)
+- [DOCacheHostSource](policy-csp-deliveryoptimization.md#docachehostsource)
+- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#dodelaybackgrounddownloadfromhttp)
+- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#dodelaycacheserverfallbackbackground)
+- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#dodelaycacheserverfallbackforeground)
+- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#dodelayforegrounddownloadfromhttp)
+- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md#dodisallowcacheserverdownloadsonvpn)
+- [DODownloadMode](policy-csp-deliveryoptimization.md#dodownloadmode)
+- [DOGroupId](policy-csp-deliveryoptimization.md#dogroupid)
+- [DOGroupIdSource](policy-csp-deliveryoptimization.md#dogroupidsource)
+- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#domaxbackgrounddownloadbandwidth)
+- [DOMaxCacheAge](policy-csp-deliveryoptimization.md#domaxcacheage)
+- [DOMaxCacheSize](policy-csp-deliveryoptimization.md#domaxcachesize)
+- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#domaxforegrounddownloadbandwidth)
+- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md#dominbackgroundqos)
+- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#dominbatterypercentageallowedtoupload)
+- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#domindisksizeallowedtopeer)
+- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#dominfilesizetocache)
+- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#dominramallowedtopeer)
+- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md#domodifycachedrive)
+- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#domonthlyuploaddatacap)
+- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#dopercentagemaxbackgroundbandwidth)
+- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#dopercentagemaxforegroundbandwidth)
+- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#dorestrictpeerselectionby)
+- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth)
+- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth)
+- [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords)
 
 ## Experience
 
-- [DoNotShowFeedbackNotifications](policy-csp-experience.md)
+- [DoNotShowFeedbackNotifications](policy-csp-experience.md#donotshowfeedbacknotifications)
 
 ## ExploitGuard
 
-- [ExploitGuard](policy-csp-exploitguard.md)
-- [ExploitProtectionSettings](policy-csp-exploitguard.md)
+- [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitprotectionsettings)
 
 ## LocalUsersAndGroups
 
-- [LocalUsersAndGroups](policy-csp-localusersandgroups.md)
-- [Configure](policy-csp-localusersandgroups.md)
+- [Configure](policy-csp-localusersandgroups.md#configure)
 
 ## NetworkIsolation
 
-- [NetworkIsolation](policy-csp-networkisolation.md)
-- [EnterpriseCloudResources](policy-csp-networkisolation.md)
-- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md)
-- [EnterpriseIPRange](policy-csp-networkisolation.md)
-- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md)
-- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md)
-- [EnterpriseProxyServers](policy-csp-networkisolation.md)
-- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md)
-- [NeutralResources](policy-csp-networkisolation.md)
+- [EnterpriseCloudResources](policy-csp-networkisolation.md#enterprisecloudresources)
+- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md#enterpriseinternalproxyservers)
+- [EnterpriseIPRange](policy-csp-networkisolation.md#enterpriseiprange)
+- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md#enterpriseiprangesareauthoritative)
+- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md#enterprisenetworkdomainnames)
+- [EnterpriseProxyServers](policy-csp-networkisolation.md#enterpriseproxyservers)
+- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md#enterpriseproxyserversareauthoritative)
+- [NeutralResources](policy-csp-networkisolation.md#neutralresources)
 
 ## Privacy
 
-- [DisableAdvertisingId](policy-csp-privacy.md)
-- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md)
-- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsRunInBackground](policy-csp-privacy.md)
-- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [AllowInputPersonalization](policy-csp-privacy.md)
-- [LetAppsAccessAccountInfo](policy-csp-privacy.md)
-- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCalendar](policy-csp-privacy.md)
-- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCallHistory](policy-csp-privacy.md)
-- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCamera](policy-csp-privacy.md)
-- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessContacts](policy-csp-privacy.md)
-- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessEmail](policy-csp-privacy.md)
-- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessLocation](policy-csp-privacy.md)
-- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessMessaging](policy-csp-privacy.md)
-- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessMicrophone](policy-csp-privacy.md)
-- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessNotifications](policy-csp-privacy.md)
-- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessPhone](policy-csp-privacy.md)
-- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessRadios](policy-csp-privacy.md)
-- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessTasks](policy-csp-privacy.md)
-- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessTrustedDevices](policy-csp-privacy.md)
-- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsSyncWithDevices](policy-csp-privacy.md)
-- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md)
-- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md)
-- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md)
-- [LetAppsActivateWithVoice](policy-csp-privacy.md)
-- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md)
+- [AllowInputPersonalization](policy-csp-privacy.md#allowinputpersonalization)
+- [DisableAdvertisingId](policy-csp-privacy.md#disableadvertisingid)
+- [LetAppsAccessAccountInfo](policy-csp-privacy.md#letappsaccessaccountinfo)
+- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forceallowtheseapps)
+- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forcedenytheseapps)
+- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-userincontroloftheseapps)
+- [LetAppsAccessCalendar](policy-csp-privacy.md#letappsaccesscalendar)
+- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forceallowtheseapps)
+- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forcedenytheseapps)
+- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar-userincontroloftheseapps)
+- [LetAppsAccessCallHistory](policy-csp-privacy.md#letappsaccesscallhistory)
+- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forceallowtheseapps)
+- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forcedenytheseapps)
+- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-userincontroloftheseapps)
+- [LetAppsAccessCamera](policy-csp-privacy.md#letappsaccesscamera)
+- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera-forceallowtheseapps)
+- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera-forcedenytheseapps)
+- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera-userincontroloftheseapps)
+- [LetAppsAccessContacts](policy-csp-privacy.md#letappsaccesscontacts)
+- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forceallowtheseapps)
+- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forcedenytheseapps)
+- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts-userincontroloftheseapps)
+- [LetAppsAccessEmail](policy-csp-privacy.md#letappsaccessemail)
+- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail-forceallowtheseapps)
+- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail-forcedenytheseapps)
+- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail-userincontroloftheseapps)
+- [LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation)
+- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation-forceallowtheseapps)
+- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation-forcedenytheseapps)
+- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation-userincontroloftheseapps)
+- [LetAppsAccessMessaging](policy-csp-privacy.md#letappsaccessmessaging)
+- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forceallowtheseapps)
+- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forcedenytheseapps)
+- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging-userincontroloftheseapps)
+- [LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone)
+- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forceallowtheseapps)
+- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forcedenytheseapps)
+- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-userincontroloftheseapps)
+- [LetAppsAccessNotifications](policy-csp-privacy.md#letappsaccessnotifications)
+- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forceallowtheseapps)
+- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forcedenytheseapps)
+- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications-userincontroloftheseapps)
+- [LetAppsAccessPhone](policy-csp-privacy.md#letappsaccessphone)
+- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone-forceallowtheseapps)
+- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone-forcedenytheseapps)
+- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone-userincontroloftheseapps)
+- [LetAppsAccessRadios](policy-csp-privacy.md#letappsaccessradios)
+- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios-forceallowtheseapps)
+- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios-forcedenytheseapps)
+- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios-userincontroloftheseapps)
+- [LetAppsAccessTasks](policy-csp-privacy.md#letappsaccesstasks)
+- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks-forceallowtheseapps)
+- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks-forcedenytheseapps)
+- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks-userincontroloftheseapps)
+- [LetAppsAccessTrustedDevices](policy-csp-privacy.md#letappsaccesstrusteddevices)
+- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forceallowtheseapps)
+- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forcedenytheseapps)
+- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-userincontroloftheseapps)
+- [LetAppsActivateWithVoice](policy-csp-privacy.md#letappsactivatewithvoice)
+- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#letappsactivatewithvoiceabovelock)
+- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#letappsgetdiagnosticinfo)
+- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forceallowtheseapps)
+- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forcedenytheseapps)
+- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-userincontroloftheseapps)
+- [LetAppsRunInBackground](policy-csp-privacy.md#letappsruninbackground)
+- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground-forceallowtheseapps)
+- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground-forcedenytheseapps)
+- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground-userincontroloftheseapps)
+- [LetAppsSyncWithDevices](policy-csp-privacy.md#letappssyncwithdevices)
+- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forceallowtheseapps)
+- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forcedenytheseapps)
+- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices-userincontroloftheseapps)
 
 ## RestrictedGroups
 
-- [ConfigureGroupMembership](policy-csp-restrictedgroups.md)
+- [ConfigureGroupMembership](policy-csp-restrictedgroups.md#configuregroupmembership)
 
 ## Security
 
-- [RecoveryEnvironmentAuthentication](policy-csp-security.md)
-- [RequireProvisioningPackageSignature](policy-csp-security.md)
-- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md)
-- [RecoveryEnvironmentAuthentication](policy-csp-security.md)
+- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication)
+- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication)
+- [RequireProvisioningPackageSignature](policy-csp-security.md#requireprovisioningpackagesignature)
+- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md#requireretrievehealthcertificateonboot)
 
 ## Settings
 
-- [ConfigureTaskbarCalendar](policy-csp-settings.md)
+- [ConfigureTaskbarCalendar](policy-csp-settings.md#configuretaskbarcalendar)
 
 ## Start
 
-- [Start](policy-csp-start.md)
-- [ForceStartSize](policy-csp-start.md)
-- [DisableContextMenus](policy-csp-start.md)
-- [ShowOrHideMostUsedApps](policy-csp-start.md)
-- [HideFrequentlyUsedApps](policy-csp-start.md)
-- [HideRecentlyAddedApps](policy-csp-start.md)
-- [HideRecentJumplists](policy-csp-start.md)
-- [HideAppList](policy-csp-start.md)
-- [HidePeopleBar](policy-csp-start.md)
-- [StartLayout](policy-csp-start.md)
-- [ConfigureStartPins](policy-csp-start.md)
-- [HideRecommendedSection](policy-csp-start.md)
-- [HideTaskViewButton](policy-csp-start.md)
-- [DisableControlCenter](policy-csp-start.md)
-- [Start](policy-csp-start.md)
-- [AllowPinnedFolderDocuments](policy-csp-start.md)
-- [AllowPinnedFolderDownloads](policy-csp-start.md)
-- [AllowPinnedFolderFileExplorer](policy-csp-start.md)
-- [AllowPinnedFolderHomeGroup](policy-csp-start.md)
-- [AllowPinnedFolderMusic](policy-csp-start.md)
-- [AllowPinnedFolderNetwork](policy-csp-start.md)
-- [AllowPinnedFolderPersonalFolder](policy-csp-start.md)
-- [AllowPinnedFolderPictures](policy-csp-start.md)
-- [AllowPinnedFolderSettings](policy-csp-start.md)
-- [AllowPinnedFolderVideos](policy-csp-start.md)
-- [ForceStartSize](policy-csp-start.md)
-- [DisableContextMenus](policy-csp-start.md)
-- [ShowOrHideMostUsedApps](policy-csp-start.md)
-- [HideFrequentlyUsedApps](policy-csp-start.md)
-- [HideRecentlyAddedApps](policy-csp-start.md)
-- [HideRecentJumplists](policy-csp-start.md)
-- [HideAppList](policy-csp-start.md)
-- [HideChangeAccountSettings](policy-csp-start.md)
-- [HideLock](policy-csp-start.md)
-- [HideSignOut](policy-csp-start.md)
-- [HideSwitchAccount](policy-csp-start.md)
-- [HideSleep](policy-csp-start.md)
-- [HideHibernate](policy-csp-start.md)
-- [HideShutDown](policy-csp-start.md)
-- [HideRestart](policy-csp-start.md)
-- [HideUserTile](policy-csp-start.md)
-- [HidePowerButton](policy-csp-start.md)
-- [ImportEdgeAssets](policy-csp-start.md)
-- [NoPinningToTaskbar](policy-csp-start.md)
-- [StartLayout](policy-csp-start.md)
-- [ConfigureStartPins](policy-csp-start.md)
-- [HideRecommendedSection](policy-csp-start.md)
-- [SimplifyQuickSettings](policy-csp-start.md)
-- [DisableEditingQuickSettings](policy-csp-start.md)
-- [HideTaskViewButton](policy-csp-start.md)
+- [AllowPinnedFolderDocuments](policy-csp-start.md#allowpinnedfolderdocuments)
+- [AllowPinnedFolderDownloads](policy-csp-start.md#allowpinnedfolderdownloads)
+- [AllowPinnedFolderFileExplorer](policy-csp-start.md#allowpinnedfolderfileexplorer)
+- [AllowPinnedFolderHomeGroup](policy-csp-start.md#allowpinnedfolderhomegroup)
+- [AllowPinnedFolderMusic](policy-csp-start.md#allowpinnedfoldermusic)
+- [AllowPinnedFolderNetwork](policy-csp-start.md#allowpinnedfoldernetwork)
+- [AllowPinnedFolderPersonalFolder](policy-csp-start.md#allowpinnedfolderpersonalfolder)
+- [AllowPinnedFolderPictures](policy-csp-start.md#allowpinnedfolderpictures)
+- [AllowPinnedFolderSettings](policy-csp-start.md#allowpinnedfoldersettings)
+- [AllowPinnedFolderVideos](policy-csp-start.md#allowpinnedfoldervideos)
+- [ConfigureStartPins](policy-csp-start.md#configurestartpins)
+- [ConfigureStartPins](policy-csp-start.md#configurestartpins)
+- [DisableContextMenus](policy-csp-start.md#disablecontextmenus)
+- [DisableContextMenus](policy-csp-start.md#disablecontextmenus)
+- [DisableControlCenter](policy-csp-start.md#disablecontrolcenter)
+- [DisableEditingQuickSettings](policy-csp-start.md#disableeditingquicksettings)
+- [ForceStartSize](policy-csp-start.md#forcestartsize)
+- [ForceStartSize](policy-csp-start.md#forcestartsize)
+- [HideAppList](policy-csp-start.md#hideapplist)
+- [HideAppList](policy-csp-start.md#hideapplist)
+- [HideChangeAccountSettings](policy-csp-start.md#hidechangeaccountsettings)
+- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps)
+- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps)
+- [HideHibernate](policy-csp-start.md#hidehibernate)
+- [HideLock](policy-csp-start.md#hidelock)
+- [HidePeopleBar](policy-csp-start.md#hidepeoplebar)
+- [HidePowerButton](policy-csp-start.md#hidepowerbutton)
+- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists)
+- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists)
+- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps)
+- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps)
+- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection)
+- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection)
+- [HideRestart](policy-csp-start.md#hiderestart)
+- [HideShutDown](policy-csp-start.md#hideshutdown)
+- [HideSignOut](policy-csp-start.md#hidesignout)
+- [HideSleep](policy-csp-start.md#hidesleep)
+- [HideSwitchAccount](policy-csp-start.md#hideswitchaccount)
+- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton)
+- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton)
+- [HideUserTile](policy-csp-start.md#hideusertile)
+- [ImportEdgeAssets](policy-csp-start.md#importedgeassets)
+- [NoPinningToTaskbar](policy-csp-start.md#nopinningtotaskbar)
+- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps)
+- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps)
+- [SimplifyQuickSettings](policy-csp-start.md#simplifyquicksettings)
+- [StartLayout](policy-csp-start.md#startlayout)
+- [StartLayout](policy-csp-start.md#startlayout)
 
 ## Storage
 
-- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md)
-- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md)
-- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md)
-- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md)
+- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md#wpddevicesdenyreadaccessperdevice)
+- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md#wpddevicesdenyreadaccessperuser)
+- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md#wpddevicesdenywriteaccessperdevice)
+- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md#wpddevicesdenywriteaccessperuser)
 
 ## System
 
-- [AllowTelemetry](policy-csp-system.md)
-- [AllowBuildPreview](policy-csp-system.md)
-- [AllowExperimentation](policy-csp-system.md)
-- [AllowFontProviders](policy-csp-system.md)
-- [AllowLocation](policy-csp-system.md)
-- [AllowStorageCard](policy-csp-system.md)
-- [AllowTelemetry](policy-csp-system.md)
+- [AllowBuildPreview](policy-csp-system.md#allowbuildpreview)
+- [AllowExperimentation](policy-csp-system.md#allowexperimentation)
+- [AllowFontProviders](policy-csp-system.md#allowfontproviders)
+- [AllowLocation](policy-csp-system.md#allowlocation)
+- [AllowStorageCard](policy-csp-system.md#allowstoragecard)
+- [AllowTelemetry](policy-csp-system.md#allowtelemetry)
+- [AllowTelemetry](policy-csp-system.md#allowtelemetry)
 
 ## TextInput
 
-- [TextInput](policy-csp-textinput.md)
-- [AllowIMELogging](policy-csp-textinput.md)
-- [AllowIMENetworkAccess](policy-csp-textinput.md)
-- [AllowInputPanel](policy-csp-textinput.md)
-- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md)
-- [AllowJapaneseIVSCharacters](policy-csp-textinput.md)
-- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md)
-- [AllowJapaneseUserDictionary](policy-csp-textinput.md)
-- [AllowKeyboardTextSuggestions](policy-csp-textinput.md)
-- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md)
-- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md)
-- [AllowLinguisticDataCollection](policy-csp-textinput.md)
-- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md)
-- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md)
-- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md)
-- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md)
-- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md)
-- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md)
-- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md)
-- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md)
-- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md)
-- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md)
-- [ForceTouchKeyboardDockedState](policy-csp-textinput.md)
-- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md)
-- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md)
-- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md)
-- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md)
-- [ConfigureKoreanIMEVersion](policy-csp-textinput.md)
-- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md)
+- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md#allowhardwarekeyboardtextsuggestions)
+- [AllowIMELogging](policy-csp-textinput.md#allowimelogging)
+- [AllowIMENetworkAccess](policy-csp-textinput.md#allowimenetworkaccess)
+- [AllowInputPanel](policy-csp-textinput.md#allowinputpanel)
+- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#allowjapaneseimesurrogatepaircharacters)
+- [AllowJapaneseIVSCharacters](policy-csp-textinput.md#allowjapaneseivscharacters)
+- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#allowjapanesenonpublishingstandardglyph)
+- [AllowJapaneseUserDictionary](policy-csp-textinput.md#allowjapaneseuserdictionary)
+- [AllowKeyboardTextSuggestions](policy-csp-textinput.md#allowkeyboardtextsuggestions)
+- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md#allowlanguagefeaturesuninstall)
+- [AllowLinguisticDataCollection](policy-csp-textinput.md#allowlinguisticdatacollection)
+- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md#allowtextinputsuggestionupdate)
+- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md#configurejapaneseimeversion)
+- [ConfigureKoreanIMEVersion](policy-csp-textinput.md#configurekoreanimeversion)
+- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#configuresimplifiedchineseimeversion)
+- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#configuretraditionalchineseimeversion)
+- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md#enabletouchkeyboardautoinvokeindesktopmode)
+- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#excludejapaneseimeexceptjis0208)
+- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc)
+- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis)
+- [ForceTouchKeyboardDockedState](policy-csp-textinput.md#forcetouchkeyboarddockedstate)
+- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md#touchkeyboarddictationbuttonavailability)
+- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md#touchkeyboardemojibuttonavailability)
+- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md#touchkeyboardfullmodeavailability)
+- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md#touchkeyboardhandwritingmodeavailability)
+- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md#touchkeyboardnarrowmodeavailability)
+- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md#touchkeyboardsplitmodeavailability)
+- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md#touchkeyboardwidemodeavailability)
 
 ## TimeLanguageSettings
 
-- [ConfigureTimeZone](policy-csp-timelanguagesettings.md)
+- [ConfigureTimeZone](policy-csp-timelanguagesettings.md#configuretimezone)
 
 ## Update
 
-- [Update](policy-csp-update.md)
-- [ActiveHoursEnd](policy-csp-update.md)
-- [ActiveHoursStart](policy-csp-update.md)
-- [ActiveHoursMaxRange](policy-csp-update.md)
-- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md)
-- [AutoRestartNotificationSchedule](policy-csp-update.md)
-- [SetAutoRestartNotificationDisable](policy-csp-update.md)
-- [ScheduleRestartWarning](policy-csp-update.md)
-- [ScheduleImminentRestartWarning](policy-csp-update.md)
-- [AllowAutoUpdate](policy-csp-update.md)
-- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md)
-- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md)
-- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md)
-- [EngagedRestartTransitionSchedule](policy-csp-update.md)
-- [EngagedRestartSnoozeSchedule](policy-csp-update.md)
-- [EngagedRestartDeadline](policy-csp-update.md)
-- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md)
-- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md)
-- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md)
-- [DetectionFrequency](policy-csp-update.md)
-- [ManagePreviewBuilds](policy-csp-update.md)
-- [BranchReadinessLevel](policy-csp-update.md)
-- [ProductVersion](policy-csp-update.md)
-- [TargetReleaseVersion](policy-csp-update.md)
-- [DisableWUfBSafeguards](policy-csp-update.md)
-- [AllowUpdateService](policy-csp-update.md)
-- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md)
-- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md)
-- [DeferUpdatePeriod](policy-csp-update.md)
-- [DeferUpgradePeriod](policy-csp-update.md)
-- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md)
-- [PauseDeferrals](policy-csp-update.md)
-- [PauseFeatureUpdates](policy-csp-update.md)
-- [PauseQualityUpdates](policy-csp-update.md)
-- [PauseFeatureUpdatesStartTime](policy-csp-update.md)
-- [PauseQualityUpdatesStartTime](policy-csp-update.md)
-- [PhoneUpdateRestrictions](policy-csp-update.md)
-- [RequireDeferUpgrade](policy-csp-update.md)
-- [AllowMUUpdateService](policy-csp-update.md)
-- [RequireUpdateApproval](policy-csp-update.md)
-- [ScheduledInstallDay](policy-csp-update.md)
-- [ScheduledInstallTime](policy-csp-update.md)
-- [ScheduledInstallEveryWeek](policy-csp-update.md)
-- [ScheduledInstallFirstWeek](policy-csp-update.md)
-- [ScheduledInstallSecondWeek](policy-csp-update.md)
-- [ScheduledInstallThirdWeek](policy-csp-update.md)
-- [ScheduledInstallFourthWeek](policy-csp-update.md)
-- [UpdateServiceUrl](policy-csp-update.md)
-- [UpdateServiceUrlAlternate](policy-csp-update.md)
-- [FillEmptyContentUrls](policy-csp-update.md)
-- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md)
-- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md)
-- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md)
-- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md)
-- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md)
-- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md)
-- [SetEDURestart](policy-csp-update.md)
-- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md)
-- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md)
-- [SetDisableUXWUAccess](policy-csp-update.md)
-- [SetDisablePauseUXAccess](policy-csp-update.md)
-- [UpdateNotificationLevel](policy-csp-update.md)
-- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md)
-- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md)
-- [IgnoreMOAppDownloadLimit](policy-csp-update.md)
-- [DisableDualScan](policy-csp-update.md)
-- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md)
-- [AutomaticMaintenanceWakeUp](policy-csp-update.md)
-- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md)
-- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md)
-- [ConfigureDeadlineGracePeriod](policy-csp-update.md)
-- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md)
-- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md)
-- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md)
-- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md)
+- [ActiveHoursEnd](policy-csp-update.md#activehoursend)
+- [ActiveHoursMaxRange](policy-csp-update.md#activehoursmaxrange)
+- [ActiveHoursStart](policy-csp-update.md#activehoursstart)
+- [AllowAutoUpdate](policy-csp-update.md#allowautoupdate)
+- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md#allowautowindowsupdatedownloadovermeterednetwork)
+- [AllowMUUpdateService](policy-csp-update.md#allowmuupdateservice)
+- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md#allownonmicrosoftsignedupdate)
+- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol)
+- [AllowUpdateService](policy-csp-update.md#allowupdateservice)
+- [AutomaticMaintenanceWakeUp](policy-csp-update.md#automaticmaintenancewakeup)
+- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md#autorestartdeadlineperiodindays)
+- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md#autorestartdeadlineperiodindaysforfeatureupdates)
+- [AutoRestartNotificationSchedule](policy-csp-update.md#autorestartnotificationschedule)
+- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md#autorestartrequirednotificationdismissal)
+- [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel)
+- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#configuredeadlineforfeatureupdates)
+- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md#configuredeadlineforqualityupdates)
+- [ConfigureDeadlineGracePeriod](policy-csp-update.md#configuredeadlinegraceperiod)
+- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md#configuredeadlinegraceperiodforfeatureupdates)
+- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md#configuredeadlinenoautoreboot)
+- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#configuredeadlinenoautorebootforfeatureupdates)
+- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#configuredeadlinenoautorebootforqualityupdates)
+- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod)
+- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays)
+- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#deferqualityupdatesperiodindays)
+- [DeferUpdatePeriod](policy-csp-update.md#deferupdateperiod)
+- [DeferUpgradePeriod](policy-csp-update.md#deferupgradeperiod)
+- [DetectionFrequency](policy-csp-update.md#detectionfrequency)
+- [DisableDualScan](policy-csp-update.md#disabledualscan)
+- [DisableWUfBSafeguards](policy-csp-update.md#disablewufbsafeguards)
+- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection)
+- [EngagedRestartDeadline](policy-csp-update.md#engagedrestartdeadline)
+- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#engagedrestartdeadlineforfeatureupdates)
+- [EngagedRestartSnoozeSchedule](policy-csp-update.md#engagedrestartsnoozeschedule)
+- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md#engagedrestartsnoozescheduleforfeatureupdates)
+- [EngagedRestartTransitionSchedule](policy-csp-update.md#engagedrestarttransitionschedule)
+- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md#engagedrestarttransitionscheduleforfeatureupdates)
+- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate)
+- [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls)
+- [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit)
+- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md#ignoremoupdatedownloadlimit)
+- [ManagePreviewBuilds](policy-csp-update.md#managepreviewbuilds)
+- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md#noupdatenotificationsduringactivehours)
+- [PauseDeferrals](policy-csp-update.md#pausedeferrals)
+- [PauseFeatureUpdates](policy-csp-update.md#pausefeatureupdates)
+- [PauseFeatureUpdatesStartTime](policy-csp-update.md#pausefeatureupdatesstarttime)
+- [PauseQualityUpdates](policy-csp-update.md#pausequalityupdates)
+- [PauseQualityUpdatesStartTime](policy-csp-update.md#pausequalityupdatesstarttime)
+- [PhoneUpdateRestrictions](policy-csp-update.md#phoneupdaterestrictions)
+- [ProductVersion](policy-csp-update.md#productversion)
+- [RequireDeferUpgrade](policy-csp-update.md#requiredeferupgrade)
+- [RequireUpdateApproval](policy-csp-update.md#requireupdateapproval)
+- [ScheduledInstallDay](policy-csp-update.md#scheduledinstallday)
+- [ScheduledInstallEveryWeek](policy-csp-update.md#scheduledinstalleveryweek)
+- [ScheduledInstallFirstWeek](policy-csp-update.md#scheduledinstallfirstweek)
+- [ScheduledInstallFourthWeek](policy-csp-update.md#scheduledinstallfourthweek)
+- [ScheduledInstallSecondWeek](policy-csp-update.md#scheduledinstallsecondweek)
+- [ScheduledInstallThirdWeek](policy-csp-update.md#scheduledinstallthirdweek)
+- [ScheduledInstallTime](policy-csp-update.md#scheduledinstalltime)
+- [ScheduleImminentRestartWarning](policy-csp-update.md#scheduleimminentrestartwarning)
+- [ScheduleRestartWarning](policy-csp-update.md#schedulerestartwarning)
+- [SetAutoRestartNotificationDisable](policy-csp-update.md#setautorestartnotificationdisable)
+- [SetDisablePauseUXAccess](policy-csp-update.md#setdisablepauseuxaccess)
+- [SetDisableUXWUAccess](policy-csp-update.md#setdisableuxwuaccess)
+- [SetEDURestart](policy-csp-update.md#setedurestart)
+- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#setpolicydrivenupdatesourcefordriverupdates)
+- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforfeatureupdates)
+- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforotherupdates)
+- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforqualityupdates)
+- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#setproxybehaviorforupdatedetection)
+- [TargetReleaseVersion](policy-csp-update.md#targetreleaseversion)
+- [UpdateNotificationLevel](policy-csp-update.md#updatenotificationlevel)
+- [UpdateServiceUrl](policy-csp-update.md#updateserviceurl)
+- [UpdateServiceUrlAlternate](policy-csp-update.md#updateserviceurlalternate)
 
 ## Wifi
 
-- [AllowInternetSharing](policy-csp-wifi.md)
-- [AllowManualWiFiConfiguration](policy-csp-wifi.md)
-- [AllowWiFi](policy-csp-wifi.md)
-- [AllowWiFiDirect](policy-csp-wifi.md)
-- [WLANScanMode](policy-csp-wifi.md)
+- [AllowInternetSharing](policy-csp-wifi.md#allowinternetsharing)
+- [AllowManualWiFiConfiguration](policy-csp-wifi.md#allowmanualwificonfiguration)
+- [AllowWiFi](policy-csp-wifi.md#allowwifi)
+- [AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect)
+- [WLANScanMode](policy-csp-wifi.md#wlanscanmode)
 
 ## WindowsDefenderSecurityCenter
 
-- [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md)
-- [CompanyName](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md)
-- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md)
-- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md)
-- [Email](policy-csp-windowsdefendersecuritycenter.md)
-- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md)
-- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md)
-- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md)
-- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md)
-- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md)
-- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md)
-- [Phone](policy-csp-windowsdefendersecuritycenter.md)
-- [URL](policy-csp-windowsdefendersecuritycenter.md)
+- [CompanyName](policy-csp-windowsdefendersecuritycenter.md#companyname)
+- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md#disableaccountprotectionui)
+- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md#disableappbrowserui)
+- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md#disablecleartpmbutton)
+- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md#disabledevicesecurityui)
+- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md#disableenhancednotifications)
+- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md#disablefamilyui)
+- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md#disablehealthui)
+- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md#disablenetworkui)
+- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md#disablenotifications)
+- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md#disabletpmfirmwareupdatewarning)
+- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md#disablevirusui)
+- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md#disallowexploitprotectionoverride)
+- [Email](policy-csp-windowsdefendersecuritycenter.md#email)
+- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md#enablecustomizedtoasts)
+- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md#enableinappcustomization)
+- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md#hideransomwaredatarecovery)
+- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md#hidesecureboot)
+- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md#hidetpmtroubleshooting)
+- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md#hidewindowssecuritynotificationareacontrol)
+- [Phone](policy-csp-windowsdefendersecuritycenter.md#phone)
+- [URL](policy-csp-windowsdefendersecuritycenter.md#url)
 
 ## WirelessDisplay
 
-- [WirelessDisplay](policy-csp-wirelessdisplay.md)
-- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md)
-- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md)
-- [AllowProjectionToPC](policy-csp-wirelessdisplay.md)
-- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md)
-- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md)
-- [RequirePinForPairing](policy-csp-wirelessdisplay.md)
-- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md)
-- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md)
-- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md)
-- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md)
-- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md)
+- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement)
+- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#allowmdnsdiscovery)
+- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md#allowmovementdetectiononinfrastructure)
+- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md#allowpcreceivertobetcpserver)
+- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md#allowpcsendertobetcpclient)
+- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md#allowprojectionfrompc)
+- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectionfrompcoverinfrastructure)
+- [AllowProjectionToPC](policy-csp-wirelessdisplay.md#allowprojectiontopc)
+- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectiontopcoverinfrastructure)
+- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#allowuserinputfromwirelessdisplayreceiver)
+- [RequirePinForPairing](policy-csp-wirelessdisplay.md#requirepinforpairing)
 
 ## Related articles
 

From 42da51b1ea6a8e336e2276b24a74a3c3008f0e85 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 17 Mar 2023 18:05:45 -0400
Subject: [PATCH 04/64] Fix bookmark links

---
 ...-in-policy-csp-supported-by-surface-hub.md | 102 +++++++++---------
 1 file changed, 51 insertions(+), 51 deletions(-)

diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index f426bbd777..5abbb6fc17 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -215,75 +215,75 @@ This article lists the policies in Policy CSP that are applicable for Surface Hu
 - [AllowInputPersonalization](policy-csp-privacy.md#allowinputpersonalization)
 - [DisableAdvertisingId](policy-csp-privacy.md#disableadvertisingid)
 - [LetAppsAccessAccountInfo](policy-csp-privacy.md#letappsaccessaccountinfo)
-- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forceallowtheseapps)
-- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-forcedenytheseapps)
-- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo-userincontroloftheseapps)
+- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forceallowtheseapps)
+- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forcedenytheseapps)
+- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_userincontroloftheseapps)
 - [LetAppsAccessCalendar](policy-csp-privacy.md#letappsaccesscalendar)
-- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forceallowtheseapps)
-- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar-forcedenytheseapps)
-- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar-userincontroloftheseapps)
+- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar_forceallowtheseapps)
+- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar_forcedenytheseapps)
+- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar_userincontroloftheseapps)
 - [LetAppsAccessCallHistory](policy-csp-privacy.md#letappsaccesscallhistory)
-- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forceallowtheseapps)
-- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-forcedenytheseapps)
-- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory-userincontroloftheseapps)
+- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_forceallowtheseapps)
+- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_forcedenytheseapps)
+- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_userincontroloftheseapps)
 - [LetAppsAccessCamera](policy-csp-privacy.md#letappsaccesscamera)
-- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera-forceallowtheseapps)
-- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera-forcedenytheseapps)
-- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera-userincontroloftheseapps)
+- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera_forceallowtheseapps)
+- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera_forcedenytheseapps)
+- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera_userincontroloftheseapps)
 - [LetAppsAccessContacts](policy-csp-privacy.md#letappsaccesscontacts)
-- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forceallowtheseapps)
-- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts-forcedenytheseapps)
-- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts-userincontroloftheseapps)
+- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts_forceallowtheseapps)
+- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts_forcedenytheseapps)
+- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts_userincontroloftheseapps)
 - [LetAppsAccessEmail](policy-csp-privacy.md#letappsaccessemail)
-- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail-forceallowtheseapps)
-- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail-forcedenytheseapps)
-- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail-userincontroloftheseapps)
+- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail_forceallowtheseapps)
+- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail_forcedenytheseapps)
+- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail_userincontroloftheseapps)
 - [LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation)
-- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation-forceallowtheseapps)
-- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation-forcedenytheseapps)
-- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation-userincontroloftheseapps)
+- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps)
+- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps)
+- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps)
 - [LetAppsAccessMessaging](policy-csp-privacy.md#letappsaccessmessaging)
-- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forceallowtheseapps)
-- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging-forcedenytheseapps)
-- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging-userincontroloftheseapps)
+- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging_forceallowtheseapps)
+- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging_forcedenytheseapps)
+- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging_userincontroloftheseapps)
 - [LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone)
-- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forceallowtheseapps)
-- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-forcedenytheseapps)
-- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone-userincontroloftheseapps)
+- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps)
+- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps)
+- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_userincontroloftheseapps)
 - [LetAppsAccessNotifications](policy-csp-privacy.md#letappsaccessnotifications)
-- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forceallowtheseapps)
-- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications-forcedenytheseapps)
-- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications-userincontroloftheseapps)
+- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications_forceallowtheseapps)
+- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications_forcedenytheseapps)
+- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications_userincontroloftheseapps)
 - [LetAppsAccessPhone](policy-csp-privacy.md#letappsaccessphone)
-- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone-forceallowtheseapps)
-- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone-forcedenytheseapps)
-- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone-userincontroloftheseapps)
+- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone_forceallowtheseapps)
+- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone_forcedenytheseapps)
+- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone_userincontroloftheseapps)
 - [LetAppsAccessRadios](policy-csp-privacy.md#letappsaccessradios)
-- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios-forceallowtheseapps)
-- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios-forcedenytheseapps)
-- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios-userincontroloftheseapps)
+- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios_forceallowtheseapps)
+- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios_forcedenytheseapps)
+- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios_userincontroloftheseapps)
 - [LetAppsAccessTasks](policy-csp-privacy.md#letappsaccesstasks)
-- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks-forceallowtheseapps)
-- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks-forcedenytheseapps)
-- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks-userincontroloftheseapps)
+- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks_forceallowtheseapps)
+- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks_forcedenytheseapps)
+- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks_userincontroloftheseapps)
 - [LetAppsAccessTrustedDevices](policy-csp-privacy.md#letappsaccesstrusteddevices)
-- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forceallowtheseapps)
-- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-forcedenytheseapps)
-- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices-userincontroloftheseapps)
+- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_forceallowtheseapps)
+- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_forcedenytheseapps)
+- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_userincontroloftheseapps)
 - [LetAppsActivateWithVoice](policy-csp-privacy.md#letappsactivatewithvoice)
 - [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#letappsactivatewithvoiceabovelock)
 - [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#letappsgetdiagnosticinfo)
-- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forceallowtheseapps)
-- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-forcedenytheseapps)
-- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo-userincontroloftheseapps)
+- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_forceallowtheseapps)
+- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_forcedenytheseapps)
+- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_userincontroloftheseapps)
 - [LetAppsRunInBackground](policy-csp-privacy.md#letappsruninbackground)
-- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground-forceallowtheseapps)
-- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground-forcedenytheseapps)
-- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground-userincontroloftheseapps)
+- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground_forceallowtheseapps)
+- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground_forcedenytheseapps)
+- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground_userincontroloftheseapps)
 - [LetAppsSyncWithDevices](policy-csp-privacy.md#letappssyncwithdevices)
-- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forceallowtheseapps)
-- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices-forcedenytheseapps)
-- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices-userincontroloftheseapps)
+- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices_forceallowtheseapps)
+- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices_forcedenytheseapps)
+- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices_userincontroloftheseapps)
 
 ## RestrictedGroups
 

From f234cd3e7a92496ce144b7c3b044be0472422c5d Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Mon, 20 Mar 2023 10:14:38 -0400
Subject: [PATCH 05/64] Update TOC

---
 windows/client-management/mdm/toc.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 3a88cd3e96..bded40d8ed 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -37,21 +37,21 @@ items:
         href: configuration-service-provider-ddf.md
       - name: Policy CSP support scenarios
         items:
-        - name: ADMX policies in Policy CSP
+        - name: Policies that are ADMX-backed
           href: policies-in-policy-csp-admx-backed.md
-        - name: Policies in Policy CSP supported by Group Policy
+        - name: Policies supported by Group Policy
           href: policies-in-policy-csp-supported-by-group-policy.md
-        - name: Policies in Policy CSP supported by HoloLens 2
+        - name: Policies supported by HoloLens 2
           href: policies-in-policy-csp-supported-by-hololens2.md
-        - name: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite
+        - name: Policies supported by HoloLens (1st gen) Commercial Suite
           href: policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md
-        - name: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition
+        - name: Policies supported by HoloLens (1st gen) Development Edition
           href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
-        - name: Policies in Policy CSP supported by Windows 10 IoT Core
+        - name: Policies supported by Windows 10 IoT Core
           href: policies-in-policy-csp-supported-by-iot-core.md
-        - name: Policies in Policy CSP supported by Microsoft Surface Hub
+        - name: Policies supported by Microsoft Surface Hub
           href: policies-in-policy-csp-supported-by-surface-hub.md
-        - name: Policy CSPs that can be set using Exchange Active Sync (EAS)
+        - name: Policies that can be set using Exchange Active Sync (EAS)
           href: policies-in-policy-csp-that-can-be-set-using-eas.md
       - name: Policy CSP areas
         expanded: true

From d60b9559e018d1ababace77a6bbb6fa26f9b9b2a Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 23 Mar 2023 12:13:46 -0400
Subject: [PATCH 06/64] 2303 CSP Updates

---
 .../client-management/mdm/bitlocker-csp.md    |   32 +-
 .../mdm/bitlocker-ddf-file.md                 |   64 +-
 windows/client-management/mdm/defender-csp.md |   95 +-
 windows/client-management/mdm/defender-ddf.md |   77 +-
 .../mdm/devicepreparation-csp.md              |   84 +-
 .../mdm/devicepreparation-ddf-file.md         |   47 +-
 windows/client-management/mdm/firewall-csp.md | 1153 ++++++++++++-
 .../mdm/firewall-ddf-file.md                  |  819 ++++++++-
 .../mdm/passportforwork-csp.md                |   59 +-
 .../mdm/passportforwork-ddf.md                |   45 +-
 .../mdm/personaldataencryption-csp.md         |  279 ++-
 .../mdm/personaldataencryption-ddf-file.md    |  184 +-
 .../mdm/policies-in-policy-csp-admx-backed.md |    4 +-
 ...in-policy-csp-supported-by-group-policy.md |   18 +-
 ...-in-policy-csp-supported-by-surface-hub.md |    4 +-
 .../mdm/policy-csp-abovelock.md               |    4 +-
 .../mdm/policy-csp-accounts.md                |    8 +-
 .../mdm/policy-csp-admx-addremoveprograms.md  |   19 +-
 .../mdm/policy-csp-admx-appcompat.md          |    5 +-
 .../mdm/policy-csp-admx-auditsettings.md      |    3 +-
 .../mdm/policy-csp-admx-ciphersuiteorder.md   |    4 +-
 .../mdm/policy-csp-admx-controlpanel.md       |    5 +-
 .../policy-csp-admx-controlpaneldisplay.md    |   20 +-
 .../policy-csp-admx-credentialproviders.md    |    4 +-
 .../mdm/policy-csp-admx-credssp.md            |   44 +-
 .../mdm/policy-csp-admx-ctrlaltdel.md         |    4 +-
 .../mdm/policy-csp-admx-datacollection.md     |    4 +-
 .../mdm/policy-csp-admx-dcom.md               |    4 +-
 .../mdm/policy-csp-admx-desktop.md            |   14 +-
 .../mdm/policy-csp-admx-deviceinstallation.md |    7 +-
 .../mdm/policy-csp-admx-diskquota.md          |    6 +-
 .../mdm/policy-csp-admx-errorreporting.md     |    5 +-
 .../mdm/policy-csp-admx-eventlog.md           |    4 +-
 .../mdm/policy-csp-admx-eventviewer.md        |    4 +-
 .../mdm/policy-csp-admx-explorer.md           |    4 +-
 .../mdm/policy-csp-admx-filesys.md            |    9 +-
 .../mdm/policy-csp-admx-folderredirection.md  |    4 +-
 .../mdm/policy-csp-admx-framepanes.md         |    8 +-
 .../mdm/policy-csp-admx-grouppolicy.md        |   27 +-
 .../mdm/policy-csp-admx-help.md               |    6 +-
 .../mdm/policy-csp-admx-iis.md                |    3 +-
 .../mdm/policy-csp-admx-kdc.md                |   12 +-
 .../mdm/policy-csp-admx-kerberos.md           |    3 +-
 .../mdm/policy-csp-admx-leakdiagnostic.md     |    6 +-
 .../mdm/policy-csp-admx-logon.md              |   10 +-
 ...icy-csp-admx-microsoftdefenderantivirus.md |   45 +-
 .../mdm/policy-csp-admx-mmc.md                |   10 +-
 .../mdm/policy-csp-admx-mmcsnapins.md         |    4 +-
 .../mdm/policy-csp-admx-msapolicy.md          |    3 +-
 .../mdm/policy-csp-admx-msdt.md               |    3 +-
 .../mdm/policy-csp-admx-msi.md                |   10 +-
 .../mdm/policy-csp-admx-nca.md                |    6 +-
 .../mdm/policy-csp-admx-ncsi.md               |    5 +-
 .../mdm/policy-csp-admx-netlogon.md           |   27 +-
 .../mdm/policy-csp-admx-networkconnections.md |    8 +-
 .../mdm/policy-csp-admx-offlinefiles.md       |   16 +-
 .../mdm/policy-csp-admx-peertopeercaching.md  |    7 +-
 .../mdm/policy-csp-admx-printing.md           |   13 +-
 .../mdm/policy-csp-admx-printing2.md          |    6 +-
 .../mdm/policy-csp-admx-programs.md           |   12 +-
 .../mdm/policy-csp-admx-pushtoinstall.md      |    4 +-
 .../mdm/policy-csp-admx-rpc.md                |    4 +-
 .../mdm/policy-csp-admx-sam.md                |   18 +-
 .../mdm/policy-csp-admx-settingsync.md        |   20 +-
 .../mdm/policy-csp-admx-sharedfolders.md      |    8 +-
 ...csp-admx-shellcommandpromptregedittools.md |    4 +-
 .../mdm/policy-csp-admx-smartcard.md          |   10 +-
 .../mdm/policy-csp-admx-srmfci.md             |    4 +-
 .../mdm/policy-csp-admx-startmenu.md          |   37 +-
 .../mdm/policy-csp-admx-taskbar.md            |    4 +-
 .../mdm/policy-csp-admx-tcpip.md              |    4 +-
 .../mdm/policy-csp-admx-terminalserver.md     |   43 +-
 .../mdm/policy-csp-admx-tpm.md                |    4 +-
 ...y-csp-admx-userexperiencevirtualization.md |  131 +-
 .../mdm/policy-csp-admx-userprofiles.md       |    8 +-
 .../mdm/policy-csp-admx-w32time.md            |    4 +-
 .../mdm/policy-csp-admx-wcm.md                |    8 +-
 .../mdm/policy-csp-admx-windowsexplorer.md    |   23 +-
 .../mdm/policy-csp-admx-winlogon.md           |    7 +-
 .../mdm/policy-csp-admx-workfoldersclient.md  |    4 +-
 .../mdm/policy-csp-applicationdefaults.md     |   21 +-
 .../mdm/policy-csp-applicationmanagement.md   |    9 +-
 .../mdm/policy-csp-appvirtualization.md       |    4 +-
 .../client-management/mdm/policy-csp-audit.md |  119 +-
 .../mdm/policy-csp-authentication.md          |   59 +-
 .../client-management/mdm/policy-csp-bits.md  |  119 +-
 .../mdm/policy-csp-bluetooth.md               |    4 +-
 .../mdm/policy-csp-browser.md                 |  216 ++-
 .../mdm/policy-csp-cellular.md                |   66 +-
 .../mdm/policy-csp-clouddesktop.md            |   12 +-
 .../mdm/policy-csp-connectivity.md            |   10 +-
 .../mdm/policy-csp-dataprotection.md          |    4 +-
 .../mdm/policy-csp-defender.md                |  177 +-
 .../mdm/policy-csp-deliveryoptimization.md    |   18 +-
 .../mdm/policy-csp-desktop.md                 |    4 +-
 .../mdm/policy-csp-desktopappinstaller.md     |  104 +-
 .../mdm/policy-csp-deviceguard.md             |   70 +-
 .../mdm/policy-csp-deviceinstallation.md      |   40 +-
 .../mdm/policy-csp-devicelock.md              |  221 ++-
 .../mdm/policy-csp-display.md                 |   74 +-
 .../mdm/policy-csp-education.md               |   12 +-
 .../mdm/policy-csp-enterprisecloudprint.md    |   14 +-
 .../mdm/policy-csp-experience.md              |   91 +-
 .../mdm/policy-csp-exploitguard.md            |    4 +-
 .../mdm/policy-csp-federatedauthentication.md |    4 +-
 .../mdm/policy-csp-humanpresence.md           |  242 ++-
 .../mdm/policy-csp-internetexplorer.md        |   58 +-
 .../mdm/policy-csp-kerberos.md                |   41 +-
 .../mdm/policy-csp-licensing.md               |   16 +-
 ...policy-csp-localpoliciessecurityoptions.md |  102 +-
 .../mdm/policy-csp-localusersandgroups.md     |   14 +-
 .../mdm/policy-csp-multitasking.md            |   20 +-
 .../mdm/policy-csp-networkisolation.md        |   86 +-
 .../mdm/policy-csp-networklistmanager.md      |   10 +-
 .../mdm/policy-csp-notifications.md           |   69 +-
 .../client-management/mdm/policy-csp-power.md |  116 +-
 .../mdm/policy-csp-printers.md                |   36 +-
 .../mdm/policy-csp-privacy.md                 | 1530 +++++++++++++++--
 .../mdm/policy-csp-remoteassistance.md        |    4 +-
 .../mdm/policy-csp-remotedesktop.md           |    4 +-
 .../mdm/policy-csp-remotemanagement.md        |    4 +-
 .../mdm/policy-csp-remoteshell.md             |    6 +-
 .../mdm/policy-csp-restrictedgroups.md        |    4 +-
 .../mdm/policy-csp-search.md                  |   38 +-
 .../mdm/policy-csp-security.md                |    6 +-
 .../mdm/policy-csp-settings.md                |   30 +-
 .../mdm/policy-csp-settingssync.md            |    7 +-
 .../mdm/policy-csp-smartscreen.md             |   23 +-
 .../client-management/mdm/policy-csp-start.md |   84 +-
 .../mdm/policy-csp-stickers.md                |    6 +-
 .../mdm/policy-csp-system.md                  |   74 +-
 .../mdm/policy-csp-taskmanager.md             |    4 +-
 .../mdm/policy-csp-textinput.md               |   32 +-
 .../mdm/policy-csp-update.md                  |  769 +++++++--
 .../mdm/policy-csp-userrights.md              |  101 +-
 ...olicy-csp-virtualizationbasedtechnology.md |   12 +-
 .../mdm/policy-csp-webthreatdefense.md        |    5 +-
 .../client-management/mdm/policy-csp-wifi.md  |    6 +-
 ...olicy-csp-windowsdefendersecuritycenter.md |   72 +-
 .../mdm/policy-csp-windowsinkworkspace.md     |   10 +-
 .../mdm/policy-csp-windowslogon.md            |   18 +-
 .../mdm/policy-csp-windowspowershell.md       |    3 +-
 windows/client-management/mdm/reboot-csp.md   |   44 +-
 .../client-management/mdm/reboot-ddf-file.md  |   33 +-
 .../mdm/rootcacertificates-csp.md             |   98 +-
 .../mdm/rootcacertificates-ddf-file.md        |    7 +-
 windows/client-management/mdm/supl-csp.md     |    8 +-
 .../client-management/mdm/supl-ddf-file.md    |    8 +-
 148 files changed, 7519 insertions(+), 1565 deletions(-)

diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md
index b3bbbac0bc..b34bc4709f 100644
--- a/windows/client-management/mdm/bitlocker-csp.md
+++ b/windows/client-management/mdm/bitlocker-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the BitLocker CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -176,7 +176,7 @@ require reinstallation of Windows.
 > [!NOTE]
 > This policy takes effect only if "RequireDeviceEncryption" policy is set to 1.
 
-The expected values for this policy are
+The expected values for this policy are:
 
 1 = This is the default, when the policy is not set. **Warning** prompt and encryption notification is allowed.
 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update,
@@ -317,11 +317,16 @@ Supported Values: 0 - Numeric Recovery Passwords rotation OFF.
 
 <!-- Device-EncryptionMethodByDriveType-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.
+This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.
 
-- If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511).
+- If you enable this policy setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.
 
-- If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script."
+If the "Deny write access to devices configured in another organization" option is selected, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" policy setting.
+
+- If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.
+
+> [!NOTE]
+> This policy setting can be overridden by the policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" policy setting is enabled this policy setting will be ignored.
 <!-- Device-EncryptionMethodByDriveType-Description-End -->
 
 <!-- Device-EncryptionMethodByDriveType-Editable-Begin -->
@@ -369,11 +374,12 @@ Sample value for this node to enable this policy and set the encryption methods
 
 | Name | Value |
 |:--|:--|
-| Name | EncryptionMethodWithXts_Name |
-| Friendly Name | Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) |
+| Name | RDVDenyWriteAccess_Name |
+| Friendly Name | Deny write access to removable drives not protected by BitLocker |
 | Location | Computer Configuration |
-| Path | Windows Components > BitLocker Drive Encryption |
-| Registry Key Name | SOFTWARE\Policies\Microsoft\FVE |
+| Path | Windows Components > BitLocker Drive Encryption > Removable Data Drives |
+| Registry Key Name | System\CurrentControlSet\Policies\Microsoft\FVE |
+| Registry Value Name | RDVDenyWriteAccess |
 | ADMX File Name | VolumeEncryption.admx |
 <!-- Device-EncryptionMethodByDriveType-AdmxBacked-End -->
 
@@ -1578,10 +1584,10 @@ The Windows touch keyboard (such as that used by tablets) isn't available in the
 
 - If this policy is not enabled, the Windows Recovery Environment must be enabled on tablets to support the entry of the BitLocker recovery password. When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard.
 
-**Note** that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include
-- Configure TPM startup PIN Required/Allowed
-- Configure TPM startup key and PIN Required/Allowed
-- Configure use of passwords for operating system drives.
+**Note** that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include:
+  - Configure TPM startup PIN: Required/Allowed
+  - Configure TPM startup key and PIN: Required/Allowed
+  - Configure use of passwords for operating system drives.
 <!-- Device-SystemDrivesEnablePrebootInputProtectorsOnSlates-Description-End -->
 
 <!-- Device-SystemDrivesEnablePrebootInputProtectorsOnSlates-Editable-Begin -->
diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md
index 081ef8b6f2..206cf3acd1 100644
--- a/windows/client-management/mdm/bitlocker-ddf-file.md
+++ b/windows/client-management/mdm/bitlocker-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/22/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -149,7 +149,7 @@ The following XML file contains the device description framework (DDF) for the B
                          If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.”
                          The format is string.
                          Sample value for this node to enable this policy and set the encryption methods is:
-
+                         
 
                          EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives.
                          EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives.
@@ -179,7 +179,7 @@ The following XML file contains the device description framework (DDF) for the B
           <MIME />
         </DFType>
         <MSFT:AllowedValues ValueType="ADMX">
-          <MSFT:AdmxBacked Area="VolumeEncryption~AT~WindowsComponents~FVECategory~FVERDVCategory" Name="EncryptionMethodWithXts_Name" File="VolumeEncryption.admx" />
+          <MSFT:AdmxBacked Area="VolumeEncryption~AT~WindowsComponents~FVECategory~FVERDVCategory" Name="RDVDenyWriteAccess_Name" File="VolumeEncryption.admx" />
         </MSFT:AllowedValues>
       </DFProperties>
     </Node>
@@ -201,7 +201,7 @@ The following XML file contains the device description framework (DDF) for the B
                          Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)
                          All of the below settings are for computers with a TPM.
@@ -257,7 +257,7 @@ The following XML file contains the device description framework (DDF) for the B
                          NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          Disabling the policy will let the system choose the default behaviors.
                          If you want to disable this policy use the following SyncML:
@@ -298,7 +298,7 @@ The following XML file contains the device description framework (DDF) for the B
                          Note: Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          The possible values for 'xx' are:
                          0 = Empty
@@ -351,7 +351,7 @@ The following XML file contains the device description framework (DDF) for the B
                          If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          The possible values for 'xx' are:
                          true = Explicitly allow
@@ -409,7 +409,7 @@ The following XML file contains the device description framework (DDF) for the B
                          If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          The possible values for 'xx' are:
                          true = Explicitly allow
@@ -461,7 +461,7 @@ The following XML file contains the device description framework (DDF) for the B
                          If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          Disabling the policy will let the system choose the default behaviors.
                          If you want to disable this policy use the following SyncML:
@@ -502,7 +502,7 @@ The following XML file contains the device description framework (DDF) for the B
                          Note: This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored.
                          The format is string.
                          Sample value for this node to enable this policy is:
-
+                         
 
                          The possible values for 'xx' are:
                          true = Explicitly allow
@@ -582,11 +582,11 @@ The following XML file contains the device description framework (DDF) for the B
                          require reinstallation of Windows.
                          Note: This policy takes effect only if "RequireDeviceEncryption" policy is set to 1.
                          The format is integer.
-                         The expected values for this policy are:
+                         The expected values for this policy are: 
 
                          1 = This is the default, when the policy is not set. Warning prompt and encryption notification is allowed.
-                         0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update,
-                             the value 0 only takes affect on Azure Active Directory joined devices.
+                         0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, 
+                             the value 0 only takes affect on Azure Active Directory joined devices. 
                              Windows will attempt to silently enable BitLocker for value 0.
 
                          If you want to disable this policy use the following SyncML:
@@ -630,7 +630,7 @@ The following XML file contains the device description framework (DDF) for the B
                          If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user
                          is the current logged on user in the system.
 
-                         The expected values for this policy are:
+                         The expected values for this policy are: 
 
                          1 = "RequireDeviceEncryption" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user.
                          0 = This is the default, when the policy is not set. If current logged on user is a standard user, "RequireDeviceEncryption" policy
@@ -687,17 +687,17 @@ The following XML file contains the device description framework (DDF) for the B
         </AccessType>
         <DefaultValue>0</DefaultValue>
         <Description> Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices.
-                          When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when
+                          When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when 
                           Active Directory back up for recovery password is configured to required.
                           For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives"
                           For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives"
-
+                       
                           Supported Values: 0 - Numeric Recovery Passwords rotation OFF.
                                             1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value
                                             2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices
-
+                         
                          If you want to disable this policy use the following SyncML:
-
+ 
                          112./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotationint0</Description>
         <DFFormat>
           <int />
@@ -739,20 +739,20 @@ The following XML file contains the device description framework (DDF) for the B
         </AccessType>
         <Description> Allows admin to push one-time rotation of all numeric recovery passwords for OS and Fixed Data drives on an Azure Active Directory or hybrid-joined device.
                           This policy is Execute type and rotates all numeric passwords when issued from MDM tools.
-
+                          
 The policy only comes into effect when Active Directory backup for a recovery password is configured to "required."
                               * For OS drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for operating system drives."
                               *For fixed drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for fixed data drives."
-
-                          Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes:
-
-* status\RotateRecoveryPasswordsStatus
+                       
+                          Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: 
+                              
+* status\RotateRecoveryPasswordsStatus 
                               * status\RotateRecoveryPasswordsRequestID
+                          
 
-
-
+                          
 Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\
-
+                         
                          113./Device/Vendor/MSFT/BitLocker/RotateRecoveryPasswordschr</Description>
         <DFFormat>
           <chr />
@@ -824,10 +824,10 @@ Supported Values: String form of request ID. Example format of request ID is GUI
           <AccessType>
             <Get />
           </AccessType>
-          <Description> This Node reports the status of RotateRecoveryPasswords request.
+          <Description> This Node reports the status of RotateRecoveryPasswords request. 
                                 Status code can be one of the following:
-                                NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure
-
+                                NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure 
+  
                   </Description>
           <DFFormat>
             <int />
@@ -853,10 +853,10 @@ Supported Values: String form of request ID. Example format of request ID is GUI
           <AccessType>
             <Get />
           </AccessType>
-          <Description> This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus.
+          <Description> This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. 
                                 This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus
-                                To ensure the status is correctly matched to the request ID.
-
+                                To ensure the status is correctly matched to the request ID.                        
+                    
                   </Description>
           <DFFormat>
             <chr />
diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md
index 40d679359a..fe160a4fe0 100644
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the Defender CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -58,6 +58,7 @@ The following list shows the Defender configuration service provider nodes:
     - [EnableFileHashComputation](#configurationenablefilehashcomputation)
     - [EngineUpdatesChannel](#configurationengineupdateschannel)
     - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins)
+    - [HideExclusionsFromLocalUsers](#configurationhideexclusionsfromlocalusers)
     - [IntelTDTEnabled](#configurationinteltdtenabled)
     - [MeteredConnectionUpdates](#configurationmeteredconnectionupdates)
     - [PassiveRemediation](#configurationpassiveremediation)
@@ -65,6 +66,7 @@ The following list shows the Defender configuration service provider nodes:
     - [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes)
     - [ScanOnlyIfIdleEnabled](#configurationscanonlyifidleenabled)
     - [SchedulerRandomizationTime](#configurationschedulerrandomizationtime)
+    - [SecuredDevicesConfiguration](#configurationsecureddevicesconfiguration)
     - [SecurityIntelligenceUpdatesChannel](#configurationsecurityintelligenceupdateschannel)
     - [SupportLogLocation](#configurationsupportloglocation)
     - [TamperProtection](#configurationtamperprotection)
@@ -1622,7 +1624,7 @@ Enable this policy to specify when devices receive Microsoft Defender engine upd
 
 <!-- Device-Configuration-HideExclusionsFromLocalAdmins-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled.
+This policy setting controls whether or not exclusions are visible to local admins. To control local users exclusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set.
 <!-- Device-Configuration-HideExclusionsFromLocalAdmins-Description-End -->
 
 <!-- Device-Configuration-HideExclusionsFromLocalAdmins-Editable-Begin -->
@@ -1656,6 +1658,55 @@ This policy setting controls whether or not exclusions are visible to local admi
 
 <!-- Device-Configuration-HideExclusionsFromLocalAdmins-End -->
 
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Begin -->
+### Configuration/HideExclusionsFromLocalUsers
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later |
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Applicability-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/HideExclusionsFromLocalUsers
+```
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-OmaUri-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Description-Begin -->
+<!-- Description-Source-DDF -->
+This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set.
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Description-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Editable-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-DFProperties-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 1 | If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. |
+| 0 (Default) | If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell. |
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-AllowedValues-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-Examples-End -->
+
+<!-- Device-Configuration-HideExclusionsFromLocalUsers-End -->
+
 <!-- Device-Configuration-IntelTDTEnabled-Begin -->
 ### Configuration/IntelTDTEnabled
 
@@ -1696,6 +1747,7 @@ This policy setting configures the Intel TDT integration level for Intel TDT-cap
 | Value | Description |
 |:--|:--|
 | 0 (Default) | If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat. |
+| 1 | If you configure this setting to enabled, Intel TDT integration will turn on. |
 | 2 | If you configure this setting to disabled, Intel TDT integration will turn off. |
 <!-- Device-Configuration-IntelTDTEnabled-AllowedValues-End -->
 
@@ -1996,6 +2048,45 @@ This setting allows you to configure the scheduler randomization in hours. The r
 
 <!-- Device-Configuration-SchedulerRandomizationTime-End -->
 
+<!-- Device-Configuration-SecuredDevicesConfiguration-Begin -->
+### Configuration/SecuredDevicesConfiguration
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later |
+<!-- Device-Configuration-SecuredDevicesConfiguration-Applicability-End -->
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Defender/Configuration/SecuredDevicesConfiguration
+```
+<!-- Device-Configuration-SecuredDevicesConfiguration-OmaUri-End -->
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-Description-Begin -->
+<!-- Description-Source-DDF -->
+Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured.
+<!-- Device-Configuration-SecuredDevicesConfiguration-Description-End -->
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Configuration-SecuredDevicesConfiguration-Editable-End -->
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+<!-- Device-Configuration-SecuredDevicesConfiguration-DFProperties-End -->
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Configuration-SecuredDevicesConfiguration-Examples-End -->
+
+<!-- Device-Configuration-SecuredDevicesConfiguration-End -->
+
 <!-- Device-Configuration-SecurityIntelligenceUpdatesChannel-Begin -->
 ### Configuration/SecurityIntelligenceUpdatesChannel
 
diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md
index b540c17da8..4a653a572d 100644
--- a/windows/client-management/mdm/defender-ddf.md
+++ b/windows/client-management/mdm/defender-ddf.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/17/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -1852,7 +1852,7 @@ The following XML file contains the device description framework (DDF) for the D
             <Replace />
           </AccessType>
           <DefaultValue>0</DefaultValue>
-          <Description>This policy setting controls whether or not exclusions are visible to local admins.  For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled.</Description>
+          <Description>This policy setting controls whether or not exclusions are visible to local admins. To control local users exlcusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set.</Description>
           <DFFormat>
             <int />
           </DFFormat>
@@ -1881,6 +1881,45 @@ The following XML file contains the device description framework (DDF) for the D
           </MSFT:AllowedValues>
         </DFProperties>
       </Node>
+      <Node>
+        <NodeName>HideExclusionsFromLocalUsers</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <DefaultValue>0</DefaultValue>
+          <Description>This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set.</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:Applicability>
+            <MSFT:OsBuildVersion>10.0.17763</MSFT:OsBuildVersion>
+            <MSFT:CspVersion>1.3</MSFT:CspVersion>
+          </MSFT:Applicability>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
       <Node>
         <NodeName>ThrottleForScheduledScanOnly</NodeName>
         <DFProperties>
@@ -2010,6 +2049,36 @@ The following XML file contains the device description framework (DDF) for the D
           </MSFT:AllowedValues>
         </DFProperties>
       </Node>
+      <Node>
+        <NodeName>SecuredDevicesConfiguration</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <Description>Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured.</Description>
+          <DFFormat>
+            <chr />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:Applicability>
+            <MSFT:OsBuildVersion>10.0.17763</MSFT:OsBuildVersion>
+            <MSFT:CspVersion>1.3</MSFT:CspVersion>
+          </MSFT:Applicability>
+          <MSFT:AllowedValues ValueType="None">
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
       <Node>
         <NodeName>DataDuplicationLocalRetentionPeriod</NodeName>
         <DFProperties>
@@ -2197,6 +2266,10 @@ The following XML file contains the device description framework (DDF) for the D
               <MSFT:Value>0</MSFT:Value>
               <MSFT:ValueDescription>If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat.</MSFT:ValueDescription>
             </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>If you configure this setting to enabled, Intel TDT integration will turn on.</MSFT:ValueDescription>
+            </MSFT:Enum>
             <MSFT:Enum>
               <MSFT:Value>2</MSFT:Value>
               <MSFT:ValueDescription>If you configure this setting to disabled, Intel TDT integration will turn off.</MSFT:ValueDescription>
diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md
index 35028e068e..e32d2c6c9a 100644
--- a/windows/client-management/mdm/devicepreparation-csp.md
+++ b/windows/client-management/mdm/devicepreparation-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the DevicePreparation CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -31,6 +31,8 @@ The following list shows the DevicePreparation configuration service provider no
     - [ClassID](#bootstrapperagentclassid)
     - [ExecutionContext](#bootstrapperagentexecutioncontext)
     - [InstallationStatusUri](#bootstrapperagentinstallationstatusuri)
+  - [MDMProvider](#mdmprovider)
+    - [Progress](#mdmproviderprogress)
   - [PageEnabled](#pageenabled)
   - [PageSettings](#pagesettings)
   - [PageStatus](#pagestatus)
@@ -192,6 +194,84 @@ This node holds a URI that can be queried for the status of the Bootstrapper Age
 
 <!-- Device-BootstrapperAgent-InstallationStatusUri-End -->
 
+<!-- Device-MDMProvider-Begin -->
+## MDMProvider
+
+<!-- Device-MDMProvider-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- Device-MDMProvider-Applicability-End -->
+
+<!-- Device-MDMProvider-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/DevicePreparation/MDMProvider
+```
+<!-- Device-MDMProvider-OmaUri-End -->
+
+<!-- Device-MDMProvider-Description-Begin -->
+<!-- Description-Source-DDF -->
+The subnode configures the settings for the MDMProvider.
+<!-- Device-MDMProvider-Description-End -->
+
+<!-- Device-MDMProvider-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MDMProvider-Editable-End -->
+
+<!-- Device-MDMProvider-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Get |
+<!-- Device-MDMProvider-DFProperties-End -->
+
+<!-- Device-MDMProvider-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MDMProvider-Examples-End -->
+
+<!-- Device-MDMProvider-End -->
+
+<!-- Device-MDMProvider-Progress-Begin -->
+### MDMProvider/Progress
+
+<!-- Device-MDMProvider-Progress-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- Device-MDMProvider-Progress-Applicability-End -->
+
+<!-- Device-MDMProvider-Progress-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/DevicePreparation/MDMProvider/Progress
+```
+<!-- Device-MDMProvider-Progress-OmaUri-End -->
+
+<!-- Device-MDMProvider-Progress-Description-Begin -->
+<!-- Description-Source-DDF -->
+Noode for reporting progress status as opaque data.
+<!-- Device-MDMProvider-Progress-Description-End -->
+
+<!-- Device-MDMProvider-Progress-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MDMProvider-Progress-Editable-End -->
+
+<!-- Device-MDMProvider-Progress-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Get, Replace |
+<!-- Device-MDMProvider-Progress-DFProperties-End -->
+
+<!-- Device-MDMProvider-Progress-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MDMProvider-Progress-Examples-End -->
+
+<!-- Device-MDMProvider-Progress-End -->
+
 <!-- Device-PageEnabled-Begin -->
 ## PageEnabled
 
@@ -297,7 +377,7 @@ This node configures specific settings for the Device Preparation page.
 
 <!-- Device-PageStatus-Description-Begin -->
 <!-- Description-Source-DDF -->
-This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = Succeeded; 4 = Failed.
+This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = ExitedOnSuccess; 4 = ExitedOnFailure.
 <!-- Device-PageStatus-Description-End -->
 
 <!-- Device-PageStatus-Editable-Begin -->
diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md
index e10e6a1a49..c2a8a4aa4e 100644
--- a/windows/client-management/mdm/devicepreparation-ddf-file.md
+++ b/windows/client-management/mdm/devicepreparation-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/17/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -89,7 +89,7 @@ The following XML file contains the device description framework (DDF) for the D
         <AccessType>
           <Get />
         </AccessType>
-        <Description>This node provides status of the Device Preparation page.  Values are an enum: 0 = Disabled; 1 = Enabled;  2 = InProgress; 3 = Succeeded; 4 = Failed.</Description>
+        <Description>This node provides status of the Device Preparation page.  Values are an enum: 0 = Disabled; 1 = Enabled;  2 = InProgress; 3 = ExitedOnSuccess; 4 = ExitedOnFailure.</Description>
         <DFFormat>
           <int />
         </DFFormat>
@@ -243,6 +243,49 @@ The following XML file contains the device description framework (DDF) for the D
         </DFProperties>
       </Node>
     </Node>
+    <Node>
+      <NodeName>MDMProvider</NodeName>
+      <DFProperties>
+        <AccessType>
+          <Get />
+        </AccessType>
+        <Description>The subnode configures the settings for the MDMProvider.</Description>
+        <DFFormat>
+          <node />
+        </DFFormat>
+        <Occurrence>
+          <One />
+        </Occurrence>
+        <Scope>
+          <Permanent />
+        </Scope>
+        <DFType>
+          <DDFName />
+        </DFType>
+      </DFProperties>
+      <Node>
+        <NodeName>Progress</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Get />
+            <Replace />
+          </AccessType>
+          <Description>Noode for reporting progress status as opaque data.</Description>
+          <DFFormat>
+            <chr />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Permanent />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+        </DFProperties>
+      </Node>
+    </Node>
   </Node>
 </MgmtTree>
 ```
diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md
index e0917186af..c5b31e1372 100644
--- a/windows/client-management/mdm/firewall-csp.md
+++ b/windows/client-management/mdm/firewall-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the Firewall CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -104,19 +104,41 @@ The following list shows the Firewall configuration service provider nodes:
         - [Enabled](#mdmstorehypervfirewallrulesfirewallrulenameenabled)
         - [LocalAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocaladdressranges)
         - [LocalPortRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocalportranges)
-        - [Name](#mdmstorehypervfirewallrulesfirewallrulenamename)
         - [Priority](#mdmstorehypervfirewallrulesfirewallrulenamepriority)
+        - [Profiles](#mdmstorehypervfirewallrulesfirewallrulenameprofiles)
         - [Protocol](#mdmstorehypervfirewallrulesfirewallrulenameprotocol)
         - [RemoteAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteaddressranges)
         - [RemotePortRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteportranges)
         - [Status](#mdmstorehypervfirewallrulesfirewallrulenamestatus)
         - [VMCreatorId](#mdmstorehypervfirewallrulesfirewallrulenamevmcreatorid)
+    - [HyperVLoopbackRules](#mdmstorehypervloopbackrules)
+      - [{RuleName}](#mdmstorehypervloopbackrulesrulename)
+        - [DestinationVMCreatorId](#mdmstorehypervloopbackrulesrulenamedestinationvmcreatorid)
+        - [Enabled](#mdmstorehypervloopbackrulesrulenameenabled)
+        - [PortRanges](#mdmstorehypervloopbackrulesrulenameportranges)
+        - [SourceVMCreatorId](#mdmstorehypervloopbackrulesrulenamesourcevmcreatorid)
     - [HyperVVMSettings](#mdmstorehypervvmsettings)
       - [{VMCreatorId}](#mdmstorehypervvmsettingsvmcreatorid)
+        - [AllowHostPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge)
         - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoriddefaultinboundaction)
         - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoriddefaultoutboundaction)
+        - [DomainProfile](#mdmstorehypervvmsettingsvmcreatoriddomainprofile)
+          - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoriddomainprofileallowlocalpolicymerge)
+          - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoriddomainprofiledefaultinboundaction)
+          - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoriddomainprofiledefaultoutboundaction)
+          - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall)
         - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridenablefirewall)
         - [EnableLoopback](#mdmstorehypervvmsettingsvmcreatoridenableloopback)
+        - [PrivateProfile](#mdmstorehypervvmsettingsvmcreatoridprivateprofile)
+          - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridprivateprofileallowlocalpolicymerge)
+          - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoridprivateprofiledefaultinboundaction)
+          - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoridprivateprofiledefaultoutboundaction)
+          - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridprivateprofileenablefirewall)
+        - [PublicProfile](#mdmstorehypervvmsettingsvmcreatoridpublicprofile)
+          - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridpublicprofileallowlocalpolicymerge)
+          - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoridpublicprofiledefaultinboundaction)
+          - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoridpublicprofiledefaultoutboundaction)
+          - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridpublicprofileenablefirewall)
     - [PrivateProfile](#mdmstoreprivateprofile)
       - [AllowLocalIpsecPolicyMerge](#mdmstoreprivateprofileallowlocalipsecpolicymerge)
       - [AllowLocalPolicyMerge](#mdmstoreprivateprofileallowlocalpolicymerge)
@@ -1093,7 +1115,7 @@ This value is used as an on/off switch. If this value is on and EnableFirewall i
 <!-- Device-MdmStore-DynamicKeywords-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-DynamicKeywords-Applicability-End -->
 
 <!-- Device-MdmStore-DynamicKeywords-OmaUri-Begin -->
@@ -1131,7 +1153,7 @@ This value is used as an on/off switch. If this value is on and EnableFirewall i
 <!-- Device-MdmStore-DynamicKeywords-Addresses-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-DynamicKeywords-Addresses-Applicability-End -->
 
 <!-- Device-MdmStore-DynamicKeywords-Addresses-OmaUri-Begin -->
@@ -1170,7 +1192,7 @@ A list of dynamic keyword addresses for use within firewall rules. Dynamic keywo
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Applicability-End -->
 
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-OmaUri-Begin -->
@@ -1212,7 +1234,7 @@ A unique GUID string identifier for this dynamic keyword address.
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Addresses-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Addresses-Applicability-End -->
 
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Addresses-OmaUri-Begin -->
@@ -1258,7 +1280,7 @@ An IPv6 address range in the format of "start address - end address" with no spa
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-AutoResolve-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-AutoResolve-Applicability-End -->
 
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-AutoResolve-OmaUri-Begin -->
@@ -1307,7 +1329,7 @@ If this flag is set to TRUE, then the 'keyword' field of this object is expected
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Keyword-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Keyword-Applicability-End -->
 
 <!-- Device-MdmStore-DynamicKeywords-Addresses-{Id}-Keyword-OmaUri-Begin -->
@@ -2078,7 +2100,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
 |:--|:--|
 | Format | chr (string) |
 | Access Type | Add, Delete, Get, Replace |
-| Allowed Values | List (Delimiter: `,`) |
+| Allowed Values | Regular Expression: `^[0-9,-]+$` |
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-LocalPortRanges-DFProperties-End -->
 
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-LocalPortRanges-Examples-Begin -->
@@ -2303,7 +2325,7 @@ Specifies the profiles to which the rule belongs: Domain, Private, Public. See [
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemoteAddressDynamicKeywords-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later <br> :heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemoteAddressDynamicKeywords-Applicability-End -->
 
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemoteAddressDynamicKeywords-OmaUri-Begin -->
@@ -2422,7 +2444,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
 |:--|:--|
 | Format | chr (string) |
 | Access Type | Add, Delete, Get, Replace |
-| Allowed Values | List (Delimiter: `,`) |
+| Allowed Values | Regular Expression: `^[0-9,-]+$` |
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemotePortRanges-DFProperties-End -->
 
 <!-- Device-MdmStore-FirewallRules-{FirewallRuleName}-RemotePortRanges-Examples-Begin -->
@@ -3354,7 +3376,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
 |:--|:--|
 | Format | chr (string) |
 | Access Type | Add, Delete, Get, Replace |
-| Allowed Values | List (Delimiter: `,`) |
+| Allowed Values | Regular Expression: `^[0-9,-]+$` |
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-LocalPortRanges-DFProperties-End -->
 
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-LocalPortRanges-Examples-Begin -->
@@ -3363,44 +3385,6 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
 
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-LocalPortRanges-End -->
 
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Begin -->
-##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Applicability-Begin -->
-| Scope | Editions | Applicable OS |
-|:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Applicability-End -->
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-OmaUri-Begin -->
-```Device
-./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name
-```
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-OmaUri-End -->
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Description-Begin -->
-<!-- Description-Source-Not-Found -->
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Description-End -->
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Editable-Begin -->
-<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Editable-End -->
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-DFProperties-Begin -->
-**Description framework properties**:
-
-| Property name | Property value |
-|:--|:--|
-| Format | chr (string) |
-| Access Type | Add, Delete, Get, Replace |
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-DFProperties-End -->
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Examples-Begin -->
-<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-Examples-End -->
-
-<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Name-End -->
-
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-Begin -->
 ##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Priority
 
@@ -3441,6 +3425,56 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
 
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Priority-End -->
 
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Begin -->
+##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Profiles
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Profiles
+```
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Description-Begin -->
+<!-- Description-Source-DDF -->
+Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All.
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Description-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Editable-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-AllowedValues-Begin -->
+**Allowed values**:
+
+| Flag | Description |
+|:--|:--|
+| 0x1 | FW_PROFILE_TYPE_DOMAIN:  This value represents the profile for networks that are connected to domains. |
+| 0x2 | FW_PROFILE_TYPE_STANDARD:  This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE:  This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD. |
+| 0x4 | FW_PROFILE_TYPE_PUBLIC:  This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted. |
+| 0x7FFFFFFF | FW_PROFILE_TYPE_ALL:  This value represents all these network sets and any future network sets. |
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-Examples-End -->
+
+<!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Profiles-End -->
+
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-Protocol-Begin -->
 ##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Protocol
 
@@ -3557,7 +3591,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the
 |:--|:--|
 | Format | chr (string) |
 | Access Type | Add, Delete, Get, Replace |
-| Allowed Values | List (Delimiter: `,`) |
+| Allowed Values | Regular Expression: `^[0-9,-]+$` |
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-RemotePortRanges-DFProperties-End -->
 
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-RemotePortRanges-Examples-Begin -->
@@ -3645,6 +3679,255 @@ This field specifies the VM Creator ID that this rule is applicable to. A NULL G
 
 <!-- Device-MdmStore-HyperVFirewallRules-{FirewallRuleName}-VMCreatorId-End -->
 
+<!-- Device-MdmStore-HyperVLoopbackRules-Begin -->
+### MdmStore/HyperVLoopbackRules
+
+<!-- Device-MdmStore-HyperVLoopbackRules-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVLoopbackRules-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules
+```
+<!-- Device-MdmStore-HyperVLoopbackRules-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-Description-Begin -->
+<!-- Description-Source-DDF -->
+A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules.
+<!-- Device-MdmStore-HyperVLoopbackRules-Description-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-Editable-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Get |
+<!-- Device-MdmStore-HyperVLoopbackRules-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-Examples-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Begin -->
+#### MdmStore/HyperVLoopbackRules/{RuleName}
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}
+```
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Description-Begin -->
+<!-- Description-Source-DDF -->
+Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Description-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Editable-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Add, Delete, Get, Replace |
+| Atomic Required | True |
+| Dynamic Node Naming | ServerGeneratedUniqueIdentifier |
+| Allowed Values | Regular Expression: `^[^|/]*$` |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Examples-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Begin -->
+##### MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId
+```
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Description-Begin -->
+<!-- Description-Source-DDF -->
+This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All.
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Description-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Editable-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-Examples-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-DestinationVMCreatorId-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Begin -->
+##### MdmStore/HyperVLoopbackRules/{RuleName}/Enabled
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/Enabled
+```
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Description-Begin -->
+<!-- Description-Source-DDF -->
+Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default.
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Description-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Editable-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Get, Replace |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Disabled. |
+| 1 | Enabled. |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-Examples-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-Enabled-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Begin -->
+##### MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges
+```
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Description-Begin -->
+<!-- Description-Source-DDF -->
+Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All.
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Description-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Editable-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Regular Expression: `^[0-9,-]+$` |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-Examples-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-PortRanges-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Begin -->
+##### MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId
+```
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Description-Begin -->
+<!-- Description-Source-DDF -->
+This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All.
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Description-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Editable-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` |
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-Examples-End -->
+
+<!-- Device-MdmStore-HyperVLoopbackRules-{RuleName}-SourceVMCreatorId-End -->
+
 <!-- Device-MdmStore-HyperVVMSettings-Begin -->
 ### MdmStore/HyperVVMSettings
 
@@ -3726,6 +4009,55 @@ VM Creator ID that these settings apply to. Valid format is a GUID.
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-End -->
 
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Begin -->
+##### MdmStore/HyperVVMSettings/{VMCreatorId}/AllowHostPolicyMerge
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/AllowHostPolicyMerge
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Get, Replace |
+| Default Value  | true |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | AllowHostPolicyMerge Off. |
+| true (Default) | AllowHostPolicyMerge On. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-AllowHostPolicyMerge-End -->
+
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Begin -->
 ##### MdmStore/HyperVVMSettings/{VMCreatorId}/DefaultInboundAction
 
@@ -3743,7 +4075,7 @@ VM Creator ID that these settings apply to. Valid format is a GUID.
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Description-Begin -->
 <!-- Description-Source-DDF -->
-This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
+This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Description-End -->
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultInboundAction-Editable-Begin -->
@@ -3793,7 +4125,7 @@ This value is the action that the firewall does by default (and evaluates at the
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-Description-Begin -->
 <!-- Description-Source-DDF -->
-This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
+This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-Description-End -->
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-Editable-Begin -->
@@ -3826,6 +4158,243 @@ This value is the action that the firewall does by default (and evaluates at the
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DefaultOutboundAction-End -->
 
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Begin -->
+##### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Description-Begin -->
+<!-- Description-Source-Not-Found -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Get |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/AllowLocalPolicyMerge
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/AllowLocalPolicyMerge
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Replace |
+| Default Value  | true |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | AllowLocalPolicyMerge Off. |
+| true (Default) | AllowLocalPolicyMerge On. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-AllowLocalPolicyMerge-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultInboundAction
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultInboundAction
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+| Default Value  | 1 |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Allow Inbound By Default. |
+| 1 (Default) | Block Inbound By Default. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultInboundAction-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultOutboundAction
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultOutboundAction
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+| Default Value  | 0 |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Allow Outbound By Default. |
+| 1 | Block Outbound By Default. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-DefaultOutboundAction-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/EnableFirewall
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/EnableFirewall
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is an on/off switch for the firewall and advanced security enforcement.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Replace |
+| Default Value  | true |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | Disable Firewall. |
+| true (Default) | Enable Firewall. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-DomainProfile-EnableFirewall-End -->
+
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Begin -->
 ##### MdmStore/HyperVVMSettings/{VMCreatorId}/EnableFirewall
 
@@ -3843,7 +4412,7 @@ This value is the action that the firewall does by default (and evaluates at the
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Description-Begin -->
 <!-- Description-Source-DDF -->
-This value is an on/off switch for the firewall and advanced security enforcement.
+This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Description-End -->
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableFirewall-Editable-Begin -->
@@ -3892,7 +4461,7 @@ This value is an on/off switch for the firewall and advanced security enforcemen
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableLoopback-Description-Begin -->
 <!-- Description-Source-DDF -->
-This value is an on/off switch for loopback traffic. This determines if this VM type is able to send/receive loopback traffic.
+This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host.
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableLoopback-Description-End -->
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableLoopback-Editable-Begin -->
@@ -3924,6 +4493,480 @@ This value is an on/off switch for loopback traffic. This determines if this VM
 
 <!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-EnableLoopback-End -->
 
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Begin -->
+##### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Description-Begin -->
+<!-- Description-Source-Not-Found -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Get |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/AllowLocalPolicyMerge
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/AllowLocalPolicyMerge
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Replace |
+| Default Value  | true |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | AllowLocalPolicyMerge Off. |
+| true (Default) | AllowLocalPolicyMerge On. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-AllowLocalPolicyMerge-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultInboundAction
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultInboundAction
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+| Default Value  | 1 |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Allow Inbound By Default. |
+| 1 (Default) | Block Inbound By Default. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultInboundAction-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultOutboundAction
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultOutboundAction
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+| Default Value  | 0 |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Allow Outbound By Default. |
+| 1 | Block Outbound By Default. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-DefaultOutboundAction-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/EnableFirewall
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/EnableFirewall
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is an on/off switch for the firewall and advanced security enforcement.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Replace |
+| Default Value  | true |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | Disable Firewall. |
+| true (Default) | Enable Firewall. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PrivateProfile-EnableFirewall-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Begin -->
+##### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Description-Begin -->
+<!-- Description-Source-Not-Found -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Get |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/AllowLocalPolicyMerge
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/AllowLocalPolicyMerge
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Replace |
+| Default Value  | true |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | AllowLocalPolicyMerge Off. |
+| true (Default) | AllowLocalPolicyMerge On. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-AllowLocalPolicyMerge-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultInboundAction
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultInboundAction
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+| Default Value  | 1 |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Allow Inbound By Default. |
+| 1 (Default) | Block Inbound By Default. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultInboundAction-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultOutboundAction
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultOutboundAction
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get, Replace |
+| Default Value  | 0 |
+| Dependency [Enable Firewall] | Dependency Type: `DependsOn` <br> Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall` <br> Dependency Allowed Value: `true` <br> Dependency Allowed Value Type: `ENUM` <br>  |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Allow Outbound By Default. |
+| 1 | Block Outbound By Default. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-DefaultOutboundAction-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Begin -->
+###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/EnableFirewall
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Applicability-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-OmaUri-Begin -->
+```Device
+./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/EnableFirewall
+```
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-OmaUri-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Description-Begin -->
+<!-- Description-Source-DDF -->
+This value is an on/off switch for the firewall and advanced security enforcement.
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Description-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Editable-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Replace |
+| Default Value  | true |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-DFProperties-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false | Disable Firewall. |
+| true (Default) | Enable Firewall. |
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-AllowedValues-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-Examples-End -->
+
+<!-- Device-MdmStore-HyperVVMSettings-{VMCreatorId}-PublicProfile-EnableFirewall-End -->
+
 <!-- Device-MdmStore-PrivateProfile-Begin -->
 ### MdmStore/PrivateProfile
 
diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md
index a55d7cb441..4eb6ee5f96 100644
--- a/windows/client-management/mdm/firewall-ddf-file.md
+++ b/windows/client-management/mdm/firewall-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/27/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -2855,7 +2855,7 @@ The following XML file contains the device description framework (DDF) for the F
                 <Replace />
               </AccessType>
               <DefaultValue>true</DefaultValue>
-              <Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
+              <Description>This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
               <DFFormat>
                 <bool />
               </DFFormat>
@@ -2888,7 +2888,7 @@ The following XML file contains the device description framework (DDF) for the F
                 <Replace />
               </AccessType>
               <DefaultValue>0</DefaultValue>
-              <Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
+              <Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
               <DFFormat>
                 <int />
               </DFFormat>
@@ -2934,7 +2934,7 @@ The following XML file contains the device description framework (DDF) for the F
                 <Replace />
               </AccessType>
               <DefaultValue>1</DefaultValue>
-              <Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
+              <Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree.</Description>
               <DFFormat>
                 <int />
               </DFFormat>
@@ -2979,7 +2979,7 @@ The following XML file contains the device description framework (DDF) for the F
                 <Replace />
               </AccessType>
               <DefaultValue>false</DefaultValue>
-              <Description>This value is an on/off switch for loopback traffic. This determines if this VM type is able to send/receive loopback traffic.</Description>
+              <Description>This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host.</Description>
               <DFFormat>
                 <bool />
               </DFFormat>
@@ -3004,6 +3004,606 @@ The following XML file contains the device description framework (DDF) for the F
               </MSFT:AllowedValues>
             </DFProperties>
           </Node>
+          <Node>
+            <NodeName>AllowHostPolicyMerge</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Get />
+                <Replace />
+              </AccessType>
+              <DefaultValue>true</DefaultValue>
+              <Description>This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall.</Description>
+              <DFFormat>
+                <bool />
+              </DFFormat>
+              <Occurrence>
+                <One />
+              </Occurrence>
+              <Scope>
+                <Permanent />
+              </Scope>
+              <DFType>
+                <MIME />
+              </DFType>
+              <MSFT:AllowedValues ValueType="ENUM">
+                <MSFT:Enum>
+                  <MSFT:Value>false</MSFT:Value>
+                  <MSFT:ValueDescription>AllowHostPolicyMerge Off</MSFT:ValueDescription>
+                </MSFT:Enum>
+                <MSFT:Enum>
+                  <MSFT:Value>true</MSFT:Value>
+                  <MSFT:ValueDescription>AllowHostPolicyMerge On</MSFT:ValueDescription>
+                </MSFT:Enum>
+              </MSFT:AllowedValues>
+            </DFProperties>
+          </Node>
+          <Node>
+            <NodeName>DomainProfile</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Get />
+              </AccessType>
+              <DFFormat>
+                <node />
+              </DFFormat>
+              <Occurrence>
+                <One />
+              </Occurrence>
+              <Scope>
+                <Permanent />
+              </Scope>
+              <DFType>
+                <DDFName />
+              </DFType>
+            </DFProperties>
+            <Node>
+              <NodeName>EnableFirewall</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Replace />
+                </AccessType>
+                <DefaultValue>true</DefaultValue>
+                <Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
+                <DFFormat>
+                  <bool />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>false</MSFT:Value>
+                    <MSFT:ValueDescription>Disable Firewall</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>true</MSFT:Value>
+                    <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>DefaultOutboundAction</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Get />
+                  <Replace />
+                </AccessType>
+                <DefaultValue>0</DefaultValue>
+                <Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
+                <DFFormat>
+                  <int />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>0</MSFT:Value>
+                    <MSFT:ValueDescription>Allow Outbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>1</MSFT:Value>
+                    <MSFT:ValueDescription>Block Outbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>DefaultInboundAction</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Get />
+                  <Replace />
+                </AccessType>
+                <DefaultValue>1</DefaultValue>
+                <Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
+                <DFFormat>
+                  <int />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>0</MSFT:Value>
+                    <MSFT:ValueDescription>Allow Inbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>1</MSFT:Value>
+                    <MSFT:ValueDescription>Block Inbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>AllowLocalPolicyMerge</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Replace />
+                </AccessType>
+                <DefaultValue>true</DefaultValue>
+                <Description>This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced.  The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.</Description>
+                <DFFormat>
+                  <bool />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>false</MSFT:Value>
+                    <MSFT:ValueDescription>AllowLocalPolicyMerge Off</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>true</MSFT:Value>
+                    <MSFT:ValueDescription>AllowLocalPolicyMerge On</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+          </Node>
+          <Node>
+            <NodeName>PrivateProfile</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Get />
+              </AccessType>
+              <DFFormat>
+                <node />
+              </DFFormat>
+              <Occurrence>
+                <One />
+              </Occurrence>
+              <Scope>
+                <Permanent />
+              </Scope>
+              <DFType>
+                <DDFName />
+              </DFType>
+            </DFProperties>
+            <Node>
+              <NodeName>EnableFirewall</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Replace />
+                </AccessType>
+                <DefaultValue>true</DefaultValue>
+                <Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
+                <DFFormat>
+                  <bool />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>false</MSFT:Value>
+                    <MSFT:ValueDescription>Disable Firewall</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>true</MSFT:Value>
+                    <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>DefaultOutboundAction</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Get />
+                  <Replace />
+                </AccessType>
+                <DefaultValue>0</DefaultValue>
+                <Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
+                <DFFormat>
+                  <int />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>0</MSFT:Value>
+                    <MSFT:ValueDescription>Allow Outbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>1</MSFT:Value>
+                    <MSFT:ValueDescription>Block Outbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>DefaultInboundAction</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Get />
+                  <Replace />
+                </AccessType>
+                <DefaultValue>1</DefaultValue>
+                <Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
+                <DFFormat>
+                  <int />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>0</MSFT:Value>
+                    <MSFT:ValueDescription>Allow Inbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>1</MSFT:Value>
+                    <MSFT:ValueDescription>Block Inbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>AllowLocalPolicyMerge</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Replace />
+                </AccessType>
+                <DefaultValue>true</DefaultValue>
+                <Description>This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced.  The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.</Description>
+                <DFFormat>
+                  <bool />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>false</MSFT:Value>
+                    <MSFT:ValueDescription>AllowLocalPolicyMerge Off</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>true</MSFT:Value>
+                    <MSFT:ValueDescription>AllowLocalPolicyMerge On</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+          </Node>
+          <Node>
+            <NodeName>PublicProfile</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Get />
+              </AccessType>
+              <DFFormat>
+                <node />
+              </DFFormat>
+              <Occurrence>
+                <One />
+              </Occurrence>
+              <Scope>
+                <Permanent />
+              </Scope>
+              <DFType>
+                <DDFName />
+              </DFType>
+            </DFProperties>
+            <Node>
+              <NodeName>EnableFirewall</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Replace />
+                </AccessType>
+                <DefaultValue>true</DefaultValue>
+                <Description>This value is an on/off switch for the firewall and advanced security enforcement.</Description>
+                <DFFormat>
+                  <bool />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>false</MSFT:Value>
+                    <MSFT:ValueDescription>Disable Firewall</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>true</MSFT:Value>
+                    <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>DefaultOutboundAction</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Get />
+                  <Replace />
+                </AccessType>
+                <DefaultValue>0</DefaultValue>
+                <Description>This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow].</Description>
+                <DFFormat>
+                  <int />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>0</MSFT:Value>
+                    <MSFT:ValueDescription>Allow Outbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>1</MSFT:Value>
+                    <MSFT:ValueDescription>Block Outbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>DefaultInboundAction</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Get />
+                  <Replace />
+                </AccessType>
+                <DefaultValue>1</DefaultValue>
+                <Description>This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block].</Description>
+                <DFFormat>
+                  <int />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>0</MSFT:Value>
+                    <MSFT:ValueDescription>Allow Inbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>1</MSFT:Value>
+                    <MSFT:ValueDescription>Block Inbound By Default</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+            <Node>
+              <NodeName>AllowLocalPolicyMerge</NodeName>
+              <DFProperties>
+                <AccessType>
+                  <Replace />
+                </AccessType>
+                <DefaultValue>true</DefaultValue>
+                <Description>This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced.  The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.</Description>
+                <DFFormat>
+                  <bool />
+                </DFFormat>
+                <Occurrence>
+                  <One />
+                </Occurrence>
+                <Scope>
+                  <Dynamic />
+                </Scope>
+                <DFType>
+                  <MIME />
+                </DFType>
+                <MSFT:AllowedValues ValueType="ENUM">
+                  <MSFT:Enum>
+                    <MSFT:Value>false</MSFT:Value>
+                    <MSFT:ValueDescription>AllowLocalPolicyMerge Off</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                  <MSFT:Enum>
+                    <MSFT:Value>true</MSFT:Value>
+                    <MSFT:ValueDescription>AllowLocalPolicyMerge On</MSFT:ValueDescription>
+                  </MSFT:Enum>
+                </MSFT:AllowedValues>
+                <MSFT:DependencyBehavior>
+                  <MSFT:DependencyGroup FriendlyId="Enable Firewall">
+                    <MSFT:Dependency Type="DependsOn">
+                      <MSFT:DependencyUri>Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall</MSFT:DependencyUri>
+                      <MSFT:DependencyAllowedValue ValueType="ENUM">
+                        <MSFT:Enum>
+                          <MSFT:Value>true</MSFT:Value>
+                          <MSFT:ValueDescription>Enable Firewall</MSFT:ValueDescription>
+                        </MSFT:Enum>
+                      </MSFT:DependencyAllowedValue>
+                    </MSFT:Dependency>
+                  </MSFT:DependencyGroup>
+                </MSFT:DependencyBehavior>
+              </DFProperties>
+            </Node>
+          </Node>
         </Node>
       </Node>
       <Node>
@@ -3231,7 +3831,8 @@ ServiceName</Description>
               <DFType>
                 <MIME />
               </DFType>
-              <MSFT:AllowedValues ValueType="None">
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>^[0-9,-]+$</MSFT:Value>
                 <MSFT:List Delimiter="," />
               </MSFT:AllowedValues>
             </DFProperties>
@@ -3258,7 +3859,8 @@ ServiceName</Description>
               <DFType>
                 <MIME />
               </DFType>
-              <MSFT:AllowedValues ValueType="None">
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>^[0-9,-]+$</MSFT:Value>
                 <MSFT:List Delimiter="," />
               </MSFT:AllowedValues>
             </DFProperties>
@@ -3396,7 +3998,7 @@ An IPv6 address range in the format of "start address - end address" with no spa
                 <MIME />
               </DFType>
               <MSFT:Applicability>
-                <MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
+                <MSFT:OsBuildVersion>10.0.22000, 10.0.19044.1706, 10.0.19043.1706, 10.0.19042.1706</MSFT:OsBuildVersion>
                 <MSFT:CspVersion>1.0</MSFT:CspVersion>
               </MSFT:Applicability>
               <MSFT:AllowedValues ValueType="RegEx">
@@ -4022,7 +4624,8 @@ An IPv6 address range in the format of "start address - end address" with no spa
               <DFType>
                 <MIME />
               </DFType>
-              <MSFT:AllowedValues ValueType="None">
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>^[0-9,-]+$</MSFT:Value>
                 <MSFT:List Delimiter="," />
               </MSFT:AllowedValues>
             </DFProperties>
@@ -4081,7 +4684,8 @@ An IPv6 address range in the format of "start address - end address" with no spa
               <DFType>
                 <MIME />
               </DFType>
-              <MSFT:AllowedValues ValueType="None">
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>^[0-9,-]+$</MSFT:Value>
                 <MSFT:List Delimiter="," />
               </MSFT:AllowedValues>
             </DFProperties>
@@ -4197,16 +4801,15 @@ If not specified - a new rule is disabled by default.</Description>
             </DFProperties>
           </Node>
           <Node>
-            <NodeName>Name</NodeName>
+            <NodeName>Profiles</NodeName>
             <DFProperties>
               <AccessType>
-                <Add />
-                <Delete />
                 <Get />
                 <Replace />
               </AccessType>
+              <Description>Specifies the profiles to which the rule belongs: Domain, Private, Public.  See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types.  If not specified, the default is All.</Description>
               <DFFormat>
-                <chr />
+                <int />
               </DFFormat>
               <Occurrence>
                 <One />
@@ -4217,6 +4820,192 @@ If not specified - a new rule is disabled by default.</Description>
               <DFType>
                 <MIME />
               </DFType>
+              <MSFT:AllowedValues ValueType="Flag">
+                <MSFT:Enum>
+                  <MSFT:Value>0x1</MSFT:Value>
+                  <MSFT:ValueDescription>FW_PROFILE_TYPE_DOMAIN:  This value represents the profile for networks that are connected to domains.</MSFT:ValueDescription>
+                </MSFT:Enum>
+                <MSFT:Enum>
+                  <MSFT:Value>0x2</MSFT:Value>
+                  <MSFT:ValueDescription>FW_PROFILE_TYPE_STANDARD:  This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE:  This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD.</MSFT:ValueDescription>
+                </MSFT:Enum>
+                <MSFT:Enum>
+                  <MSFT:Value>0x4</MSFT:Value>
+                  <MSFT:ValueDescription>FW_PROFILE_TYPE_PUBLIC:  This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted.</MSFT:ValueDescription>
+                </MSFT:Enum>
+                <MSFT:Enum>
+                  <MSFT:Value>0x7FFFFFFF</MSFT:Value>
+                  <MSFT:ValueDescription>FW_PROFILE_TYPE_ALL:  This value represents all these network sets and any future network sets.</MSFT:ValueDescription>
+                </MSFT:Enum>
+              </MSFT:AllowedValues>
+            </DFProperties>
+          </Node>
+        </Node>
+      </Node>
+      <Node>
+        <NodeName>HyperVLoopbackRules</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Get />
+          </AccessType>
+          <Description>A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules.</Description>
+          <DFFormat>
+            <node />
+          </DFFormat>
+          <Occurrence>
+            <ZeroOrOne />
+          </Occurrence>
+          <Scope>
+            <Permanent />
+          </Scope>
+          <DFType>
+            <DDFName />
+          </DFType>
+        </DFProperties>
+        <Node>
+          <NodeName>
+          </NodeName>
+          <DFProperties>
+            <AccessType>
+              <Add />
+              <Delete />
+              <Get />
+              <Replace />
+            </AccessType>
+            <Description>Unique alpha numeric identifier for the rule.  The rule name must not include a forward slash (/).</Description>
+            <DFFormat>
+              <node />
+            </DFFormat>
+            <Occurrence>
+              <ZeroOrMore />
+            </Occurrence>
+            <Scope>
+              <Dynamic />
+            </Scope>
+            <DFTitle>RuleName</DFTitle>
+            <DFType>
+              <DDFName />
+            </DFType>
+            <MSFT:DynamicNodeNaming>
+              <MSFT:ServerGeneratedUniqueIdentifier />
+            </MSFT:DynamicNodeNaming>
+            <MSFT:AllowedValues ValueType="RegEx">
+              <MSFT:Value>^[^|/]*$</MSFT:Value>
+            </MSFT:AllowedValues>
+            <MSFT:AtomicRequired />
+          </DFProperties>
+          <Node>
+            <NodeName>SourceVMCreatorId</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Add />
+                <Delete />
+                <Get />
+                <Replace />
+              </AccessType>
+              <Description>This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All.</Description>
+              <DFFormat>
+                <chr />
+              </DFFormat>
+              <Occurrence>
+                <ZeroOrOne />
+              </Occurrence>
+              <Scope>
+                <Dynamic />
+              </Scope>
+              <DFType>
+                <MIME />
+              </DFType>
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}</MSFT:Value>
+              </MSFT:AllowedValues>
+            </DFProperties>
+          </Node>
+          <Node>
+            <NodeName>DestinationVMCreatorId</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Add />
+                <Delete />
+                <Get />
+                <Replace />
+              </AccessType>
+              <Description>This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All.</Description>
+              <DFFormat>
+                <chr />
+              </DFFormat>
+              <Occurrence>
+                <ZeroOrOne />
+              </Occurrence>
+              <Scope>
+                <Dynamic />
+              </Scope>
+              <DFType>
+                <MIME />
+              </DFType>
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}</MSFT:Value>
+              </MSFT:AllowedValues>
+            </DFProperties>
+          </Node>
+          <Node>
+            <NodeName>PortRanges</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Add />
+                <Delete />
+                <Get />
+                <Replace />
+              </AccessType>
+              <Description>Comma Separated list of ranges for eg. 100-120,200,300-320.  If not specified the default is All.</Description>
+              <DFFormat>
+                <chr />
+              </DFFormat>
+              <Occurrence>
+                <ZeroOrOne />
+              </Occurrence>
+              <Scope>
+                <Dynamic />
+              </Scope>
+              <DFType>
+                <MIME />
+              </DFType>
+              <MSFT:AllowedValues ValueType="RegEx">
+                <MSFT:Value>^[0-9,-]+$</MSFT:Value>
+                <MSFT:List Delimiter="," />
+              </MSFT:AllowedValues>
+            </DFProperties>
+          </Node>
+          <Node>
+            <NodeName>Enabled</NodeName>
+            <DFProperties>
+              <AccessType>
+                <Get />
+                <Replace />
+              </AccessType>
+              <Description>Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default.</Description>
+              <DFFormat>
+                <bool />
+              </DFFormat>
+              <Occurrence>
+                <ZeroOrOne />
+              </Occurrence>
+              <Scope>
+                <Dynamic />
+              </Scope>
+              <DFType>
+                <MIME />
+              </DFType>
+              <MSFT:AllowedValues ValueType="ENUM">
+                <MSFT:Enum>
+                  <MSFT:Value>0</MSFT:Value>
+                  <MSFT:ValueDescription>Disabled</MSFT:ValueDescription>
+                </MSFT:Enum>
+                <MSFT:Enum>
+                  <MSFT:Value>1</MSFT:Value>
+                  <MSFT:ValueDescription>Enabled</MSFT:ValueDescription>
+                </MSFT:Enum>
+              </MSFT:AllowedValues>
             </DFProperties>
           </Node>
         </Node>
@@ -4240,7 +5029,7 @@ If not specified - a new rule is disabled by default.</Description>
             <DDFName />
           </DFType>
           <MSFT:Applicability>
-            <MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
+            <MSFT:OsBuildVersion>10.0.22000, 10.0.19044.1706, 10.0.19043.1706, 10.0.19042.1706</MSFT:OsBuildVersion>
             <MSFT:CspVersion>1.0</MSFT:CspVersion>
           </MSFT:Applicability>
         </DFProperties>
diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md
index 34cd8ae204..a937496bd1 100644
--- a/windows/client-management/mdm/passportforwork-csp.md
+++ b/windows/client-management/mdm/passportforwork-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the PassportForWork CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- PassportForWork-Begin -->
 # PassportForWork CSP
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- PassportForWork-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). It allows you to log in to Windows using your Active Directory or Azure Active Directory account and replace passwords, smartcards, and virtual smart cards.
@@ -30,6 +33,7 @@ The following list shows the PassportForWork configuration service provider node
 - ./Device/Vendor/MSFT/PassportForWork
   - [{TenantId}](#devicetenantid)
     - [Policies](#devicetenantidpolicies)
+      - [DisablePostLogonProvisioning](#devicetenantidpoliciesdisablepostlogonprovisioning)
       - [EnablePinRecovery](#devicetenantidpoliciesenablepinrecovery)
       - [ExcludeSecurityDevices](#devicetenantidpoliciesexcludesecuritydevices)
         - [TPM12](#devicetenantidpoliciesexcludesecuritydevicestpm12)
@@ -160,6 +164,55 @@ Root node for policies.
 
 <!-- Device-{TenantId}-Policies-End -->
 
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Begin -->
+#### Device/{TenantId}/Policies/DisablePostLogonProvisioning
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Applicability-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning
+```
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-OmaUri-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Description-Begin -->
+<!-- Description-Source-DDF -->
+Do not start Windows Hello provisioning after sign-in.
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Description-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Editable-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | bool |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | False |
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-DFProperties-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| false (Default) | Disabled. |
+| true | Enabled. |
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-AllowedValues-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-Examples-End -->
+
+<!-- Device-{TenantId}-Policies-DisablePostLogonProvisioning-End -->
+
 <!-- Device-{TenantId}-Policies-EnablePinRecovery-Begin -->
 #### Device/{TenantId}/Policies/EnablePinRecovery
 
@@ -1187,8 +1240,8 @@ Enhanced Sign-in Security (ESS) isolates both biometric template data and matchi
 
 | Value | Description |
 |:--|:--|
-| 0 | Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended). |
-| 1 (Default) | Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security). |
+| 0 | ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended). |
+| 1 (Default) | ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security). |
 <!-- Device-Biometrics-EnableESSwithSupportedPeripherals-AllowedValues-End -->
 
 <!-- Device-Biometrics-EnableESSwithSupportedPeripherals-GpMapping-Begin -->
diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md
index 89dbc41c22..28991ea21c 100644
--- a/windows/client-management/mdm/passportforwork-ddf.md
+++ b/windows/client-management/mdm/passportforwork-ddf.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/24/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -814,6 +814,45 @@ If you disable or do not configure this policy setting, the PIN recovery secret
             </MSFT:AllowedValues>
           </DFProperties>
         </Node>
+        <Node>
+          <NodeName>DisablePostLogonProvisioning</NodeName>
+          <DFProperties>
+            <AccessType>
+              <Add />
+              <Delete />
+              <Get />
+              <Replace />
+            </AccessType>
+            <DefaultValue>False</DefaultValue>
+            <Description>Do not start Windows Hello provisioning after sign-in.</Description>
+            <DFFormat>
+              <bool />
+            </DFFormat>
+            <Occurrence>
+              <ZeroOrOne />
+            </Occurrence>
+            <Scope>
+              <Dynamic />
+            </Scope>
+            <DFType>
+              <MIME />
+            </DFType>
+            <MSFT:Applicability>
+              <MSFT:OsBuildVersion>99.9.99999</MSFT:OsBuildVersion>
+              <MSFT:CspVersion>1.6</MSFT:CspVersion>
+            </MSFT:Applicability>
+            <MSFT:AllowedValues ValueType="ENUM">
+              <MSFT:Enum>
+                <MSFT:Value>false</MSFT:Value>
+                <MSFT:ValueDescription>Disabled</MSFT:ValueDescription>
+              </MSFT:Enum>
+              <MSFT:Enum>
+                <MSFT:Value>true</MSFT:Value>
+                <MSFT:ValueDescription>Enabled</MSFT:ValueDescription>
+              </MSFT:Enum>
+            </MSFT:AllowedValues>
+          </DFProperties>
+        </Node>
         <Node>
           <NodeName>UseCertificateForOnPremAuth</NodeName>
           <DFProperties>
@@ -1507,11 +1546,11 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re
           <MSFT:AllowedValues ValueType="ENUM">
             <MSFT:Enum>
               <MSFT:Value>0</MSFT:Value>
-              <MSFT:ValueDescription>Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended)</MSFT:ValueDescription>
+              <MSFT:ValueDescription>ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended)</MSFT:ValueDescription>
             </MSFT:Enum>
             <MSFT:Enum>
               <MSFT:Value>1</MSFT:Value>
-              <MSFT:ValueDescription>Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security)</MSFT:ValueDescription>
+              <MSFT:ValueDescription>ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security)</MSFT:ValueDescription>
             </MSFT:Enum>
           </MSFT:AllowedValues>
           <MSFT:GpMapping GpEnglishName="Enable ESS with Supported Peripherals" GpAreaPath="Passport~AT~WindowsComponents~MSPassportForWorkCategory" />
diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md
index b7227416df..af0cf9f34d 100644
--- a/windows/client-management/mdm/personaldataencryption-csp.md
+++ b/windows/client-management/mdm/personaldataencryption-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the PDE CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -26,7 +26,13 @@ The following list shows the PDE configuration service provider nodes:
 
 - ./User/Vendor/MSFT/PDE
   - [EnablePersonalDataEncryption](#enablepersonaldataencryption)
+  - [ProtectFolders](#protectfolders)
+    - [ProtectDesktop](#protectfoldersprotectdesktop)
+    - [ProtectDocuments](#protectfoldersprotectdocuments)
+    - [ProtectPictures](#protectfoldersprotectpictures)
   - [Status](#status)
+    - [FolderProtectionStatus](#statusfolderprotectionstatus)
+    - [FoldersProtected](#statusfoldersprotected)
     - [PersonalDataEncryptionStatus](#statuspersonaldataencryptionstatus)
 <!-- PDE-Tree-End -->
 
@@ -79,6 +85,188 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u
 
 <!-- User-EnablePersonalDataEncryption-End -->
 
+<!-- User-ProtectFolders-Begin -->
+## ProtectFolders
+
+<!-- User-ProtectFolders-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- User-ProtectFolders-Applicability-End -->
+
+<!-- User-ProtectFolders-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/PDE/ProtectFolders
+```
+<!-- User-ProtectFolders-OmaUri-End -->
+
+<!-- User-ProtectFolders-Description-Begin -->
+<!-- Description-Source-Not-Found -->
+<!-- User-ProtectFolders-Description-End -->
+
+<!-- User-ProtectFolders-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- User-ProtectFolders-Editable-End -->
+
+<!-- User-ProtectFolders-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | node |
+| Access Type | Get |
+<!-- User-ProtectFolders-DFProperties-End -->
+
+<!-- User-ProtectFolders-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- User-ProtectFolders-Examples-End -->
+
+<!-- User-ProtectFolders-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-Begin -->
+### ProtectFolders/ProtectDesktop
+
+<!-- User-ProtectFolders-ProtectDesktop-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- User-ProtectFolders-ProtectDesktop-Applicability-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDesktop
+```
+<!-- User-ProtectFolders-ProtectDesktop-OmaUri-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-Description-Begin -->
+<!-- Description-Source-DDF -->
+Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy.
+<!-- User-ProtectFolders-ProtectDesktop-Description-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- User-ProtectFolders-ProtectDesktop-Editable-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+<!-- User-ProtectFolders-ProtectDesktop-DFProperties-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. |
+| 1 | Enable PDE on the folder. |
+<!-- User-ProtectFolders-ProtectDesktop-AllowedValues-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- User-ProtectFolders-ProtectDesktop-Examples-End -->
+
+<!-- User-ProtectFolders-ProtectDesktop-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-Begin -->
+### ProtectFolders/ProtectDocuments
+
+<!-- User-ProtectFolders-ProtectDocuments-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- User-ProtectFolders-ProtectDocuments-Applicability-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDocuments
+```
+<!-- User-ProtectFolders-ProtectDocuments-OmaUri-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-Description-Begin -->
+<!-- Description-Source-DDF -->
+Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy.
+<!-- User-ProtectFolders-ProtectDocuments-Description-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- User-ProtectFolders-ProtectDocuments-Editable-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+<!-- User-ProtectFolders-ProtectDocuments-DFProperties-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. |
+| 1 | Enable PDE on the folder. |
+<!-- User-ProtectFolders-ProtectDocuments-AllowedValues-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- User-ProtectFolders-ProtectDocuments-Examples-End -->
+
+<!-- User-ProtectFolders-ProtectDocuments-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-Begin -->
+### ProtectFolders/ProtectPictures
+
+<!-- User-ProtectFolders-ProtectPictures-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- User-ProtectFolders-ProtectPictures-Applicability-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/PDE/ProtectFolders/ProtectPictures
+```
+<!-- User-ProtectFolders-ProtectPictures-OmaUri-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-Description-Begin -->
+<!-- Description-Source-DDF -->
+Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy.
+<!-- User-ProtectFolders-ProtectPictures-Description-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- User-ProtectFolders-ProtectPictures-Editable-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+<!-- User-ProtectFolders-ProtectPictures-DFProperties-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. |
+| 1 | Enable PDE on the folder. |
+<!-- User-ProtectFolders-ProtectPictures-AllowedValues-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- User-ProtectFolders-ProtectPictures-Examples-End -->
+
+<!-- User-ProtectFolders-ProtectPictures-End -->
+
 <!-- User-Status-Begin -->
 ## Status
 
@@ -121,6 +309,95 @@ Reports the current status of Personal Data Encryption (PDE) for the user.
 
 <!-- User-Status-End -->
 
+<!-- User-Status-FolderProtectionStatus-Begin -->
+### Status/FolderProtectionStatus
+
+<!-- User-Status-FolderProtectionStatus-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- User-Status-FolderProtectionStatus-Applicability-End -->
+
+<!-- User-Status-FolderProtectionStatus-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/PDE/Status/FolderProtectionStatus
+```
+<!-- User-Status-FolderProtectionStatus-OmaUri-End -->
+
+<!-- User-Status-FolderProtectionStatus-Description-Begin -->
+<!-- Description-Source-DDF -->
+This node reports folder protection status for a user.
+<!-- User-Status-FolderProtectionStatus-Description-End -->
+
+<!-- User-Status-FolderProtectionStatus-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- User-Status-FolderProtectionStatus-Editable-End -->
+
+<!-- User-Status-FolderProtectionStatus-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Get |
+<!-- User-Status-FolderProtectionStatus-DFProperties-End -->
+
+<!-- User-Status-FolderProtectionStatus-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 | Protection not started. |
+| 1 | Protection is completed with no failures. |
+| 2 | Protection in progress. |
+| 3 | Protection failed. |
+<!-- User-Status-FolderProtectionStatus-AllowedValues-End -->
+
+<!-- User-Status-FolderProtectionStatus-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- User-Status-FolderProtectionStatus-Examples-End -->
+
+<!-- User-Status-FolderProtectionStatus-End -->
+
+<!-- User-Status-FoldersProtected-Begin -->
+### Status/FoldersProtected
+
+<!-- User-Status-FoldersProtected-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- User-Status-FoldersProtected-Applicability-End -->
+
+<!-- User-Status-FoldersProtected-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/PDE/Status/FoldersProtected
+```
+<!-- User-Status-FoldersProtected-OmaUri-End -->
+
+<!-- User-Status-FoldersProtected-Description-Begin -->
+<!-- Description-Source-DDF -->
+This node reports all folders (full path to each folder) that have been protected.
+<!-- User-Status-FoldersProtected-Description-End -->
+
+<!-- User-Status-FoldersProtected-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- User-Status-FoldersProtected-Editable-End -->
+
+<!-- User-Status-FoldersProtected-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Get |
+<!-- User-Status-FoldersProtected-DFProperties-End -->
+
+<!-- User-Status-FoldersProtected-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- User-Status-FoldersProtected-Examples-End -->
+
+<!-- User-Status-FoldersProtected-End -->
+
 <!-- User-Status-PersonalDataEncryptionStatus-Begin -->
 ### Status/PersonalDataEncryptionStatus
 
diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md
index 9550cce774..b5425cab46 100644
--- a/windows/client-management/mdm/personaldataencryption-ddf-file.md
+++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/17/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -83,6 +83,128 @@ The following XML file contains the device description framework (DDF) for the P
         </MSFT:AllowedValues>
       </DFProperties>
     </Node>
+    <Node>
+      <NodeName>ProtectFolders</NodeName>
+      <DFProperties>
+        <AccessType>
+          <Get />
+        </AccessType>
+        <DFFormat>
+          <node />
+        </DFFormat>
+        <Occurrence>
+          <One />
+        </Occurrence>
+        <Scope>
+          <Permanent />
+        </Scope>
+        <DFType>
+          <DDFName />
+        </DFType>
+      </DFProperties>
+      <Node>
+        <NodeName>ProtectDocuments</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <Description>Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy.</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>Enable PDE on the folder.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
+      <Node>
+        <NodeName>ProtectDesktop</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <Description>Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy.</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>Enable PDE on the folder.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
+      <Node>
+        <NodeName>ProtectPictures</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <Description>Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy.</Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>Enable PDE on the folder.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
+    </Node>
     <Node>
       <NodeName>Status</NodeName>
       <DFProperties>
@@ -123,6 +245,66 @@ The following XML file contains the device description framework (DDF) for the P
           </DFType>
         </DFProperties>
       </Node>
+      <Node>
+        <NodeName>FolderProtectionStatus</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Get />
+          </AccessType>
+          <Description>This node reports folder protection status for a user. </Description>
+          <DFFormat>
+            <int />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Permanent />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:AllowedValues ValueType="ENUM">
+            <MSFT:Enum>
+              <MSFT:Value>0</MSFT:Value>
+              <MSFT:ValueDescription>Protection not started.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>1</MSFT:Value>
+              <MSFT:ValueDescription>Protection is completed with no failures.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>2</MSFT:Value>
+              <MSFT:ValueDescription>Protection in progress.</MSFT:ValueDescription>
+            </MSFT:Enum>
+            <MSFT:Enum>
+              <MSFT:Value>3</MSFT:Value>
+              <MSFT:ValueDescription>Protection failed.</MSFT:ValueDescription>
+            </MSFT:Enum>
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
+      <Node>
+        <NodeName>FoldersProtected</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Get />
+          </AccessType>
+          <Description>This node reports all folders (full path to each folder) that have been protected.</Description>
+          <DFFormat>
+            <chr />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Permanent />
+          </Scope>
+          <DFType>
+            <MIME />
+          </DFType>
+        </DFProperties>
+      </Node>
     </Node>
   </Node>
 </MgmtTree>
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index c45d67308a..08332c2601 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/18/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -2303,7 +2303,9 @@ This article lists the ADMX-backed policies in Policy CSP.
 - [EnableSettings](policy-csp-desktopappinstaller.md)
 - [EnableExperimentalFeatures](policy-csp-desktopappinstaller.md)
 - [EnableLocalManifestFiles](policy-csp-desktopappinstaller.md)
+- [EnableBypassCertificatePinningForMicrosoftStore](policy-csp-desktopappinstaller.md)
 - [EnableHashOverride](policy-csp-desktopappinstaller.md)
+- [EnableLocalArchiveMalwareScanOverride](policy-csp-desktopappinstaller.md)
 - [EnableDefaultSource](policy-csp-desktopappinstaller.md)
 - [EnableMicrosoftStoreSource](policy-csp-desktopappinstaller.md)
 - [SourceAutoUpdateInterval](policy-csp-desktopappinstaller.md)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
index 2b636d3e4f..6aba70d787 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
@@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/03/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -340,6 +340,10 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 - [ClearTextPassword](policy-csp-devicelock.md)
 - [PasswordComplexity](policy-csp-devicelock.md)
 - [PasswordHistorySize](policy-csp-devicelock.md)
+- [AccountLockoutThreshold](policy-csp-devicelock.md)
+- [AccountLockoutDuration](policy-csp-devicelock.md)
+- [ResetAccountLockoutCounterAfter](policy-csp-devicelock.md)
+- [AllowAdministratorLockout](policy-csp-devicelock.md)
 
 ## Display
 
@@ -400,6 +404,10 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 - [ForceInstantLock](policy-csp-humanpresence.md)
 - [ForceLockTimeout](policy-csp-humanpresence.md)
 - [ForceInstantDim](policy-csp-humanpresence.md)
+- [ForceDisableWakeWhenBatterySaverOn](policy-csp-humanpresence.md)
+- [ForceAllowWakeWhenExternalDisplayConnected](policy-csp-humanpresence.md)
+- [ForceAllowLockWhenExternalDisplayConnected](policy-csp-humanpresence.md)
+- [ForceAllowDimWhenExternalDisplayConnected](policy-csp-humanpresence.md)
 
 ## Kerberos
 
@@ -511,6 +519,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 
 - [DisallowNotificationMirroring](policy-csp-notifications.md)
 - [DisallowTileNotification](policy-csp-notifications.md)
+- [EnableExpandedToastNotifications](policy-csp-notifications.md)
 - [DisallowCloudNotification](policy-csp-notifications.md)
 - [WnsEndpoint](policy-csp-notifications.md)
 
@@ -574,6 +583,10 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 - [LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps](policy-csp-privacy.md)
 - [LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps](policy-csp-privacy.md)
 - [LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessHumanPresence](policy-csp-privacy.md)
+- [LetAppsAccessHumanPresence_ForceAllowTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessHumanPresence_ForceDenyTheseApps](policy-csp-privacy.md)
+- [LetAppsAccessHumanPresence_UserInControlOfTheseApps](policy-csp-privacy.md)
 - [LetAppsAccessLocation](policy-csp-privacy.md)
 - [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md)
 - [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md)
@@ -676,6 +689,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 - [StartLayout](policy-csp-start.md)
 - [ConfigureStartPins](policy-csp-start.md)
 - [HideRecommendedSection](policy-csp-start.md)
+- [HideRecoPersonalizedSites](policy-csp-start.md)
 - [HideTaskViewButton](policy-csp-start.md)
 - [DisableControlCenter](policy-csp-start.md)
 - [ForceStartSize](policy-csp-start.md)
@@ -686,6 +700,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 - [StartLayout](policy-csp-start.md)
 - [ConfigureStartPins](policy-csp-start.md)
 - [HideRecommendedSection](policy-csp-start.md)
+- [HideRecoPersonalizedSites](policy-csp-start.md)
 - [SimplifyQuickSettings](policy-csp-start.md)
 - [DisableEditingQuickSettings](policy-csp-start.md)
 - [HideTaskViewButton](policy-csp-start.md)
@@ -869,6 +884,7 @@ This article lists the policies in Policy CSP that have a group policy mapping.
 - [DenyLogOnAsBatchJob](policy-csp-userrights.md)
 - [LogOnAsService](policy-csp-userrights.md)
 - [IncreaseProcessWorkingSet](policy-csp-userrights.md)
+- [DenyServiceLogonRight](policy-csp-userrights.md)
 
 ## VirtualizationBasedTechnology
 
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index 5abbb6fc17..f0100f698a 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Surface Hub.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/17/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -335,6 +335,8 @@ This article lists the policies in Policy CSP that are applicable for Surface Hu
 - [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps)
 - [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection)
 - [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection)
+- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites)
+- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites)
 - [HideRestart](policy-csp-start.md#hiderestart)
 - [HideShutDown](policy-csp-start.md#hideshutdown)
 - [HideSignOut](policy-csp-start.md#hidesignout)
diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md
index bdb6a819f1..f6ee903aef 100644
--- a/windows/client-management/mdm/policy-csp-abovelock.md
+++ b/windows/client-management/mdm/policy-csp-abovelock.md
@@ -4,7 +4,7 @@ description: Learn more about the AboveLock Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -40,7 +40,7 @@ ms.topic: reference
 
 <!-- AllowActionCenterNotifications-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy is deprecated
+This policy is deprecated.
 <!-- AllowActionCenterNotifications-Description-End -->
 
 <!-- AllowActionCenterNotifications-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md
index 44c49be631..a9ee824925 100644
--- a/windows/client-management/mdm/policy-csp-accounts.md
+++ b/windows/client-management/mdm/policy-csp-accounts.md
@@ -4,7 +4,7 @@ description: Learn more about the Accounts Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowAddingNonMicrosoftAccountsManually-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0
+Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0.
 
 > [!NOTE]
 > This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the EMAIL2 CSP.
@@ -138,10 +138,10 @@ Specifies whether the user is allowed to use an MSA account for non-email relate
 
 <!-- AllowMicrosoftAccountSignInAssistant-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service
+Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service.
 
 > [!NOTE]
-> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are
+> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are.
 
 > [!NOTE]
 > If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to "step-up" from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app.
diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md
index 58e17f5f98..d1170a124f 100644
--- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md
+++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_AddRemovePrograms Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -110,7 +110,7 @@ You can use this setting to direct users to the programs they are most likely to
 <!-- Description-Source-ADMX -->
 Removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media.
 
-- If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users.
+If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users.
 
 This setting does not prevent users from using other tools and methods to add or remove program components.
 
@@ -173,7 +173,7 @@ This setting does not prevent users from using other tools and methods to add or
 <!-- Description-Source-ADMX -->
 Removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update.
 
-- If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users.
+If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users.
 
 This setting does not prevent users from using other tools and methods to connect to Windows Update.
 
@@ -305,7 +305,7 @@ Removes the Add New Programs button from the Add or Remove Programs bar. As a re
 
 The Add New Programs button lets users install programs published or assigned by a system administrator.
 
-- If you disable this setting or do not configure it, the Add New Programs button is available to all users.
+If you disable this setting or do not configure it, the Add New Programs button is available to all users.
 
 This setting does not prevent users from using other tools and methods to install programs.
 <!-- NoAddPage-Description-End -->
@@ -369,7 +369,7 @@ This setting removes Add or Remove Programs from Control Panel and removes the A
 
 Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs.
 
-- If you disable this setting or do not configure it, Add or Remove Programs is available to all users.
+If you disable this setting or do not configure it, Add or Remove Programs is available to all users.
 
 When enabled, this setting takes precedence over the other settings in this folder.
 
@@ -433,7 +433,7 @@ Removes the Set Program Access and Defaults button from the Add or Remove Progra
 
 The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations.
 
-- If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users.
+If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users.
 
 This setting does not prevent users from using other tools and methods to change program access or defaults.
 
@@ -497,7 +497,7 @@ Removes the Change or Remove Programs button from the Add or Remove Programs bar
 
 The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs.
 
-- If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users.
+If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users.
 
 This setting does not prevent users from using other tools and methods to delete or uninstall programs.
 <!-- NoRemovePage-Description-End -->
@@ -560,6 +560,7 @@ Prevents users from using Add or Remove Programs to configure installed services
 This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools.
 
 - If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services.
+
 - If you enable this setting, "Set up services" never appears.
 
 This setting does not prevent users from using other methods to configure services.
@@ -627,7 +628,7 @@ Removes links to the Support Info dialog box from programs on the Change or Remo
 
 Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page.
 
-- If you disable this setting or do not configure it, the Support Info hyperlink appears.
+If you disable this setting or do not configure it, the Support Info hyperlink appears.
 
 > [!NOTE]
 > Not all programs provide a support information hyperlink.
@@ -690,7 +691,7 @@ Removes the Add/Remove Windows Components button from the Add or Remove Programs
 
 The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files.
 
-- If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users.
+If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users.
 
 This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard.
 <!-- NoWindowsSetupPage-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md
index a0d2e3d901..d864def13f 100644
--- a/windows/client-management/mdm/policy-csp-admx-appcompat.md
+++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_AppCompat Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -241,7 +241,8 @@ The Windows Resource Protection and User Account Control features of Windows use
 
 This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential.
 
-NOTE: Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes.
+> [!NOTE]
+> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes.
 <!-- AppCompatTurnOffEngine-Description-End -->
 
 <!-- AppCompatTurnOffEngine-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md
index 8e82cda5ea..9df41c0e25 100644
--- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md
+++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_AuditSettings Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -45,6 +45,7 @@ ms.topic: reference
 This policy setting determines what information is logged in security audit events when a new process has been created.
 
 This setting only applies when the Audit Process Creation policy is enabled.
+
 - If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied.
 
 - If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events.
diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md
index 6c2d52f8d1..4381ecdcb1 100644
--- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md
+++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_CipherSuiteOrder Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -117,7 +117,7 @@ NistP384
 
 To See all the curves supported on the system, Use the following command:
 
-CertUtil.exe -DisplayEccCurve
+CertUtil.exe -DisplayEccCurve.
 <!-- SSLCurveOrder-Description-End -->
 
 <!-- SSLCurveOrder-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md
index 4a3df26d6e..07bb2c18f1 100644
--- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md
+++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_ControlPanel Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings.
 
-- If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen.
+If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen.
 
 To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft. Mouse, Microsoft. System, or Microsoft. Personalization.
 
@@ -120,6 +120,7 @@ This policy setting controls the default Control Panel view, whether by category
 - If this policy setting is disabled, the Control Panel opens to the category view.
 
 - If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session.
+
 > [!NOTE]
 > Icon size is dependent upon what the user has set it to in the previous session.
 <!-- ForceClassicControlPanel-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md
index 68499c0c39..e751b4fa8b 100644
--- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md
+++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_ControlPanelDisplay Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/13/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 Disables the Display Control Panel.
 
-- If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action.
+If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action.
 
 Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings.
 <!-- CPL_Display_Disable-Description-End -->
@@ -537,7 +537,7 @@ Prevents users from changing the background image shown when the machine is lock
 
 By default, users can change the background image shown when the machine is locked or displaying the logon screen.
 
-- If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image.
+If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image.
 <!-- CPL_Personalization_NoChangingLockScreen-Description-End -->
 
 <!-- CPL_Personalization_NoChangingLockScreen-Editable-Begin -->
@@ -597,7 +597,7 @@ Prevents users from changing the look of their start menu background, such as it
 
 By default, users can change the look of their start menu background, such as its color or accent.
 
-- If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them.
+If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them.
 
 If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy.
 
@@ -661,7 +661,7 @@ Disables the Color (or Window Color) page in the Personalization Control Panel,
 
 This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows.
 
-- If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel.
+If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel.
 
 For systems prior to Windows Vista, this setting hides the Appearance and Themes tabs in the in Display in Control Panel.
 <!-- CPL_Personalization_NoColorAppearanceUI-Description-End -->
@@ -723,7 +723,7 @@ Prevents users from adding or changing the background design of the desktop.
 
 By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop.
 
-- If you enable this setting, none of the Desktop Background settings can be changed by the user.
+If you enable this setting, none of the Desktop Background settings can be changed by the user.
 
 To specify wallpaper for a group, use the "Desktop Wallpaper" setting.
 
@@ -790,7 +790,7 @@ Prevents users from changing the desktop icons.
 
 By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons.
 
-- If you enable this setting, none of the desktop icons can be changed by the user.
+If you enable this setting, none of the desktop icons can be changed by the user.
 
 For systems prior to Windows Vista, this setting also hides the Desktop tab in the Display Control Panel.
 <!-- CPL_Personalization_NoDesktopIconsUI-Description-End -->
@@ -912,7 +912,7 @@ Prevents users from changing the mouse pointers.
 
 By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers.
 
-- If you enable this setting, none of the mouse pointer scheme settings can be changed by the user.
+If you enable this setting, none of the mouse pointer scheme settings can be changed by the user.
 <!-- CPL_Personalization_NoMousePointersUI-Description-End -->
 
 <!-- CPL_Personalization_NoMousePointersUI-Editable-Begin -->
@@ -1030,7 +1030,7 @@ Prevents users from changing the sound scheme.
 
 By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme.
 
-- If you enable this setting, none of the Sound Scheme settings can be changed by the user.
+If you enable this setting, none of the Sound Scheme settings can be changed by the user.
 <!-- CPL_Personalization_NoSoundSchemeUI-Description-End -->
 
 <!-- CPL_Personalization_NoSoundSchemeUI-Editable-Begin -->
@@ -1090,7 +1090,7 @@ Forces Windows to use the specified colors for the background and accent. The co
 
 By default, users can change the background and accent colors.
 
-- If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text.
+If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text.
 <!-- CPL_Personalization_PersonalColors-Description-End -->
 
 <!-- CPL_Personalization_PersonalColors-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md
index 9ded8c68b8..90a95f4010 100644
--- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md
+++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_CredentialProviders Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -173,7 +173,7 @@ credential providers from use during authentication.
 
 **Note** credential providers are used to process and validate user
 credentials during logon or when authentication is required.
-Windows Vista provides two default credential providers
+Windows Vista provides two default credential providers:
 Password and Smart Card. An administrator can install additional
 credential providers for different sets of credentials
 (for example, to support biometric authentication).
diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md
index 6af877c393..336f4f912a 100644
--- a/windows/client-management/mdm/policy-csp-admx-credssp.md
+++ b/windows/client-management/mdm/policy-csp-admx-credssp.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_CredSsp Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -50,7 +50,7 @@ This policy setting applies when server authentication was achieved by using a t
 
 The policy becomes effective the next time the user signs on to a computer running Windows.
 
-If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB.
+- If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB.
 
 FWlink for KB:
 <https://go.microsoft.com/fwlink/?LinkId=301508>
@@ -61,7 +61,7 @@ FWlink for KB:
 For Example:
 TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
 TERMSRV/* Remote Desktop Session Host running on all machines.
-TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com
+TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com.
 <!-- AllowDefaultCredentials-Description-End -->
 
 <!-- AllowDefaultCredentials-Editable-Begin -->
@@ -123,7 +123,7 @@ This policy setting applies when server authentication was achieved via NTLM.
 
 - If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).
 
-If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine.
+- If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine.
 
 > [!NOTE]
 > The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN.
@@ -131,7 +131,7 @@ If you disable or do not configure (by default) this policy setting, delegation
 For Example:
 TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
 TERMSRV/* Remote Desktop Session Host running on all machines.
-TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com
+TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com.
 <!-- AllowDefCredentialsWhenNTLMOnly-Description-End -->
 
 <!-- AllowDefCredentialsWhenNTLMOnly-Editable-Begin -->
@@ -189,19 +189,19 @@ TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all
 <!-- Description-Source-ADMX -->
 Encryption Oracle Remediation
 
-This policy setting applies to applications using the CredSSP component (for example Remote Desktop Connection).
+This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection).
 
 Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability.
 
-- If you enable this policy setting, CredSSP version support will be selected based on the following options
+If you enable this policy setting, CredSSP version support will be selected based on the following options:
 
-Force Updated Clients Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. **Note** this setting should not be deployed until all remote hosts support the newest version.
+Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. **Note** this setting should not be deployed until all remote hosts support the newest version.
 
-Mitigated Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients.
+Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients.
 
-Vulnerable Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients.
+Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients.
 
-For more information about the vulnerability and servicing requirements for protection, see <https//go.microsoft.com/fwlink/?linkid=866660>
+For more information about the vulnerability and servicing requirements for protection, see <https://go.microsoft.com/fwlink/?linkid=866660>
 <!-- AllowEncryptionOracle-Description-End -->
 
 <!-- AllowEncryptionOracle-Editable-Begin -->
@@ -262,7 +262,7 @@ This policy setting applies when server authentication was achieved via a truste
 
 - If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).
 
-If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
+- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
 
 - If you disable this policy setting, delegation of fresh credentials is not permitted to any machine.
 
@@ -273,7 +273,7 @@ For Example:
 TERMSRV/host.humanresources.fabrikam.com
 Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
 TERMSRV/* Remote Desktop Session Host running on all machines.
-TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com
+TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com.
 <!-- AllowFreshCredentials-Description-End -->
 
 <!-- AllowFreshCredentials-Editable-Begin -->
@@ -335,7 +335,7 @@ This policy setting applies when server authentication was achieved via NTLM.
 
 - If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).
 
-If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
+- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
 
 - If you disable this policy setting, delegation of fresh credentials is not permitted to any machine.
 
@@ -345,7 +345,7 @@ If you do not configure (by default) this policy setting, after proper mutual au
 For Example:
 TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
 TERMSRV/* Remote Desktop Session Host running on all machines.
-TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com
+TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com.
 <!-- AllowFreshCredentialsWhenNTLMOnly-Description-End -->
 
 <!-- AllowFreshCredentialsWhenNTLMOnly-Editable-Begin -->
@@ -407,7 +407,7 @@ This policy setting applies when server authentication was achieved via a truste
 
 - If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).
 
-If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
+- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*).
 
 - If you disable this policy setting, delegation of saved credentials is not permitted to any machine.
 
@@ -417,7 +417,7 @@ If you do not configure (by default) this policy setting, after proper mutual au
 For Example:
 TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
 TERMSRV/* Remote Desktop Session Host running on all machines.
-TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com
+TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com.
 <!-- AllowSavedCredentials-Description-End -->
 
 <!-- AllowSavedCredentials-Editable-Begin -->
@@ -479,7 +479,7 @@ This policy setting applies when server authentication was achieved via NTLM.
 
 - If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).
 
-If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine.
+- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine.
 
 - If you disable this policy setting, delegation of saved credentials is not permitted to any machine.
 
@@ -489,7 +489,7 @@ If you do not configure (by default) this policy setting, after proper mutual au
 For Example:
 TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine
 TERMSRV/* Remote Desktop Session Host running on all machines.
-TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com
+TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com.
 <!-- AllowSavedCredentialsWhenNTLMOnly-Description-End -->
 
 <!-- AllowSavedCredentialsWhenNTLMOnly-Editable-Begin -->
@@ -549,7 +549,7 @@ This policy setting applies to applications using the Cred SSP component (for ex
 
 - If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows).
 
-If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
+- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
 
 > [!NOTE]
 > The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.
@@ -619,7 +619,7 @@ This policy setting applies to applications using the Cred SSP component (for ex
 
 - If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application).
 
-If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
+- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
 
 > [!NOTE]
 > The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.
@@ -689,7 +689,7 @@ This policy setting applies to applications using the Cred SSP component (for ex
 
 - If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager).
 
-If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
+- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server.
 
 > [!NOTE]
 > The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN.
diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md
index 16b4681320..84347d6bd5 100644
--- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md
+++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_CtrlAltDel Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting prevents users from changing their Windows password on demand.
 
-- If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del.
+If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del.
 
 However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring.
 <!-- DisableChangePassword-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md
index d658533761..fcae6c76a0 100644
--- a/windows/client-management/mdm/policy-csp-admx-datacollection.md
+++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_DataCollection Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting defines the identifier used to uniquely associate this device's diagnostic data data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program.
 
-- If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization.
+If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization.
 <!-- CommercialIdPolicy-Description-End -->
 
 <!-- CommercialIdPolicy-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-dcom.md b/windows/client-management/mdm/policy-csp-admx-dcom.md
index 61fe97ffea..57e6837e05 100644
--- a/windows/client-management/mdm/policy-csp-admx-dcom.md
+++ b/windows/client-management/mdm/policy-csp-admx-dcom.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_DCOM Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -107,7 +107,7 @@ Allows you to specify that local computer administrators can supplement the "Def
 <!-- Description-Source-ADMX -->
 Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check. DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators. DCOM ignores the second list when this policy setting is configured, unless the "Allow local activation security check exemptions" policy is enabled.
 
-DCOM server appids added to this policy must be listed in curly-brace format. For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors.
+DCOM server appids added to this policy must be listed in curly-brace format. For Example: `{b5dcb061-cefb-42e0-a1be-e6a6438133fe}`. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors.
 
 - If you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server. If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md
index 69fb32dabf..4a0662062e 100644
--- a/windows/client-management/mdm/policy-csp-admx-desktop.md
+++ b/windows/client-management/mdm/policy-csp-admx-desktop.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Desktop Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -233,7 +233,7 @@ Enables Active Desktop and prevents users from disabling it.
 
 This setting prevents users from trying to enable or disable Active Desktop while a policy controls it.
 
-- If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.
+If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.
 
 > [!NOTE]
 > If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting ( in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored.
@@ -296,7 +296,7 @@ Disables Active Desktop and prevents users from enabling it.
 
 This setting prevents users from trying to enable or disable Active Desktop while a policy controls it.
 
-- If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.
+If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.
 
 > [!NOTE]
 > If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored.
@@ -1098,7 +1098,7 @@ Removes the Properties option from the Recycle Bin context menu.
 <!-- Description-Source-ADMX -->
 Prevents users from saving certain changes to the desktop.
 
-- If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved.
+If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved.
 <!-- NoSaveSettings-Description-End -->
 
 <!-- NoSaveSettings-Editable-Begin -->
@@ -1343,7 +1343,7 @@ Prevents users from removing Web content from their Active Desktop.
 
 In Active Desktop, you can add items to the desktop but close them so they are not displayed.
 
-- If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel.
+If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel.
 
 > [!NOTE]
 > This setting does not prevent users from deleting items from their Active Desktop.
@@ -1585,7 +1585,7 @@ This setting removes all Active Desktop items from the desktop. It also removes
 <!-- Description-Source-ADMX -->
 Prevents users from manipulating desktop toolbars.
 
-- If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars.
+If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars.
 
 > [!NOTE]
 > If users have added or removed toolbars, this setting prevents them from restoring the default configuration.
@@ -1776,7 +1776,7 @@ This setting lets you specify the wallpaper on users' desktops and prevents user
 
 To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification.
 
-- If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice.
+If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice.
 
 Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md
index 1deaa9fc80..e0d3710fed 100644
--- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md
+++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_DeviceInstallation Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -45,6 +45,7 @@ ms.topic: reference
 This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.
 
 - If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device.
+
 - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
 
 - If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation.
@@ -345,9 +346,11 @@ This policy setting establishes the amount of time (in seconds) that the system
 <!-- Description-Source-ADMX -->
 This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
 
-NOTE: To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
+> [!NOTE]
+> To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
 
 - If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated.
+
 - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.
 
 - If you disable or do not configure this policy setting, Windows can install and update driver packages for removable devices as allowed or prevented by other policy settings.
diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md
index a8d0a1bea1..30316a20e8 100644
--- a/windows/client-management/mdm/policy-csp-admx-diskquota.md
+++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_DiskQuota Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -189,7 +189,7 @@ This setting overrides new users' settings for the disk quota limit and warning
 
 This policy setting applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users, or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties).
 
-- If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level.
+If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level.
 
 When you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group.
 
@@ -384,7 +384,7 @@ This policy setting does not affect the Quota Entries window on the Quota tab. E
 <!-- Description-Source-ADMX -->
 This policy setting extends the disk quota policies in this folder to NTFS file system volumes on removable media.
 
-- If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only
+If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only.
 
 > [!NOTE]
 > When this policy setting is applied, the computer will apply the disk quota to both fixed and removable media.
diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md
index 600645f1cf..17b77f1279 100644
--- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md
+++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_ErrorReporting Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -243,6 +243,7 @@ This policy setting does not enable or disable Windows Error Reporting. To turn
 > If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting.
 
 - If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel).
+
 - If you enable this policy setting, you can configure the following settings in the policy setting:
 
 - "Do not display links to any Microsoft 'More information' websites": Select this option if you do not want error dialog boxes to display links to Microsoft websites.
@@ -1425,6 +1426,7 @@ This policy setting turns off Windows Error Reporting, so that reports are not c
 This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on.
 
 - If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE.
+
 - If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence.
 
 - If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default.
@@ -1485,6 +1487,7 @@ This policy setting limits Windows Error Reporting behavior for errors in genera
 This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on.
 
 - If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE.
+
 - If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence.
 
 - If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default.
diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md
index e1e98092d9..1164b582ab 100644
--- a/windows/client-management/mdm/policy-csp-admx-eventlog.md
+++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_EventLog Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -973,7 +973,7 @@ This policy setting controls Event Log behavior when the log file reaches its ma
 <!-- Description-Source-ADMX -->
 This policy setting turns on logging.
 
-- If you enable or do not configure this policy setting, then events can be written to this log.
+If you enable or do not configure this policy setting, then events can be written to this log.
 
 If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting.
 <!-- Channel_LogEnabled-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-eventviewer.md b/windows/client-management/mdm/policy-csp-admx-eventviewer.md
index c0b5223b4c..ec7f4e721d 100644
--- a/windows/client-management/mdm/policy-csp-admx-eventviewer.md
+++ b/windows/client-management/mdm/policy-csp-admx-eventviewer.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_EventViewer Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -97,7 +97,7 @@ This is the program that will be invoked when the user clicks the events.asp lin
 
 <!-- EventViewer_RedirectionProgramCommandLineParameters-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This specifies the command line parameters that will be passed to the events.asp program
+This specifies the command line parameters that will be passed to the events.asp program.
 <!-- EventViewer_RedirectionProgramCommandLineParameters-Description-End -->
 
 <!-- EventViewer_RedirectionProgramCommandLineParameters-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md
index 1d565c61b0..1508b4ca33 100644
--- a/windows/client-management/mdm/policy-csp-admx-explorer.md
+++ b/windows/client-management/mdm/policy-csp-admx-explorer.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Explorer Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -165,7 +165,7 @@ This policy setting configures File Explorer to always display the menu bar.
 <!-- Description-Source-ADMX -->
 This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values.
 
-- If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur.
+If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur.
 <!-- DisableRoamedProfileInit-Description-End -->
 
 <!-- DisableRoamedProfileInit-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md
index 329a7e9c63..cf01947874 100644
--- a/windows/client-management/mdm/policy-csp-admx-filesys.md
+++ b/windows/client-management/mdm/policy-csp-admx-filesys.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_FileSys Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files.
 
-A reboot is required for this setting to take effect
+A reboot is required for this setting to take effect.
 <!-- DisableCompression-Description-End -->
 
 <!-- DisableCompression-Editable-Begin -->
@@ -161,7 +161,7 @@ A value of 1 will disable delete notifications for all volumes.
 <!-- Description-Source-ADMX -->
 Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files.
 
-A reboot is required for this setting to take effect
+A reboot is required for this setting to take effect.
 <!-- DisableEncryption-Description-End -->
 
 <!-- DisableEncryption-Editable-Begin -->
@@ -395,7 +395,8 @@ Remote Link to Local Target
 
 For further information please refer to the Windows Help section
 
-NOTE: If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated.
+> [!NOTE]
+> If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated.
 <!-- SymlinkEvaluation-Description-End -->
 
 <!-- SymlinkEvaluation-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md
index e3ca25a214..ef355a430a 100644
--- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md
+++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_FolderRedirection Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -115,7 +115,7 @@ This policy setting allows you to control whether individual redirected shell fo
 
 For the folders affected by this setting, users must manually select the files they wish to make available offline.
 
-- If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline.
+If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline.
 
 > [!NOTE]
 > This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface.
diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md
index 898a9c4f92..00c5fcc190 100644
--- a/windows/client-management/mdm/policy-csp-admx-framepanes.md
+++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_FramePanes Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,9 +44,9 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting shows or hides the Details Pane in File Explorer.
 
-- If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user.
+If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user.
 
-- If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user
+If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user.
 
 > [!NOTE]
 > This has a side effect of not being able to toggle to the Preview Pane since the two cannot be displayed at the same time.
@@ -108,7 +108,7 @@ If you disable, or do not configure this policy setting, the Details Pane is hid
 <!-- Description-Source-ADMX -->
 Hides the Preview Pane in File Explorer.
 
-- If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user.
+If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user.
 
 If you disable, or do not configure this setting, the Preview Pane is hidden by default and can be displayed by the user.
 <!-- NoReadingPane-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md
index f755796c17..f1ef50e530 100644
--- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md
+++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_GroupPolicy Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -47,10 +47,10 @@ This policy setting allows user-based policy processing, roaming user profiles,
 This policy setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists.
 
 - If you do not configure this policy setting:
-- No user-based policy settings are applied from the user's forest.
-- Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted.
-- Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer.
-- An event log message (1109) is posted, stating that loopback was invoked in Replace mode.
+  - No user-based policy settings are applied from the user's forest.
+  - Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted.
+  - Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer.
+  - An event log message (1109) is posted, stating that loopback was invoked in Replace mode.
 
 - If you enable this policy setting, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest.
 
@@ -1117,7 +1117,8 @@ Changing the status of this setting to Enabled will keep any source files from c
 
 Changing the status of this setting to Disabled will enforce the default behavior. Files will always be copied to the GPO if they have a later timestamp.
 
-NOTE: If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled.
+> [!NOTE]
+> If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled.
 <!-- DisableAutoADMUpdate-Description-End -->
 
 <!-- DisableAutoADMUpdate-Editable-Begin -->
@@ -1496,6 +1497,7 @@ The timeout value that is defined in this policy setting determines how long Gro
 <!-- EnableLogonOptimizationOnServerSKU-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure Group Policy caching behavior on Windows Server machines.
+
 - If you enable this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the "Configure Group Policy Slow Link Detection" policy setting to configure asynchronous foreground behavior.)
 The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds.
 The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds.
@@ -1819,7 +1821,7 @@ The system's response to a slow policy connection varies among policies. The pro
 
 This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder.
 
-Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile
+Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile.
 
 > [!NOTE]
 > If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used.
@@ -1889,7 +1891,7 @@ The system's response to a slow policy connection varies among policies. The pro
 
 This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder.
 
-Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile
+Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile.
 
 > [!NOTE]
 > If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used.
@@ -2231,7 +2233,7 @@ This setting allows you to specify the default name for new Group Policy objects
 
 The display name can contain environment variables and can be a maximum of 255 characters long.
 
-- If this setting is disabled or Not Configured, the default display name of New Group Policy object is used.
+If this setting is Disabled or Not Configured, the default display name of New Group Policy object is used.
 <!-- NewGPODisplayName-Description-End -->
 
 <!-- NewGPODisplayName-Editable-Begin -->
@@ -2694,12 +2696,10 @@ This policy directs Group Policy processing to skip processing any client side e
 - If you enable this policy setting, when a slow network connection is detected, Group Policy processing will always run in an asynchronous manner.
 Client computers will not wait for the network to be fully initialized at startup and logon. Existing users will be logged on using cached credentials,
 which will result in shorter logon times. Group Policy will be applied in the background after the network becomes available.
-> [!NOTE]
-> that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection
+**Note** that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection
 and Drive Maps preference extension will not be applied.
 
-> [!NOTE]
-> There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled:
+**Note** There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled:
 1 - At the first computer startup after the client computer has joined the domain.
 2 - If the policy setting "Always wait for the network at computer startup and logon" is enabled.
 
@@ -2821,6 +2821,7 @@ This policy setting specifies how long Group Policy should wait for network avai
 This policy setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used.
 
 By default, the user's Group Policy Objects determine which user settings apply.
+
 - If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy Objects determine which set of Group Policy Objects applies.
 
 - If you enable this setting, you can select one of the following modes from the Mode box:
diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md
index 08e004e302..c125af97bc 100644
--- a/windows/client-management/mdm/policy-csp-admx-help.md
+++ b/windows/client-management/mdm/policy-csp-admx-help.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Help Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -187,7 +187,7 @@ This policy setting allows you to restrict programs from being run from online H
 > You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings.
 
 > [!NOTE]
-> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help
+> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help.
 <!-- RestrictRunFromHelp-Description-End -->
 
 <!-- RestrictRunFromHelp-Editable-Begin -->
@@ -252,7 +252,7 @@ This policy setting allows you to restrict programs from being run from online H
 > You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings.
 
 > [!NOTE]
-> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help
+> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help.
 <!-- RestrictRunFromHelp_Comp-Description-End -->
 
 <!-- RestrictRunFromHelp_Comp-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-iis.md b/windows/client-management/mdm/policy-csp-admx-iis.md
index 0af1df4d24..6ac2bb4f65 100644
--- a/windows/client-management/mdm/policy-csp-admx-iis.md
+++ b/windows/client-management/mdm/policy-csp-admx-iis.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_IIS Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -43,6 +43,7 @@ ms.topic: reference
 <!-- PreventIISInstall-Description-Begin -->
 <!-- Description-Source-ADMX -->
 "This policy setting prevents installation of Internet Information Services (IIS) on this computer.
+
 - If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer.
 - If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run."
 <!-- PreventIISInstall-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md
index 0b0cd3777a..3a5a0abee3 100644
--- a/windows/client-management/mdm/policy-csp-admx-kdc.md
+++ b/windows/client-management/mdm/policy-csp-admx-kdc.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_kdc Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -59,8 +59,8 @@ Domain functional level requirements
 For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected.
 
 When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and:
-- If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST).
-- If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages.
+  - If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST).
+  - If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages.
 
 > [!WARNING]
 > When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller.
@@ -68,9 +68,9 @@ When the domain functional level is set to Windows Server 2012 then the domain c
 To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled).
 
 Impact on domain controller performance when this policy setting is enabled:
-- Secure Kerberos domain capability discovery is required resulting in additional message exchanges.
-- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size.
-- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size.
+  - Secure Kerberos domain capability discovery is required resulting in additional message exchanges.
+  - Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size.
+  - Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size.
 <!-- CbacAndArmor-Description-End -->
 
 <!-- CbacAndArmor-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md
index 1845af6733..2a492d3afd 100644
--- a/windows/client-management/mdm/policy-csp-admx-kerberos.md
+++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Kerberos Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -237,6 +237,7 @@ This policy setting allows you to specify which DNS host names and which DNS suf
 This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server.
 
 - If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections.
+
 > [!WARNING]
 > When revocation check is ignored, the server represented by the certificate is not guaranteed valid.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md
index 3908dc2a9b..566b0c5342 100644
--- a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md
+++ b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_LeakDiagnostic Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -49,8 +49,8 @@ This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses
 - If you disable this policy setting, the DPS is not able to diagnose memory leak problems.
 
 This policy setting takes effect only under the following conditions:
-- If the diagnostics-wide scenario execution policy is not configured.
-- When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed.
+  - If the diagnostics-wide scenario execution policy is not configured.
+  - When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed.
 
 > [!NOTE]
 > The DPS can be configured with the Services snap-in to the Microsoft Management Console.
diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md
index d95dcfdb4f..8854f1a0e9 100644
--- a/windows/client-management/mdm/policy-csp-admx-logon.md
+++ b/windows/client-management/mdm/policy-csp-admx-logon.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Logon Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -839,15 +839,15 @@ If a user with a roaming profile, home directory, or user object logon script lo
 
 On servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup).
 
-If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon
-- The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and
-- The "Allow asynchronous user Group Policy processing when logging on through Terminal Services" policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\.
+If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon:
+  - The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and
+  - The "Allow asynchronous user Group Policy processing when logging on through Terminal Services" policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\.
 
 If this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon).
 
 - If you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background.
 
-**Note**
+**Note**:
 -If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy.
 -If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available.
 <!-- SyncForegroundPolicy-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
index 7cc5313827..4e89010233 100644
--- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
+++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -589,7 +589,7 @@ This policy setting allows you to disable scheduled and real-time scanning for f
 
 <!-- Exclusions_Processes-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as "c\windows\app.exe". The value is not used and it is recommended that this be set to 0.
+This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0.
 <!-- Exclusions_Processes-Description-End -->
 
 <!-- Exclusions_Processes-Editable-Begin -->
@@ -650,8 +650,8 @@ Exclude files and paths from Attack Surface Reduction (ASR) rules.
 Enabled:
 Specify the folders or files and resources that should be excluded from ASR rules in the Options section.
 Enter each rule on a new line as a name-value pair:
-- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder
-- Value column: Enter "0" for each item
+  - Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder
+  - Value column: Enter "0" for each item
 
 Disabled:
 No exclusions will be applied to the ASR rules.
@@ -718,26 +718,26 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s
 Set the state for each Attack Surface Reduction (ASR) rule.
 
 After enabling this setting, you can set each rule to the following in the Options section:
-- Block: the rule will be applied
-- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied)
-- Off: the rule will not be applied
-- Not Configured: the rule is enabled with default values
-- Warn: the rule will be applied and the end-user will have the option to bypass the block
+  - Block: the rule will be applied
+  - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied)
+  - Off: the rule will not be applied
+  - Not Configured: the rule is enabled with default values
+  - Warn: the rule will be applied and the end-user will have the option to bypass the block
 
 Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured.
 
 Enabled:
 Specify the state for each ASR rule under the Options section for this setting.
 Enter each rule on a new line as a name-value pair:
-- Name column: Enter a valid ASR rule ID
-- Value column: Enter the status ID that relates to state you want to specify for the associated rule
+  - Name column: Enter a valid ASR rule ID
+  - Value column: Enter the status ID that relates to state you want to specify for the associated rule
 
 The following status IDs are permitted under the value column:
-- 1 (Block)
-- 0 (Off)
-- 2 (Audit)
-- 5 (Not Configured)
-- 6 (Warn)
+  - 1 (Block)
+  - 0 (Off)
+  - 2 (Audit)
+  - 5 (Not Configured)
+  - 6 (Warn)
 
 Example:
 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
@@ -1511,6 +1511,7 @@ This policy setting defines the number of days items should be kept in the Quara
 This policy setting allows you to configure the scheduled scan, and the scheduled security intelligence update, start time window in hours.
 
 - If you disable or do not configure this setting, scheduled tasks will begin at a random time within 4 hours after the time specified in Task Scheduler.
+
 - If you enable this setting, you can widen, or narrow, this randomization period. Specify a randomization window of between 1 and 23 hours.
 <!-- RandomizeScheduleTaskTimes-Description-End -->
 
@@ -2823,7 +2824,7 @@ Tracing levels are defined as:
 1 - Error
 2 - Warning
 3 - Info
-4 - Debug
+4 - Debug.
 <!-- Reporting_WppTracingLevel-Description-End -->
 
 <!-- Reporting_WppTracingLevel-Editable-Begin -->
@@ -4742,7 +4743,7 @@ This policy setting allows you to configure security intelligence updates on sta
 <!-- Description-Source-ADMX -->
 This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares"
 
-For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }
+For Example: `{ InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }`
 
 - If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted.
 
@@ -5054,7 +5055,7 @@ This policy setting allows you to specify the time of day at which to check for
 <!-- Description-Source-ADMX -->
 This policy setting allows you to define the security intelligence location for VDI-configured computers.
 
-- If you disable or do not configure this setting, security intelligence will be referred from the default local source.
+If you disable or do not configure this setting, security intelligence will be referred from the default local source.
 <!-- SignatureUpdate_SharedSignaturesLocation-Description-End -->
 
 <!-- SignatureUpdate_SharedSignaturesLocation-Editable-Begin -->
@@ -5427,7 +5428,7 @@ This policy setting customize which remediation action will be taken for each li
 Valid remediation action values are:
 2 = Quarantine
 3 = Remove
-6 = Ignore
+6 = Ignore.
 <!-- Threats_ThreatIdDefaultAction-Description-End -->
 
 <!-- Threats_ThreatIdDefaultAction-Editable-Begin -->
@@ -5603,7 +5604,7 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus noti
 <!-- Description-Source-ADMX -->
 This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode).
 
-- If you enable this setting AM UI won't show reboot notifications.
+If you enable this setting AM UI won't show reboot notifications.
 <!-- UX_Configuration_SuppressRebootNotification-Description-End -->
 
 <!-- UX_Configuration_SuppressRebootNotification-Editable-Begin -->
@@ -5660,7 +5661,7 @@ This policy setting allows user to supress reboot notifications in UI only mode
 <!-- UX_Configuration_UILockdown-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure whether or not to display AM UI to the users.
-- If you enable this setting AM UI won't be available to users.
+If you enable this setting AM UI won't be available to users.
 <!-- UX_Configuration_UILockdown-Description-End -->
 
 <!-- UX_Configuration_UILockdown-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md
index 1956accd4b..1a28b481b0 100644
--- a/windows/client-management/mdm/policy-csp-admx-mmc.md
+++ b/windows/client-management/mdm/policy-csp-admx-mmc.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MMC Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 Permits or prohibits use of this snap-in.
 
-- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
+If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
 
 If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.
 
@@ -114,7 +114,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo
 <!-- Description-Source-ADMX -->
 Permits or prohibits use of this snap-in.
 
-- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
+If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
 
 If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.
 
@@ -184,7 +184,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo
 <!-- Description-Source-ADMX -->
 Permits or prohibits use of this snap-in.
 
-- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
+If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.
 
 If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.
 
@@ -260,7 +260,7 @@ As a result, users cannot create console files or add or remove snap-ins. Also,
 
 This setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click Run, and type mmc.) Users also cannot open a blank MMC console window from a command prompt.
 
-- If you disable this setting or do not configure it, users can enter author mode and open author-mode console files.
+If you disable this setting or do not configure it, users can enter author mode and open author-mode console files.
 <!-- MMC_Restrict_Author-Description-End -->
 
 <!-- MMC_Restrict_Author-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md
index b4f74ad73e..4bd4f1a4d1 100644
--- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md
+++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MMCSnapins Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -2564,7 +2564,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo
 <!-- Description-Source-ADMX -->
 Permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins.
 
-- If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins.
+If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins.
 
 If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md
index aac8c8c118..6d4c737e5b 100644
--- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md
+++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSAPolicy Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -43,6 +43,7 @@ ms.topic: reference
 <!-- MicrosoftAccount_DisableUserAuth-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This setting controls whether users can provide Microsoft accounts for authentication for applications or services.
+
 - If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication.
 This applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires.
 It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present.
diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md
index cdfeba781c..5dee7d69dd 100644
--- a/windows/client-management/mdm/policy-csp-admx-msdt.md
+++ b/windows/client-management/mdm/policy-csp-admx-msdt.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSDT Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -115,6 +115,7 @@ Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by
 These tools are required to completely troubleshoot the problem. If tool download is restricted, it may not be possible to find the root cause of the problem.
 
 - If you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only.
+
 - If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading.
 
 - If you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers.
diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md
index 637630abaf..6b3d9e67e1 100644
--- a/windows/client-management/mdm/policy-csp-admx-msi.md
+++ b/windows/client-management/mdm/policy-csp-admx-msi.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSI Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -551,7 +551,7 @@ Also, see the "Enable user to use media source while elevated" and "Hide the 'Ad
 <!-- Description-Source-ADMX -->
 This policy setting restricts the use of Windows Installer.
 
-- If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting.
+If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting.
 
 - The "Never" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured.
 
@@ -681,7 +681,7 @@ Also, see the "Enable user to patch elevated products" policy setting.
 <!-- Description-Source-ADMX -->
 This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.
 
-- If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.
+If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.
 
 This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential.
 
@@ -743,7 +743,7 @@ This policy setting appears in the Computer Configuration and User Configuration
 <!-- Description-Source-ADMX -->
 This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.
 
-- If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.
+If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete.
 
 This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential.
 
@@ -1303,7 +1303,7 @@ When you enable this policy setting, you can specify the types of events you wan
 
 To disable logging, delete all of the letters from the box.
 
-- If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap."
+If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap."
 <!-- MSILogging-Description-End -->
 
 <!-- MSILogging-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md
index 3177e932ac..4f0aa3bb0a 100644
--- a/windows/client-management/mdm/policy-csp-admx-nca.md
+++ b/windows/client-management/mdm/policy-csp-admx-nca.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_nca Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -56,7 +56,7 @@ We recommend that you use FQDNs instead of IPv6 addresses wherever possible.
 
 At least one of the entries must be a PING: resource.
 
--	A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is "HTTP:" followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:<https://myserver.corp.contoso.com/> or HTTP:https://2002:836b:1::1/.
+-	A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is "HTTP:" followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:https://myserver.corp.contoso.com/ or HTTP:https://2002:836b:1::1/.
 
 -	A Universal Naming Convention (UNC) path to a file that NCA checks for existence. The contents of the file do not matter. The syntax is "FILE:" followed by a UNC path. The ComputerName portion of the UNC path must resolve to an IPv6 address or contain an IPv6 address. Examples: FILE:\\myserver\myshare\test.txt or FILE:\\2002:836b:1::1\myshare\test.txt.
 
@@ -290,7 +290,7 @@ If this setting is not configured, the string that appears for DirectAccess conn
 <!-- Description-Source-ADMX -->
 Specifies whether the user has Connect and Disconnect options for the DirectAccess entry when the user clicks the Networking notification area icon.
 
-If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the Name Resolution Policy Table (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. **Note** that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names.
+If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the [Name Resolution Policy Table](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn593632(v=ws.11)) (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. **Note** that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names.
 
 The ability to disconnect allows users to specify single-label, unqualified names (such as "PRINTSVR") for local resources when connected to a different intranet and for temporary access to intranet resources when network location detection has not correctly determined that the DirectAccess client computer is connected to its own intranet.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md
index 66333d0c19..24975f13e3 100644
--- a/windows/client-management/mdm/policy-csp-admx-ncsi.md
+++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_NCSI Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -317,8 +317,7 @@ This policy setting enables you to specify the HTTPS URL of the corporate websit
 
 <!-- NCSI_GlobalDns-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on.
-- If you enable this setting, NCSI will allow the DNS lookups to happen on any interface.
+This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface.
 <!-- NCSI_GlobalDns-Description-End -->
 
 <!-- NCSI_GlobalDns-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md
index 9656e0aa10..2b76aaec77 100644
--- a/windows/client-management/mdm/policy-csp-admx-netlogon.md
+++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Netlogon Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -54,7 +54,7 @@ The allowable values for this setting result in the following behaviors:
 
 To specify this behavior in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 2.
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_AddressLookupOnPingBehavior-Description-End -->
 
 <!-- Netlogon_AddressLookupOnPingBehavior-Editable-Begin -->
@@ -955,7 +955,7 @@ DCs configured to perform dynamic registration of the DC Locator DNS resource re
 
 To specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes).
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_DnsRefreshInterval-Description-End -->
 
 <!-- Netlogon_DnsRefreshInterval-Editable-Begin -->
@@ -1082,7 +1082,7 @@ This policy setting specifies the value for the Time-To-Live (TTL) field in SRV
 
 To specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes).
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_DnsTtl-Description-End -->
 
 <!-- Netlogon_DnsTtl-Editable-Begin -->
@@ -1141,7 +1141,7 @@ This policy setting specifies the additional time for the computer to wait for t
 
 To specify the expected dial-up delay at logon, click Enabled, and then enter the desired value in seconds (for example, the value "60" is 1 minute).
 
-- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.
+If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.
 <!-- Netlogon_ExpectedDialupDelay-Description-End -->
 
 <!-- Netlogon_ExpectedDialupDelay-Editable-Begin -->
@@ -1265,7 +1265,7 @@ The GC Locator DNS records and the site-specific SRV records are dynamically reg
 
 To specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format.
 
-- If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration.
 <!-- Netlogon_GcSiteCoverage-Description-End -->
 
 <!-- Netlogon_GcSiteCoverage-Editable-Begin -->
@@ -1391,7 +1391,7 @@ The Priority field in the SRV record sets the preference for target hosts (speci
 
 To specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is from 0 to 65535.
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_LdapSrvPriority-Description-End -->
 
 <!-- Netlogon_LdapSrvPriority-Editable-Begin -->
@@ -1452,7 +1452,7 @@ The Weight field in the SRV record can be used in addition to the Priority value
 
 To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 65535.
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_LdapSrvWeight-Description-End -->
 
 <!-- Netlogon_LdapSrvWeight-Editable-Begin -->
@@ -1510,6 +1510,7 @@ To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then
 This policy setting specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled.
 
 By default, the maximum size of the log file is 20MB.
+
 - If you enable this policy setting, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified.
 
 - If you disable or do not configure this policy setting, the default behavior occurs as indicated above.
@@ -1573,7 +1574,7 @@ The application directory partition DC Locator DNS records and the site-specific
 
 To specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format.
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_NdncSiteCoverage-Description-End -->
 
 <!-- Netlogon_NdncSiteCoverage-Editable-Begin -->
@@ -1823,7 +1824,7 @@ The allowable values for this setting result in the following behaviors:
 
 To specify this behavior, click Enabled and then enter a value. The range of values is from 1 to 2.
 
-- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.
+If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.
 <!-- Netlogon_PingUrgencyMode-Description-End -->
 
 <!-- Netlogon_PingUrgencyMode-Editable-Begin -->
@@ -1949,7 +1950,7 @@ The DC Locator DNS records are dynamically registered by the Net Logon service,
 
 To specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format.
 
-- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
+If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration.
 <!-- Netlogon_SiteCoverage-Description-End -->
 
 <!-- Netlogon_SiteCoverage-Editable-Begin -->
@@ -2010,7 +2011,7 @@ An Active Directory site is one or more well-connected TCP/IP subnets that allow
 
 To specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory.
 
-- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.
+If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration.
 <!-- Netlogon_SiteName-Description-End -->
 
 <!-- Netlogon_SiteName-Editable-Begin -->
@@ -2076,7 +2077,7 @@ By default, the SYSVOL share will grant shared read access to files on the share
 > [!NOTE]
 > The SYSVOL share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the SYSVOL share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the SYSVOL share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the SYSVOL share on the domain will be decreased.
 
-- If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator.
+If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator.
 <!-- Netlogon_SysvolShareCompatibilityMode-Description-End -->
 
 <!-- Netlogon_SysvolShareCompatibilityMode-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md
index f59fcc9805..8844aca989 100644
--- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md
+++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_NetworkConnections Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -544,7 +544,7 @@ Specifies whether or not the "local access only" network icon will be shown.
 
 When enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only.
 
-- If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only.
+If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only.
 <!-- NC_DoNotShowLocalOnlyIcon-Description-End -->
 
 <!-- NC_DoNotShowLocalOnlyIcon-Editable-Begin -->
@@ -950,6 +950,7 @@ This setting determines whether the Properties menu item is enabled, and thus, w
 
 > [!NOTE]
 > This setting takes precedence over settings that manipulate the availability of features inside the Local Area Connection Properties dialog box.
+
 - If this setting is enabled, nothing within the properties dialog box for a LAN connection is available to users.
 
 > [!NOTE]
@@ -1378,6 +1379,7 @@ This setting determines whether the Properties menu item is enabled, and thus, w
 
 > [!NOTE]
 > This setting takes precedence over settings that manipulate the availability of features in the Remote Access Connection Properties dialog box.
+
 - If this setting is enabled, nothing within the properties dialog box for a remote access connection will be available to users.
 
 > [!NOTE]
@@ -1445,7 +1447,7 @@ To create an all-user connection, on the Connection Availability page in the New
 
 - If you disable this setting, the Rename option is disabled for nonadministrators only.
 
-If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections.
+- If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections.
 
 > [!NOTE]
 > This setting does not apply to Administrators
diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md
index a4d11fa601..38fe42d808 100644
--- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md
+++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_OfflineFiles Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -1642,7 +1642,7 @@ Hides or displays reminder balloons, and prevents users from changing the settin
 
 Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.
 
-- If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.
+If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.
 
 If you disable the setting, the system displays the reminder balloons and prevents users from hiding them.
 
@@ -1713,7 +1713,7 @@ Hides or displays reminder balloons, and prevents users from changing the settin
 
 Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.
 
-- If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.
+If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.
 
 If you disable the setting, the system displays the reminder balloons and prevents users from hiding them.
 
@@ -1847,7 +1847,7 @@ Deletes local copies of the user's offline files when the user logs off.
 
 This setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files.
 
-- If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use.
+If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use.
 
 > [!CAUTION]
 > Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost.
@@ -1968,7 +1968,7 @@ This policy setting allows you to turn on economical application of administrati
 <!-- Description-Source-ADMX -->
 Determines how often reminder balloon updates appear.
 
-- If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.
+If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.
 
 Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval.
 
@@ -2032,7 +2032,7 @@ This setting appears in the Computer Configuration and User Configuration folder
 <!-- Description-Source-ADMX -->
 Determines how often reminder balloon updates appear.
 
-- If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.
+If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.
 
 Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval.
 
@@ -2744,7 +2744,7 @@ Determines whether offline files are synchonized before a computer is suspended.
 
 - If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version.
 
-If you disable or do not configuring this setting, files are not synchronized when the computer is suspended.
+- If you disable or do not configuring this setting, files are not synchronized when the computer is suspended.
 
 > [!NOTE]
 > If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed.
@@ -2806,7 +2806,7 @@ Determines whether offline files are synchonized before a computer is suspended.
 
 - If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version.
 
-If you disable or do not configuring this setting, files are not synchronized when the computer is suspended.
+- If you disable or do not configuring this setting, files are not synchronized when the computer is suspended.
 
 > [!NOTE]
 > If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed.
diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md
index dea0b08208..f2d2d78382 100644
--- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md
+++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_PeerToPeerCaching Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -261,10 +261,9 @@ Hosted cache clients must trust the server certificate that is issued to the hos
 
 <!-- EnableWindowsBranchCache_HostedCacheDiscovery-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site.
-- If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies.
+This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies.
 
-- If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy.
+If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy.
 
 When this policy setting is applied, the client computer performs or does not perform automatic hosted cache server discovery under the following circumstances:
 
diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md
index b85780257a..207d96ce87 100644
--- a/windows/client-management/mdm/policy-csp-admx-printing.md
+++ b/windows/client-management/mdm/policy-csp-admx-printing.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Printing Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -242,6 +242,7 @@ Web view is affected by the "Turn on Classic Shell" and "Do not allow Folder Opt
 
 <!-- DomainPrinters-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.)
 
 - If this policy setting is disabled, the network scan page will not be displayed.
@@ -258,6 +259,7 @@ In order to view available Web Services printers on your network, ensure that ne
 If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0.
 
 In Windows 10 and later, only TCP/IP printers can be shown in the wizard.
+
 - If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied.
 
 In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows.
@@ -577,7 +579,7 @@ Adds a link to an Internet or intranet Web page to the Add Printer Wizard.
 
 You can use this setting to direct users to a Web page from which they can install printers.
 
-- If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers.
+If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers.
 
 This setting makes it easy for users to find the printers you want them to add.
 
@@ -823,13 +825,14 @@ Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default
 
 <!-- NoDeletePrinter-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If this policy setting is enabled, it prevents users from deleting local and network printers.
 
 If a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a setting prevents the action.
 
 This setting does not prevent users from running other programs to delete a printer.
 
-If this policy is disabled, or not configured, users can delete printers using the methods described above.
+- If this policy is disabled, or not configured, users can delete printers using the methods described above.
 <!-- NoDeletePrinter-Description-End -->
 
 <!-- NoDeletePrinter-Editable-Begin -->
@@ -898,6 +901,7 @@ Shared printers: 50
 If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0.
 
 In Windows 10 and later, only TCP/IP printers can be shown in the wizard.
+
 - If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied.
 
 In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows.
@@ -1204,6 +1208,7 @@ Windows Vista and later clients will attempt to make a non-package point and pri
 
 <!-- PhysicalLocation-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If this policy setting is enabled, it specifies the default location criteria used when searching for printers.
 
 This setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the "Pre-populate printer search location text" setting.
@@ -1463,7 +1468,7 @@ Specifies the Active Directory location where searches for printers begin.
 
 The Add Printer Wizard gives users the option of searching Active Directory for a shared printer.
 
-- If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory.
+If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory.
 
 This setting only provides a starting point for Active Directory searches for printers. It does not restrict user searches through Active Directory.
 <!-- PrinterDirectorySearchScope-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md
index dd69376114..1d78b2f09e 100644
--- a/windows/client-management/mdm/policy-csp-admx-printing2.md
+++ b/windows/client-management/mdm/policy-csp-admx-printing2.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Printing2 Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -251,7 +251,7 @@ By default, the pruning service contacts computers every eight hours and allows
 
 - If you enable this setting, you can change the interval between contact attempts.
 
-If you do not configure or disable this setting the default values will be used.
+- If you do not configure or disable this setting the default values will be used.
 
 > [!NOTE]
 > This setting is used only on domain controllers.
@@ -381,7 +381,7 @@ By default, the pruning service contacts computers every eight hours and allows
 
 - If you enable this setting, you can change the interval between attempts.
 
-If you do not configure or disable this setting, the default values are used.
+- If you do not configure or disable this setting, the default values are used.
 
 > [!NOTE]
 > This setting is used only on domain controllers.
diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md
index 1d7a70b423..da10e25a17 100644
--- a/windows/client-management/mdm/policy-csp-admx-programs.md
+++ b/windows/client-management/mdm/policy-csp-admx-programs.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Programs Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -46,7 +46,7 @@ This setting removes the Set Program Access and Defaults page from the Programs
 
 The Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations.
 
-- If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users.
+If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users.
 
 This setting does not prevent users from using other tools and methods to change program access or defaults.
 
@@ -177,7 +177,7 @@ This setting prevents users from accessing "Installed Updates" page from the "Vi
 
 "Installed Updates" allows users to view and uninstall updates currently installed on the computer. The updates are often downloaded directly from Windows Update or from various program publishers.
 
-- If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users.
+If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users.
 
 This setting does not prevent users from using other tools and methods to install or uninstall programs.
 <!-- NoInstalledUpdates-Description-End -->
@@ -237,7 +237,7 @@ This setting does not prevent users from using other tools and methods to instal
 <!-- Description-Source-ADMX -->
 This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer.
 
-- If this setting is disabled or not configured, "Programs and Features" will be available to all users.
+If this setting is disabled or not configured, "Programs and Features" will be available to all users.
 
 This setting does not prevent users from using other tools and methods to view or uninstall programs. It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace.
 <!-- NoProgramsAndFeatures-Description-End -->
@@ -299,7 +299,7 @@ This setting prevents users from using the Programs Control Panel in Category Vi
 
 The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel.
 
-- If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users.
+If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users.
 
 When enabled, this setting takes precedence over the other settings in this folder.
 
@@ -361,7 +361,7 @@ This setting does not prevent users from using other tools and methods to instal
 <!-- Description-Source-ADMX -->
 This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. As a result, users cannot view, enable, or disable various Windows features and services.
 
-- If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users.
+If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users.
 
 This setting does not prevent users from using other tools and methods to configure services or enable or disable program components.
 <!-- NoWindowsFeatures-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md
index a2094c9c4e..812ee0a71e 100644
--- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md
+++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_PushToInstall Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -42,7 +42,7 @@ ms.topic: reference
 
 <!-- DisablePushToInstall-Description-Begin -->
 <!-- Description-Source-ADMX -->
-- If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web.
+If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web.
 <!-- DisablePushToInstall-Description-End -->
 
 <!-- DisablePushToInstall-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md
index b37b7eb63d..ca1428aae4 100644
--- a/windows/client-management/mdm/policy-csp-admx-rpc.md
+++ b/windows/client-management/mdm/policy-csp-admx-rpc.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_RPC Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -273,7 +273,7 @@ This policy setting determines whether the RPC Runtime maintains RPC state infor
 
 - If you enable this policy setting, you can use the drop-down box to determine which systems maintain RPC state information.
 
-- "None" indicates that the system does not maintain any RPC state information
+- "None" indicates that the system does not maintain any RPC state information.
 
 > [!NOTE]
 > Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations.
diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md
index 3a57924050..1dc3a07841 100644
--- a/windows/client-management/mdm/policy-csp-admx-sam.md
+++ b/windows/client-management/mdm/policy-csp-admx-sam.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_sam Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,19 +44,19 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure how domain controllers handle Windows Hello for Business (WHfB) keys that are vulnerable to the "Return of Coppersmith's attack" (ROCA) vulnerability.
 
-For more information on the ROCA vulnerability, please see
+For more information on the ROCA vulnerability, please see:
 
-<https//cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15361>
+<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15361>
 
-<https//en.wikipedia.org/wiki/ROCA_vulnerability>
+<https://en.wikipedia.org/wiki/ROCA_vulnerability>
 
-- If you enable this policy setting the following options are supported
+If you enable this policy setting the following options are supported:
 
-Ignore during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability.
+Ignore: during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability.
 
-Audit during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed).
+Audit: during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed).
 
-Block during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail).
+Block: during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail).
 
 This setting only takes effect on domain controllers.
 
@@ -66,7 +66,7 @@ A reboot is not required for changes to this setting to take effect.
 
 **Note** to avoid unexpected disruptions this setting should not be set to Block until appropriate mitigations have been performed, for example patching of vulnerable TPMs.
 
-More information is available at <https//go.microsoft.com/fwlink/?linkid=2116430>.
+More information is available at< https://go.microsoft.com/fwlink/?linkid=2116430>.
 <!-- SamNGCKeyROCAValidation-Description-End -->
 
 <!-- SamNGCKeyROCAValidation-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md
index 4525405908..3eb2672ba9 100644
--- a/windows/client-management/mdm/policy-csp-admx-settingsync.md
+++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_SettingSync Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "app settings" group will not be synced.
+If you enable this policy setting, the "app settings" group will not be synced.
 
 Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled.
 
@@ -106,7 +106,7 @@ If you do not set or disable this setting, syncing of the "app settings" group i
 <!-- Description-Source-ADMX -->
 Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "AppSync" group will not be synced.
+If you enable this policy setting, the "AppSync" group will not be synced.
 
 Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled.
 
@@ -168,7 +168,7 @@ If you do not set or disable this setting, syncing of the "AppSync" group is on
 <!-- Description-Source-ADMX -->
 Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "passwords" group will not be synced.
+If you enable this policy setting, the "passwords" group will not be synced.
 
 Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled.
 
@@ -230,7 +230,7 @@ If you do not set or disable this setting, syncing of the "passwords" group is o
 <!-- Description-Source-ADMX -->
 Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "desktop personalization" group will not be synced.
+If you enable this policy setting, the "desktop personalization" group will not be synced.
 
 Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled.
 
@@ -292,7 +292,7 @@ If you do not set or disable this setting, syncing of the "desktop personalizati
 <!-- Description-Source-ADMX -->
 Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "personalize" group will not be synced.
+If you enable this policy setting, the "personalize" group will not be synced.
 
 Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled.
 
@@ -354,7 +354,7 @@ If you do not set or disable this setting, syncing of the "personalize" group is
 <!-- Description-Source-ADMX -->
 Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings.
 
-- If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC.
+If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC.
 
 Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled.
 
@@ -416,7 +416,7 @@ If you do not set or disable this setting, "sync your settings" is on by default
 <!-- Description-Source-ADMX -->
 Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "Start layout" group will not be synced.
+If you enable this policy setting, the "Start layout" group will not be synced.
 
 Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled.
 
@@ -478,7 +478,7 @@ If you do not set or disable this setting, syncing of the "Start layout" group i
 <!-- Description-Source-ADMX -->
 Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings.
 
-- If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection.
+If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection.
 
 If you do not set or disable this setting, syncing on metered connections is configurable by the user.
 <!-- DisableSyncOnPaidNetwork-Description-End -->
@@ -538,7 +538,7 @@ If you do not set or disable this setting, syncing on metered connections is con
 <!-- Description-Source-ADMX -->
 Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings.
 
-- If you enable this policy setting, the "Other Windows settings" group will not be synced.
+If you enable this policy setting, the "Other Windows settings" group will not be synced.
 
 Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md
index 0380f886fb..fbc5c518ac 100644
--- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md
+++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_SharedFolders Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -31,7 +31,7 @@ ms.topic: reference
 <!-- PublishDfsRoots-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later <br> :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later <br> :heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later <br> :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- PublishDfsRoots-Applicability-End -->
 
 <!-- PublishDfsRoots-OmaUri-Begin -->
@@ -46,7 +46,7 @@ This policy setting determines whether the user can publish DFS roots in Active
 
 - If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS .
 
-- If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled
+- If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled.
 
 > [!NOTE]
 > The default is to allow shared folders to be published when this setting is not configured.
@@ -109,7 +109,7 @@ This policy setting determines whether the user can publish shared folders in Ac
 
 - If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS.
 
-- If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled
+- If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled.
 
 > [!NOTE]
 > The default is to allow shared folders to be published when this setting is not configured.
diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md
index d51369a170..e438a375db 100644
--- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md
+++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Po
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -175,6 +175,7 @@ This policy setting only prevents users from running programs that are started b
 
 > [!NOTE]
 > Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting.
+
 > [!NOTE]
 > To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe).
 <!-- DisallowApps-Description-End -->
@@ -242,6 +243,7 @@ This policy setting only prevents users from running programs that are started b
 
 > [!NOTE]
 > Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting.
+
 > [!NOTE]
 > To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe).
 <!-- RestrictApps-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md
index ddfeafcb32..9cc16c1696 100644
--- a/windows/client-management/mdm/policy-csp-admx-smartcard.md
+++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Smartcard Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/23/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -352,6 +352,7 @@ This policy setting allows you to manage the certificate propagation that occurs
 <!-- CertPropRootCleanupString-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to manage the clean up behavior of root certificates.
+
 - If you enable this policy setting then root certificate cleanup will occur according to the option selected.
 - If you disable or do not configure this setting then root certificate clean up will occur on log off.
 <!-- CertPropRootCleanupString-Description-End -->
@@ -413,7 +414,7 @@ This policy setting allows you to manage the root certificate propagation that o
 - If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card.
 
 > [!NOTE]
-> For this policy setting to work the following policy setting must also be enabled Turn on certificate propagation from smart card.
+> For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card.
 
 - If you disable this policy setting then root certificates will not be propagated from the smart card.
 <!-- CertPropRootEnabledString-Description-End -->
@@ -542,6 +543,7 @@ This policy setting allows you to control whether elliptic curve cryptography (E
 
 > [!NOTE]
 > This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting.
+
 > [!NOTE]
 > If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network.
 <!-- EnumerateECCCerts-Description-End -->
@@ -606,7 +608,7 @@ During the certificate renewal period, a user can have multiple valid logon cert
 If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown.
 
 > [!NOTE]
-> This setting will be applied after the following policy "Allow time invalid certificates"
+> This setting will be applied after the following policy: "Allow time invalid certificates"
 
 - If you enable or do not configure this policy setting, filtering will take place.
 
@@ -794,7 +796,7 @@ This policy setting lets you reverse the subject name from how it is stored in t
 
 By default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then "User1" will be displayed along with "user1@example.com." If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization.
 
-- If you enable this policy setting or do not configure this setting, then the subject name will be reversed.
+If you enable this policy setting or do not configure this setting, then the subject name will be reversed.
 
 If you disable , the subject name will be displayed as it appears in the certificate.
 <!-- ReverseSubject-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md
index 11e6d2fff2..cce101b264 100644
--- a/windows/client-management/mdm/policy-csp-admx-srmfci.md
+++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_srmfci Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -227,7 +227,7 @@ The Classification tab enables users to manually classify files by selecting pro
 
 <!-- EnableShellAccessCheck-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types
+This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types.
 <!-- EnableShellAccessCheck-Description-End -->
 
 <!-- EnableShellAccessCheck-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md
index b4ffcc734a..39837aa6f0 100644
--- a/windows/client-management/mdm/policy-csp-admx-startmenu.md
+++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_StartMenu Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -42,6 +42,7 @@ ms.topic: reference
 
 <!-- AddSearchInternetLinkInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, a "Search the Internet" link is shown when the user performs a search in the start menu search box. This button launches the default browser with the search terms.
 
 - If you disable this policy, there will not be a "Search the Internet" link when the user performs a search in the start menu search box.
@@ -173,6 +174,7 @@ This policy also does not clear items that the user may have pinned to the Jump
 
 <!-- ClearRecentProgForNewUserInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting, the recent programs list in the start menu will be blank for each new user.
 
 - If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user.
@@ -231,6 +233,7 @@ This policy also does not clear items that the user may have pinned to the Jump
 
 <!-- ClearTilesOnExit-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, the system deletes tile notifications when the user logs on. As a result, the Tiles in the start view will always show their default content when the user logs on. In addition, any cached versions of these notifications will be cleared when the user logs on.
 
 - If you disable or do not configure this setting, the system retains notifications, and when a user logs on, the tiles appear just as they did when the user logged off, including the history of previous notifications for each tile.
@@ -550,7 +553,7 @@ This setting makes it easier for users to distinguish between programs that are
 
 Partially installed programs include those that a system administrator assigns using Windows Installer and those that users have configured for full installation upon first use.
 
-- If you disable this setting or do not configure it, all Start menu shortcuts appear as black text.
+If you disable this setting or do not configure it, all Start menu shortcuts appear as black text.
 
 > [!NOTE]
 > Enabling this setting can make the Start menu slow to open.
@@ -673,7 +676,7 @@ Disables personalized menus.
 
 Windows personalizes long menus by moving recently used items to the top of the menu and hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu.
 
-- If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect.
+If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect.
 
 > [!NOTE]
 > Personalized menus require user tracking. If you enable the "Turn off user tracking" setting, the system disables user tracking and personalized menus and ignores this setting.
@@ -868,7 +871,7 @@ The notification area is located in the task bar, generally at the bottom of the
 
 - If you disable this setting, the system notification area will always collapse notifications.
 
-If you do not configure it, the user can choose if they want notifications collapsed.
+- If you do not configure it, the user can choose if they want notifications collapsed.
 <!-- NoAutoTrayNotify-Description-End -->
 
 <!-- NoAutoTrayNotify-Editable-Begin -->
@@ -1115,8 +1118,7 @@ This policy setting prevents users from performing the following commands from t
 <!-- Description-Source-ADMX -->
 Removes items in the All Users profile from the Programs menu on the Start menu.
 
-By default, the Programs menu contains items from the All Users profile and items from the user's profile.
-- If you enable this setting, only items in the user's profile appear in the Programs menu.
+By default, the Programs menu contains items from the All Users profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu.
 
 > [!TIP]
 > To see the Program menu items in the All Users profile, on the system drive, go to ProgramData\Microsoft\Windows\Start Menu\Programs.
@@ -1311,6 +1313,7 @@ This policy setting affects the specified user interface elements only. It does
 
 <!-- NoGamesFolderOnStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy the start menu will not show a link to the Games folder.
 
 - If you disable or do not configure this policy, the start menu will show a link to the Games folder, unless the user chooses to remove it in the start menu control panel.
@@ -1499,6 +1502,7 @@ This policy setting does not prevent users from pinning programs to the Start Me
 
 <!-- NoMoreProgramsList-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu.
 
 Selecting "Collapse" will not display the app list next to the pinned tiles in Start. An "All apps" button will be displayed on Start to open the all apps list. This is equivalent to setting the "Show app list in Start" in Settings to Off.
@@ -1628,6 +1632,7 @@ Also, see the "Disable programs on Settings menu" and "Disable Control Panel" po
 
 <!-- NoPinnedPrograms-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, the "Pinned Programs" list is removed from the Start menu. Users cannot pin programs to the Start menu.
 
 In Windows XP and Windows Vista, the Internet and email checkboxes are removed from the 'Customize Start Menu' dialog.
@@ -1692,7 +1697,7 @@ Removes the Recent Items menu from the Start menu. Removes the Documents menu fr
 
 The Recent Items menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen their documents.
 
-- If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on.
+If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on.
 
 If you later disable the setting, so that the Recent Items menu appears in the Start Menu, the document shortcuts saved before the setting was enabled and while it was in effect appear in the Recent Items menu.
 
@@ -1973,6 +1978,7 @@ Also, users with extended keyboards will no longer be able to display the Run di
 
 <!-- NoSearchCommInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy the start menu search box will not search for communications.
 
 - If you disable or do not configure this policy, the start menu will search for communications, unless the user chooses not to in the start menu control panel.
@@ -2031,6 +2037,7 @@ Also, users with extended keyboards will no longer be able to display the Run di
 
 <!-- NoSearchComputerLinkInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search box.
 
 - If you disable or do not configure this policy, the "See all results" link will be shown when the user performs a search in the start menu search box.
@@ -2089,6 +2096,7 @@ Also, users with extended keyboards will no longer be able to display the Run di
 
 <!-- NoSearchEverywhereLinkInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box.
 
 - If you disable or do not configure this policy, a "See more results" link will be shown when the user performs a search in the start menu search box. If a 3rd party protocol handler is installed, a "Search Everywhere" link will be shown instead of the "See more results" link.
@@ -2147,9 +2155,11 @@ Also, users with extended keyboards will no longer be able to display the Run di
 
 <!-- NoSearchFilesInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting the Start menu search box will not search for files.
 
 - If you disable or do not configure this policy setting, the Start menu will search for files, unless the user chooses not to do so directly in Control Panel.
+
 - If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box.
 <!-- NoSearchFilesInStartMenu-Description-End -->
 
@@ -2206,6 +2216,7 @@ Also, users with extended keyboards will no longer be able to display the Run di
 
 <!-- NoSearchInternetInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy the start menu search box will not search for internet history or favorites.
 
 - If you disable or do not configure this policy, the start menu will search for for internet history or favorites, unless the user chooses not to in the start menu control panel.
@@ -2264,6 +2275,7 @@ Also, users with extended keyboards will no longer be able to display the Run di
 
 <!-- NoSearchProgramsInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting the Start menu search box will not search for programs or Control Panel items.
 
 - If you disable or do not configure this policy setting, the Start menu search box will search for programs and Control Panel items, unless the user chooses not to do so directly in Control Panel.
@@ -2822,6 +2834,7 @@ This policy setting allows you to remove the Downloads link from the Start Menu.
 
 <!-- NoStartMenuHomegroup-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy the Start menu will not show a link to Homegroup. It also removes the homegroup item from the Start Menu options. As a result, users cannot add the homegroup link to the Start Menu.
 
 - If you disable or do not configure this policy, users can use the Start Menu options to add or remove the homegroup link from the Start Menu.
@@ -3194,7 +3207,7 @@ Taskbar grouping consolidates similar applications when there is no room on the
 
 - If you enable this setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled.
 
-If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose.
+- If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose.
 <!-- NoTaskGrouping-Description-End -->
 
 <!-- NoTaskGrouping-Editable-Begin -->
@@ -3447,9 +3460,10 @@ Description: The notification area is located at the far right end of the task b
 
 <!-- NoUninstallFromStart-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, users cannot uninstall apps from Start.
 
-- If you disable this setting or do not configure it, users can access the uninstall command from Start
+- If you disable this setting or do not configure it, users can access the uninstall command from Start.
 <!-- NoUninstallFromStart-Description-End -->
 
 <!-- NoUninstallFromStart-Editable-Begin -->
@@ -3505,6 +3519,7 @@ Description: The notification area is located at the far right end of the task b
 
 <!-- NoUserFolderOnStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy the start menu will not show a link to the user's storage folder.
 
 - If you disable or do not configure this policy, the start menu will display a link, unless the user chooses to remove it in the start menu control panel.
@@ -3629,7 +3644,7 @@ This policy setting allows you to remove links and access to Windows Update.
 
 - If you enable this policy setting, users are prevented from connecting to the Windows Update Web site.
 
-Enabling this policy setting blocks user access to the Windows Update Web site at <https://windowsupdate.microsoft.com>. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer.
+Enabling this policy setting blocks user access to the Windows Update Web site at< https://windowsupdate.microsoft.com>. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer.
 
 Windows Update, the online extension of Windows, offers software updates to keep a user's system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download.
 
@@ -3814,6 +3829,7 @@ This policy setting controls whether the QuickLaunch bar is displayed in the Tas
 
 <!-- RemoveUnDockPCButton-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked.
 
 - If you disable this setting or do not configure it, the "Undock PC" button remains on the simple Start menu, and your PC can be undocked.
@@ -3995,6 +4011,7 @@ This policy setting shows or hides the "Run as different user" command on the St
 
 <!-- ShowRunInStartMenu-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, the Run command is added to the Start menu.
 - If you disable or do not configure this setting, the Run command is not visible on the Start menu by default, but it can be added from the Taskbar and Start menu properties. If the Remove Run link from Start Menu policy is set, the Add the Run command to the Start menu policy has no effect.
 <!-- ShowRunInStartMenu-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md
index d5babf1d77..5324e13ac0 100644
--- a/windows/client-management/mdm/policy-csp-admx-taskbar.md
+++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Taskbar Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -416,7 +416,7 @@ This policy setting allows you to remove the volume control icon from the system
 <!-- Description-Source-ADMX -->
 This policy setting allows you to turn off feature advertisement balloon notifications.
 
-- If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown.
+If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown.
 
 If you disable do not configure this policy setting, feature advertisement balloons are shown.
 <!-- NoBalloonFeatureAdvertisements-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md
index a0b38a0dd1..07885bdc4a 100644
--- a/windows/client-management/mdm/policy-csp-admx-tcpip.md
+++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_tcpip Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -535,7 +535,7 @@ This policy setting allows you to select the UDP port the Teredo client will use
 <!-- Description-Source-ADMX -->
 This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state.
 
-- If you disable or do not configure this policy setting, the local host setting is used.
+If you disable or do not configure this policy setting, the local host setting is used.
 
 This policy setting contains only one state:
 
diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md
index e293e8cf71..31bdd76413 100644
--- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md
+++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_TerminalServer Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -239,7 +239,8 @@ This policy setting allows you to specify whether users can run Remote Desktop P
 - If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.
 
 > [!NOTE]
-> You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.
+> You can define this policy setting in the Computer Configuration node or in the User Configuration node.
+- If you configure this policy setting for the computer, all users on the computer are affected.
 <!-- TS_CLIENT_ALLOW_SIGNED_FILES_1-Description-End -->
 
 <!-- TS_CLIENT_ALLOW_SIGNED_FILES_1-Editable-Begin -->
@@ -302,7 +303,8 @@ This policy setting allows you to specify whether users can run Remote Desktop P
 - If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.
 
 > [!NOTE]
-> You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.
+> You can define this policy setting in the Computer Configuration node or in the User Configuration node.
+- If you configure this policy setting for the computer, all users on the computer are affected.
 <!-- TS_CLIENT_ALLOW_SIGNED_FILES_2-Description-End -->
 
 <!-- TS_CLIENT_ALLOW_SIGNED_FILES_2-Editable-Begin -->
@@ -863,8 +865,7 @@ By default, Remote Desktop Services automatically designates the client default
 
 <!-- TS_CLIENT_DISABLE_HARDWARE_MODE-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate.
-- If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available.
+This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available.
 <!-- TS_CLIENT_DISABLE_HARDWARE_MODE-Description-End -->
 
 <!-- TS_CLIENT_DISABLE_HARDWARE_MODE-Editable-Begin -->
@@ -924,7 +925,7 @@ Controls whether a user can save passwords using Remote Desktop Connection.
 
 - If you enable this setting the credential saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.
 
-- If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection
+- If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection.
 <!-- TS_CLIENT_DISABLE_PASSWORD_SAVING_1-Description-End -->
 
 <!-- TS_CLIENT_DISABLE_PASSWORD_SAVING_1-Editable-Begin -->
@@ -1182,7 +1183,8 @@ This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA
 
 **Note**:
 
-You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.
+You can define this policy setting in the Computer Configuration node or in the User Configuration node.
+- If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.
 
 This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting.
 
@@ -1249,7 +1251,8 @@ This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA
 
 **Note**:
 
-You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.
+You can define this policy setting in the Computer Configuration node or in the User Configuration node.
+- If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.
 
 This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting.
 
@@ -1579,7 +1582,8 @@ This policy setting enables system administrators to change the graphics renderi
 
 - If you do not configure this policy setting, Remote Desktop Services sessions on the RD Session Host server use the Microsoft Basic Render Driver as the default adapter. In all other cases, Remote Desktop Services sessions use the hardware graphics renderer by default.
 
-NOTE: The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting.
+> [!NOTE]
+> The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting.
 <!-- TS_DX_USE_FULL_HWGPU-Description-End -->
 
 <!-- TS_DX_USE_FULL_HWGPU-Editable-Begin -->
@@ -1971,7 +1975,7 @@ Specifies the authentication method that clients must use when attempting to con
 
 To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default.
 
-- If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication.
+If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication.
 <!-- TS_GATEWAY_POLICY_AUTH_METHOD-Description-End -->
 
 <!-- TS_GATEWAY_POLICY_AUTH_METHOD-Editable-Begin -->
@@ -2026,6 +2030,7 @@ To allow users to overwrite this policy setting, select the "Allow users to chan
 
 <!-- TS_GATEWAY_POLICY_ENABLE-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting.
 
 You can enforce this policy setting or you can allow users to overwrite this setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client.
@@ -2165,6 +2170,7 @@ If the policy setting is not configured, the policy setting is not specified at
 **Note**:
 
 1.
+
 - If you enable this policy setting, you must also enable the Configure RD Connection Broker farm name and Configure RD Connection Broker server name policy settings.
 
 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.
@@ -2982,7 +2988,7 @@ This policy setting determines whether a user will be prompted on the client com
 <!-- Description-Source-ADMX -->
 This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs.
 
-The default connection URL must be configured in the form of <https://contoso.com/rdweb/Feed/webfeed.aspx>.
+The default connection URL must be configured in the form of< https://contoso.com/rdweb/Feed/webfeed.aspx>.
 
 - If you enable this policy setting, the specified URL is configured as the default connection URL for the user and replaces any existing connection URL. The user cannot change the default connection URL. The user's default logon credentials are used when setting up the default connection URL.
 
@@ -3106,6 +3112,7 @@ By default, when a new user signs in to a computer, the Start screen is shown an
 
 <!-- TS_RemoteControl_1-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list:
 
 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session.
@@ -3171,6 +3178,7 @@ By default, when a new user signs in to a computer, the Start screen is shown an
 
 <!-- TS_RemoteControl_2-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list:
 
 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session.
@@ -3242,8 +3250,7 @@ Depending on the requirements of your users, you can reduce network bandwidth us
 
 If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality.
 
-By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions.
-- If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior).
+By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior).
 <!-- TS_RemoteDesktopVirtualGraphics-Description-End -->
 
 <!-- TS_RemoteDesktopVirtualGraphics-Editable-Begin -->
@@ -3573,7 +3580,7 @@ If you disable Continuous Network Detect, Remote Desktop Protocol will not try t
 
 If you disable Connect Time Detect and Continuous Network Detect, Remote Desktop Protocol will not try to determine the network quality at the connect time; instead it will assume that all traffic to this server originates from a low-speed connection, and it will not try to adapt the user experience to varying network quality.
 
-- If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality.
+If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality.
 <!-- TS_SELECT_NETWORK_DETECT-Description-End -->
 
 <!-- TS_SELECT_NETWORK_DETECT-Editable-Begin -->
@@ -3818,8 +3825,7 @@ Do not connect if authentication fails: The client establishes a connection to t
 
 <!-- TS_SERVER_AVC_HW_ENCODE_PREFERRED-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding.
-- If you disable or do not configure this policy, we will always use software encoding.
+This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. If you disable or do not configure this policy, we will always use software encoding.
 <!-- TS_SERVER_AVC_HW_ENCODE_PREFERRED-Description-End -->
 
 <!-- TS_SERVER_AVC_HW_ENCODE_PREFERRED-Editable-Begin -->
@@ -3995,9 +4001,13 @@ You can also choose not to use an RDP compression algorithm. Choosing not to use
 <!-- TS_SERVER_IMAGE_QUALITY-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to specify the visual quality for remote users when connecting to this computer by using Remote Desktop Connection. You can use this policy setting to balance the network bandwidth usage with the visual quality that is delivered.
+
 - If you enable this policy setting and set quality to Low, RemoteFX Adaptive Graphics uses an encoding mechanism that results in low quality images. This mode consumes the lowest amount of network bandwidth of the quality modes.
+
 - If you enable this policy setting and set quality to Medium, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. This mode provides better graphics quality than low quality and uses less bandwidth than high quality.
+
 - If you enable this policy setting and set quality to High, RemoteFX Adaptive Graphics uses an encoding mechanism that results in high quality images and consumes moderate network bandwidth.
+
 - If you enable this policy setting and set quality to Lossless, RemoteFX Adaptive Graphics uses lossless encoding. In this mode, the color integrity of the graphics data is not impacted. However, this setting results in a significant increase in network bandwidth consumption. We recommend that you set this for very specific cases only.
 - If you disable or do not configure this policy setting, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images.
 <!-- TS_SERVER_IMAGE_QUALITY-Description-End -->
@@ -4055,6 +4065,7 @@ This policy setting allows you to specify the visual quality for remote users wh
 <!-- TS_SERVER_LEGACY_RFX-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure graphics encoding to use the RemoteFX Codec on the Remote Desktop Session Host server so that the sessions are compatible with non-Windows thin client devices designed for Windows Server 2008 R2 SP1. These clients only support the Windows Server 2008 R2 SP1 RemoteFX Codec.
+
 - If you enable this policy setting, users' sessions on this server will only use the Windows Server 2008 R2 SP1 RemoteFX Codec for encoding. This mode is compatible with thin client devices that only support the Windows Server 2008 R2 SP1 RemoteFX Codec.
 - If you disable or do not configure this policy setting, non-Windows thin clients that only support the Windows Server 2008 R2 SP1 RemoteFX Codec will not be able to connect to this server. This policy setting applies only to clients that are using Remote Desktop Protocol (RDP) 7.1, and does not affect clients that are using other RDP versions.
 <!-- TS_SERVER_LEGACY_RFX-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md
index 9237bb81e7..b22b7d4527 100644
--- a/windows/client-management/mdm/policy-csp-admx-tpm.md
+++ b/windows/client-management/mdm/policy-csp-admx-tpm.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_TPM Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -342,7 +342,7 @@ This policy setting configures how much of the TPM owner authorization informati
 
 You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none.
 
-- If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose.
+If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose.
 
 Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md
index 15da8637a6..f802208d23 100644
--- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md
+++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_UserExperienceVirtualization Area in Poli
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -48,6 +48,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings of Calculator.
 By default, the user settings of Calculator synchronize between computers. Use the policy setting to prevent the user settings of Calculator from synchronization between computers.
+
 - If you enable this policy setting, the Calculator user settings continue to synchronize.
 - If you disable this policy setting, Calculator user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -175,6 +176,7 @@ With notifications enabled, UE-V users receive a message when the settings sync
 <!-- ConfigureVdi-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of User Experience Virtualization (UE-V) rollback information for computers running in a non-persistent, pooled VDI environment. UE-V settings rollback data and checkpoints are normally stored only on the local computer. With this policy setting enabled, the rollback information is copied to the settings storage location when the user logs off or shuts down their VDI session. Enable this setting to register a VDI-specific settings location template and restore data on computers in pooled VDI environments that reset to a clean state on logout. With this policy enabled you can roll settings back to the state when UE-V was installed or to "last-known-good" configurations. Only enable this policy setting on computers running in a non-persistent VDI environment. The VDI Collection Name defines the name of the virtual desktop collection containing the virtual computers.
+
 - If you enable this policy setting, the UE-V rollback state is copied to the settings storage location on logout and restored on login.
 - If you disable this policy setting, no UE-V rollback state is copied to the settings storage location.
 - If you do not configure this policy, no UE-V rollback state is copied to the settings storage location.
@@ -234,6 +236,7 @@ This policy setting configures the synchronization of User Experience Virtualiza
 <!-- ContactITDescription-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center.
+
 - If you enable this policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL.
 - If you disable this policy setting, the Company Settings Center does not display an IT Contact link.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -292,6 +295,7 @@ This policy setting specifies the text of the Contact IT URL hyperlink in the Co
 <!-- ContactITUrl-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting specifies the URL for the Contact IT link in the Company Settings Center.
+
 - If you enable this policy setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol such as http or mailto.
 - If you disable this policy setting, the Company Settings Center does not display an IT Contact link.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -355,9 +359,11 @@ This policy setting specifies the URL for the Contact IT link in the Company Set
 <!-- Description-Source-ADMX -->
 This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings for Windows apps.
 By default, the UE-V Agent synchronizes settings for Windows apps between the computer and the settings storage location.
+
 - If you enable this policy setting, the UE-V Agent will not synchronize settings for Windows apps.
 - If you disable this policy setting, the UE-V Agent will synchronize settings for Windows apps.
 - If you do not configure this policy setting, any defined values are deleted.
+
 > [!NOTE]
 > If the user connects their Microsoft account for their computer then the UE-V Agent will not synchronize Windows apps. The Windows apps will default to whatever settings are configured in the Sync your settings configuration in Windows.
 <!-- DisableWin8Sync-Description-End -->
@@ -421,6 +427,7 @@ By default, the UE-V Agent synchronizes settings for Windows apps between the co
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of Windows settings between computers.
 Certain Windows settings will synchronize between computers by default. These settings include Windows themes, Windows desktop settings, Ease of Access settings, and network printers. Use this policy setting to specify which Windows settings synchronize between computers. You can also use these settings to enable synchronization of users' sign-in information for certain apps, networks, and certificates.
+
 - If you enable this policy setting, only the selected Windows settings synchronize. Unselected Windows settings are excluded from settings synchronization.
 - If you disable this policy setting, all Windows Settings are excluded from the settings synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -540,6 +547,7 @@ This policy setting allows you to enable or disable User Experience Virtualizati
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Finance app.
 By default, the user settings of Finance sync between computers. Use the policy setting to prevent the user settings of Finance from synchronizing between computers.
+
 - If you enable this policy setting, Finance user settings continue to sync.
 - If you disable this policy setting, Finance user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -602,7 +610,7 @@ This policy setting enables a notification in the system tray that appears when
 By default, a notification informs users that Company Settings Center, the user-facing name for the UE-V Agent, now helps to synchronize settings between their work computers.
 With this setting enabled, the notification appears the first time that the UE-V Agent runs.
 With this setting disabled, no notification appears.
-- If you do not configure this policy setting, any defined values are deleted.
+If you do not configure this policy setting, any defined values are deleted.
 <!-- FirstUseNotificationEnabled-Description-End -->
 
 <!-- FirstUseNotificationEnabled-Editable-Begin -->
@@ -664,6 +672,7 @@ With this setting disabled, no notification appears.
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Games app.
 By default, the user settings of Games sync between computers. Use the policy setting to prevent the user settings of Games from synchronizing between computers.
+
 - If you enable this policy setting, Games user settings continue to sync.
 - If you disable this policy setting, Games user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -728,6 +737,7 @@ By default, the user settings of Games sync between computers. Use the policy se
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings of Internet Explorer 10.
 By default, the user settings of Internet Explorer 10 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 10 from synchronization between computers.
+
 - If you enable this policy setting, the Internet Explorer 10 user settings continue to synchronize.
 - If you disable this policy setting, Internet Explorer 10 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -792,6 +802,7 @@ By default, the user settings of Internet Explorer 10 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings of Internet Explorer 11.
 By default, the user settings of Internet Explorer 11 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 11 from synchronization between computers.
+
 - If you enable this policy setting, the Internet Explorer 11 user settings continue to synchronize.
 - If you disable this policy setting, Internet Explorer 11 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -856,6 +867,7 @@ By default, the user settings of Internet Explorer 11 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Internet Explorer 8.
 By default, the user settings of Internet Explorer 8 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 8 from synchronization between computers.
+
 - If you enable this policy setting, the Internet Explorer 8 user settings continue to synchronize.
 - If you disable this policy setting, Internet Explorer 8 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -920,6 +932,7 @@ By default, the user settings of Internet Explorer 8 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Internet Explorer 9.
 By default, the user settings of Internet Explorer 9 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 9 from synchronization between computers.
+
 - If you enable this policy setting, the Internet Explorer 9 user settings continue to synchronize.
 - If you disable this policy setting, Internet Explorer 9 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -984,6 +997,7 @@ By default, the user settings of Internet Explorer 9 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings which are common between the versions of Internet Explorer.
 By default, the user settings which are common between the versions of Internet Explorer synchronize between computers. Use the policy setting to prevent the user settings of Internet Explorer from synchronization between computers.
+
 - If you enable this policy setting, the user settings which are common between the versions of Internet Explorer continue to synchronize.
 - If you disable this policy setting, the user settings which are common between the versions of Internet Explorer are excluded from settings synchronization. If any version of the Internet Explorer settings are enabled this policy setting should not be disabled.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1047,6 +1061,7 @@ By default, the user settings which are common between the versions of Internet
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Maps app.
 By default, the user settings of Maps sync between computers. Use the policy setting to prevent the user settings of Maps from synchronizing between computers.
+
 - If you enable this policy setting, Maps user settings continue to sync.
 - If you disable this policy setting, Maps user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1110,6 +1125,7 @@ By default, the user settings of Maps sync between computers. Use the policy set
 <!-- MaxPackageSizeInBytes-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure the UE-V Agent to write a warning event to the event log when a settings package file size reaches a defined threshold. By default the UE-V Agent does not report information about package file size.
+
 - If you enable this policy setting, specify the threshold file size in bytes. When the settings package file exceeds this threshold the UE-V Agent will write a warning event to the event log.
 - If you disable or do not configure this policy setting, no event is written to the event log to report settings package size.
 <!-- MaxPackageSizeInBytes-Description-End -->
@@ -1172,6 +1188,7 @@ This policy setting allows you to configure the UE-V Agent to write a warning ev
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Access 2010.
 By default, the user settings of Microsoft Access 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Access 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Access 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1235,6 +1252,7 @@ By default, the user settings of Microsoft Access 2010 synchronize between compu
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2010 applications.
 By default, the user settings which are common between the Microsoft Office Suite 2010 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2010 applications from synchronization between computers.
+
 - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications continue to synchronize.
 - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2010 applications are enabled, this policy setting should not be disabled
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1298,6 +1316,7 @@ By default, the user settings which are common between the Microsoft Office Suit
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Excel 2010.
 By default, the user settings of Microsoft Excel 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Excel 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Excel 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1361,6 +1380,7 @@ By default, the user settings of Microsoft Excel 2010 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft InfoPath 2010.
 By default, the user settings of Microsoft InfoPath 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft InfoPath 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft InfoPath 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1424,6 +1444,7 @@ By default, the user settings of Microsoft InfoPath 2010 synchronize between com
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Lync 2010.
 By default, the user settings of Microsoft Lync 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Lync 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Lync 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1488,6 +1509,7 @@ By default, the user settings of Microsoft Lync 2010 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft OneNote 2010.
 By default, the user settings of Microsoft OneNote 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft OneNote 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft OneNote 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1551,6 +1573,7 @@ By default, the user settings of Microsoft OneNote 2010 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Outlook 2010.
 By default, the user settings of Microsoft Outlook 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Outlook 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Outlook 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1614,6 +1637,7 @@ By default, the user settings of Microsoft Outlook 2010 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2010.
 By default, the user settings of Microsoft PowerPoint 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft PowerPoint 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft PowerPoint 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1677,6 +1701,7 @@ By default, the user settings of Microsoft PowerPoint 2010 synchronize between c
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Project 2010.
 By default, the user settings of Microsoft Project 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Project 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Project 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1740,6 +1765,7 @@ By default, the user settings of Microsoft Project 2010 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Publisher 2010.
 By default, the user settings of Microsoft Publisher 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Publisher 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Publisher 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1803,6 +1829,7 @@ By default, the user settings of Microsoft Publisher 2010 synchronize between co
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2010.
 By default, the user settings of Microsoft SharePoint Designer 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft SharePoint Designer 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft SharePoint Designer 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1866,6 +1893,7 @@ By default, the user settings of Microsoft SharePoint Designer 2010 synchronize
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft SharePoint Workspace 2010.
 By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Workspace 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft SharePoint Workspace 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft SharePoint Workspace 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1929,6 +1957,7 @@ By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Visio 2010.
 By default, the user settings of Microsoft Visio 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Visio 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Visio 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -1992,6 +2021,7 @@ By default, the user settings of Microsoft Visio 2010 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Word 2010.
 By default, the user settings of Microsoft Word 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2010 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Word 2010 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Word 2010 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2055,6 +2085,7 @@ By default, the user settings of Microsoft Word 2010 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Access 2013.
 By default, the user settings of Microsoft Access 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Access 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Access 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2118,6 +2149,7 @@ By default, the user settings of Microsoft Access 2013 synchronize between compu
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Access 2013.
 Microsoft Access 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Access 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Access 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2181,6 +2213,7 @@ Microsoft Access 2013 has user settings that are backed up instead of synchroniz
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications.
 By default, the user settings which are common between the Microsoft Office Suite 2013 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers.
+
 - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize.
 - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2013 applications are enabled, this policy setting should not be disabled.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2244,6 +2277,7 @@ By default, the user settings which are common between the Microsoft Office Suit
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2013 applications.
 Microsoft Office Suite 2013 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2013 applications.
+
 - If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will continue to be backed up.
 - If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2307,6 +2341,7 @@ Microsoft Office Suite 2013 has user settings which are common between applicati
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Excel 2013.
 By default, the user settings of Microsoft Excel 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Excel 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Excel 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2370,6 +2405,7 @@ By default, the user settings of Microsoft Excel 2013 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Excel 2013.
 Microsoft Excel 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Excel 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Excel 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2433,6 +2469,7 @@ Microsoft Excel 2013 has user settings that are backed up instead of synchronizi
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft InfoPath 2013.
 By default, the user settings of Microsoft InfoPath 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft InfoPath 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft InfoPath 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2496,6 +2533,7 @@ By default, the user settings of Microsoft InfoPath 2013 synchronize between com
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft InfoPath 2013.
 Microsoft InfoPath 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft InfoPath 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft InfoPath 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft InfoPath 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2559,6 +2597,7 @@ Microsoft InfoPath 2013 has user settings that are backed up instead of synchron
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Lync 2013.
 By default, the user settings of Microsoft Lync 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Lync 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Lync 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2622,6 +2661,7 @@ By default, the user settings of Microsoft Lync 2013 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Lync 2013.
 Microsoft Lync 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Lync 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Lync 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2685,6 +2725,7 @@ Microsoft Lync 2013 has user settings that are backed up instead of synchronizin
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for OneDrive for Business 2013.
 By default, the user settings of OneDrive for Business 2013 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2013 from synchronization between computers.
+
 - If you enable this policy setting, OneDrive for Business 2013 user settings continue to synchronize.
 - If you disable this policy setting, OneDrive for Business 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2748,6 +2789,7 @@ By default, the user settings of OneDrive for Business 2013 synchronize between
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft OneNote 2013.
 By default, the user settings of Microsoft OneNote 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft OneNote 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft OneNote 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2811,6 +2853,7 @@ By default, the user settings of Microsoft OneNote 2013 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft OneNote 2013.
 Microsoft OneNote 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft OneNote 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft OneNote 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2874,6 +2917,7 @@ Microsoft OneNote 2013 has user settings that are backed up instead of synchroni
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Outlook 2013.
 By default, the user settings of Microsoft Outlook 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Outlook 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Outlook 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -2937,6 +2981,7 @@ By default, the user settings of Microsoft Outlook 2013 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Outlook 2013.
 Microsoft Outlook 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Outlook 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Outlook 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3000,6 +3045,7 @@ Microsoft Outlook 2013 has user settings that are backed up instead of synchroni
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2013.
 By default, the user settings of Microsoft PowerPoint 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft PowerPoint 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft PowerPoint 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3063,6 +3109,7 @@ By default, the user settings of Microsoft PowerPoint 2013 synchronize between c
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2013.
 Microsoft PowerPoint 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft PowerPoint 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft PowerPoint 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3126,6 +3173,7 @@ Microsoft PowerPoint 2013 has user settings that are backed up instead of synchr
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Project 2013.
 By default, the user settings of Microsoft Project 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Project 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Project 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3189,6 +3237,7 @@ By default, the user settings of Microsoft Project 2013 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Project 2013.
 Microsoft Project 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Project 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Project 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3252,6 +3301,7 @@ Microsoft Project 2013 has user settings that are backed up instead of synchroni
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Publisher 2013.
 By default, the user settings of Microsoft Publisher 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Publisher 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Publisher 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3315,6 +3365,7 @@ By default, the user settings of Microsoft Publisher 2013 synchronize between co
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Publisher 2013.
 Microsoft Publisher 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Publisher 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Publisher 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3378,6 +3429,7 @@ Microsoft Publisher 2013 has user settings that are backed up instead of synchro
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2013.
 By default, the user settings of Microsoft SharePoint Designer 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft SharePoint Designer 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft SharePoint Designer 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3441,6 +3493,7 @@ By default, the user settings of Microsoft SharePoint Designer 2013 synchronize
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft SharePoint Designer 2013.
 Microsoft SharePoint Designer 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft SharePoint Designer 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3504,6 +3557,7 @@ Microsoft SharePoint Designer 2013 has user settings that are backed up instead
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 2013 Upload Center.
 By default, the user settings of Microsoft Office 2013 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2013 Upload Center from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Office 2013 Upload Center user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Office 2013 Upload Center user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3567,6 +3621,7 @@ By default, the user settings of Microsoft Office 2013 Upload Center synchronize
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Visio 2013.
 By default, the user settings of Microsoft Visio 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Visio 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Visio 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3630,6 +3685,7 @@ By default, the user settings of Microsoft Visio 2013 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Visio 2013.
 Microsoft Visio 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Visio 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Visio 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3693,6 +3749,7 @@ Microsoft Visio 2013 has user settings that are backed up instead of synchronizi
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Word 2013.
 By default, the user settings of Microsoft Word 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2013 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Word 2013 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Word 2013 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3756,6 +3813,7 @@ By default, the user settings of Microsoft Word 2013 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Word 2013.
 Microsoft Word 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2013 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Word 2013 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Word 2013 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3819,6 +3877,7 @@ Microsoft Word 2013 has user settings that are backed up instead of synchronizin
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Access 2016.
 By default, the user settings of Microsoft Access 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Access 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Access 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3882,6 +3941,7 @@ By default, the user settings of Microsoft Access 2016 synchronize between compu
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Access 2016.
 Microsoft Access 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Access 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Access 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -3945,6 +4005,7 @@ Microsoft Access 2016 has user settings that are backed up instead of synchroniz
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications.
 By default, the user settings which are common between the Microsoft Office Suite 2016 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers.
+
 - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize.
 - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2016 applications are enabled, this policy setting should not be disabled.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4008,6 +4069,7 @@ By default, the user settings which are common between the Microsoft Office Suit
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2016 applications.
 Microsoft Office Suite 2016 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2016 applications.
+
 - If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will continue to be backed up.
 - If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4071,6 +4133,7 @@ Microsoft Office Suite 2016 has user settings which are common between applicati
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Excel 2016.
 By default, the user settings of Microsoft Excel 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Excel 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Excel 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4134,6 +4197,7 @@ By default, the user settings of Microsoft Excel 2016 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Excel 2016.
 Microsoft Excel 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Excel 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Excel 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4197,6 +4261,7 @@ Microsoft Excel 2016 has user settings that are backed up instead of synchronizi
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Lync 2016.
 By default, the user settings of Microsoft Lync 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Lync 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Lync 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4260,6 +4325,7 @@ By default, the user settings of Microsoft Lync 2016 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Lync 2016.
 Microsoft Lync 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Lync 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Lync 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4323,6 +4389,7 @@ Microsoft Lync 2016 has user settings that are backed up instead of synchronizin
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for OneDrive for Business 2016.
 By default, the user settings of OneDrive for Business 2016 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2016 from synchronization between computers.
+
 - If you enable this policy setting, OneDrive for Business 2016 user settings continue to synchronize.
 - If you disable this policy setting, OneDrive for Business 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4386,6 +4453,7 @@ By default, the user settings of OneDrive for Business 2016 synchronize between
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft OneNote 2016.
 By default, the user settings of Microsoft OneNote 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft OneNote 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft OneNote 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4449,6 +4517,7 @@ By default, the user settings of Microsoft OneNote 2016 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft OneNote 2016.
 Microsoft OneNote 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft OneNote 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft OneNote 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4512,6 +4581,7 @@ Microsoft OneNote 2016 has user settings that are backed up instead of synchroni
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Outlook 2016.
 By default, the user settings of Microsoft Outlook 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Outlook 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Outlook 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4575,6 +4645,7 @@ By default, the user settings of Microsoft Outlook 2016 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Outlook 2016.
 Microsoft Outlook 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Outlook 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Outlook 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4638,6 +4709,7 @@ Microsoft Outlook 2016 has user settings that are backed up instead of synchroni
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2016.
 By default, the user settings of Microsoft PowerPoint 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft PowerPoint 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft PowerPoint 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4701,6 +4773,7 @@ By default, the user settings of Microsoft PowerPoint 2016 synchronize between c
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2016.
 Microsoft PowerPoint 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft PowerPoint 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft PowerPoint 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4764,6 +4837,7 @@ Microsoft PowerPoint 2016 has user settings that are backed up instead of synchr
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Project 2016.
 By default, the user settings of Microsoft Project 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Project 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Project 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4827,6 +4901,7 @@ By default, the user settings of Microsoft Project 2016 synchronize between comp
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Project 2016.
 Microsoft Project 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Project 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Project 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4890,6 +4965,7 @@ Microsoft Project 2016 has user settings that are backed up instead of synchroni
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Publisher 2016.
 By default, the user settings of Microsoft Publisher 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Publisher 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Publisher 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -4953,6 +5029,7 @@ By default, the user settings of Microsoft Publisher 2016 synchronize between co
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Publisher 2016.
 Microsoft Publisher 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Publisher 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Publisher 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5016,6 +5093,7 @@ Microsoft Publisher 2016 has user settings that are backed up instead of synchro
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 2016 Upload Center.
 By default, the user settings of Microsoft Office 2016 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2016 Upload Center from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Office 2016 Upload Center user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Office 2016 Upload Center user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5079,6 +5157,7 @@ By default, the user settings of Microsoft Office 2016 Upload Center synchronize
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Visio 2016.
 By default, the user settings of Microsoft Visio 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Visio 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Visio 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5142,6 +5221,7 @@ By default, the user settings of Microsoft Visio 2016 synchronize between comput
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Visio 2016.
 Microsoft Visio 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Visio 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Visio 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5205,6 +5285,7 @@ Microsoft Visio 2016 has user settings that are backed up instead of synchronizi
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Word 2016.
 By default, the user settings of Microsoft Word 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2016 from synchronization between computers.
+
 - If you enable this policy setting, Microsoft Word 2016 user settings continue to synchronize.
 - If you disable this policy setting, Microsoft Word 2016 user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5268,6 +5349,7 @@ By default, the user settings of Microsoft Word 2016 synchronize between compute
 <!-- Description-Source-ADMX -->
 This policy setting configures the backup of certain user settings for Microsoft Word 2016.
 Microsoft Word 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2016 settings.
+
 - If you enable this policy setting, certain user settings of Microsoft Word 2016 will continue to be backed up.
 - If you disable this policy setting, certain user settings of Microsoft Word 2016 will not be backed up.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5331,6 +5413,7 @@ Microsoft Word 2016 has user settings that are backed up instead of synchronizin
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Access 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Access 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5394,6 +5477,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Access 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Access 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5457,6 +5541,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2013 applications will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers with UE-V.
+
 - If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize with UE-V.
 - If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5520,6 +5605,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2016 applications will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers with UE-V.
+
 - If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize with UE-V.
 - If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5583,6 +5669,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Excel 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Excel 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5646,6 +5733,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Excel 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Excel 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5709,6 +5797,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 InfoPath 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 InfoPath 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 InfoPath 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 InfoPath 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 InfoPath 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5772,6 +5861,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Lync 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Lync 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5835,6 +5925,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Lync 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Lync 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5898,6 +5989,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 OneNote 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 OneNote 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -5961,6 +6053,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 OneNote 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 OneNote 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6024,6 +6117,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Outlook 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Outlook 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6087,6 +6181,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Outlook 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Outlook 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6150,6 +6245,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6213,6 +6309,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6276,6 +6373,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Project 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Project 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6339,6 +6437,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Project 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Project 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6402,6 +6501,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Publisher 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Publisher 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6465,6 +6565,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Publisher 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Publisher 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6528,6 +6629,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 SharePoint Designer 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 SharePoint Designer 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 SharePoint Designer 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6591,6 +6693,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Visio 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Visio 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6654,6 +6757,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Visio 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Visio 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6717,6 +6821,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2013.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2013 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Word 2013 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Word 2013 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6780,6 +6885,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2016.
 Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2016 from synchronization between computers with UE-V.
+
 - If you enable this policy setting, Microsoft Office 365 Word 2016 user settings continue to sync with UE-V.
 - If you disable this policy setting, Microsoft Office 365 Word 2016 user settings are excluded from synchronization with UE-V.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6843,6 +6949,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Music app.
 By default, the user settings of Music sync between computers. Use the policy setting to prevent the user settings of Music from synchronizing between computers.
+
 - If you enable this policy setting, Music user settings continue to sync.
 - If you disable this policy setting, Music user settings are excluded from the synchronizing settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6907,6 +7014,7 @@ By default, the user settings of Music sync between computers. Use the policy se
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the News app.
 By default, the user settings of News sync between computers. Use the policy setting to prevent the user settings of News from synchronizing between computers.
+
 - If you enable this policy setting, News user settings continue to sync.
 - If you disable this policy setting, News user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -6971,6 +7079,7 @@ By default, the user settings of News sync between computers. Use the policy set
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings of Notepad.
 By default, the user settings of Notepad synchronize between computers. Use the policy setting to prevent the user settings of Notepad from synchronization between computers.
+
 - If you enable this policy setting, the Notepad user settings continue to synchronize.
 - If you disable this policy setting, Notepad user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -7035,6 +7144,7 @@ By default, the user settings of Notepad synchronize between computers. Use the
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Reader app.
 By default, the user settings of Reader sync between computers. Use the policy setting to prevent the user settings of Reader from synchronizing between computers.
+
 - If you enable this policy setting, Reader user settings continue to sync.
 - If you disable this policy setting, Reader user settings are excluded from the synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -7099,6 +7209,7 @@ By default, the user settings of Reader sync between computers. Use the policy s
 <!-- Description-Source-ADMX -->
 This policy setting configures the number of milliseconds that the computer waits when retrieving user settings from the settings storage location.
 You can use this setting to override the default value of 2000 milliseconds.
+
 - If you enable this policy setting, set the number of milliseconds that the system waits to retrieve settings.
 - If you disable or do not configure this policy setting, the default value of 2000 milliseconds is used.
 <!-- RepositoryTimeout-Description-End -->
@@ -7160,6 +7271,7 @@ You can use this setting to override the default value of 2000 milliseconds.
 <!-- SettingsStoragePath-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting configures where the settings package files that contain user settings are stored.
+
 - If you enable this policy setting, the user settings are stored in the specified location.
 - If you disable or do not configure this policy setting, the user settings are stored in the user's home directory if configured for your environment.
 <!-- SettingsStoragePath-Description-End -->
@@ -7217,6 +7329,7 @@ This policy setting configures where the settings package files that contain use
 <!-- SettingsTemplateCatalogPath-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting configures where custom settings location templates are stored and if the catalog will be used to replace the default Microsoft templates installed with the UE-V Agent.
+
 - If you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location.
 If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored.
 If you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used.
@@ -7283,6 +7396,7 @@ If you specify a UNC path and check the option to replace the default Microsoft
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Sports app.
 By default, the user settings of Sports sync between computers. Use the policy setting to prevent the user settings of Sports from synchronizing between computers.
+
 - If you enable this policy setting, Sports user settings continue to sync.
 - If you disable this policy setting, Sports user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -7409,7 +7523,7 @@ This policy setting defines whether the User Experience Virtualization (UE-V) Ag
 By default, the UE-V Agent does not synchronize settings over a metered connection.
 With this setting enabled, the UE-V Agent synchronizes settings over a metered connection.
 With this setting disabled, the UE-V Agent does not synchronize settings over a metered connection.
-- If you do not configure this policy setting, any defined values are deleted.
+If you do not configure this policy setting, any defined values are deleted.
 <!-- SyncOverMeteredNetwork-Description-End -->
 
 <!-- SyncOverMeteredNetwork-Editable-Begin -->
@@ -7473,7 +7587,7 @@ This policy setting defines whether the User Experience Virtualization (UE-V) Ag
 By default, the UE-V Agent does not synchronize settings over a metered connection that is roaming.
 With this setting enabled, the UE-V Agent synchronizes settings over a metered connection that is roaming.
 With this setting disabled, the UE-V Agent will not synchronize settings over a metered connection that is roaming.
-- If you do not configure this policy setting, any defined values are deleted.
+If you do not configure this policy setting, any defined values are deleted.
 <!-- SyncOverMeteredNetworkWhenRoaming-Description-End -->
 
 <!-- SyncOverMeteredNetworkWhenRoaming-Editable-Begin -->
@@ -7534,6 +7648,7 @@ With this setting disabled, the UE-V Agent will not synchronize settings over a
 <!-- SyncProviderPingEnabled-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure the User Experience Virtualization (UE-V) sync provider to ping the settings storage path before attempting to sync settings. If the ping is successful then the sync provider attempts to synchronize the settings packages. If the ping is unsuccessful then the sync provider doesn't attempt the synchronization.
+
 - If you enable this policy setting, the sync provider pings the settings storage location before synchronizing settings packages.
 - If you disable this policy setting, the sync provider doesn't ping the settings storage location before synchronizing settings packages.
 - If you do not configure this policy, any defined values will be deleted.
@@ -7596,7 +7711,7 @@ This policy setting defines the default settings sync behavior of the User Exper
 By default, the UE-V Agent only synchronizes settings of those Windows apps included in the Windows App List.
 With this setting enabled, the settings of all Windows apps not expressly disable in the Windows App List are synchronized.
 With this setting disabled, only the settings of the Windows apps set to synchronize in the Windows App List are synchronized.
-- If you do not configure this policy setting, any defined values are deleted.
+If you do not configure this policy setting, any defined values are deleted.
 <!-- SyncUnlistedWindows8Apps-Description-End -->
 
 <!-- SyncUnlistedWindows8Apps-Editable-Begin -->
@@ -7658,6 +7773,7 @@ With this setting disabled, only the settings of the Windows apps set to synchro
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Travel app.
 By default, the user settings of Travel sync between computers. Use the policy setting to prevent the user settings of Travel from synchronizing between computers.
+
 - If you enable this policy setting, Travel user settings continue to sync.
 - If you disable this policy setting, Travel user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -7718,7 +7834,7 @@ By default, the user settings of Travel sync between computers. Use the policy s
 <!-- Description-Source-ADMX -->
 This policy setting enables the User Experience Virtualization (UE-V) tray icon. By default, an icon appears in the system tray that displays notifications for UE-V. This icon also provides a link to the UE-V Agent application, Company Settings Center. Users can open the Company Settings Center by right-clicking the icon and selecting Open or by double-clicking the icon. When this group policy setting is enabled, the UE-V tray icon is visible, the UE-V notifications display, and the Company Settings Center is accessible from the tray icon.
 With this setting disabled, the tray icon does not appear in the system tray, UE-V never displays notifications, and the user cannot access Company Settings Center from the system tray. The Company Settings Center remains accessible through the Control Panel and the Start menu or Start screen.
-- If you do not configure this policy setting, any defined values are deleted.
+If you do not configure this policy setting, any defined values are deleted.
 <!-- TrayIconEnabled-Description-End -->
 
 <!-- TrayIconEnabled-Editable-Begin -->
@@ -7780,6 +7896,7 @@ With this setting disabled, the tray icon does not appear in the system tray, UE
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Video app.
 By default, the user settings of Video sync between computers. Use the policy setting to prevent the user settings of Video from synchronizing between computers.
+
 - If you enable this policy setting, Video user settings continue to sync.
 - If you disable this policy setting, Video user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -7844,6 +7961,7 @@ By default, the user settings of Video sync between computers. Use the policy se
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings for the Weather app.
 By default, the user settings of Weather sync between computers. Use the policy setting to prevent the user settings of Weather from synchronizing between computers.
+
 - If you enable this policy setting, Weather user settings continue to sync.
 - If you disable this policy setting, Weather user settings are excluded from synchronization.
 - If you do not configure this policy setting, any defined values will be deleted.
@@ -7908,6 +8026,7 @@ By default, the user settings of Weather sync between computers. Use the policy
 <!-- Description-Source-ADMX -->
 This policy setting configures the synchronization of user settings of WordPad.
 By default, the user settings of WordPad synchronize between computers. Use the policy setting to prevent the user settings of WordPad from synchronization between computers.
+
 - If you enable this policy setting, the WordPad user settings continue to synchronize.
 - If you disable this policy setting, WordPad user settings are excluded from the synchronization settings.
 - If you do not configure this policy setting, any defined values will be deleted.
diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md
index 1f26fcf32f..e5f3324a38 100644
--- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md
+++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_UserProfiles Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -42,7 +42,7 @@ ms.topic: reference
 
 <!-- CleanupProfiles-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days
+This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days.
 
 > [!NOTE]
 > One day is interpreted as 24 hours after a specific user profile was accessed.
@@ -373,7 +373,7 @@ This policy setting and related policy settings in this folder together define t
 
 - If you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow.
 
-- If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond. Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections
+- If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond. Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.
 
 > [!IMPORTANT]
 > If the "Do not detect slow network connections" policy setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection.
@@ -507,7 +507,7 @@ This setting prevents users from managing the ability to allow apps to access th
 
 "Always off" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources.
 
-If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off.
+- If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off.
 <!-- UserInfoAccessAction-Description-End -->
 
 <!-- UserInfoAccessAction-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md
index 48ea1bbd7f..f35943b958 100644
--- a/windows/client-management/mdm/policy-csp-admx-w32time.md
+++ b/windows/client-management/mdm/policy-csp-admx-w32time.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_W32Time Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -46,7 +46,7 @@ This policy setting allows you to specify Clock discipline and General values fo
 
 - If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values.
 
-For more details on individual parameters, combinations of parameter values as well as definitions of flags, see <https://go.microsoft.com/fwlink/?linkid=847809>.
+For more details on individual parameters, combinations of parameter values as well as definitions of flags, see< https://go.microsoft.com/fwlink/?linkid=847809>.
 
 FrequencyCorrectRate
 This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause larger corrections; larger values cause smaller corrections. Default: 4 (scalar).
diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md
index f572e7a8d8..525dff55c9 100644
--- a/windows/client-management/mdm/policy-csp-admx-wcm.md
+++ b/windows/client-management/mdm/policy-csp-admx-wcm.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_WCM Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -109,9 +109,9 @@ This policy setting determines whether Windows will soft-disconnect a computer f
 - If this policy setting is disabled, Windows will disconnect a computer from a network immediately when it determines that the computer should no longer be connected to a network.
 
 When soft disconnect is enabled:
-- When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted.
-- Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection.
-- When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they're not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network.
+  - When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted.
+  - Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection.
+  - When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they're not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network.
 
 This policy setting depends on other group policy settings. For example, if 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is disabled, Windows will not disconnect from any networks.
 <!-- WCM_EnableSoftDisconnect-Description-End -->
diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md
index 8a53921483..be0b41abb0 100644
--- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md
+++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_WindowsExplorer Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/10/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -357,6 +357,7 @@ This disables access to user-defined properties, and properties stored in NTFS s
 <!-- DisableIndexedLibraryExperience-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to turn off Windows Libraries features that need indexed file metadata to function properly.
+
 - If you enable this policy, some Windows Libraries features will be turned off to better handle included folders that have been redirected to non-indexed network locations.
 Setting this policy will:
 * Disable all Arrangement views except for "By Folder"
@@ -681,8 +682,7 @@ For more information, see [Microsoft Defender SmartScreen](/windows/security/thr
 
 <!-- EnforceShellExtensionSecurity-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This setting is designed to ensure that shell extensions can operate on a per-user basis.
-- If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine.
+This setting is designed to ensure that shell extensions can operate on a per-user basis. If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine.
 
 A shell extension only runs if there is an entry in at least one of the following locations in registry.
 
@@ -749,6 +749,7 @@ For shell extensions to run on a per-user basis, there must be an entry at HKEY_
 <!-- ExplorerRibbonStartsMinimized-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to specify whether the ribbon appears minimized or in full when new File Explorer windows are opened.
+
 - If you enable this policy setting, you can set how the ribbon appears the first time users open File Explorer and whenever they open new windows.
 - If you disable or do not configure this policy setting, users can choose how the ribbon appears when they open new windows.
 <!-- ExplorerRibbonStartsMinimized-Description-End -->
@@ -2776,7 +2777,7 @@ Also, see the "Prevent access to drives from My Computer" policy setting.
 <!-- Description-Source-ADMX -->
 Removes all computers outside of the user's workgroup or local domain from lists of network resources in File Explorer and Network Locations.
 
-- If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option.
+If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option.
 
 This setting does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as by typing the share name in the Run dialog box or the Map Network Drive dialog box.
 
@@ -2900,6 +2901,7 @@ This setting does not prevent users from using other methods to perform tasks av
 Removes the list of most recently used files from the Open dialog box.
 
 - If you disable this setting or do not configure it, the "File name" field includes a drop-down list of recently used files.
+
 - If you enable this setting, the "File name" field is a simple text box. Users must browse directories to find a file or type a file name in the text box.
 
 This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs.
@@ -3213,7 +3215,7 @@ When a Windows client is in a workgroup, a Shared Documents icon appears in the
 <!-- Description-Source-ADMX -->
 Prevents users from using File Explorer or Network Locations to map or disconnect network drives.
 
-- If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons.
+If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons.
 
 This setting does not prevent users from connecting to another computer by typing the name of a shared folder in the Run dialog box.
 
@@ -3465,6 +3467,7 @@ Prevents users from submitting alternate logon credentials to install a program.
 This setting suppresses the "Install Program As Other User" dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials.
 
 Many programs can be installed only by an administrator.
+
 - If you enable this setting and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly.
 
 - If you disable this setting or do not configure it, the "Install Program As Other User" dialog box appears whenever users install programs locally on the computer.
@@ -3525,6 +3528,7 @@ By default, users are not prompted for alternate logon credentials when installi
 
 <!-- NoSearchInternetTryHarderButton-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, the "Internet" "Search again" link will not be shown when the user performs a search in the Explorer window.
 
 - If you disable this policy, there will be an "Internet" "Search again" link when the user performs a search in the Explorer window. This button launches a search in the default browser with the search terms.
@@ -3714,6 +3718,7 @@ This policy setting does not affect the Search items on the File Explorer contex
 <!-- NoStrCmpLogical-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order.
+
 - If you enable this policy setting, File Explorer will sort file names by each digit in a file name (for example, 111 < 22 < 3).
 - If you disable or do not configure this policy setting, File Explorer will sort file names by increasing number value (for example, 3 < 22 < 111).
 <!-- NoStrCmpLogical-Description-End -->
@@ -3773,7 +3778,7 @@ This policy setting allows you to have file names sorted literally (as in Window
 <!-- Description-Source-ADMX -->
 Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear when you right-click an item.
 
-- If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus.
+If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus.
 <!-- NoViewContextMenu-Description-End -->
 
 <!-- NoViewContextMenu-Editable-Begin -->
@@ -3831,7 +3836,7 @@ Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear
 <!-- Description-Source-ADMX -->
 Prevents users from using My Computer to gain access to the content of selected drives.
 
-- If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives.
+If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives.
 
 To use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list.
 
@@ -4039,7 +4044,7 @@ The list of Common Shell Folders that may be specified:
 
 Desktop, Recent Places, Documents, Pictures, Music, Recently Changed, Attachments and Saved Searches.
 
-- If you disable or do not configure this setting the default list of items will be displayed in the Places Bar.
+If you disable or do not configure this setting the default list of items will be displayed in the Places Bar.
 
 > [!NOTE]
 > In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style.
@@ -4101,7 +4106,7 @@ Prompts users for alternate logon credentials during network-based installations
 
 This setting displays the "Install Program As Other User" dialog box even when a program is being installed from files on a network computer across a local area network connection.
 
-- If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media.
+If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media.
 
 The "Install Program as Other User" dialog box prompts the current user for the user name and password of an administrator. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials.
 
diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md
index 97b2a94a4a..3f211bcf84 100644
--- a/windows/client-management/mdm/policy-csp-admx-winlogon.md
+++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_WinLogon Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -45,6 +45,7 @@ ms.topic: reference
 Specifies an alternate user interface.
 
 The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface.
+
 - If you enable this setting, the system starts the interface you specify instead of Explorer.exe.
 
 To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file.
@@ -176,7 +177,7 @@ This policy controls whether the logged on user should be notified when his logo
 - If you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire.
 
 > [!NOTE]
-> If you configure this setting, you might want to examine and appropriately configure the "Set action to take when logon hours expire" setting. If "Set action to take when logon hours expire" is disabled or not configured, the "Remove logon hours expiration warnings" setting will have no effect, and users receive no warnings about logon hour expiration
+> If you configure this setting, you might want to examine and appropriately configure the "Set action to take when logon hours expire" setting. If "Set action to take when logon hours expire" is disabled or not configured, the "Remove logon hours expiration warnings" setting will have no effect, and users receive no warnings about logon hour expiration.
 <!-- LogonHoursNotificationPolicyDescription-Description-End -->
 
 <!-- LogonHoursNotificationPolicyDescription-Editable-Begin -->
@@ -243,7 +244,7 @@ If you choose to log off a user, the user cannot log on again except during perm
 - If you disable or do not configure this setting, the system takes no action when the user's logon hours expire. The user can continue the existing session, but cannot log on to a new session.
 
 > [!NOTE]
-> If you configure this setting, you might want to examine and appropriately configure the "Remove logon hours expiration warnings" setting
+> If you configure this setting, you might want to examine and appropriately configure the "Remove logon hours expiration warnings" setting.
 <!-- LogonHoursPolicyDescription-Description-End -->
 
 <!-- LogonHoursPolicyDescription-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md
index 1ba24c4abe..1d2efeeadc 100644
--- a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md
+++ b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_WorkFoldersClient Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -165,7 +165,7 @@ This policy setting specifies the Work Folders server for affected users, as wel
 
 The "Work Folders URL" can specify either the URL used by the organization for Work Folders discovery, or the specific URL of the file server that stores the affected users' data.
 
-The "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables
+The "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables.
 
 > [!NOTE]
 > In order for this configuration to take effect, a valid 'Work Folders URL' must also be specified.
diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md
index 849c9609bc..dfa18c48f2 100644
--- a/windows/client-management/mdm/policy-csp-applicationdefaults.md
+++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md
@@ -4,7 +4,7 @@ description: Learn more about the ApplicationDefaults Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,8 +36,19 @@ ms.topic: reference
 <!-- DefaultAssociationsConfiguration-OmaUri-End -->
 
 <!-- DefaultAssociationsConfiguration-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc. xml), and then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied.
+<!-- Description-Source-ADMX -->
+This policy specifies the path to a file (e.g. either stored locally or on a network location) that contains file type and protocol default application associations. This file can be created using the DISM tool.
+
+For example:
+Dism.exe /Online /Export-DefaultAppAssociations:C:\AppAssoc.txt
+
+For more information, refer to the DISM documentation on TechNet.
+
+If this group policy is enabled and the client machine is domain-joined, the file will be processed and default associations will be applied at logon time.
+
+If the group policy is not configured, disabled, or the client machine is not domain-joined, no default associations will be applied at logon time.
+
+If the policy is enabled, disabled, or not configured, users will still be able to override default file type and protocol associations.
 <!-- DefaultAssociationsConfiguration-Description-End -->
 
 <!-- DefaultAssociationsConfiguration-Editable-Begin -->
@@ -60,7 +71,7 @@ This policy allows an administrator to set default file type and protocol associ
 |:--|:--|
 | Name | DefaultAssociationsConfiguration |
 | Friendly Name | Set a default associations configuration file |
-| Element Name | Default Associations Configuration File |
+| Element Name | Default Associations Configuration File. |
 | Location | Computer Configuration |
 | Path | WindowsComponents > File Explorer |
 | Registry Key Name | Software\Policies\Microsoft\Windows\System |
@@ -147,7 +158,7 @@ Enabling this policy setting enables web-to-app linking so that apps can be laun
 
 Disabling this policy disables web-to-app linking and http(s) URIs will be opened in the default browser instead of launching the associated app.
 
-- If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
+If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
 <!-- EnableAppUriHandlers-Description-End -->
 
 <!-- EnableAppUriHandlers-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md
index 8e2b18b64d..6cd0b742ae 100644
--- a/windows/client-management/mdm/policy-csp-applicationmanagement.md
+++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md
@@ -4,7 +4,7 @@ description: Learn more about the ApplicationManagement Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -309,8 +309,7 @@ Allows or denies development of Microsoft Store applications and installing them
 <!-- Description-Source-ADMX -->
 Windows Game Recording and Broadcasting.
 
-This setting enables or disables the Windows Game Recording and Broadcasting features.
-- If you disable this setting, Windows Game Recording will not be allowed.
+This setting enables or disables the Windows Game Recording and Broadcasting features. If you disable this setting, Windows Game Recording will not be allowed.
 If the setting is enabled or not configured, then Recording and Broadcasting (streaming) will be allowed.
 <!-- AllowGameDVR-Description-End -->
 
@@ -446,7 +445,7 @@ Manages a Windows app's ability to share data between users who have installed t
 
 <!-- AllowStore-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy is deprecated
+This policy is deprecated.
 <!-- AllowStore-Description-End -->
 
 <!-- AllowStore-Editable-Begin -->
@@ -498,7 +497,7 @@ This policy is deprecated
 
 <!-- ApplicationRestrictions-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy is deprecated
+This policy is deprecated.
 <!-- ApplicationRestrictions-Description-End -->
 
 <!-- ApplicationRestrictions-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md
index f4f3975002..8163149bf4 100644
--- a/windows/client-management/mdm/policy-csp-appvirtualization.md
+++ b/windows/client-management/mdm/policy-csp-appvirtualization.md
@@ -4,7 +4,7 @@ description: Learn more about the AppVirtualization Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -1526,7 +1526,7 @@ Specifies that streamed package contents will be not be saved to the local hard
 
 <!-- StreamingSupportBranchCache-Description-Begin -->
 <!-- Description-Source-ADMX -->
-If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache
+If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache.
 <!-- StreamingSupportBranchCache-Description-End -->
 
 <!-- StreamingSupportBranchCache-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md
index 46796cc58d..f558a57eaa 100644
--- a/windows/client-management/mdm/policy-csp-audit.md
+++ b/windows/client-management/mdm/policy-csp-audit.md
@@ -4,7 +4,7 @@ description: Learn more about the Audit Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/10/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -98,7 +98,8 @@ Volume: High on domain controllers.
 
 <!-- AccountLogon_AuditKerberosAuthenticationService-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests.
+This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests.
+- If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests.
 - If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request.
 <!-- AccountLogon_AuditKerberosAuthenticationService-Description-End -->
 
@@ -160,7 +161,8 @@ Volume: High on Kerberos Key Distribution Center servers.
 
 <!-- AccountLogon_AuditKerberosServiceTicketOperations-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests.
+This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts.
+- If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests.
 - If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account.
 <!-- AccountLogon_AuditKerberosServiceTicketOperations-Description-End -->
 
@@ -404,7 +406,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser
 
 <!-- AccountLogonLogoff_AuditIPsecExtendedMode-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations.
+- If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation.
 <!-- AccountLogonLogoff_AuditIPsecExtendedMode-Description-End -->
 
@@ -466,7 +469,8 @@ Volume: High.
 
 <!-- AccountLogonLogoff_AuditIPsecMainMode-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations.
+- If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation.
 <!-- AccountLogonLogoff_AuditIPsecMainMode-Description-End -->
 
@@ -528,7 +532,8 @@ Volume: High.
 
 <!-- AccountLogonLogoff_AuditIPsecQuickMode-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations.
+- If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation.
 <!-- AccountLogonLogoff_AuditIPsecQuickMode-Description-End -->
 
@@ -590,7 +595,8 @@ Volume: High.
 
 <!-- AccountLogonLogoff_AuditLogoff-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions.
+This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to.
+- If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions.
 - If you do not configure this policy setting, no audit event is generated when a logon session is closed.
 <!-- AccountLogonLogoff_AuditLogoff-Description-End -->
 
@@ -713,7 +719,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser
 
 <!-- AccountLogonLogoff_AuditNetworkPolicyServer-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock.
+- If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts.
 - If you do not configure this policy settings, IAS and NAP user access requests are not audited.
 <!-- AccountLogonLogoff_AuditNetworkPolicyServer-Description-End -->
 
@@ -836,7 +843,7 @@ Volume: Low.
 
 <!-- AccountLogonLogoff_AuditSpecialLogon-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](<https://go.microsoft.com/fwlink/?LinkId=121697>).
+This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697).
 <!-- AccountLogonLogoff_AuditSpecialLogon-Description-End -->
 
 <!-- AccountLogonLogoff_AuditSpecialLogon-Editable-Begin -->
@@ -958,7 +965,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser
 
 <!-- AccountManagement_AuditApplicationGroupManagement-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group.
+- If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when an application group changes.
 <!-- AccountManagement_AuditApplicationGroupManagement-Description-End -->
 
@@ -1020,7 +1028,8 @@ Volume: Low.
 
 <!-- AccountManagement_AuditComputerAccountManagement-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted.
+- If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a computer account changes.
 <!-- AccountManagement_AuditComputerAccountManagement-Description-End -->
 
@@ -1082,7 +1091,8 @@ Volume: Low.
 
 <!-- AccountManagement_AuditDistributionGroupManagement-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to distribution groups such as the following Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to distribution groups such as the following: Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed.
+- If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a distribution group changes.
 
 > [!NOTE]
@@ -1147,7 +1157,7 @@ Volume: Low.
 
 <!-- AccountManagement_AuditOtherAccountManagementEvents-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy
+This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy.
 <!-- AccountManagement_AuditOtherAccountManagementEvents-Description-End -->
 
 <!-- AccountManagement_AuditOtherAccountManagementEvents-Editable-Begin -->
@@ -1208,7 +1218,8 @@ Volume: Low.
 
 <!-- AccountManagement_AuditSecurityGroupManagement-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed.
+- If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a security group changes.
 <!-- AccountManagement_AuditSecurityGroupManagement-Description-End -->
 
@@ -1270,7 +1281,8 @@ Volume: Low.
 
 <!-- AccountManagement_AuditUserAccountManagement-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored.
+- If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a user account changes.
 <!-- AccountManagement_AuditUserAccountManagement-Description-End -->
 
@@ -1332,7 +1344,8 @@ Volume: Low.
 
 <!-- DetailedTracking_AuditDPAPIActivity-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see [How to Use Data Protection](/dotnet/standard/security/how-to-use-data-protection). If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests.
+This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see [How to Use Data Protection](/dotnet/standard/security/how-to-use-data-protection).
+- If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests.
 - If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI.
 <!-- DetailedTracking_AuditDPAPIActivity-Description-End -->
 
@@ -1394,7 +1407,8 @@ Volume: Low.
 
 <!-- DetailedTracking_AuditPNPActivity-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category.
+This policy setting allows you to audit when plug and play detects an external device.
+- If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category.
 - If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play.
 <!-- DetailedTracking_AuditPNPActivity-Description-End -->
 
@@ -1456,7 +1470,8 @@ Volume: Low.
 
 <!-- DetailedTracking_AuditProcessCreation-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited.
+- If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a process is created.
 <!-- DetailedTracking_AuditProcessCreation-Description-End -->
 
@@ -1518,7 +1533,8 @@ Volume: Depends on how the computer is used.
 
 <!-- DetailedTracking_AuditProcessTermination-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated when a process ends.
+- If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a process ends.
 <!-- DetailedTracking_AuditProcessTermination-Description-End -->
 
@@ -1580,7 +1596,8 @@ Volume: Depends on how the computer is used.
 
 <!-- DetailedTracking_AuditRPCEvents-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit inbound remote procedure call (RPC) connections.
+- If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted.
 <!-- DetailedTracking_AuditRPCEvents-Description-End -->
 
@@ -1828,7 +1845,8 @@ Volume: High on domain controllers. None on client computers.
 This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object's properties. Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged.
 
 > [!NOTE]
-> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded.
+> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema.
+- If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded.
 - If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made.
 <!-- DSAccess_AuditDirectoryServiceChanges-Description-End -->
 
@@ -1890,7 +1908,8 @@ Volume: High on domain controllers only.
 
 <!-- DSAccess_AuditDirectoryServiceReplication-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication.
+This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers.
+- If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication.
 - If you do not configure this policy setting, no audit event is generated during AD DS replication.
 <!-- DSAccess_AuditDirectoryServiceReplication-Description-End -->
 
@@ -2135,10 +2154,12 @@ Volume: Medium or Low on computers running Active Directory Certificate Services
 
 <!-- ObjectAccess_AuditDetailedFileShare-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures.
+This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.
+- If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures.
 
 > [!NOTE]
 > There are no system access control lists (SACLs) for shared folders.
+
 - If this policy setting is enabled, access to all shared files and folders on the system is audited.
 <!-- ObjectAccess_AuditDetailedFileShare-Description-End -->
 
@@ -2200,11 +2221,13 @@ Volume: High on a file server or domain controller because of SYSVOL network acc
 
 <!-- ObjectAccess_AuditFileShare-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder.
+This policy setting allows you to audit attempts to access a shared folder.
+- If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder.
 - If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures.
 
 > [!NOTE]
 > There are no system access control lists (SACLs) for shared folders.
+
 - If this policy setting is enabled, access to all shared folders on the system is audited.
 <!-- ObjectAccess_AuditFileShare-Description-End -->
 
@@ -2266,7 +2289,8 @@ Volume: High on a file server or domain controller because of SYSVOL network acc
 
 <!-- ObjectAccess_AuditFileSystem-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see <https//go.microsoft.com/fwlink/?LinkId=122083>. If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see< https://go.microsoft.com/fwlink/?LinkId=122083>.
+- If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL.
 
 > [!NOTE]
@@ -2331,7 +2355,8 @@ Volume: Depends on how the file system SACLs are configured.
 
 <!-- ObjectAccess_AuditFilteringPlatformConnection-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked.
+This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections.
+- If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked.
 - If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP.
 <!-- ObjectAccess_AuditFilteringPlatformConnection-Description-End -->
 
@@ -2454,7 +2479,8 @@ Volume: High.
 
 <!-- ObjectAccess_AuditHandleManipulation-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events.
+- If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a handle is manipulated.
 
 > [!NOTE]
@@ -2522,7 +2548,7 @@ Volume: Depends on how SACLs are configured.
 This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events.
 
 > [!NOTE]
-> The Audit Audit the access of global system objects policy setting controls the default SACL of kernel objects.
+> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects.
 <!-- ObjectAccess_AuditKernelObject-Description-End -->
 
 <!-- ObjectAccess_AuditKernelObject-Editable-Begin -->
@@ -2644,7 +2670,8 @@ Volume: Low.
 
 <!-- ObjectAccess_AuditRegistry-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL.
+- If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL.
 
 > [!NOTE]
@@ -2709,7 +2736,8 @@ Volume: Depends on how registry SACLs are configured.
 
 <!-- ObjectAccess_AuditRemovableStorage-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested.
+- If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage.
 <!-- ObjectAccess_AuditRemovableStorage-Description-End -->
 
@@ -2770,11 +2798,12 @@ This policy setting allows you to audit user attempts to access file system obje
 
 <!-- ObjectAccess_AuditSAM-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account. If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account.
+- If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made.
 
 > [!NOTE]
-> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume High on domain controllers. For information about SACL, see [Access control lists](/windows/win32/secauthz/access-control-lists).
+> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698).
 <!-- ObjectAccess_AuditSAM-Description-End -->
 
 <!-- ObjectAccess_AuditSAM-Editable-Begin -->
@@ -2835,7 +2864,8 @@ Volume: High on domain controllers. For more information about reducing the numb
 
 <!-- PolicyChange_AuditAuthenticationPolicyChange-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to the authentication policy such as the following Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to the authentication policy such as the following: Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group: Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name.
+- If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when the authentication policy is changed.
 
 > [!NOTE]
@@ -2900,7 +2930,8 @@ Volume: Low.
 
 <!-- PolicyChange_AuditAuthorizationPolicyChange-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object.
+- If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when the authorization policy changes.
 <!-- PolicyChange_AuditAuthorizationPolicyChange-Description-End -->
 
@@ -2962,7 +2993,8 @@ Volume: Low.
 
 <!-- PolicyChange_AuditFilteringPlatformPolicyChange-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine.
+- If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP.
 <!-- PolicyChange_AuditFilteringPlatformPolicyChange-Description-End -->
 
@@ -3024,7 +3056,8 @@ Volume: Low.
 
 <!-- PolicyChange_AuditMPSSVCRuleLevelPolicyChange-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings.
+- If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC.
 <!-- PolicyChange_AuditMPSSVCRuleLevelPolicyChange-Description-End -->
 
@@ -3147,7 +3180,7 @@ Volume: Low.
 
 <!-- PolicyChange_AuditPolicyChange-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit changes in the security audit policy settings such as the following Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list.
+This policy setting allows you to audit changes in the security audit policy settings such as the following: Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list.
 
 > [!NOTE]
 > System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change.
@@ -3212,7 +3245,8 @@ Volume: Low.
 <!-- PrivilegeUse_AuditNonSensitivePrivilegeUse-Description-Begin -->
 <!-- Description-Source-DDF -->
 This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: Access Credential Manager as a trusted caller. Access this computer from the network. Add workstations to domain. Adjust memory quotas for a process. Allow log on locally. Allow log on through Terminal Services. Bypass traverse checking. Change the system time. Create a pagefile. Create global objects.
-Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls.
+Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data.
+- If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls.
 - If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called.
 <!-- PrivilegeUse_AuditNonSensitivePrivilegeUse-Description-End -->
 
@@ -3334,7 +3368,8 @@ Not used.
 
 <!-- PrivilegeUse_AuditSensitivePrivilegeUse-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests.
+This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects.
+- If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests.
 - If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made.
 <!-- PrivilegeUse_AuditSensitivePrivilegeUse-Description-End -->
 
@@ -3396,7 +3431,8 @@ Volume: High.
 
 <!-- System_AuditIPsecDriver-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters.
+- If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation.
 <!-- System_AuditIPsecDriver-Description-End -->
 
@@ -3580,7 +3616,8 @@ Volume: Low.
 
 <!-- System_AuditSecuritySystemExtension-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts.
+This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account.
+- If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts.
 - If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension.
 <!-- System_AuditSecuritySystemExtension-Description-End -->
 
diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md
index 019ddd4885..3fa1f38453 100644
--- a/windows/client-management/mdm/policy-csp-authentication.md
+++ b/windows/client-management/mdm/policy-csp-authentication.md
@@ -4,7 +4,7 @@ description: Learn more about the Authentication Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- Authentication-Begin -->
 # Policy CSP - Authentication
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- Authentication-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- Authentication-Editable-End -->
@@ -356,7 +359,7 @@ Your organization's PIN reset or web sign-in authentication flow is expected to
 
 <!-- EnableFastFirstSignIn-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts
+Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts.
 <!-- EnableFastFirstSignIn-Description-End -->
 
 <!-- EnableFastFirstSignIn-Editable-Begin -->
@@ -394,6 +397,56 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex
 
 <!-- EnableFastFirstSignIn-End -->
 
+<!-- EnablePasswordlessExperience-Begin -->
+## EnablePasswordlessExperience
+
+<!-- EnablePasswordlessExperience-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- EnablePasswordlessExperience-Applicability-End -->
+
+<!-- EnablePasswordlessExperience-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Authentication/EnablePasswordlessExperience
+```
+<!-- EnablePasswordlessExperience-OmaUri-End -->
+
+<!-- EnablePasswordlessExperience-Description-Begin -->
+<!-- Description-Source-DDF -->
+Specifies whether connected users on AADJ devices receive a Passwordless experience on Windows.
+<!-- EnablePasswordlessExperience-Description-End -->
+
+<!-- EnablePasswordlessExperience-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- EnablePasswordlessExperience-Editable-End -->
+
+<!-- EnablePasswordlessExperience-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- EnablePasswordlessExperience-DFProperties-End -->
+
+<!-- EnablePasswordlessExperience-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | The feature defaults to the existing edition and device capabilities. |
+| 1 | Enabled. The Passwordless experience will be enabled on Windows. |
+| 2 | Disabled. The Passwordless experience will not be enabled on Windows. |
+<!-- EnablePasswordlessExperience-AllowedValues-End -->
+
+<!-- EnablePasswordlessExperience-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- EnablePasswordlessExperience-Examples-End -->
+
+<!-- EnablePasswordlessExperience-End -->
+
 <!-- EnableWebSignIn-Begin -->
 ## EnableWebSignIn
 
@@ -411,7 +464,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex
 
 <!-- EnableWebSignIn-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies whether web-based sign-in is allowed for signing in to Windows
+Specifies whether web-based sign-in is allowed for signing in to Windows.
 <!-- EnableWebSignIn-Description-End -->
 
 <!-- EnableWebSignIn-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md
index 332ce05cc6..a51ea4a85a 100644
--- a/windows/client-management/mdm/policy-csp-bits.md
+++ b/windows/client-management/mdm/policy-csp-bits.md
@@ -4,7 +4,7 @@ description: Learn more about the BITS Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,12 +36,19 @@ ms.topic: reference
 <!-- BandwidthThrottlingEndTime-OmaUri-End -->
 
 <!-- BandwidthThrottlingEndTime-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy specifies the bandwidth throttling end time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 17 (5 PM). Supported value range 0 - 23. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
-- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth
+<!-- Description-Source-ADMX -->
+This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.)
+
+You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours.
+
+- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
+
+- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth.
 
 > [!NOTE]
-> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
+> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
+
+Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
 <!-- BandwidthThrottlingEndTime-Description-End -->
 
 <!-- BandwidthThrottlingEndTime-Editable-Begin -->
@@ -66,7 +73,7 @@ This policy specifies the bandwidth throttling end time that Background Intellig
 |:--|:--|
 | Name | BITS_MaxBandwidth |
 | Friendly Name | Limit the maximum network bandwidth for BITS background transfers |
-| Element Name | to |
+| Element Name | to. |
 | Location | Computer Configuration |
 | Path | Network > Background Intelligent Transfer Service (BITS) |
 | Registry Key Name | Software\Policies\Microsoft\Windows\BITS |
@@ -95,12 +102,19 @@ This policy specifies the bandwidth throttling end time that Background Intellig
 <!-- BandwidthThrottlingStartTime-OmaUri-End -->
 
 <!-- BandwidthThrottlingStartTime-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy specifies the bandwidth throttling start time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 8 (8 am). Supported value range 0 - 23. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
-- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth
+<!-- Description-Source-ADMX -->
+This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.)
+
+You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours.
+
+- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
+
+- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth.
 
 > [!NOTE]
-> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
+> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
+
+Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
 <!-- BandwidthThrottlingStartTime-Description-End -->
 
 <!-- BandwidthThrottlingStartTime-Editable-Begin -->
@@ -125,7 +139,7 @@ This policy specifies the bandwidth throttling start time that Background Intell
 |:--|:--|
 | Name | BITS_MaxBandwidth |
 | Friendly Name | Limit the maximum network bandwidth for BITS background transfers |
-| Element Name | From |
+| Element Name | From. |
 | Location | Computer Configuration |
 | Path | Network > Background Intelligent Transfer Service (BITS) |
 | Registry Key Name | Software\Policies\Microsoft\Windows\BITS |
@@ -154,12 +168,19 @@ This policy specifies the bandwidth throttling start time that Background Intell
 <!-- BandwidthThrottlingTransferRate-OmaUri-End -->
 
 <!-- BandwidthThrottlingTransferRate-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy specifies the bandwidth throttling transfer rate in kilobits per second (Kbps) that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. Value type is integer. Default value is 1000. Supported value range 0 - 4294967200. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
-- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth
+<!-- Description-Source-ADMX -->
+This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.)
+
+You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours.
+
+- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
+
+- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth.
 
 > [!NOTE]
-> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
+> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
+
+Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
 <!-- BandwidthThrottlingTransferRate-Description-End -->
 
 <!-- BandwidthThrottlingTransferRate-Editable-Begin -->
@@ -184,7 +205,7 @@ This policy specifies the bandwidth throttling transfer rate in kilobits per sec
 |:--|:--|
 | Name | BITS_MaxBandwidth |
 | Friendly Name | Limit the maximum network bandwidth for BITS background transfers |
-| Element Name | Limit background transfer rate (Kbps) to |
+| Element Name | Limit background transfer rate (Kbps) to. |
 | Location | Computer Configuration |
 | Path | Network > Background Intelligent Transfer Service (BITS) |
 | Registry Key Name | Software\Policies\Microsoft\Windows\BITS |
@@ -213,9 +234,27 @@ This policy specifies the bandwidth throttling transfer rate in kilobits per sec
 <!-- CostedNetworkBehaviorBackgroundPriority-OmaUri-End -->
 
 <!-- CostedNetworkBehaviorBackgroundPriority-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of background transfers.
-- If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained
+<!-- Description-Source-ADMX -->
+This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers.
+
+If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority.
+
+For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:
+  - Always transfer
+  - Transfer unless roaming
+  - Transfer unless surcharge applies (when not roaming or overcap)
+  - Transfer unless nearing limit (when not roaming or nearing cap)
+  - Transfer only if unconstrained
+  - Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here)
+0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints.
+0x2 - The usage of this connection is unrestricted up to a certain data limit
+0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit.
+0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit.
+0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown.
+0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced.
+0x40 - The connection is costed on a per-byte basis.
+0x80 - The connection is roaming.
+0x80000000 - Ignore congestion.
 <!-- CostedNetworkBehaviorBackgroundPriority-Description-End -->
 
 <!-- CostedNetworkBehaviorBackgroundPriority-Editable-Begin -->
@@ -251,7 +290,7 @@ This policy setting defines the default behavior that the Background Intelligent
 |:--|:--|
 | Name | BITS_SetTransferPolicyOnCostedNetwork |
 | Friendly Name | Set default download behavior for BITS jobs on costed networks |
-| Element Name | Normal |
+| Element Name | Normal. |
 | Location | Computer Configuration |
 | Path | Network > Background Intelligent Transfer Service (BITS) |
 | Registry Key Name | Software\Policies\Microsoft\Windows\BITS\TransferPolicy |
@@ -280,9 +319,27 @@ This policy setting defines the default behavior that the Background Intelligent
 <!-- CostedNetworkBehaviorForegroundPriority-OmaUri-End -->
 
 <!-- CostedNetworkBehaviorForegroundPriority-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting defines the default behavior that the foreground Intelligent Transfer Service (BITS) uses for foreground transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of foreground transfers.
-- If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that foreground jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained
+<!-- Description-Source-ADMX -->
+This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers.
+
+If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority.
+
+For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:
+  - Always transfer
+  - Transfer unless roaming
+  - Transfer unless surcharge applies (when not roaming or overcap)
+  - Transfer unless nearing limit (when not roaming or nearing cap)
+  - Transfer only if unconstrained
+  - Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here)
+0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints.
+0x2 - The usage of this connection is unrestricted up to a certain data limit
+0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit.
+0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit.
+0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown.
+0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced.
+0x40 - The connection is costed on a per-byte basis.
+0x80 - The connection is roaming.
+0x80000000 - Ignore congestion.
 <!-- CostedNetworkBehaviorForegroundPriority-Description-End -->
 
 <!-- CostedNetworkBehaviorForegroundPriority-Editable-Begin -->
@@ -318,7 +375,7 @@ This policy setting defines the default behavior that the foreground Intelligent
 |:--|:--|
 | Name | BITS_SetTransferPolicyOnCostedNetwork |
 | Friendly Name | Set default download behavior for BITS jobs on costed networks |
-| Element Name | Foreground |
+| Element Name | Foreground. |
 | Location | Computer Configuration |
 | Path | Network > Background Intelligent Transfer Service (BITS) |
 | Registry Key Name | Software\Policies\Microsoft\Windows\BITS\TransferPolicy |
@@ -347,11 +404,17 @@ This policy setting defines the default behavior that the foreground Intelligent
 <!-- JobInactivityTimeout-OmaUri-End -->
 
 <!-- JobInactivityTimeout-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk
+<!-- Description-Source-ADMX -->
+This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk.
 
 > [!NOTE]
-> Any property changes to the job or any successful download action will reset this timeout. Value type is integer. Default is 90 days. Supported values range 0 - 999. Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. Consider decreasing this value if you are concerned about orphaned jobs occupying disk space.
+> Any property changes to the job or any successful download action will reset this timeout.
+
+Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs.
+Consider decreasing this value if you are concerned about orphaned jobs occupying disk space.
+
+- If you enable this policy setting, you can configure the inactive job timeout to specified number of days.
+
 - If you disable or do not configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout.
 <!-- JobInactivityTimeout-Description-End -->
 
@@ -377,7 +440,7 @@ This policy setting specifies the number of days a pending BITS job can remain i
 |:--|:--|
 | Name | BITS_Job_Timeout |
 | Friendly Name | Timeout for inactive BITS jobs |
-| Element Name | Inactive Job Timeout in Days |
+| Element Name | Inactive Job Timeout in Days. |
 | Location | Computer Configuration |
 | Path | Network > Background Intelligent Transfer Service (BITS) |
 | Registry Key Name | Software\Policies\Microsoft\Windows\BITS |
diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md
index e2910d975d..d3031acbca 100644
--- a/windows/client-management/mdm/policy-csp-bluetooth.md
+++ b/windows/client-management/mdm/policy-csp-bluetooth.md
@@ -4,7 +4,7 @@ description: Learn more about the Bluetooth Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -272,7 +272,7 @@ Sets the local Bluetooth device name. If this is set, the value that it is set t
 
 <!-- ServicesAllowedList-Description-Begin -->
 <!-- Description-Source-DDF -->
-Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide
+Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide.
 <!-- ServicesAllowedList-Description-End -->
 
 <!-- ServicesAllowedList-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index 8f7766c3a5..7dc55c850b 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -4,7 +4,7 @@ description: Learn more about the Browser Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -200,7 +200,7 @@ To verify AllowAutofill is set to 0 (not allowed):
 
 <!-- AllowBrowser-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy is deprecated
+This policy is deprecated.
 <!-- AllowBrowser-Description-End -->
 
 <!-- AllowBrowser-Editable-Begin -->
@@ -305,8 +305,15 @@ This policy setting lets you decide whether Microsoft Edge can automatically upd
 <!-- AllowCookies-OmaUri-End -->
 
 <!-- AllowCookies-Description-Begin -->
-<!-- Description-Source-DDF -->
-This setting lets you configure how your company deals with cookies.
+<!-- Description-Source-ADMX -->
+This setting lets you configure how to work with cookies.
+
+- If you enable this setting, you must also decide whether to:
+Allow all cookies (default): Allows all cookies from all websites.
+Block all cookies: Blocks all cookies from all websites.
+Block only 3rd-party cookies: Blocks only cookies from 3rd-party websites.
+
+- If you disable or don't configure this setting, all cookies are allowed from all sites.
 <!-- AllowCookies-Description-End -->
 
 <!-- AllowCookies-Editable-Begin -->
@@ -340,7 +347,7 @@ This setting lets you configure how your company deals with cookies.
 |:--|:--|
 | Name | Cookies |
 | Friendly Name | Configure cookies |
-| Element Name | Configure Cookies |
+| Element Name | Configure Cookies. |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Main |
@@ -1483,8 +1490,8 @@ Computer Configuration > Administrative Templates > Windows Components > App Pac
 Supported versions: Microsoft Edge on Windows 10, version 1809
 Default setting: Disabled or not configured
 Related policies:
-- Allows development of Windows Store apps and installing them from an integrated development environment (IDE)
-- Allow all trusted apps to install
+  - Allows development of Windows Store apps and installing them from an integrated development environment (IDE)
+  - Allow all trusted apps to install 
 <!-- AllowSideloadingOfExtensions-Description-End -->
 
 <!-- AllowSideloadingOfExtensions-Editable-Begin -->
@@ -1920,9 +1927,17 @@ To verify whether browsing data is cleared on exit (ClearBrowsingDataOnExit is s
 <!-- ConfigureAdditionalSearchEngines-OmaUri-End -->
 
 <!-- ConfigureAdditionalSearchEngines-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows you to add up to 5 additional search engines for MDM-enrolled devices. If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. If this setting is not configured, the search engines are the ones specified in the App settings.
-- If this setting is disabled, the search engines you had added will be deleted from your employee's machine. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled.
+<!-- Description-Source-ADMX -->
+This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting.
+
+**Important**
+This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
+
+- If you enable this setting, you can add up to 5 additional search engines. For each additional engine, you must also add a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/library/dd163546.aspx) topic. Use this format to specify the link(s) you wish to add: `<https://fabrikam.com/opensearch.xml>` `<https://www.contoso.com/opensearch.xml>`
+
+- If you disable this setting, any added search engines are removed from your employee's devices.
+
+- If you don't configure this setting, the search engine list is set to what is specified in App settings.
 <!-- ConfigureAdditionalSearchEngines-Description-End -->
 
 <!-- ConfigureAdditionalSearchEngines-Editable-Begin -->
@@ -1945,7 +1960,7 @@ Allows you to add up to 5 additional search engines for MDM-enrolled devices. If
 |:--|:--|
 | Name | ConfigureAdditionalSearchEngines |
 | Friendly Name | Configure additional search engines |
-| Element Name | Use this format to specify the link(s) you wish to add: `<<https://fabrikam.com/opensearch.xml>>` `<<https://www.contoso.com/opensearch.xml>>` |
+| Element Name | Use this format to specify the link(s) you wish to add: `<https://fabrikam.com/opensearch.xml>` `<https://www.contoso.com/opensearch.xml>` |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\OpenSearch |
@@ -2051,8 +2066,23 @@ If not configured, the favorites bar is hidden but is visible on the Start and N
 <!-- ConfigureHomeButton-OmaUri-End -->
 
 <!-- ConfigureHomeButton-Description-Begin -->
-<!-- Description-Source-DDF -->
-The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. By default, this policy is disabled or not configured and clicking the home button loads the default Start page. When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. If Enabled AND: - Show home button & set to Start page is selected, clicking the home button loads the Start page. - Show home button & set to New tab page is selected, clicking the home button loads a New tab page. - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. - Hide home button is selected, the home button is hidden in Microsoft Edge. Default setting: Disabled or not configured Related policies: - Set Home Button URL - Unlock Home Button
+<!-- Description-Source-ADMX -->
+The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy.
+
+By default, this policy is disabled or not configured and clicking the home button loads the default Start page.
+
+When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy.
+
+If Enabled AND:
+  - Show home button & set to Start page is selected, clicking the home button loads the Start page.
+  - Show home button & set to New tab page is selected, clicking the home button loads a New tab page.
+  - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy.
+  - Hide home button is selected, the home button is hidden in Microsoft Edge.
+
+Default setting: Disabled or not configured
+Related policies:
+  - Set Home Button URL
+  - Unlock Home Button.
 <!-- ConfigureHomeButton-Description-End -->
 
 <!-- ConfigureHomeButton-Editable-Begin -->
@@ -2087,7 +2117,7 @@ The Home button loads either the default Start page, the New tab page, or a URL
 |:--|:--|
 | Name | ConfigureHomeButton |
 | Friendly Name | Configure Home Button |
-| Element Name | Configure the Home Button |
+| Element Name | Configure the Home Button. |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings |
@@ -2122,8 +2152,17 @@ The Home button loads either the default Start page, the New tab page, or a URL
 <!-- ConfigureKioskMode-OmaUri-End -->
 
 <!-- ConfigureKioskMode-Description-Begin -->
-<!-- Description-Source-DDF -->
-Configure how Microsoft Edge behaves when it's running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see "Configure kiosk and shared devices running Windows desktop editions" (<https://aka.ms/E489vw)>. If enabled and set to 0 (Default or not configured): - If it's a single app, it runs InPrivate full screen for digital signage or interactive displays. - If it's one of many apps, Microsoft Edge runs as normal. If enabled and set to 1: - If it's a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can't minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking "End session." You can configure Microsoft Edge to restart after a period of inactivity by using the "Configure kiosk reset after idle timeout" policy. - If it's one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can't customize Microsoft Edge.
+<!-- Description-Source-ADMX -->
+Configure how Microsoft Edge behaves when it's running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge.
+
+You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see "Configure kiosk and shared devices running Windows desktop editions" (https://aka.ms/E489vw).
+
+If enabled and set to 0 (Default or not configured):
+  - If it's a single app, it runs InPrivate full screen for digital signage or interactive displays.
+  - If it's one of many apps, Microsoft Edge runs as normal.
+If enabled and set to 1:
+  - If it's a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can't minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking "End session." You can configure Microsoft Edge to restart after a period of inactivity by using the "Configure kiosk reset after idle timeout" policy.
+  - If it's one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can't customize Microsoft Edge.
 <!-- ConfigureKioskMode-Description-End -->
 
 <!-- ConfigureKioskMode-Editable-Begin -->
@@ -2188,8 +2227,16 @@ Configure how Microsoft Edge behaves when it's running in kiosk mode with assign
 <!-- ConfigureKioskResetAfterIdleTimeout-OmaUri-End -->
 
 <!-- ConfigureKioskResetAfterIdleTimeout-Description-Begin -->
-<!-- Description-Source-DDF -->
-You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user's browsing data. If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. If you set this policy to 0, Microsoft Edge does not use an idle timer. If disabled or not configured, the default value is 5 minutes. If you do not configure Microsoft Edge in assigned access, then this policy does not take effect.
+<!-- Description-Source-ADMX -->
+You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user's browsing data.
+
+If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds.
+
+If you set this policy to 0, Microsoft Edge does not use an idle timer.
+
+If disabled or not configured, the default value is 5 minutes.
+
+If you do not configure Microsoft Edge in assigned access, then this policy does not take effect.
 <!-- ConfigureKioskResetAfterIdleTimeout-Description-End -->
 
 <!-- ConfigureKioskResetAfterIdleTimeout-Editable-Begin -->
@@ -2247,8 +2294,23 @@ You can configure Microsoft Edge to reset to the configured start experience aft
 <!-- ConfigureOpenMicrosoftEdgeWith-OmaUri-End -->
 
 <!-- ConfigureOpenMicrosoftEdgeWith-Description-Begin -->
-<!-- Description-Source-DDF -->
-You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. If enabled, you can choose one of the following options: - Start page: the Start page loads ignoring the Configure Start Pages policy. - New tab page: the New tab page loads ignoring the Configure Start Pages policy. - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. Default setting: A specific page or pages (default) Related policies: -Disable Lockdown of Start Pages -Configure Start Pages
+<!-- Description-Source-ADMX -->
+You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it.
+
+If enabled, you can choose one of the following options:
+  - Start page: the Start page loads ignoring the Configure Start Pages policy.
+  - New tab page: the New tab page loads ignoring the Configure Start Pages policy.
+  - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy.
+  - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored.
+
+When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Microsoft Edge With policy, and then enable the Disable Lockdown of Start Pages policy.
+
+If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page.
+
+Default setting: A specific page or pages (default)
+Related policies:
+-Disable Lockdown of Start Pages
+-Configure Start Pages.
 <!-- ConfigureOpenMicrosoftEdgeWith-Description-End -->
 
 <!-- ConfigureOpenMicrosoftEdgeWith-Editable-Begin -->
@@ -2283,7 +2345,7 @@ You can configure Microsoft Edge to lock down the Start page, preventing users f
 |:--|:--|
 | Name | ConfigureOpenEdgeWith |
 | Friendly Name | Configure Open Microsoft Edge With |
-| Element Name | Configure Open Microsoft Edge With |
+| Element Name | Configure Open Microsoft Edge With. |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings |
@@ -2321,8 +2383,11 @@ You can configure Microsoft Edge to lock down the Start page, preventing users f
 <!-- ConfigureTelemetryForMicrosoft365Analytics-OmaUri-End -->
 
 <!-- ConfigureTelemetryForMicrosoft365Analytics-Description-Begin -->
-<!-- Description-Source-DDF -->
-Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization.
+<!-- Description-Source-ADMX -->
+You can configure Microsoft Edge to send intranet history only, internet history only, or both to Desktop Analytics for enterprise devices with a configured Commercial ID. If disabled or not configured, Microsoft Edge does not send browsing history data to Desktop Analytics.
+
+Supported versions: Microsoft Edge on Windows 10, version 1809
+Default setting: Disabled or not configured (no data collected or sent)
 <!-- ConfigureTelemetryForMicrosoft365Analytics-Description-End -->
 
 <!-- ConfigureTelemetryForMicrosoft365Analytics-Editable-Begin -->
@@ -2357,7 +2422,7 @@ Configures what browsing data will be sent to Microsoft 365 Analytics for device
 |:--|:--|
 | Name | ConfigureTelemetryForMicrosoft365Analytics |
 | Friendly Name | Configure collection of browsing data for Desktop Analytics |
-| Element Name | Configure telemetry collection |
+| Element Name | Configure telemetry collection. |
 | Location | Computer and User Configuration |
 | Path | WindowsComponents > Data Collection and Preview Builds |
 | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection |
@@ -2390,8 +2455,15 @@ Configures what browsing data will be sent to Microsoft 365 Analytics for device
 <!-- DisableLockdownOfStartPages-OmaUri-End -->
 
 <!-- DisableLockdownOfStartPages-Description-Begin -->
-<!-- Description-Source-DDF -->
-You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Start Pages - Configure Open Microsoft Edge With
+<!-- Description-Source-ADMX -->
+You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages.
+
+If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down.
+
+Supported devices: Domain-joined or MDM-enrolled
+Related policy:
+  - Configure Start Pages
+  - Configure Open Microsoft Edge With.
 <!-- DisableLockdownOfStartPages-Description-End -->
 
 <!-- DisableLockdownOfStartPages-Editable-Begin -->
@@ -2532,8 +2604,12 @@ This policy setting lets you decide how much data to send to Microsoft about the
 <!-- EnterpriseModeSiteList-OmaUri-End -->
 
 <!-- EnterpriseModeSiteList-Description-Begin -->
-<!-- Description-Source-DDF -->
-This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites.
+<!-- Description-Source-ADMX -->
+This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps.
+
+- If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode.
+
+- If you disable or don't configure this setting, Microsoft Edge won't use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps.
 <!-- EnterpriseModeSiteList-Description-End -->
 
 <!-- EnterpriseModeSiteList-Editable-Begin -->
@@ -2556,7 +2632,7 @@ This setting lets you configure whether your company uses Enterprise Mode and th
 |:--|:--|
 | Name | EnterpriseModeSiteList |
 | Friendly Name | Configure the Enterprise Mode Site List |
-| Element Name | Type the location (URL) of your Enterprise Mode IE website list |
+| Element Name | Type the location (URL) of your Enterprise Mode IE website list. |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode |
@@ -2676,8 +2752,25 @@ Configure first run URL.
 <!-- HomePages-OmaUri-End -->
 
 <!-- HomePages-Description-Begin -->
-<!-- Description-Source-DDF -->
-When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: `<support.contoso.com>` `<support.microsoft.com>` If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: If you do not want to send traffic to Microsoft, enable this policy and use the `<about:blank>` value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Open Microsoft Edge With - Disable Lockdown of Start Pages
+<!-- Description-Source-ADMX -->
+When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages.
+
+If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format:
+
+`<support.contoso.com>` `<support.microsoft.com>`
+
+If disabled or not configured, the webpages specified in App settings loads as the default Start pages.
+
+Version 1703 or later:
+If you do not want to send traffic to Microsoft, enable this policy and use the `<about:blank>` value, which honors domain- and non-domain-joined devices, when it is the only configured URL.
+
+Version 1809:
+If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy.
+
+Supported devices: Domain-joined or MDM-enrolled
+Related policy:
+  - Configure Open Microsoft Edge With
+  - Disable Lockdown of Start Pages.
 <!-- HomePages-Description-End -->
 
 <!-- HomePages-Editable-Begin -->
@@ -2700,7 +2793,7 @@ When you enable the Configure Open Microsoft Edge With policy, you can configure
 |:--|:--|
 | Name | HomePages |
 | Friendly Name | Configure Start pages |
-| Element Name | Use this format: `<support.contoso.com>` `<<https://support.microsoft.com/>>` |
+| Element Name | Use this format: `<support.contoso.com>` `<https://support.microsoft.com/>` |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings |
@@ -3374,12 +3467,14 @@ This policy setting lets you decide whether an employee's LocalHost IP address s
 <!-- ProvisionFavorites-OmaUri-End -->
 
 <!-- ProvisionFavorites-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites.
-- If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites
 
-> [!IMPORTANT]
-> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge.
+- If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites.
+
+**Important**
+Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge.
+
 - If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar.
 <!-- ProvisionFavorites-Description-End -->
 
@@ -3403,7 +3498,7 @@ This policy setting allows you to configure a default set of favorites, which wi
 |:--|:--|
 | Name | ConfiguredFavorites |
 | Friendly Name | Provision Favorites |
-| Element Name | Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.<br> <br> URL can be specified as<br> <br> 1. HTTP location: https://localhost:8080/URLs.html<br> 2. Local network: \\network\shares\URLs.html<br> 3. Local file: file:///c:\\Users\\`<user>`\\Documents\\URLs.html or C:\\Users\\`<user>`\\Documents\\URLs.html |
+| Element Name | Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.<br> <br> URL can be specified as<br> <br> 1. HTTP location: https://localhost:8080/URLs.html<br> 2. Local network: \\network\shares\URLs.html<br> 3. Local file: file:///c:\\Users\\`<user>`\\Documents\\URLs.html or C:\\Users\\`<user>`\\Documents\\URLs.html. |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Favorites |
@@ -3514,9 +3609,24 @@ This policy setting lets you decide whether your intranet sites should all open
 <!-- SetDefaultSearchEngine-OmaUri-End -->
 
 <!-- SetDefaultSearchEngine-Description-Begin -->
-<!-- Description-Source-DDF -->
-Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees.
-- If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled.
+<!-- Description-Source-ADMX -->
+This policy setting lets you configure the default search engine for your employees. Your employees can change the default search engine at any time.
+
+**Important**
+This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).
+
+- If you enable this setting, you can choose a default search engine for your employees.
+
+- If this setting is enabled, you must also add the default engine to the "Set default search engine" setting, by adding a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/library/dd163546.aspx) topic. Use this format to specify the link you wish to add: `<https://fabrikam.com/opensearch.xml>`
+
+**Note**
+If you'd like your employees to use the default Microsoft Edge settings for each market, you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING.
+
+Employees can change the default search engine at any time, unless you disable the "Allow search engine customization" setting, which restricts any changes.
+
+- If you disable this setting, the policy-set default search engine is removed. If this is also the current in-use default, the engine changes to the Microsoft Edge specified engine for the market.
+
+- If you don't configure this setting, the default search engine is set to the one specified in App settings.
 <!-- SetDefaultSearchEngine-Description-End -->
 
 <!-- SetDefaultSearchEngine-Editable-Begin -->
@@ -3539,7 +3649,7 @@ Sets the default search engine for MDM-enrolled devices. Users can still change
 |:--|:--|
 | Name | SetDefaultSearchEngine |
 | Friendly Name | Set default search engine |
-| Element Name | Use this format to specify the link you wish to add: `<<https://fabrikam.com/opensearch.xml>>` |
+| Element Name | Use this format to specify the link you wish to add: `<https://fabrikam.com/opensearch.xml>` |
 | Location | Computer and User Configuration |
 | Path | Windows Components > Microsoft Edge |
 | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\OpenSearch |
@@ -3572,8 +3682,13 @@ Sets the default search engine for MDM-enrolled devices. Users can still change
 <!-- SetHomeButtonURL-OmaUri-End -->
 
 <!-- SetHomeButtonURL-Description-Begin -->
-<!-- Description-Source-DDF -->
-The home button can be configured to load a custom URL when your user clicks the home button. If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. Default setting: Blank or not configured Related policy: Configure Home Button
+<!-- Description-Source-ADMX -->
+The home button can be configured to load a custom URL when your user clicks the home button.
+
+If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button.
+
+Default setting: Blank or not configured
+Related policy: Configure Home Button.
 <!-- SetHomeButtonURL-Description-End -->
 
 <!-- SetHomeButtonURL-Editable-Begin -->
@@ -3629,8 +3744,15 @@ The home button can be configured to load a custom URL when your user clicks the
 <!-- SetNewTabPageURL-OmaUri-End -->
 
 <!-- SetNewTabPageURL-Description-Begin -->
-<!-- Description-Source-DDF -->
-You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. If enabled, you can set the default New Tab page URL. If disabled or not configured, the default Microsoft Edge new tab page is used. Default setting: Disabled or not configured Related policy: Allow web content on New Tab page
+<!-- Description-Source-ADMX -->
+You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank.
+
+If enabled, you can set the default New Tab page URL.
+
+If disabled or not configured, the default Microsoft Edge new tab page is used.
+
+Default setting: Disabled or not configured
+Related policy: Allow web content on New Tab page.
 <!-- SetNewTabPageURL-Description-End -->
 
 <!-- SetNewTabPageURL-Editable-Begin -->
@@ -3696,7 +3818,7 @@ If disabled or not configured, the default app behavior occurs and no additional
 Default setting: Disabled or not configured
 Related policies:
 -Configure the Enterprise Mode Site List
--Send all intranet sites to Internet Explorer 11
+-Send all intranet sites to Internet Explorer 11.
 <!-- ShowMessageWhenOpeningSitesInInternetExplorer-Description-End -->
 
 <!-- ShowMessageWhenOpeningSitesInInternetExplorer-Editable-Begin -->
@@ -3852,7 +3974,7 @@ If disabled or not configured, the UI settings for the home button are disabled
 Default setting: Disabled or not configured
 Related policy:
 -Configure Home Button
--Set Home Button URL
+-Set Home Button URL.
 <!-- UnlockHomeButton-Description-End -->
 
 <!-- UnlockHomeButton-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md
index 6931233c08..aee369d5ea 100644
--- a/windows/client-management/mdm/policy-csp-cellular.md
+++ b/windows/client-management/mdm/policy-csp-cellular.md
@@ -4,7 +4,7 @@ description: Learn more about the Cellular Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -41,8 +41,20 @@ ms.topic: reference
 <!-- LetAppsAccessCellularData-OmaUri-End -->
 
 <!-- LetAppsAccessCellularData-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access cellular data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCellularData-Description-End -->
 
 <!-- LetAppsAccessCellularData-Editable-Begin -->
@@ -87,7 +99,7 @@ If an app is open when this Group Policy object is applied on a device, employee
 |:--|:--|
 | Name | LetAppsAccessCellularData |
 | Friendly Name | Let Windows apps access cellular data |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Network > WWAN Service > Cellular Data Access |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess |
@@ -116,8 +128,20 @@ If an app is open when this Group Policy object is applied on a device, employee
 <!-- LetAppsAccessCellularData_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCellularData_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access cellular data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCellularData_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessCellularData_ForceAllowTheseApps-Editable-Begin -->
@@ -169,8 +193,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed
 <!-- LetAppsAccessCellularData_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCellularData_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access cellular data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCellularData_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessCellularData_ForceDenyTheseApps-Editable-Begin -->
@@ -222,8 +258,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessCellularData_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCellularData_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access cellular data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCellularData_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessCellularData_UserInControlOfTheseApps-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md
index e614be7f73..5bee8f32ce 100644
--- a/windows/client-management/mdm/policy-csp-clouddesktop.md
+++ b/windows/client-management/mdm/policy-csp-clouddesktop.md
@@ -4,7 +4,7 @@ description: Learn more about the CloudDesktop Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- CloudDesktop-Begin -->
 # Policy CSP - CloudDesktop
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- CloudDesktop-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- CloudDesktop-Editable-End -->
@@ -37,12 +40,7 @@ ms.topic: reference
 
 <!-- BootToCloudMode-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well.
-
-This policy supports the below options:
-
-1. Not Configured: Machine will not trigger the Cloud PC connection automatically.
-2. Enable Boot to Cloud Desktop: Users who have a Cloud PC provisioned will get connected seamlessly to the Cloud PC as they finish sign-in operation.
+This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. This policy supports the below options: 1. Not Configured: Machine will not trigger the Cloud PC connection automatically. 2. Enable Boot to Cloud Desktop: Users who have a Cloud PC provisioned will get connected seamlessly to the Cloud PC as they finish sign-in operation.
 <!-- BootToCloudMode-Description-End -->
 
 <!-- BootToCloudMode-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index 0254386450..8bc1fb0fda 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -4,7 +4,7 @@ description: Learn more about the Connectivity Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -42,7 +42,7 @@ ms.topic: reference
 
 <!-- AllowBluetooth-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allows the user to enable Bluetooth or restrict access
+Allows the user to enable Bluetooth or restrict access.
 
 > [!NOTE]
 > This value is not supported in Windows Phone 8. 1 MDM and EAS, Windows 10 for desktop, or Windows 10 Mobile. If this is not set or it is deleted, the default value of 2 (Allow) is used. Most restricted value is 0.
@@ -220,6 +220,7 @@ To validate, the enterprise can confirm by observing the roaming enable switch i
 
 <!-- AllowConnectedDevices-Description-Begin -->
 <!-- Description-Source-DDF -->
+
 > [!NOTE]
 > This policy requires reboot to take effect. Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences.
 <!-- AllowConnectedDevices-Description-End -->
@@ -396,6 +397,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li
 
 <!-- AllowUSBConnection-Description-Begin -->
 <!-- Description-Source-DDF -->
+
 > [!NOTE]
 > Currently, this policy is supported only in HoloLens 2, HoloLens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging. Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced. Most restricted value is 0.
 <!-- AllowUSBConnection-Description-End -->
@@ -811,7 +813,7 @@ As part of determining the connectivity level, NCSI performs one of two active t
 <!-- Description-Source-ADMX -->
 This policy setting configures secure access to UNC paths.
 
-- If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements.
+If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements.
 <!-- HardenedUNCPaths-Description-End -->
 
 <!-- HardenedUNCPaths-Editable-Begin -->
@@ -874,7 +876,7 @@ Determines whether a user can install and configure the Network Bridge.
 
 The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder.
 
-- If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer.
+If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer.
 <!-- ProhibitInstallationAndConfigurationOfNetworkBridge-Description-End -->
 
 <!-- ProhibitInstallationAndConfigurationOfNetworkBridge-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md
index 6c2609c4c7..fb84b5f3b7 100644
--- a/windows/client-management/mdm/policy-csp-dataprotection.md
+++ b/windows/client-management/mdm/policy-csp-dataprotection.md
@@ -4,7 +4,7 @@ description: Learn more about the DataProtection Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -86,7 +86,7 @@ This policy setting allows you to block direct memory access (DMA) for all hot p
 
 <!-- LegacySelectiveWipeID-Description-Begin -->
 <!-- Description-Source-DDF -->
-Important. This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. Setting used by Windows 8. 1 Selective Wipe
+Important. This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. Setting used by Windows 8. 1 Selective Wipe.
 
 > [!NOTE]
 > This policy is not recommended for use in Windows 10.
diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index c5e12804f1..d7e2211264 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/08/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -221,7 +221,7 @@ In Windows 10, Basic membership is no longer available, so setting the value to
 |:--|:--|
 | Name | SpynetReporting |
 | Friendly Name | Join Microsoft MAPS |
-| Element Name | Join Microsoft MAPS |
+| Element Name | Join Microsoft MAPS. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > MAPS |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet |
@@ -700,9 +700,9 @@ Allows or disallows Windows Defender Realtime Monitoring functionality.
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting.
 
-- If you enable this setting or do not configure this setting, network files will be scanned.
+- If you enable this setting, network files will be scanned.
 
-- If you disable this setting, network files will not be scanned.
+- If you disable or do not configure this setting, network files will not be scanned.
 <!-- AllowScanningNetworkFiles-Description-End -->
 
 <!-- AllowScanningNetworkFiles-Editable-Begin -->
@@ -815,7 +815,7 @@ Allows or disallows Windows Defender Script Scanning functionality.
 <!-- AllowUserUIAccess-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure whether or not to display AM UI to the users.
-- If you enable this setting AM UI won't be available to users.
+If you enable this setting AM UI won't be available to users.
 <!-- AllowUserUIAccess-Description-End -->
 
 <!-- AllowUserUIAccess-Editable-Begin -->
@@ -883,8 +883,8 @@ Exclude files and paths from Attack Surface Reduction (ASR) rules.
 Enabled:
 Specify the folders or files and resources that should be excluded from ASR rules in the Options section.
 Enter each rule on a new line as a name-value pair:
-- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder
-- Value column: Enter "0" for each item
+  - Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder
+  - Value column: Enter "0" for each item
 
 Disabled:
 No exclusions will be applied to the ASR rules.
@@ -916,7 +916,7 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s
 |:--|:--|
 | Name | ExploitGuard_ASR_ASROnlyExclusions |
 | Friendly Name | Exclude files and paths from Attack Surface Reduction Rules |
-| Element Name | Exclusions from ASR rules |
+| Element Name | Exclusions from ASR rules. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR |
@@ -949,26 +949,26 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s
 Set the state for each Attack Surface Reduction (ASR) rule.
 
 After enabling this setting, you can set each rule to the following in the Options section:
-- Block: the rule will be applied
-- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied)
-- Off: the rule will not be applied
-- Not Configured: the rule is enabled with default values
-- Warn: the rule will be applied and the end-user will have the option to bypass the block
+  - Block: the rule will be applied
+  - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied)
+  - Off: the rule will not be applied
+  - Not Configured: the rule is enabled with default values
+  - Warn: the rule will be applied and the end-user will have the option to bypass the block
 
-Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured.
+Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured.
 
 Enabled:
 Specify the state for each ASR rule under the Options section for this setting.
 Enter each rule on a new line as a name-value pair:
-- Name column: Enter a valid ASR rule ID
-- Value column: Enter the status ID that relates to state you want to specify for the associated rule
+  - Name column: Enter a valid ASR rule ID
+  - Value column: Enter the status ID that relates to state you want to specify for the associated rule
 
 The following status IDs are permitted under the value column:
-- 1 (Block)
-- 0 (Off)
-- 2 (Audit)
-- 5 (Not Configured)
-- 6 (Warn)
+  - 1 (Block)
+  - 0 (Off)
+  - 2 (Audit)
+  - 5 (Not Configured)
+  - 6 (Warn)
 
 Example:
 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
@@ -1007,7 +1007,7 @@ You can exclude folders or files in the "Exclude files and paths from Attack Sur
 |:--|:--|
 | Name | ExploitGuard_ASR_Rules |
 | Friendly Name | Configure Attack Surface Reduction rules |
-| Element Name | Set the state for each ASR rule |
+| Element Name | Set the state for each ASR rule. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR |
@@ -1066,7 +1066,7 @@ This policy setting allows you to configure the maximum percentage CPU utilizati
 |:--|:--|
 | Name | Scan_AvgCPULoadFactor |
 | Friendly Name | Specify the maximum percentage of CPU utilization during a scan |
-| Element Name | Specify the maximum percentage of CPU utilization during a scan |
+| Element Name | Specify the maximum percentage of CPU utilization during a scan. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Scan |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan |
@@ -1163,11 +1163,22 @@ This setting applies to scheduled scans, but it has no effect on scans initiated
 <!-- CloudBlockLevel-OmaUri-End -->
 
 <!-- CloudBlockLevel-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see [Specify the cloud protection level](/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus).
+<!-- Description-Source-ADMX -->
+This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files.
+
+If this setting is on, Microsoft Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency.
+
+For more information about specific values that are supported, see the Microsoft Defender Antivirus documentation site.
 
 > [!NOTE]
-> This feature requires the Join Microsoft MAPS setting enabled in order to function.
+> This feature requires the "Join Microsoft MAPS" setting enabled in order to function.
+
+Possible options are:
+(0x0) Default Microsoft Defender Antivirus blocking level
+(0x1) Moderate Microsoft Defender Antivirus blocking level, delivers verdict only for high confidence detections
+(0x2) High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives)
+(0x4) High+ blocking level - aggressively block unknowns and apply additional protection measures (may impact client performance)
+(0x6) Zero tolerance blocking level - block all unknown executables.
 <!-- CloudBlockLevel-Description-End -->
 
 <!-- CloudBlockLevel-Editable-Begin -->
@@ -1202,7 +1213,7 @@ This policy setting determines how aggressive Windows Defender Antivirus will be
 |:--|:--|
 | Name | MpEngine_MpCloudBlockLevel |
 | Friendly Name | Select cloud protection level |
-| Element Name | Select cloud blocking level |
+| Element Name | Select cloud blocking level. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > MpEngine |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine |
@@ -1231,11 +1242,15 @@ This policy setting determines how aggressive Windows Defender Antivirus will be
 <!-- CloudExtendedTimeout-OmaUri-End -->
 
 <!-- CloudExtendedTimeout-Description-Begin -->
-<!-- Description-Source-DDF -->
-This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds.
+<!-- Description-Source-ADMX -->
+This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe.
+
+The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds.
+
+For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds.
 
 > [!NOTE]
-> This feature depends on three other MAPS settings the must all be enabled- Configure the 'Block at First Sight' feature; Join Microsoft MAPS; Send file samples when further analysis is required.
+> This feature depends on three other MAPS settings - "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required" all need to be enabled.
 <!-- CloudExtendedTimeout-Description-End -->
 
 <!-- CloudExtendedTimeout-Editable-Begin -->
@@ -1260,7 +1275,7 @@ This feature allows Windows Defender Antivirus to block a suspicious file for up
 |:--|:--|
 | Name | MpEngine_MpBafsExtendedTimeout |
 | Friendly Name | Configure extended cloud check |
-| Element Name | Specify the extended cloud check time in seconds |
+| Element Name | Specify the extended cloud check time in seconds. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > MpEngine |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine |
@@ -1331,7 +1346,7 @@ Default system folders are automatically guarded, but you can add folders in the
 |:--|:--|
 | Name | ExploitGuard_ControlledFolderAccess_AllowedApplications |
 | Friendly Name | Configure allowed applications |
-| Element Name | Enter the applications that should be trusted |
+| Element Name | Enter the applications that should be trusted. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access |
@@ -1403,7 +1418,7 @@ Microsoft Defender Antivirus automatically determines which applications can be
 |:--|:--|
 | Name | ExploitGuard_ControlledFolderAccess_ProtectedFolders |
 | Friendly Name | Configure protected folders |
-| Element Name | Enter the folders that should be guarded |
+| Element Name | Enter the folders that should be guarded. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access |
@@ -1462,7 +1477,7 @@ This policy setting defines the number of days items should be kept in the Quara
 |:--|:--|
 | Name | Quarantine_PurgeItemsAfterDelay |
 | Friendly Name | Configure removal of items from Quarantine folder |
-| Element Name | Configure removal of items from Quarantine folder |
+| Element Name | Configure removal of items from Quarantine folder. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Quarantine |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Quarantine |
@@ -1625,8 +1640,8 @@ This policy setting allows you to configure catch-up scans for scheduled quick s
 <!-- EnableControlledFolderAccess-Description-Begin -->
 <!-- Description-Source-ADMX -->
 Enable or disable controlled folder access for untrusted applications. You can choose to block, audit, or allow attempts by untrusted apps to:
-- Modify or delete files in protected folders, such as the Documents folder
-- Write to disk sectors
+  - Modify or delete files in protected folders, such as the Documents folder
+  - Write to disk sectors
 
 You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders.
 
@@ -1635,35 +1650,35 @@ Default system folders are automatically protected, but you can add folders in t
 
 Block:
 The following will be blocked:
-- Attempts by untrusted apps to modify or delete files in protected folders
-- Attempts by untrusted apps to write to disk sectors
+  - Attempts by untrusted apps to modify or delete files in protected folders
+  - Attempts by untrusted apps to write to disk sectors
 The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123.
 
 Disabled:
 The following will not be blocked and will be allowed to run:
-- Attempts by untrusted apps to modify or delete files in protected folders
-- Attempts by untrusted apps to write to disk sectors
+  - Attempts by untrusted apps to modify or delete files in protected folders
+  - Attempts by untrusted apps to write to disk sectors
 These attempts will not be recorded in the Windows event log.
 
 Audit Mode:
 The following will not be blocked and will be allowed to run:
-- Attempts by untrusted apps to modify or delete files in protected folders
-- Attempts by untrusted apps to write to disk sectors
+  - Attempts by untrusted apps to modify or delete files in protected folders
+  - Attempts by untrusted apps to write to disk sectors
 The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124.
 
 Block disk modification only:
 The following will be blocked:
-- Attempts by untrusted apps to write to disk sectors
+  - Attempts by untrusted apps to write to disk sectors
 The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123.
 
 The following will not be blocked and will be allowed to run:
-- Attempts by untrusted apps to modify or delete files in protected folders
+  - Attempts by untrusted apps to modify or delete files in protected folders
 These attempts will not be recorded in the Windows event log.
 
 Audit disk modification only:
 The following will not be blocked and will be allowed to run:
-- Attempts by untrusted apps to write to disk sectors
-- Attempts by untrusted apps to modify or delete files in protected folders
+  - Attempts by untrusted apps to write to disk sectors
+  - Attempts by untrusted apps to modify or delete files in protected folders
 Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124).
 Attempts to modify or delete files in protected folders will not be recorded.
 
@@ -1702,7 +1717,7 @@ Same as Disabled.
 |:--|:--|
 | Name | ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess |
 | Friendly Name | Configure Controlled folder access |
-| Element Name | Configure the guard my folders feature |
+| Element Name | Configure the guard my folders feature. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access |
@@ -1871,8 +1886,8 @@ Same as Disabled.
 <!-- ExcludedExtensions-OmaUri-End -->
 
 <!-- ExcludedExtensions-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a |. For example, lib|obj.
+<!-- Description-Source-ADMX -->
+This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0.
 <!-- ExcludedExtensions-Description-End -->
 
 <!-- ExcludedExtensions-Editable-Begin -->
@@ -1896,7 +1911,7 @@ Allows an administrator to specify a list of file type extensions to ignore duri
 |:--|:--|
 | Name | Exclusions_Extensions |
 | Friendly Name | Extension Exclusions |
-| Element Name | Extension Exclusions |
+| Element Name | Extension Exclusions. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Exclusions |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions |
@@ -1925,8 +1940,8 @@ Allows an administrator to specify a list of file type extensions to ignore duri
 <!-- ExcludedPaths-OmaUri-End -->
 
 <!-- ExcludedPaths-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a |. For example, C:\Example|C:\Example1.
+<!-- Description-Source-ADMX -->
+This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0.
 <!-- ExcludedPaths-Description-End -->
 
 <!-- ExcludedPaths-Editable-Begin -->
@@ -1950,7 +1965,7 @@ Allows an administrator to specify a list of directory paths to ignore during a
 |:--|:--|
 | Name | Exclusions_Paths |
 | Friendly Name | Path Exclusions |
-| Element Name | Path Exclusions |
+| Element Name | Path Exclusions. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Exclusions |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions |
@@ -1979,11 +1994,8 @@ Allows an administrator to specify a list of directory paths to ignore during a
 <!-- ExcludedProcesses-OmaUri-End -->
 
 <!-- ExcludedProcesses-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows an administrator to specify a list of files opened by processes to ignore during a scan.
-
-> [!IMPORTANT]
-> The process itself is not excluded from the scan, but can be by using the Defender/ExcludedPaths policy to exclude its path. Each file type must be separated by a |. For example, C\Example. exe|C\Example1.exe.
+<!-- Description-Source-ADMX -->
+This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0.
 <!-- ExcludedProcesses-Description-End -->
 
 <!-- ExcludedProcesses-Editable-Begin -->
@@ -2007,7 +2019,7 @@ Allows an administrator to specify a list of files opened by processes to ignore
 |:--|:--|
 | Name | Exclusions_Processes |
 | Friendly Name | Process Exclusions |
-| Element Name | Process Exclusions |
+| Element Name | Process Exclusions. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Exclusions |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions |
@@ -2115,7 +2127,7 @@ This policy setting allows you to configure monitoring for incoming and outgoing
 
 **Note** that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes.
 
-The options for this setting are mutually exclusive
+The options for this setting are mutually exclusive:
 0 = Scan incoming and outgoing files (default)
 1 = Scan incoming files only
 2 = Scan outgoing files only
@@ -2158,7 +2170,7 @@ Any other value, or if the value does not exist, resolves to the default (0).
 |:--|:--|
 | Name | RealtimeProtection_RealtimeScanDirection |
 | Friendly Name | Configure monitoring for incoming and outgoing file and program activity |
-| Element Name | Configure monitoring for incoming and outgoing file and program activity |
+| Element Name | Configure monitoring for incoming and outgoing file and program activity. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection |
@@ -2194,7 +2206,7 @@ This policy setting allows you to specify the scan type to use during a schedule
 
 - If you enable this setting, the scan type will be set to the specified value.
 
-- If you disable or do not configure this setting, the default scan type will be used.
+- If you disable or do not configure this setting, the default scan type will used.
 <!-- ScanParameter-Description-End -->
 
 <!-- ScanParameter-Editable-Begin -->
@@ -2227,7 +2239,7 @@ This policy setting allows you to specify the scan type to use during a schedule
 |:--|:--|
 | Name | Scan_ScanParameters |
 | Friendly Name | Specify the scan type to use for a scheduled scan |
-| Element Name | Specify the scan type to use for a scheduled scan |
+| Element Name | Specify the scan type to use for a scheduled scan. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Scan |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan |
@@ -2286,7 +2298,7 @@ This policy setting allows you to specify the time of day at which to perform a
 |:--|:--|
 | Name | Scan_ScheduleQuickScantime |
 | Friendly Name | Specify the time for a daily quick scan |
-| Element Name | Specify the time for a daily quick scan |
+| Element Name | Specify the time for a daily quick scan. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Scan |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan |
@@ -2371,7 +2383,7 @@ This setting can be configured with the following ordinal number values:
 |:--|:--|
 | Name | Scan_ScheduleDay |
 | Friendly Name | Specify the day of the week to run a scheduled scan |
-| Element Name | Specify the day of the week to run a scheduled scan |
+| Element Name | Specify the day of the week to run a scheduled scan. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Scan |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan |
@@ -2430,7 +2442,7 @@ This policy setting allows you to specify the time of day at which to perform a
 |:--|:--|
 | Name | Scan_ScheduleTime |
 | Friendly Name | Specify the time of day to run a scheduled scan |
-| Element Name | Specify the time of day to run a scheduled scan |
+| Element Name | Specify the time of day to run a scheduled scan. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Scan |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan |
@@ -2462,7 +2474,7 @@ This policy setting allows you to specify the time of day at which to perform a
 <!-- Description-Source-ADMX -->
 This policy setting allows you to define the security intelligence location for VDI-configured computers.
 
-- If you disable or do not configure this setting, security intelligence will be referred from the default local source.
+If you disable or do not configure this setting, security intelligence will be referred from the default local source.
 <!-- SecurityIntelligenceLocation-Description-End -->
 
 <!-- SecurityIntelligenceLocation-Editable-Begin -->
@@ -2485,7 +2497,7 @@ This policy setting allows you to define the security intelligence location for
 |:--|:--|
 | Name | SignatureUpdate_SharedSignaturesLocation |
 | Friendly Name | Define security intelligence location for VDI clients. |
-| Element Name | Define file share for downloading security intelligence updates in virtual environments |
+| Element Name | Define file share for downloading security intelligence updates in virtual environments. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates |
@@ -2517,7 +2529,7 @@ This policy setting allows you to define the security intelligence location for
 <!-- Description-Source-ADMX -->
 This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares"
 
-For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }
+For Example: `{ InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }`
 
 - If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted.
 
@@ -2545,7 +2557,7 @@ For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }
 |:--|:--|
 | Name | SignatureUpdate_FallbackOrder |
 | Friendly Name | Define the order of sources for downloading security intelligence updates |
-| Element Name | Define the order of sources for downloading security intelligence updates |
+| Element Name | Define the order of sources for downloading security intelligence updates. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates |
@@ -2603,7 +2615,7 @@ This policy setting allows you to configure UNC file share sources for downloadi
 |:--|:--|
 | Name | SignatureUpdate_DefinitionUpdateFileSharesSources |
 | Friendly Name | Define file shares for downloading security intelligence updates |
-| Element Name | Define file shares for downloading security intelligence updates |
+| Element Name | Define file shares for downloading security intelligence updates. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates |
@@ -2662,7 +2674,7 @@ This policy setting allows you to specify an interval at which to check for secu
 |:--|:--|
 | Name | SignatureUpdate_SignatureUpdateInterval |
 | Friendly Name | Specify the interval to check for security intelligence updates |
-| Element Name | Specify the interval to check for security intelligence updates |
+| Element Name | Specify the interval to check for security intelligence updates. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates |
@@ -2698,7 +2710,7 @@ Possible options are:
 (0x0) Always prompt
 (0x1) Send safe samples automatically
 (0x2) Never send
-(0x3) Send all samples automatically
+(0x3) Send all samples automatically.
 <!-- SubmitSamplesConsent-Description-End -->
 
 <!-- SubmitSamplesConsent-Editable-Begin -->
@@ -2733,7 +2745,7 @@ Possible options are:
 |:--|:--|
 | Name | SubmitSamplesConsent |
 | Friendly Name | Send file samples when further analysis is required |
-| Element Name | Send file samples when further analysis is required |
+| Element Name | Send file samples when further analysis is required. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > MAPS |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet |
@@ -2762,8 +2774,19 @@ Possible options are:
 <!-- ThreatSeverityDefaultAction-OmaUri-End -->
 
 <!-- ThreatSeverityDefaultAction-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format threat level=action|threat level=action. For example, 1=6|2=2|4=10|5=3. The following list shows the supported values for threat severity levels:1 - Low severity threats2 - Moderate severity threats4 - High severity threats5 - Severe threatsThe following list shows the supported values for possible actions:2 - Quarantine. Moves files to quarantine. 3 - Remove. Removes files from system. 6 - Allow. Allows file/does none of the above actions. 8 - User defined. Requires user to make a decision on which action to take. 10 - Block. Blocks file execution.
+<!-- Description-Source-ADMX -->
+This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken.
+
+Valid threat alert levels are:
+1 = Low
+2 = Medium
+4 = High
+5 = Severe
+
+Valid remediation action values are:
+2 = Quarantine
+3 = Remove
+6 = Ignore.
 <!-- ThreatSeverityDefaultAction-Description-End -->
 
 <!-- ThreatSeverityDefaultAction-Editable-Begin -->
@@ -2786,7 +2809,7 @@ Allows an administrator to specify any valid threat severity levels and the corr
 |:--|:--|
 | Name | Threats_ThreatSeverityDefaultAction |
 | Friendly Name | Specify threat alert levels at which default action should not be taken when detected |
-| Element Name | Specify threat alert levels at which default action should not be taken when detected |
+| Element Name | Specify threat alert levels at which default action should not be taken when detected. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Antivirus > Threats |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Threats |
diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
index fe04df23d4..0a0eeb6f78 100644
--- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md
+++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
@@ -4,7 +4,7 @@ description: Learn more about the DeliveryOptimization Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -134,7 +134,7 @@ Specifies whether the device is allowed to participate in Peer Caching while con
 |:--|:--|
 | Name | AllowVPNPeerCaching |
 | Friendly Name | Enable Peer Caching while the device connects via VPN |
-| Element Name | Enable Peer Caching while the device connects via VPN |
+| Element Name | Enable Peer Caching while the device connects via VPN. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -192,7 +192,7 @@ One or more values can be added as either fully qualified domain names (FQDN) or
 |:--|:--|
 | Name | CacheHost |
 | Friendly Name | Cache Server Hostname |
-| Element Name | Cache Server |
+| Element Name | Cache Server. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -259,7 +259,7 @@ If this policy is not configured, the client will attempt to automatically find
 |:--|:--|
 | Name | CacheHostSource |
 | Friendly Name | Cache Server Hostname Source |
-| Element Name | Cache Server Hostname Source |
+| Element Name | Cache Server Hostname Source. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -619,7 +619,7 @@ Specifies the download method that Delivery Optimization can use in downloads of
 |:--|:--|
 | Name | DownloadMode |
 | Friendly Name | Download Mode |
-| Element Name | Download Mode |
+| Element Name | Download Mode. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -676,7 +676,7 @@ Use this if you need to create a single group for Local Network Peering for bran
 |:--|:--|
 | Name | GroupId |
 | Friendly Name | Group ID |
-| Element Name | Group ID |
+| Element Name | Group ID. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -745,7 +745,7 @@ Set this policy to restrict peer selection to a specific source. Available optio
 |:--|:--|
 | Name | GroupIdSource |
 | Friendly Name | Select the source of Group IDs |
-| Element Name | Source of Group IDs |
+| Element Name | Source of Group IDs. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -1308,7 +1308,7 @@ By default, %SystemDrive% is used to store the cache. The drive location can be
 |:--|:--|
 | Name | ModifyCacheDrive |
 | Friendly Name | Modify Cache Drive |
-| Element Name | Modify Cache Drive |
+| Element Name | Modify Cache Drive. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
@@ -1555,7 +1555,7 @@ In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer
 |:--|:--|
 | Name | RestrictPeerSelectionBy |
 | Friendly Name | Select a method to restrict Peer Selection |
-| Element Name | Restrict Peer Selection By |
+| Element Name | Restrict Peer Selection By. |
 | Location | Computer Configuration |
 | Path | Windows Components > Delivery Optimization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization |
diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md
index 1cc683a423..e0eeb748b5 100644
--- a/windows/client-management/mdm/policy-csp-desktop.md
+++ b/windows/client-management/mdm/policy-csp-desktop.md
@@ -4,7 +4,7 @@ description: Learn more about the Desktop Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -46,7 +46,7 @@ Prevents users from changing the path to their profile folders.
 
 By default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box.
 
-- If you enable this setting, users are unable to type a new location in the Target box.
+If you enable this setting, users are unable to type a new location in the Target box.
 <!-- PreventUserRedirectionOfProfileFolders-Description-End -->
 
 <!-- PreventUserRedirectionOfProfileFolders-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-desktopappinstaller.md b/windows/client-management/mdm/policy-csp-desktopappinstaller.md
index 36f2988560..c2e602fd7a 100644
--- a/windows/client-management/mdm/policy-csp-desktopappinstaller.md
+++ b/windows/client-management/mdm/policy-csp-desktopappinstaller.md
@@ -4,7 +4,7 @@ description: Learn more about the DesktopAppInstaller Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -210,6 +210,57 @@ Users will still be able to execute the *winget* command. The default help will
 
 <!-- EnableAppInstaller-End -->
 
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Begin -->
+## EnableBypassCertificatePinningForMicrosoftStore
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Applicability-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/DesktopAppInstaller/EnableBypassCertificatePinningForMicrosoftStore
+```
+<!-- EnableBypassCertificatePinningForMicrosoftStore-OmaUri-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Description-Begin -->
+<!-- Description-Source-Not-Found -->
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Description-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Editable-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+<!-- EnableBypassCertificatePinningForMicrosoftStore-DFProperties-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-AdmxBacked-Begin -->
+<!-- ADMX-Not-Found -->
+> [!TIP]
+> This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | EnableBypassCertificatePinningForMicrosoftStore |
+| ADMX File Name | DesktopAppInstaller.admx |
+<!-- EnableBypassCertificatePinningForMicrosoftStore-AdmxBacked-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- EnableBypassCertificatePinningForMicrosoftStore-Examples-End -->
+
+<!-- EnableBypassCertificatePinningForMicrosoftStore-End -->
+
 <!-- EnableDefaultSource-Begin -->
 ## EnableDefaultSource
 
@@ -393,6 +444,57 @@ This policy controls whether or not the [Windows Package Manager](/windows/packa
 
 <!-- EnableHashOverride-End -->
 
+<!-- EnableLocalArchiveMalwareScanOverride-Begin -->
+## EnableLocalArchiveMalwareScanOverride
+
+<!-- EnableLocalArchiveMalwareScanOverride-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+<!-- EnableLocalArchiveMalwareScanOverride-Applicability-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/DesktopAppInstaller/EnableLocalArchiveMalwareScanOverride
+```
+<!-- EnableLocalArchiveMalwareScanOverride-OmaUri-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-Description-Begin -->
+<!-- Description-Source-Not-Found -->
+<!-- EnableLocalArchiveMalwareScanOverride-Description-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- EnableLocalArchiveMalwareScanOverride-Editable-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+<!-- EnableLocalArchiveMalwareScanOverride-DFProperties-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-AdmxBacked-Begin -->
+<!-- ADMX-Not-Found -->
+> [!TIP]
+> This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+**ADMX mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | EnableLocalArchiveMalwareScanOverride |
+| ADMX File Name | DesktopAppInstaller.admx |
+<!-- EnableLocalArchiveMalwareScanOverride-AdmxBacked-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- EnableLocalArchiveMalwareScanOverride-Examples-End -->
+
+<!-- EnableLocalArchiveMalwareScanOverride-End -->
+
 <!-- EnableLocalManifestFiles-Begin -->
 ## EnableLocalManifestFiles
 
diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md
index 03c560a1d3..ba41b0ac29 100644
--- a/windows/client-management/mdm/policy-csp-deviceguard.md
+++ b/windows/client-management/mdm/policy-csp-deviceguard.md
@@ -4,7 +4,7 @@ description: Learn more about the DeviceGuard Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/01/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -101,72 +101,8 @@ For more information about System Guard, see [Introducing Windows Defender Syste
 <!-- EnableVirtualizationBasedSecurity-OmaUri-End -->
 
 <!-- EnableVirtualizationBasedSecurity-Description-Begin -->
-<!-- Description-Source-ADMX -->
-Specifies whether Virtualization Based Security is enabled.
-
-Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections require hardware support and will only be enabled on correctly configured devices.
-
-Virtualization Based Protection of Code Integrity
-
-This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature.
-
-The "Disabled" option turns off Virtualization Based Protection of Code Integrity remotely if it was previously turned on with the "Enabled without lock" option.
-
-The "Enabled with UEFI lock" option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI.
-
-The "Enabled without lock" option allows Virtualization Based Protection of Code Integrity to be disabled remotely by using Group Policy.
-
-The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified.
-
-The "Require UEFI Memory Attributes Table" option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility.
-
-> [!WARNING]
-> All drivers on the system must be compatible with this feature or the system may crash. Ensure that this policy setting is only deployed to computers which are known to be compatible.
-
-Credential Guard
-
-This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials.
-
-For Windows 11 21. H2 and earlier, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option. For later versions, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option or was "Not Configured".
-
-The "Enabled with UEFI lock" option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI.
-
-The "Enabled without lock" option allows Credential Guard to be disabled remotely by using Group Policy. The devices that use this setting must be running at least Windows 10 (Version 1511).
-
-For Windows 11 21. H2 and earlier, the "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. For later versions, if there is no current setting in the registry, the "Not Configured" option will enable Credential Guard without UEFI lock.
-
-Secure Launch
-
-This setting sets the configuration of Secure Launch to secure the boot chain.
-
-The "Not Configured" setting is the default, and allows configuration of the feature by Administrative users.
-
-The "Enabled" option turns on Secure Launch on supported hardware.
-
-The "Disabled" option turns off Secure Launch, regardless of hardware support.
-
-Kernel-mode Hardware-enforced Stack Protection
-
-This setting enables Hardware-enforced Stack Protection for kernel-mode code. When this security feature is enabled, kernel-mode data stacks are hardened with hardware-based shadow stacks, which store intended return address targets to ensure that program control flow is not tampered.
-
-This security feature has the following prerequisites:
-1) The CPU hardware supports hardware-based shadow stacks.
-2) Virtualization Based Protection of Code Integrity is enabled.
-
-If either prerequisite is not met, this feature will not be enabled, even if an "Enabled" option is selected for this feature. **Note** that selecting an "Enabled" option for this feature will not automatically enable Virtualization Based Protection of Code Integrity, that needs to be done separately.
-
-Devices that enable this security feature must be running at least Windows 11 (Version 22. H2).
-
-The "Disabled" option turns off kernel-mode Hardware-enforced Stack Protection.
-
-The "Enabled in audit mode" option enables kernel-mode Hardware-enforced Stack Protection in audit mode, where shadow stack violations are not fatal and will be logged to the system event log.
-
-The "Enabled in enforcement mode" option enables kernel-mode Hardware-enforced Stack Protection in enforcement mode, where shadow stack violations are fatal.
-
-The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified.
-
-> [!WARNING]
-> All drivers on the system must be compatible with this security feature or the system may crash in enforcement mode. Audit mode can be used to discover incompatible drivers. For more information, see [A driver can't load on this device](https://go.microsoft.com/fwlink/?LinkId=2162953).
+<!-- Description-Source-DDF-Forced -->
+Turns On Virtualization Based Security(VBS)
 <!-- EnableVirtualizationBasedSecurity-Description-End -->
 
 <!-- EnableVirtualizationBasedSecurity-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md
index 0696c7e877..b65b65b1e4 100644
--- a/windows/client-management/mdm/policy-csp-deviceinstallation.md
+++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md
@@ -4,7 +4,7 @@ description: Learn more about the DeviceInstallation Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -45,11 +45,12 @@ ms.topic: reference
 This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
 
 When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
-- Prevent installation of devices that match these device IDs
-- Prevent installation of devices that match any of these device instance IDs
+  - Prevent installation of devices that match these device IDs
+  - Prevent installation of devices that match any of these device instance IDs
 If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
 
-NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
+> [!NOTE]
+> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
 
 Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
 
@@ -146,10 +147,11 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
 This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
 
 When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
-- Prevent installation of devices that match any of these device instance IDs
+  - Prevent installation of devices that match any of these device instance IDs
 If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
 
-NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
+> [!NOTE]
+> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
 
 Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
 
@@ -248,12 +250,13 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i
 This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
 
 When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
-- Prevent installation of devices for these device classes
-- Prevent installation of devices that match these device IDs
-- Prevent installation of devices that match any of these device instance IDs
+  - Prevent installation of devices for these device classes
+  - Prevent installation of devices that match these device IDs
+  - Prevent installation of devices that match any of these device instance IDs
 If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
 
-NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
+> [!NOTE]
+> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
 
 Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
 
@@ -378,9 +381,10 @@ Removable devices
 
 7. Prevent installation of removable devices
 
-NOTE: This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored.
+> [!NOTE]
+> This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored.
 
-- If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device.
+If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device.
 <!-- EnableInstallationPolicyLayering-Description-End -->
 
 <!-- EnableInstallationPolicyLayering-Editable-Begin -->
@@ -533,7 +537,8 @@ This policy setting allows you to prevent Windows from retrieving device metadat
 <!-- Description-Source-ADMX -->
 This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting.
 
-NOTE: This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting.
+> [!NOTE]
+> This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting.
 
 - If you enable this policy setting, Windows is prevented from installing or updating the driver package for any device that is not described by either the "Allow installation of devices that match any of these device IDs", the "Allow installation of devices for these device classes", or the "Allow installation of devices that match any of these device instance IDs" policy setting.
 
@@ -632,9 +637,11 @@ You can also block installation by using a custom profile in Intune.
 <!-- Description-Source-ADMX -->
 This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
 
-NOTE: To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
+> [!NOTE]
+> To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
 
 - If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create.
+
 - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
 
 - If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.
@@ -736,6 +743,7 @@ For example, this custom profile blocks installation and usage of USB devices wi
 This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
 
 - If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create.
+
 - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
 
 - If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.
@@ -846,9 +854,11 @@ To prevent installation of devices with matching device instance IDs by using cu
 <!-- Description-Source-ADMX -->
 This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
 
-NOTE: To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
+> [!NOTE]
+> To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
 
 - If you enable this policy setting, Windows is prevented from installing or updating driver packages whose device setup class GUIDs appear in the list you create.
+
 - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
 
 - If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.
diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md
index 9645d243cd..69a26fb46f 100644
--- a/windows/client-management/mdm/policy-csp-devicelock.md
+++ b/windows/client-management/mdm/policy-csp-devicelock.md
@@ -4,7 +4,7 @@ description: Learn more about the DeviceLock Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -21,12 +21,165 @@ ms.topic: reference
 >
 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it.  For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- DeviceLock-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 > [!IMPORTANT]
 > The DeviceLock CSP utilizes the [Exchange ActiveSync Policy Engine](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). When password length and complexity rules are applied, all the local user and administrator accounts are marked to change their password at the next sign in to ensure complexity requirements are met. For more information, see [Password length and complexity supported by account types](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)#password-length-and-complexity-supported-by-account-types).
 <!-- DeviceLock-Editable-End -->
 
+<!-- AccountLockoutDuration-Begin -->
+## AccountLockoutDuration
+
+<!-- AccountLockoutDuration-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- AccountLockoutDuration-Applicability-End -->
+
+<!-- AccountLockoutDuration-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutDuration
+```
+<!-- AccountLockoutDuration-OmaUri-End -->
+
+<!-- AccountLockoutDuration-Description-Begin -->
+<!-- Description-Source-DDF -->
+Account lockout duration This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
+<!-- AccountLockoutDuration-Description-End -->
+
+<!-- AccountLockoutDuration-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- AccountLockoutDuration-Editable-End -->
+
+<!-- AccountLockoutDuration-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Range: `[0-99999]` |
+| Default Value  | 0 |
+<!-- AccountLockoutDuration-DFProperties-End -->
+
+<!-- AccountLockoutDuration-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | Account lockout duration |
+| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
+<!-- AccountLockoutDuration-GpMapping-End -->
+
+<!-- AccountLockoutDuration-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- AccountLockoutDuration-Examples-End -->
+
+<!-- AccountLockoutDuration-End -->
+
+<!-- AccountLockoutThreshold-Begin -->
+## AccountLockoutThreshold
+
+<!-- AccountLockoutThreshold-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- AccountLockoutThreshold-Applicability-End -->
+
+<!-- AccountLockoutThreshold-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutThreshold
+```
+<!-- AccountLockoutThreshold-OmaUri-End -->
+
+<!-- AccountLockoutThreshold-Description-Begin -->
+<!-- Description-Source-DDF -->
+Account lockout threshold - This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out. Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts. Default: 0.
+<!-- AccountLockoutThreshold-Description-End -->
+
+<!-- AccountLockoutThreshold-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- AccountLockoutThreshold-Editable-End -->
+
+<!-- AccountLockoutThreshold-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Range: `[0-10]` |
+| Default Value  | 0 |
+<!-- AccountLockoutThreshold-DFProperties-End -->
+
+<!-- AccountLockoutThreshold-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | Account lockout threshold |
+| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
+<!-- AccountLockoutThreshold-GpMapping-End -->
+
+<!-- AccountLockoutThreshold-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- AccountLockoutThreshold-Examples-End -->
+
+<!-- AccountLockoutThreshold-End -->
+
+<!-- AllowAdministratorLockout-Begin -->
+## AllowAdministratorLockout
+
+<!-- AllowAdministratorLockout-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- AllowAdministratorLockout-Applicability-End -->
+
+<!-- AllowAdministratorLockout-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/DeviceLock/AllowAdministratorLockout
+```
+<!-- AllowAdministratorLockout-OmaUri-End -->
+
+<!-- AllowAdministratorLockout-Description-Begin -->
+<!-- Description-Source-DDF -->
+Allow Administrator account lockout This security setting determines whether the builtin Administrator account is subject to account lockout policy.
+<!-- AllowAdministratorLockout-Description-End -->
+
+<!-- AllowAdministratorLockout-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- AllowAdministratorLockout-Editable-End -->
+
+<!-- AllowAdministratorLockout-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Range: `[0-1]` |
+| Default Value  | 0 |
+<!-- AllowAdministratorLockout-DFProperties-End -->
+
+<!-- AllowAdministratorLockout-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | Allow Administrator account lockout |
+| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
+<!-- AllowAdministratorLockout-GpMapping-End -->
+
+<!-- AllowAdministratorLockout-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- AllowAdministratorLockout-Examples-End -->
+
+<!-- AllowAdministratorLockout-End -->
+
 <!-- AllowIdleReturnWithoutPassword-Begin -->
 ## AllowIdleReturnWithoutPassword
 
@@ -202,7 +355,7 @@ For more information about this policy, see [Exchange ActiveSync Policy Engine O
 
 <!-- AlphanumericDevicePasswordRequired-Description-Begin -->
 <!-- Description-Source-DDF -->
-Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0
+Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0.
 <!-- AlphanumericDevicePasswordRequired-Description-End -->
 
 <!-- AlphanumericDevicePasswordRequired-Editable-Begin -->
@@ -567,7 +720,7 @@ Specifies the default lock screen and logon image shown when no user is signed i
 
 <!-- MaxDevicePasswordFailedAttempts-Description-Begin -->
 <!-- Description-Source-DDF -->
-The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality
+The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality.
 
 > [!NOTE]
 > This policy must be wrapped in an Atomic command. This policy has different behaviors on the mobile device and desktop. On a mobile device, when the user reaches the value set by this policy, then the device is wiped. On a desktop, when the user reaches the value set by this policy, it is not wiped. Instead, the desktop is put on BitLocker recovery mode, which makes the data inaccessible but recoverable. If BitLocker is not enabled, then the policy cannot be enforced. Prior to reaching the failed attempts limit, the user is sent to the lock screen and warned that more failed attempts will lock their computer. When the user reaches the limit, the device automatically reboots and shows the BitLocker recovery page. This page prompts the user for the BitLocker recovery key. Most secure value is 0 if all policy values = 0; otherwise, Min policy value is the most secure value. For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)).
@@ -612,10 +765,10 @@ The number of authentication failures allowed before the device will be wiped. A
 
 <!-- MaximumPasswordAge-Description-Begin -->
 <!-- Description-Source-DDF -->
-This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days
+This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days.
 
 > [!NOTE]
-> It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources. Default 42.
+> It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources. Default: 42.
 <!-- MaximumPasswordAge-Description-End -->
 
 <!-- MaximumPasswordAge-Editable-Begin -->
@@ -1013,10 +1166,10 @@ Complexity requirements are enforced when passwords are changed or created.
 <!-- PasswordHistorySize-Description-Begin -->
 <!-- Description-Source-DDF -->
 Minimum password length
-This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required
+This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required.
 
 > [!NOTE]
-> By default, member computers follow the configuration of their domain controllers. Default 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting.
+> By default, member computers follow the configuration of their domain controllers. Default: 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting.
 <!-- PasswordHistorySize-Description-End -->
 
 <!-- PasswordHistorySize-Editable-Begin -->
@@ -1070,7 +1223,7 @@ Disables the lock screen camera toggle switch in PC Settings and prevents a came
 
 By default, users can enable invocation of an available camera on the lock screen.
 
-- If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen.
+If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen.
 <!-- PreventEnablingLockScreenCamera-Description-End -->
 
 <!-- PreventEnablingLockScreenCamera-Editable-Begin -->
@@ -1130,7 +1283,7 @@ Disables the lock screen slide show settings in PC Settings and prevents a slide
 
 By default, users can enable a slide show that will run after they lock the machine.
 
-- If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.
+If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.
 <!-- PreventLockScreenSlideShow-Description-End -->
 
 <!-- PreventLockScreenSlideShow-Editable-Begin -->
@@ -1169,6 +1322,56 @@ By default, users can enable a slide show that will run after they lock the mach
 
 <!-- PreventLockScreenSlideShow-End -->
 
+<!-- ResetAccountLockoutCounterAfter-Begin -->
+## ResetAccountLockoutCounterAfter
+
+<!-- ResetAccountLockoutCounterAfter-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- ResetAccountLockoutCounterAfter-Applicability-End -->
+
+<!-- ResetAccountLockoutCounterAfter-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/DeviceLock/ResetAccountLockoutCounterAfter
+```
+<!-- ResetAccountLockoutCounterAfter-OmaUri-End -->
+
+<!-- ResetAccountLockoutCounterAfter-Description-Begin -->
+<!-- Description-Source-DDF -->
+Reset account lockout counter after - This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes. If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified.
+<!-- ResetAccountLockoutCounterAfter-Description-End -->
+
+<!-- ResetAccountLockoutCounterAfter-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- ResetAccountLockoutCounterAfter-Editable-End -->
+
+<!-- ResetAccountLockoutCounterAfter-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | Range: `[1-99999]` |
+| Default Value  | 0 |
+<!-- ResetAccountLockoutCounterAfter-DFProperties-End -->
+
+<!-- ResetAccountLockoutCounterAfter-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | Reset account lockout counter after |
+| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
+<!-- ResetAccountLockoutCounterAfter-GpMapping-End -->
+
+<!-- ResetAccountLockoutCounterAfter-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- ResetAccountLockoutCounterAfter-Examples-End -->
+
+<!-- ResetAccountLockoutCounterAfter-End -->
+
 <!-- ScreenTimeoutWhileLocked-Begin -->
 ## ScreenTimeoutWhileLocked
 
diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md
index 5c610c1946..19f3a8b859 100644
--- a/windows/client-management/mdm/policy-csp-display.md
+++ b/windows/client-management/mdm/policy-csp-display.md
@@ -4,7 +4,7 @@ description: Learn more about the Display Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,8 +36,20 @@ ms.topic: reference
 <!-- DisablePerProcessDpiForApps-OmaUri-End -->
 
 <!-- DisablePerProcessDpiForApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value.
+<!-- Description-Source-ADMX -->
+Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows.
+
+When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows.
+
+Be aware of the following:
+
+Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors.
+
+Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays.
+
+In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled.
+
+Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system.
 <!-- DisablePerProcessDpiForApps-Description-End -->
 
 <!-- DisablePerProcessDpiForApps-Editable-Begin -->
@@ -94,8 +106,20 @@ This policy allows you to disable Per-Process System DPI for a semicolon-separat
 <!-- EnablePerProcessDpi-OmaUri-End -->
 
 <!-- EnablePerProcessDpi-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enable or disable Per-Process System DPI for all applications.
+<!-- Description-Source-ADMX -->
+Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows.
+
+When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows.
+
+Be aware of the following:
+
+Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors.
+
+Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays.
+
+In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled.
+
+Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system.
 <!-- EnablePerProcessDpi-Description-End -->
 
 <!-- EnablePerProcessDpi-Editable-Begin -->
@@ -169,8 +193,20 @@ Enabling this setting lets you specify the system-wide default for desktop appli
 <!-- EnablePerProcessDpiForApps-OmaUri-End -->
 
 <!-- EnablePerProcessDpiForApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value.
+<!-- Description-Source-ADMX -->
+Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows.
+
+When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows.
+
+Be aware of the following:
+
+Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors.
+
+Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays.
+
+In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled.
+
+Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system.
 <!-- EnablePerProcessDpiForApps-Description-End -->
 
 <!-- EnablePerProcessDpiForApps-Editable-Begin -->
@@ -223,8 +259,16 @@ This policy allows you to enable Per-Process System DPI for a semicolon-separate
 <!-- TurnOffGdiDPIScalingForApps-OmaUri-End -->
 
 <!-- TurnOffGdiDPIScalingForApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension.
+<!-- Description-Source-ADMX -->
+GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
+
+This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off.
+
+- If you enable this policy setting, GDI DPI Scaling is turned off for all applications in the list, even if they are enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
+
+- If you disable or do not configure this policy setting, GDI DPI Scaling might still be turned on for legacy applications.
+
+If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.
 <!-- TurnOffGdiDPIScalingForApps-Description-End -->
 
 <!-- TurnOffGdiDPIScalingForApps-Editable-Begin -->
@@ -293,8 +337,16 @@ To validate on Desktop, do the following tasks:
 <!-- TurnOnGdiDPIScalingForApps-OmaUri-End -->
 
 <!-- TurnOnGdiDPIScalingForApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension.
+<!-- Description-Source-ADMX -->
+GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware.
+
+This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on.
+
+- If you enable this policy setting, GDI DPI Scaling is turned on for all legacy applications in the list.
+
+- If you disable or do not configure this policy setting, GDI DPI Scaling will not be enabled for an application except when an application is enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest.
+
+If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off.
 <!-- TurnOnGdiDPIScalingForApps-Description-End -->
 
 <!-- TurnOnGdiDPIScalingForApps-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md
index c8c5aed332..004ce690a4 100644
--- a/windows/client-management/mdm/policy-csp-education.md
+++ b/windows/client-management/mdm/policy-csp-education.md
@@ -4,7 +4,7 @@ description: Learn more about the Education Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -39,6 +39,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app.
 - If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app.
+
 - If you enable or don't configure this policy setting, users will be able to access graphing functionality.
 <!-- AllowGraphingCalculator-Description-End -->
 
@@ -102,7 +103,7 @@ This policy setting allows you to control whether graphing functionality is avai
 
 <!-- DefaultPrinterName-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy sets user's default printer
+This policy sets user's default printer.
 <!-- DefaultPrinterName-Description-End -->
 
 <!-- DefaultPrinterName-Editable-Begin -->
@@ -144,6 +145,7 @@ The policy value is expected to be the name (network host name) of an installed
 <!-- Description-Source-DDF -->
 This policy setting allows you to control whether EDU-specific theme packs are available in Settings > Personalization.
 - If you disable or don't configure this policy setting, EDU-specific theme packs will not be included.
+
 - If you enable this policy setting, users will be able to personalize their devices with EDU-specific themes.
 <!-- EnableEduThemes-Description-End -->
 
@@ -193,7 +195,7 @@ This policy setting allows you to control whether EDU-specific theme packs are a
 
 <!-- IsEducationEnvironment-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows tenant to control whether to declare this OS as an education environment
+This policy setting allows tenant to control whether to declare this OS as an education environment.
 <!-- IsEducationEnvironment-Description-End -->
 
 <!-- IsEducationEnvironment-Editable-Begin -->
@@ -255,7 +257,7 @@ This setting does not delete printers that users have already added. However, if
 > [!NOTE]
 > You can use printer permissions to restrict the use of printers without specifying a setting. In the Printers folder, right-click a printer, click Properties, and then click the Security tab.
 
-If this policy is disabled, or not configured, users can add printers using the methods described above.
+- If this policy is disabled, or not configured, users can add printers using the methods described above.
 <!-- PreventAddingNewPrinters-Description-End -->
 
 <!-- PreventAddingNewPrinters-Editable-Begin -->
@@ -318,7 +320,7 @@ If this policy is disabled, or not configured, users can add printers using the
 
 <!-- PrinterNames-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy provisions per-user network printers
+This policy provisions per-user network printers.
 <!-- PrinterNames-Description-End -->
 
 <!-- PrinterNames-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
index b804039125..4dcd8140d3 100644
--- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
+++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
@@ -4,7 +4,7 @@ description: Learn more about the EnterpriseCloudPrint Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- CloudPrinterDiscoveryEndPoint-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy provisions per-user discovery end point to discover cloud printers
+This policy provisions per-user discovery end point to discover cloud printers.
 <!-- CloudPrinterDiscoveryEndPoint-Description-End -->
 
 <!-- CloudPrinterDiscoveryEndPoint-Editable-Begin -->
@@ -84,7 +84,7 @@ The default value is an empty string. Otherwise, the value should contain the UR
 
 <!-- CloudPrintOAuthAuthority-Description-Begin -->
 <!-- Description-Source-DDF -->
-Authentication endpoint for acquiring OAuth tokens
+Authentication endpoint for acquiring OAuth tokens.
 <!-- CloudPrintOAuthAuthority-Description-End -->
 
 <!-- CloudPrintOAuthAuthority-Editable-Begin -->
@@ -131,7 +131,7 @@ The default value is an empty string. Otherwise, the value should contain the UR
 
 <!-- CloudPrintOAuthClientId-Description-Begin -->
 <!-- Description-Source-DDF -->
-A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority
+A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority.
 <!-- CloudPrintOAuthClientId-Description-End -->
 
 <!-- CloudPrintOAuthClientId-Editable-Begin -->
@@ -178,7 +178,7 @@ The default value is an empty string. Otherwise, the value should contain a GUID
 
 <!-- CloudPrintResourceId-Description-Begin -->
 <!-- Description-Source-DDF -->
-Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication
+Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication.
 <!-- CloudPrintResourceId-Description-End -->
 
 <!-- CloudPrintResourceId-Editable-Begin -->
@@ -225,7 +225,7 @@ The default value is an empty string. Otherwise, the value should contain a URL.
 
 <!-- DiscoveryMaxPrinterLimit-Description-Begin -->
 <!-- Description-Source-DDF -->
-Defines the maximum number of printers that should be queried from discovery end point
+Defines the maximum number of printers that should be queried from discovery end point.
 <!-- DiscoveryMaxPrinterLimit-Description-End -->
 
 <!-- DiscoveryMaxPrinterLimit-Editable-Begin -->
@@ -267,7 +267,7 @@ This policy must target ./User, otherwise it fails.
 
 <!-- MopriaDiscoveryResourceId-Description-Begin -->
 <!-- Description-Source-DDF -->
-Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication
+Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication.
 <!-- MopriaDiscoveryResourceId-Description-End -->
 
 <!-- MopriaDiscoveryResourceId-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md
index e46c94e961..6505002489 100644
--- a/windows/client-management/mdm/policy-csp-experience.md
+++ b/windows/client-management/mdm/policy-csp-experience.md
@@ -4,7 +4,7 @@ description: Learn more about the Experience Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- Experience-Begin -->
 # Policy CSP - Experience
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- Experience-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- Experience-Editable-End -->
@@ -38,6 +41,7 @@ ms.topic: reference
 <!-- AllowClipboardHistory-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting determines whether history of Clipboard contents can be stored in memory.
+
 - If you enable this policy setting, history of Clipboard contents are allowed to be stored.
 - If you disable this policy setting, history of Clipboard contents are not allowed to be stored.
 Policy change takes effect immediately.
@@ -346,7 +350,7 @@ When Find My Device is off, the device and its location are not registered and t
 
 <!-- AllowManualMDMUnenrollment-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e. g. auto-enrolled), then disabling the MDM unenrollment has no effect
+Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e. g. auto-enrolled), then disabling the MDM unenrollment has no effect.
 
 > [!NOTE]
 > The MDM server can always remotely delete the account. Most restricted value is 0.
@@ -447,7 +451,7 @@ This policy is deprecated.
 
 <!-- AllowScreenCapture-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allow screen capture
+Allow screen capture.
 <!-- AllowScreenCapture-Description-End -->
 
 <!-- AllowScreenCapture-Editable-Begin -->
@@ -598,6 +602,7 @@ Allow SIM error dialog prompts when no SIM is inserted.
 <!-- AllowSpotlightCollection-Description-Begin -->
 <!-- Description-Source-DDF -->
 Specifies whether Spotlight collection is allowed as a Personalization->Background Setting.
+
 - If you enable this policy setting, Spotlight collection will show as an option in the user's Personalization Settings, and the user will be able to get daily images from Microsoft displayed on their desktop.
 - If you disable this policy setting, Spotlight collection will not show as an option in Personalization Settings, and the user will not have the choice of getting Microsoft daily images shown on their desktop.
 <!-- AllowSpotlightCollection-Description-End -->
@@ -708,8 +713,9 @@ Allows or disallows all Windows sync settings on the device. For information abo
 <!-- AllowTailoredExperiencesWithDiagnosticData-Description-Begin -->
 <!-- Description-Source-DDF -->
 This policy allows you to prevent Windows from using diagnostic data to provide customized experiences to the user.
+
 - If you enable this policy setting, Windows will not use diagnostic data from this device to customize content shown on the lock screen, Windows tips, Microsoft consumer features, or other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant.
-- If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value
+- If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value.
 
 > [!NOTE]
 > This setting does not control Cortana cutomized experiences because there are separate policies to configure it. Most restricted value is 0.
@@ -1009,6 +1015,7 @@ Prior to Windows 10, version 1803, this policy had User scope. This policy allow
 <!-- AllowWindowsSpotlight-Description-Begin -->
 <!-- Description-Source-DDF -->
 Specifies whether to turn off all Windows spotlight features at once.
+
 - If you enable this policy setting, Windows spotlight on lock screen, Windows Tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices.
 - If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings. Most restricted value is 0.
 <!-- AllowWindowsSpotlight-Description-End -->
@@ -1074,6 +1081,7 @@ Specifies whether to turn off all Windows spotlight features at once.
 <!-- AllowWindowsSpotlightOnActionCenter-Description-Begin -->
 <!-- Description-Source-DDF -->
 This policy allows administrators to prevent Windows spotlight notifications from being displayed in the Action Center.
+
 - If you enable this policy, Windows spotlight notifications will no longer be displayed in the Action Center.
 - If you disable or do not configure this policy, Microsoft may display notifications in the Action Center that will suggest apps or features to help users be more productive on Windows. Most restricted value is 0.
 <!-- AllowWindowsSpotlightOnActionCenter-Description-End -->
@@ -1203,6 +1211,7 @@ This policy allows IT admins to turn off Suggestions in Settings app. These sugg
 <!-- AllowWindowsSpotlightWindowsWelcomeExperience-Description-Begin -->
 <!-- Description-Source-DDF -->
 This policy setting lets you turn off the Windows spotlight Windows welcome experience feature. The Windows welcome experience feature introduces onboard users to Windows; for example, launching Microsoft Edge with a webpage that highlights new features.
+
 - If you enable this policy, the Windows welcome experience will no longer be displayed when there are updates and changes to Windows and its apps.
 - If you disable or do not configure this policy, the Windows welcome experience will be launched to inform onboard users about what's new, changed, and suggested. Most restricted value is 0.
 <!-- AllowWindowsSpotlightWindowsWelcomeExperience-Description-End -->
@@ -1318,6 +1327,9 @@ Enables or disables Windows Tips / soft landing.
 <!-- ConfigureChatIcon-Begin -->
 ## ConfigureChatIcon
 
+> [!NOTE]
+> This policy is deprecated and may be removed in a future release.
+
 <!-- ConfigureChatIcon-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
@@ -1331,8 +1343,16 @@ Enables or disables Windows Tips / soft landing.
 <!-- ConfigureChatIcon-OmaUri-End -->
 
 <!-- ConfigureChatIcon-Description-Begin -->
-<!-- Description-Source-DDF -->
-Configures the Chat icon on the taskbar
+<!-- Description-Source-ADMX -->
+This policy setting allows you to configure the Chat icon on the taskbar.
+
+- If you enable this policy setting and set it to Show, the Chat icon will be displayed on the taskbar by default. Users can show or hide it in Settings.
+
+- If you enable this policy setting and set it to Hide, the Chat icon will be hidden by default. Users can show or hide it in Settings.
+
+- If you enable this policy setting and set it to Disabled, the Chat icon will not be displayed, and users cannot show or hide it in Settings.
+
+- If you disable or do not configure this policy setting, the Chat icon will be configured according to the defaults for your Windows edition.
 <!-- ConfigureChatIcon-Description-End -->
 
 <!-- ConfigureChatIcon-Editable-Begin -->
@@ -1369,7 +1389,7 @@ Configures the Chat icon on the taskbar
 |:--|:--|
 | Name | ConfigureChatIcon |
 | Friendly Name | Configures the Chat icon on the taskbar |
-| Element Name | State |
+| Element Name | State. |
 | Location | Computer Configuration |
 | Path | Windows Components > Chat |
 | Registry Key Name | Software\Policies\Microsoft\Windows\Windows Chat |
@@ -1410,7 +1430,7 @@ Additionally, if you check the "Include content from Enterprise spotlight" check
 - If you do not configure this policy, Windows spotlight will be available on the lock screen and will be selected by default, unless you have configured another default lock screen image using the "Force a specific default lock screen and logon image" policy.
 
 > [!NOTE]
-> This policy is only available for Enterprise SKUs
+> This policy is only available for Enterprise SKUs.
 <!-- ConfigureWindowsSpotlightOnLockScreen-Description-End -->
 
 <!-- ConfigureWindowsSpotlightOnLockScreen-Editable-Begin -->
@@ -1593,6 +1613,55 @@ This policy setting lets you turn off cloud consumer account state content in al
 
 <!-- DisableConsumerAccountStateContent-End -->
 
+<!-- DisableTextTranslation-Begin -->
+## DisableTextTranslation
+
+<!-- DisableTextTranslation-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- DisableTextTranslation-Applicability-End -->
+
+<!-- DisableTextTranslation-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Experience/DisableTextTranslation
+```
+<!-- DisableTextTranslation-OmaUri-End -->
+
+<!-- DisableTextTranslation-Description-Begin -->
+<!-- Description-Source-DDF -->
+Allows Text Translation feature to be enabled/disabled.
+<!-- DisableTextTranslation-Description-End -->
+
+<!-- DisableTextTranslation-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- DisableTextTranslation-Editable-End -->
+
+<!-- DisableTextTranslation-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- DisableTextTranslation-DFProperties-End -->
+
+<!-- DisableTextTranslation-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Enable Text Translation. |
+| 1 | Disable Text Translation. |
+<!-- DisableTextTranslation-AllowedValues-End -->
+
+<!-- DisableTextTranslation-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- DisableTextTranslation-Examples-End -->
+
+<!-- DisableTextTranslation-End -->
+
 <!-- DoNotShowFeedbackNotifications-Begin -->
 ## DoNotShowFeedbackNotifications
 
@@ -1682,7 +1751,7 @@ This policy setting allows an organization to prevent its devices from showing f
 <!-- Description-Source-ADMX -->
 Prevent the "browser" group from syncing to and from this PC. This turns off and disables the "browser" group on the "sync your settings" page in PC settings. The "browser" group contains settings and info like history and favorites.
 
-- If you enable this policy setting, the "browser" group, including info like history and favorites, will not be synced.
+If you enable this policy setting, the "browser" group, including info like history and favorites, will not be synced.
 
 Use the option "Allow users to turn browser syncing on" so that syncing is turned off by default but not disabled.
 
@@ -1767,8 +1836,7 @@ _**Turn syncing off by default but don’t disable**_
 
 <!-- EnableOrganizationalMessages-Description-Begin -->
 <!-- Description-Source-DDF -->
-Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Intune. By default, this policy is disabled.
-- If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences.
+Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Endpoint Manager. By default, this policy is disabled. If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences.
 <!-- EnableOrganizationalMessages-Description-End -->
 
 <!-- EnableOrganizationalMessages-Editable-Begin -->
@@ -1901,6 +1969,7 @@ _**Prevent syncing of browser settings and let users turn on syncing**_
 <!-- ShowLockOnUserTile-Description-Begin -->
 <!-- Description-Source-ADMX -->
 Shows or hides lock from the user tile menu.
+
 - If you enable this policy setting, the lock option will be shown in the User Tile menu.
 
 - If you disable this policy setting, the lock option will never be shown in the User Tile menu.
diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md
index e1291d1cb0..8a44d2c7e1 100644
--- a/windows/client-management/mdm/policy-csp-exploitguard.md
+++ b/windows/client-management/mdm/policy-csp-exploitguard.md
@@ -4,7 +4,7 @@ description: Learn more about the ExploitGuard Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -60,7 +60,7 @@ Enables the IT admin to push out a configuration representing the desired system
 |:--|:--|
 | Name | ExploitProtection_Name |
 | Friendly Name | Use a common set of exploit protection settings |
-| Element Name | Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file |
+| Element Name | Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file. |
 | Location | Computer Configuration |
 | Path | Windows Components > Microsoft Defender Exploit Guard > Exploit Protection |
 | Registry Key Name | Software\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection |
diff --git a/windows/client-management/mdm/policy-csp-federatedauthentication.md b/windows/client-management/mdm/policy-csp-federatedauthentication.md
index 41e2f19ab9..85326a86f9 100644
--- a/windows/client-management/mdm/policy-csp-federatedauthentication.md
+++ b/windows/client-management/mdm/policy-csp-federatedauthentication.md
@@ -4,7 +4,7 @@ description: Learn more about the FederatedAuthentication Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- EnableWebSignInForPrimaryUser-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies whether web-based sign-in is enabled with the Primary User experience
+Specifies whether web-based sign-in is enabled with the Primary User experience.
 <!-- EnableWebSignInForPrimaryUser-Description-End -->
 
 <!-- EnableWebSignInForPrimaryUser-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md
index 2a1b573428..66486d9057 100644
--- a/windows/client-management/mdm/policy-csp-humanpresence.md
+++ b/windows/client-management/mdm/policy-csp-humanpresence.md
@@ -4,7 +4,7 @@ description: Learn more about the HumanPresence Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,10 +16,249 @@ ms.topic: reference
 <!-- HumanPresence-Begin -->
 # Policy CSP - HumanPresence
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- HumanPresence-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- HumanPresence-Editable-End -->
 
+<!-- ForceAllowDimWhenExternalDisplayConnected-Begin -->
+## ForceAllowDimWhenExternalDisplayConnected
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- ForceAllowDimWhenExternalDisplayConnected-Applicability-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowDimWhenExternalDisplayConnected
+```
+<!-- ForceAllowDimWhenExternalDisplayConnected-OmaUri-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-Description-Begin -->
+<!-- Description-Source-DDF -->
+Determines whether Allow Adaptive Dimming When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out.
+<!-- ForceAllowDimWhenExternalDisplayConnected-Description-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- ForceAllowDimWhenExternalDisplayConnected-Editable-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- ForceAllowDimWhenExternalDisplayConnected-DFProperties-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedUnchecked. |
+| 1 | ForcedChecked. |
+| 0 (Default) | DefaultToUserChoice. |
+<!-- ForceAllowDimWhenExternalDisplayConnected-AllowedValues-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForceAllowDimWhenExternalDisplayConnected |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+<!-- ForceAllowDimWhenExternalDisplayConnected-GpMapping-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- ForceAllowDimWhenExternalDisplayConnected-Examples-End -->
+
+<!-- ForceAllowDimWhenExternalDisplayConnected-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-Begin -->
+## ForceAllowLockWhenExternalDisplayConnected
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- ForceAllowLockWhenExternalDisplayConnected-Applicability-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowLockWhenExternalDisplayConnected
+```
+<!-- ForceAllowLockWhenExternalDisplayConnected-OmaUri-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-Description-Begin -->
+<!-- Description-Source-DDF -->
+Determines whether Allow Lock on Leave When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out.
+<!-- ForceAllowLockWhenExternalDisplayConnected-Description-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- ForceAllowLockWhenExternalDisplayConnected-Editable-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- ForceAllowLockWhenExternalDisplayConnected-DFProperties-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedUnchecked. |
+| 1 | ForcedChecked. |
+| 0 (Default) | DefaultToUserChoice. |
+<!-- ForceAllowLockWhenExternalDisplayConnected-AllowedValues-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForceAllowLockWhenExternalDisplayConnected |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+<!-- ForceAllowLockWhenExternalDisplayConnected-GpMapping-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- ForceAllowLockWhenExternalDisplayConnected-Examples-End -->
+
+<!-- ForceAllowLockWhenExternalDisplayConnected-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Begin -->
+## ForceAllowWakeWhenExternalDisplayConnected
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Applicability-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowWakeWhenExternalDisplayConnected
+```
+<!-- ForceAllowWakeWhenExternalDisplayConnected-OmaUri-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Description-Begin -->
+<!-- Description-Source-DDF -->
+Determines whether Allow Wake on Approach When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out.
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Description-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Editable-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- ForceAllowWakeWhenExternalDisplayConnected-DFProperties-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedUnchecked. |
+| 1 | ForcedChecked. |
+| 0 (Default) | DefaultToUserChoice. |
+<!-- ForceAllowWakeWhenExternalDisplayConnected-AllowedValues-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForceAllowWakeWhenExternalDisplayConnected |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+<!-- ForceAllowWakeWhenExternalDisplayConnected-GpMapping-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- ForceAllowWakeWhenExternalDisplayConnected-Examples-End -->
+
+<!-- ForceAllowWakeWhenExternalDisplayConnected-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-Begin -->
+## ForceDisableWakeWhenBatterySaverOn
+
+<!-- ForceDisableWakeWhenBatterySaverOn-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- ForceDisableWakeWhenBatterySaverOn-Applicability-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceDisableWakeWhenBatterySaverOn
+```
+<!-- ForceDisableWakeWhenBatterySaverOn-OmaUri-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-Description-Begin -->
+<!-- Description-Source-DDF -->
+Determines whether Disable Wake on Approach When Battery Saver On checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out.
+<!-- ForceDisableWakeWhenBatterySaverOn-Description-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- ForceDisableWakeWhenBatterySaverOn-Editable-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- ForceDisableWakeWhenBatterySaverOn-DFProperties-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 2 | ForcedUnchecked. |
+| 1 | ForcedChecked. |
+| 0 (Default) | DefaultToUserChoice. |
+<!-- ForceDisableWakeWhenBatterySaverOn-AllowedValues-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ForceDisableWakeWhenBatterySaverOn |
+| Path | Sensors > AT > WindowsComponents > HumanPresence |
+<!-- ForceDisableWakeWhenBatterySaverOn-GpMapping-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- ForceDisableWakeWhenBatterySaverOn-Examples-End -->
+
+<!-- ForceDisableWakeWhenBatterySaverOn-End -->
+
 <!-- ForceInstantDim-Begin -->
 ## ForceInstantDim
 
@@ -254,6 +493,7 @@ Determines the timeout for Lock on Leave forced by the MDM policy. The user will
 | 120 | TwoMinutes. |
 | 30 | ThirtySeconds. |
 | 10 | TenSeconds. |
+| 1 | Immediate. |
 | 0 (Default) | DefaultToUserChoice. |
 <!-- ForceLockTimeout-AllowedValues-End -->
 
diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md
index b60ae5ce2c..92fda2c42a 100644
--- a/windows/client-management/mdm/policy-csp-internetexplorer.md
+++ b/windows/client-management/mdm/policy-csp-internetexplorer.md
@@ -4,7 +4,7 @@ description: Learn more about the InternetExplorer Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -48,7 +48,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website.
 
-- If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes])
+- If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]).
 
 > [!NOTE]
 > This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.
@@ -577,7 +577,7 @@ This policy setting lets you decide whether users can turn on Enterprise Mode fo
 
 If you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports.
 
-- If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode.
+If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode.
 <!-- AllowEnterpriseModeFromToolsMenu-Description-End -->
 
 <!-- AllowEnterpriseModeFromToolsMenu-Editable-Begin -->
@@ -701,7 +701,7 @@ We recommend that you do not allow insecure fallback in order to prevent a man-i
 
 This policy does not affect which security protocols are enabled.
 
-- If you disable this policy, system defaults will be used.
+If you disable this policy, system defaults will be used.
 <!-- AllowFallbackToSSL3-Description-End -->
 
 <!-- AllowFallbackToSSL3-Editable-Begin -->
@@ -2098,23 +2098,23 @@ This policy setting allows you to manage whether Internet Explorer checks for di
 Enables you to configure up to three versions of Microsoft Edge to open a redirected site (in order of preference). Use this policy if your environment is configured to redirect sites from Internet Explorer 11 to Microsoft Edge. If any of the chosen versions are not installed on the device, that preference will be bypassed.
 
 If both the Windows Update for the next version of Microsoft Edge* and Microsoft Edge Stable channel are installed, the following behaviors occur:
-- If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior.
-- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where:
+  - If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior.
+  - If you enable this policy, you can configure redirected sites to open in up to three of the following channels where:
 1 = Microsoft Edge Stable
 2 = Microsoft Edge Beta version 77 or later
 3 = Microsoft Edge Dev version 77 or later
 4 = Microsoft Edge Canary version 77 or later
 
 If the Windows Update for the next version of Microsoft Edge* or Microsoft Edge Stable channel are not installed, the following behaviors occur:
-- If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior.
-- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where:
+  - If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior.
+  - If you enable this policy, you can configure redirected sites to open in up to three of the following channels where:
 0 = Microsoft Edge version 45 or earlier
 1 = Microsoft Edge Stable
 2 = Microsoft Edge Beta version 77 or later
 3 = Microsoft Edge Dev version 77 or later
 4 = Microsoft Edge Canary version 77 or later
 
-*For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see <https://go.microsoft.com/fwlink/?linkid=2102115>. This update applies only to Windows 10 version 1709 and higher.
+- For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see< https://go.microsoft.com/fwlink/?linkid=2102115>. This update applies only to Windows 10 version 1709 and higher.
 <!-- ConfigureEdgeRedirectChannel-Description-End -->
 
 <!-- ConfigureEdgeRedirectChannel-Editable-Begin -->
@@ -3160,8 +3160,8 @@ This policy setting controls whether to have background synchronization for feed
 This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
 
 - If you enable this policy setting, you must make one of the following choices:
-- Skip the First Run wizard, and go directly to the user's home page.
-- Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage.
+  - Skip the First Run wizard, and go directly to the user's home page.
+  - Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage.
 
 Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not available. The user's home page will display regardless of which option is chosen.
 
@@ -3616,13 +3616,13 @@ InPrivate Browsing prevents Internet Explorer from storing data about a user's b
 <!-- Description-Source-ADMX -->
 This policy lets you restrict launching of Internet Explorer as a standalone browser.
 
-- If you enable this policy, it
-- Prevents Internet Explorer 11 from launching as a standalone browser.
-- Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'.
-- Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.
-- Overrides any other policies that redirect to Internet Explorer 11.
+If you enable this policy, it:
+  - Prevents Internet Explorer 11 from launching as a standalone browser.
+  - Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'.
+  - Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.
+  - Overrides any other policies that redirect to Internet Explorer 11.
 
-If you disable, or don't configure this policy, all sites are opened using the current active browser settings
+If you disable, or don't configure this policy, all sites are opened using the current active browser settings.
 
 > [!NOTE]
 > Microsoft Edge Stable Channel must be installed for this policy to take effect.
@@ -4503,7 +4503,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T
 <!-- Description-Source-ADMX -->
 This policy setting lets admins enable extended Microsoft Edge Internet Explorer mode hotkeys, such as "Ctrl+S" to have "Save as" functionality.
 
-- If you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer.
+If you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer.
 
 If you disable, or don't configure this policy, extended hotkeys will not work in Internet Explorer mode.
 
@@ -5095,6 +5095,7 @@ This policy setting allows you to manage whether users can drag files or copy an
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -7256,6 +7257,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -7921,7 +7923,7 @@ This policy setting specifies whether JScript or JScript9Legacy is loaded for MS
 
 - If you disable this policy, then JScript will be utilized.
 
-If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript.
+- If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript.
 <!-- JScriptReplacement-Description-End -->
 
 <!-- JScriptReplacement-Editable-Begin -->
@@ -7990,10 +7992,10 @@ Prevents intranet sites from being opened in any browser except Internet Explore
 We strongly recommend keeping this policy in sync with the 'Send all intranet sites to Internet Explorer' ('SendIntranetToInternetExplorer') policy. Additionally, it's best to enable this policy only if your intranet sites have known compatibility problems with Microsoft Edge.
 
 Related policies:
-- Send all intranet sites to Internet Explorer ('SendIntranetToInternetExplorer')
-- Send all sites not included in the Enterprise Mode Site List to Microsoft Edge ('RestrictIE')
+  - Send all intranet sites to Internet Explorer ('SendIntranetToInternetExplorer')
+  - Send all sites not included in the Enterprise Mode Site List to Microsoft Edge ('RestrictIE')
 
-For more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see <https://go.microsoft.com/fwlink/?linkid=2094210>.
+For more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see< https://go.microsoft.com/fwlink/?linkid=2094210>.
 <!-- KeepIntranetSitesInInternetExplorer-Description-End -->
 
 <!-- KeepIntranetSitesInInternetExplorer-Editable-Begin -->
@@ -8272,6 +8274,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -9127,6 +9130,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -9988,6 +9992,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -10707,6 +10712,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -11497,6 +11503,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -12287,6 +12294,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -13399,7 +13407,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T
 <!-- Description-Source-ADMX -->
 This policy setting lets admins reset zoom to default for HTML dialogs in Internet Explorer mode.
 
-- If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page.
+If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page.
 
 If you disable, or don't configure this policy, the zoom of an HTML dialog in Internet Explorer mode will be set based on the zoom of it's parent page.
 
@@ -14051,6 +14059,7 @@ This policy setting allows you to manage whether file downloads are permitted fr
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
@@ -16414,7 +16423,7 @@ Internet Explorer allows scripts to programmatically open, resize, and repositio
 <!-- Description-Source-ADMX -->
 This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website.
 
-- If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers
+- If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers.
 
 > [!NOTE]
 > This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.
@@ -16895,6 +16904,7 @@ This policy setting determines whether users will be prompted for non user-initi
 This policy setting allows you to manage whether pages of the zone may download HTML fonts.
 
 - If you enable this policy setting, HTML fonts can be downloaded automatically.
+
 - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.
 
 - If you disable this policy setting, HTML fonts are prevented from downloading.
diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md
index 68f64fc6e5..870386a6e5 100644
--- a/windows/client-management/mdm/policy-csp-kerberos.md
+++ b/windows/client-management/mdm/policy-csp-kerberos.md
@@ -4,7 +4,7 @@ description: Learn more about the Kerberos Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -170,6 +170,7 @@ This policy setting allows retrieving the Azure AD Kerberos Ticket Granting Tick
 <!-- KerberosClientSupportsClaimsCompoundArmor-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features.
+
 - If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.
 
 - If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition.
@@ -241,7 +242,7 @@ This policy setting controls hash or checksum algorithms used by the Kerberos cl
 - "Not Supported" disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure.
 
 - If you disable or do not configure this policy, each algorithm will assume the "Default" state.
-More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at <https://go.microsoft.com/fwlink/?linkid=2169037>.
+More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at< https://go.microsoft.com/fwlink/?linkid=2169037>.
 
 Events generated by this configuration: 205, 206, 207, 208.
 <!-- PKInitHashAlgorithmConfiguration-Description-End -->
@@ -347,8 +348,13 @@ If you don't configure this policy, the SHA1 algorithm will assume the **Default
 
 | Name | Value |
 |:--|:--|
-| Name | PKInitHashAlgorithmSHA1 |
-| Path | Kerberos > AT > System > kerberos |
+| Name | PKInitHashAlgorithmConfiguration |
+| Friendly Name | Configure hash algorithms for certificate logon |
+| Location | Computer Configuration |
+| Path | System > Kerberos |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters |
+| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled |
+| ADMX File Name | Kerberos.admx |
 <!-- PKInitHashAlgorithmSHA1-GpMapping-End -->
 
 <!-- PKInitHashAlgorithmSHA1-Examples-Begin -->
@@ -415,8 +421,13 @@ If you don't configure this policy, the SHA256 algorithm will assume the **Defau
 
 | Name | Value |
 |:--|:--|
-| Name | PKInitHashAlgorithmSHA256 |
-| Path | Kerberos > AT > System > kerberos |
+| Name | PKInitHashAlgorithmConfiguration |
+| Friendly Name | Configure hash algorithms for certificate logon |
+| Location | Computer Configuration |
+| Path | System > Kerberos |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters |
+| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled |
+| ADMX File Name | Kerberos.admx |
 <!-- PKInitHashAlgorithmSHA256-GpMapping-End -->
 
 <!-- PKInitHashAlgorithmSHA256-Examples-Begin -->
@@ -483,8 +494,13 @@ If you don't configure this policy, the SHA384 algorithm will assume the **Defau
 
 | Name | Value |
 |:--|:--|
-| Name | PKInitHashAlgorithmSHA384 |
-| Path | Kerberos > AT > System > kerberos |
+| Name | PKInitHashAlgorithmConfiguration |
+| Friendly Name | Configure hash algorithms for certificate logon |
+| Location | Computer Configuration |
+| Path | System > Kerberos |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters |
+| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled |
+| ADMX File Name | Kerberos.admx |
 <!-- PKInitHashAlgorithmSHA384-GpMapping-End -->
 
 <!-- PKInitHashAlgorithmSHA384-Examples-Begin -->
@@ -551,8 +567,13 @@ If you don't configure this policy, the SHA512 algorithm will assume the **Defau
 
 | Name | Value |
 |:--|:--|
-| Name | PKInitHashAlgorithmSHA512 |
-| Path | Kerberos > AT > System > kerberos |
+| Name | PKInitHashAlgorithmConfiguration |
+| Friendly Name | Configure hash algorithms for certificate logon |
+| Location | Computer Configuration |
+| Path | System > Kerberos |
+| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters |
+| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled |
+| ADMX File Name | Kerberos.admx |
 <!-- PKInitHashAlgorithmSHA512-GpMapping-End -->
 
 <!-- PKInitHashAlgorithmSHA512-Examples-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md
index b425e49931..4ece74db51 100644
--- a/windows/client-management/mdm/policy-csp-licensing.md
+++ b/windows/client-management/mdm/policy-csp-licensing.md
@@ -4,7 +4,7 @@ description: Learn more about the Licensing Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -39,9 +39,9 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting controls whether OS Reactivation is blocked on a device.
 Policy Options:
-- Not Configured (default -- Windows registration and reactivation is allowed)
-- Disabled (Windows registration and reactivation is not allowed)
-- Enabled (Windows registration is allowed)
+  - Not Configured (default -- Windows registration and reactivation is allowed)
+  - Disabled (Windows registration and reactivation is not allowed)
+  - Enabled (Windows registration is allowed)
 <!-- AllowWindowsEntitlementReactivation-Description-End -->
 
 <!-- AllowWindowsEntitlementReactivation-Editable-Begin -->
@@ -105,11 +105,11 @@ Policy Options:
 <!-- DisallowKMSClientOnlineAVSValidation-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting lets you opt-out of sending KMS client activation data to Microsoft automatically. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
-- If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates.
+If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates.
 Policy Options:
-- Not Configured (default -- data will be automatically sent to Microsoft)
-- Disabled (data will be automatically sent to Microsoft)
-- Enabled (data will not be sent to Microsoft)
+  - Not Configured (default -- data will be automatically sent to Microsoft)
+  - Disabled (data will be automatically sent to Microsoft)
+  - Enabled (data will not be sent to Microsoft)
 <!-- DisallowKMSClientOnlineAVSValidation-Description-End -->
 
 <!-- DisallowKMSClientOnlineAVSValidation-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
index 075a1bd389..b85c550c26 100644
--- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
+++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
@@ -4,7 +4,7 @@ description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CS
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- LocalPoliciesSecurityOptions-Begin -->
 # Policy CSP - LocalPoliciesSecurityOptions
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- LocalPoliciesSecurityOptions-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 > [!NOTE]
@@ -39,8 +42,7 @@ ms.topic: reference
 
 <!-- Accounts_BlockMicrosoftAccounts-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. If you select the "Users can't add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system.
-- If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows.
+This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. If you select the "Users can't add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows.
 <!-- Accounts_BlockMicrosoftAccounts-Description-End -->
 
 <!-- Accounts_BlockMicrosoftAccounts-Editable-Begin -->
@@ -99,10 +101,10 @@ This policy setting prevents users from adding new Microsoft accounts on this co
 
 <!-- Accounts_EnableAdministratorAccountStatus-Description-Begin -->
 <!-- Description-Source-DDF -->
-This security setting determines whether the local Administrator account is enabled or disabled
+This security setting determines whether the local Administrator account is enabled or disabled.
 
 > [!NOTE]
-> If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default Disabled.
+> If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default: Disabled.
 <!-- Accounts_EnableAdministratorAccountStatus-Description-End -->
 
 <!-- Accounts_EnableAdministratorAccountStatus-Editable-Begin -->
@@ -160,10 +162,10 @@ This security setting determines whether the local Administrator account is enab
 
 <!-- Accounts_EnableGuestAccountStatus-Description-Begin -->
 <!-- Description-Source-DDF -->
-This security setting determines if the Guest account is enabled or disabled. Default Disabled
+This security setting determines if the Guest account is enabled or disabled. Default: Disabled.
 
 > [!NOTE]
-> If the Guest account is disabled and the security option Network Access Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail.
+> If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail.
 <!-- Accounts_EnableGuestAccountStatus-Description-End -->
 
 <!-- Accounts_EnableGuestAccountStatus-Editable-Begin -->
@@ -221,10 +223,10 @@ This security setting determines if the Guest account is enabled or disabled. De
 
 <!-- Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly-Description-Begin -->
 <!-- Description-Source-DDF -->
-Accounts Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. Default Enabled
+Accounts: Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. Default: Enabled.
 
 > [!WARNING]
-> Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services
+> Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services.
 
 > [!NOTE]
 > This setting does not affect logons that use domain accounts. It is possible for applications that use remote interactive logons to bypass this setting.
@@ -432,7 +434,7 @@ Devices: Allowed to format and eject removable media This security setting deter
 
 <!-- Devices_AllowUndockWithoutHavingToLogon-Description-Begin -->
 <!-- Description-Source-DDF -->
-Devices Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default Enabled
+Devices: Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default: Enabled.
 
 > [!CAUTION]
 > Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable.
@@ -494,6 +496,7 @@ Devices Allow undock without having to log on This security setting determines w
 <!-- Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters-Description-Begin -->
 <!-- Description-Source-DDF -->
 Devices: Prevent users from installing printer drivers when connecting to shared printers For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer.
+
 - If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer.
 - If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. Default on servers: Enabled. Default on workstations: Disabled Notes This setting does not affect the ability to add a local printer. This setting does not affect Administrators.
 <!-- Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters-Description-End -->
@@ -986,10 +989,10 @@ Interactive logon: Message title for users attempting to log on This security se
 
 <!-- InteractiveLogon_SmartCardRemovalBehavior-Description-Begin -->
 <!-- Description-Source-DDF -->
-Interactive logon Smart card removal behavior This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. The options are No Action Lock Workstation Force Logoff Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation
+Interactive logon: Smart card removal behavior This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. The options are: No Action Lock Workstation Force Logoff Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation.
 
 > [!NOTE]
-> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default This policy is not defined, which means that the system treats it as No action. On Windows Vista and above For this setting to work, the Smart Card Removal Policy service must be started.
+> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default: This policy is not defined, which means that the system treats it as No action. On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started.
 <!-- InteractiveLogon_SmartCardRemovalBehavior-Description-End -->
 
 <!-- InteractiveLogon_SmartCardRemovalBehavior-Editable-Begin -->
@@ -1049,14 +1052,16 @@ Interactive logon Smart card removal behavior This security setting determines w
 
 <!-- MicrosoftNetworkClient_DigitallySignCommunicationsAlways-Description-Begin -->
 <!-- Description-Source-DDF -->
-Microsoft network client Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB client component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted.
-- If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. Default Disabled
+Microsoft network client: Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB client component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted.
+
+- If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing.
+- If this policy is disabled, SMB packet signing is negotiated between the client and server. Default: Disabled.
 
 > [!IMPORTANT]
-> For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client Digitally sign communications (if server agrees)
+> For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees).
 
 > [!NOTE]
-> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. For more information, reference <https//go.microsoft.com/fwlink/?LinkID=787136>.
+> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
 <!-- MicrosoftNetworkClient_DigitallySignCommunicationsAlways-Description-End -->
 
 <!-- MicrosoftNetworkClient_DigitallySignCommunicationsAlways-Editable-Begin -->
@@ -1114,11 +1119,13 @@ Microsoft network client Digitally sign communications (always) This security se
 
 <!-- MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees-Description-Begin -->
 <!-- Description-Source-DDF -->
-Microsoft network client Digitally sign communications (if server agrees) This security setting determines whether the SMB client attempts to negotiate SMB packet signing. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server.
-- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default Enabled
+Microsoft network client: Digitally sign communications (if server agrees) This security setting determines whether the SMB client attempts to negotiate SMB packet signing. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server.
+
+- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated.
+- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default: Enabled.
 
 > [!NOTE]
-> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference <https//go.microsoft.com/fwlink/?LinkID=787136>.
+> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
 <!-- MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees-Description-End -->
 
 <!-- MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees-Editable-Begin -->
@@ -1234,15 +1241,16 @@ Microsoft network client: Send unencrypted password to connect to third-party SM
 
 <!-- MicrosoftNetworkServer_DigitallySignCommunicationsAlways-Description-Begin -->
 <!-- Description-Source-DDF -->
-Microsoft network server Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB server component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted.
+Microsoft network server: Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB server component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted.
+
 - If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing.
-- If this setting is disabled, SMB packet signing is negotiated between the client and server. Default Disabled for member servers. Enabled for domain controllers
+- If this setting is disabled, SMB packet signing is negotiated between the client and server. Default: Disabled for member servers. Enabled for domain controllers.
 
 > [!NOTE]
-> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors
+> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors.
 
 > [!IMPORTANT]
-> For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy Microsoft network server Digitally sign communications (if server agrees) For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature For more information, reference <https//go.microsoft.com/fwlink/?LinkID=787136>.
+> For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: Microsoft network server: Digitally sign communications (if server agrees) For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
 <!-- MicrosoftNetworkServer_DigitallySignCommunicationsAlways-Description-End -->
 
 <!-- MicrosoftNetworkServer_DigitallySignCommunicationsAlways-Editable-Begin -->
@@ -1300,11 +1308,13 @@ Microsoft network server Digitally sign communications (always) This security se
 
 <!-- MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees-Description-Begin -->
 <!-- Description-Source-DDF -->
-Microsoft network server Digitally sign communications (if client agrees) This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it.
-- If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default Enabled on domain controllers only
+Microsoft network server: Digitally sign communications (if client agrees) This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it.
+
+- If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated.
+- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default: Enabled on domain controllers only.
 
 > [!IMPORTANT]
-> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000 HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference <https//go.microsoft.com/fwlink/?LinkID=787136>.
+> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>.
 <!-- MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees-Description-End -->
 
 <!-- MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees-Editable-Begin -->
@@ -1362,7 +1372,8 @@ Microsoft network server Digitally sign communications (if client agrees) This s
 
 <!-- NetworkAccess_AllowAnonymousSIDOrNameTranslation-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network access: Allow anonymous SID/name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user. If this policy is enabled, an anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects both the SID-to-name translation as well as the name-to-SID translation.
+Network access: Allow anonymous SID/name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user.
+- If this policy is enabled, an anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects both the SID-to-name translation as well as the name-to-SID translation.
 - If this policy setting is disabled, an anonymous user cannot request the SID attribute for another user. Default on workstations and member servers: Disabled. Default on domain controllers running Windows Server 2008 or later: Disabled. Default on domain controllers running Windows Server 2003 R2 or earlier: Enabled.
 <!-- NetworkAccess_AllowAnonymousSIDOrNameTranslation-Description-End -->
 
@@ -1421,7 +1432,7 @@ Network access: Allow anonymous SID/name translation This policy setting determi
 
 <!-- NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network access Do not allow anonymous enumeration of SAM accounts This security setting determines what additional permissions will be granted for anonymous connections to the computer. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. This security option allows additional restrictions to be placed on anonymous connections as follows Enabled Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. Disabled No additional restrictions. Rely on default permissions. Default on workstations Enabled. Default on serverEnabled
+Network access: Do not allow anonymous enumeration of SAM accounts This security setting determines what additional permissions will be granted for anonymous connections to the computer. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. This security option allows additional restrictions to be placed on anonymous connections as follows: Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. Disabled: No additional restrictions. Rely on default permissions. Default on workstations: Enabled. Default on server:Enabled.
 
 > [!IMPORTANT]
 > This policy has no impact on domain controllers.
@@ -1646,9 +1657,10 @@ Network access: Restrict clients allowed to make remote calls to SAM This policy
 
 <!-- NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security Allow Local System to use computer identity for NTLM This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication.
+Network security: Allow Local System to use computer identity for NTLM This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication.
+
 - If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.
-- If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. By default, this policy is enabled on Windows 7 and above. By default, this policy is disabled on Windows Vista. This policy is supported on at least Windows Vista or Windows Server 2008
+- If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. By default, this policy is enabled on Windows 7 and above. By default, this policy is disabled on Windows Vista. This policy is supported on at least Windows Vista or Windows Server 2008.
 
 > [!NOTE]
 > Windows Vista or Windows Server 2008 do not expose this setting in Group Policy.
@@ -1772,7 +1784,7 @@ Network security: Allow PKU2U authentication requests to this computer to use on
 
 <!-- NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security Do not store LAN Manager hash value on next password change This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. Default on Windows Vista and above Enabled Default on Windows XP Disabled
+Network security: Do not store LAN Manager hash value on next password change This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. Default on Windows Vista and above: Enabled Default on Windows XP: Disabled.
 
 > [!IMPORTANT]
 > Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98.
@@ -1833,7 +1845,7 @@ Network security Do not store LAN Manager hash value on next password change Thi
 
 <!-- NetworkSecurity_ForceLogoffWhenLogonHoursExpire-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security Force logoff when logon hours expire This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired. Default Enabled
+Network security: Force logoff when logon hours expire This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired. Default: Enabled.
 
 > [!NOTE]
 > This security setting behaves as an account policy. For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy object (GPO), even if there is a different account policy applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (for example, member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be different from the domain account policy by defining an account policy for the organizational unit that contains the member computers. Kerberos settings are not applied to member computers.
@@ -1894,10 +1906,10 @@ Network security Force logoff when logon hours expire This security setting dete
 
 <!-- NetworkSecurity_LANManagerAuthenticationLevel-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows Send LM and NTLM responses Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send LM and NTLM - use NTLMv2 session security if negotiated Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLM response only Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only\refuse LM Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). Send NTLMv2 response only\refuse LM and NTLM Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication)
+Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication).
 
 > [!IMPORTANT]
-> This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. Default Windows 2000 and windows XP send LM and NTLM responses Windows Server 2003 Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 Send NTLMv2 response only
+> This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. Default: Windows 2000 and windows XP: send LM and NTLM responses Windows Server 2003: Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only.
 <!-- NetworkSecurity_LANManagerAuthenticationLevel-Description-End -->
 
 <!-- NetworkSecurity_LANManagerAuthenticationLevel-Editable-Begin -->
@@ -1959,7 +1971,7 @@ Network security LAN Manager authentication level This security setting determin
 
 <!-- NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption
+Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption.
 <!-- NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients-Description-End -->
 
 <!-- NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients-Editable-Begin -->
@@ -2019,7 +2031,7 @@ Network security: Minimum session security for NTLM SSP based (including secure
 
 <!-- NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption
+Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption.
 <!-- NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers-Description-End -->
 
 <!-- NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers-Editable-Begin -->
@@ -2079,7 +2091,8 @@ Network security: Minimum session security for NTLM SSP based (including secure
 
 <!-- NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication.
+Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured.
+- If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication.
 - If you do not configure this policy setting, no exceptions will be applied. The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character.
 <!-- NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication-Description-End -->
 
@@ -2129,7 +2142,7 @@ Network security: Restrict NTLM: Add remote server exceptions for NTLM authentic
 
 <!-- NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security Restrict NTLM Audit Incoming NTLM Traffic This policy setting allows you to audit incoming NTLM traffic. If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security Restrict NTLM Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security Restrict NTLM Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. This policy is supported on at least Windows 7 or Windows Server 2008 R2
+Network security: Restrict NTLM: Audit Incoming NTLM Traffic This policy setting allows you to audit incoming NTLM traffic. If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. This policy is supported on at least Windows 7 or Windows Server 2008 R2.
 
 > [!NOTE]
 > Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM.
@@ -2191,7 +2204,7 @@ Network security Restrict NTLM Audit Incoming NTLM Traffic This policy setting a
 
 <!-- NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security Restrict NTLM Incoming NTLM traffic This policy setting allows you to deny or allow incoming NTLM traffic. If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. This policy is supported on at least Windows 7 or Windows Server 2008 R2
+Network security: Restrict NTLM: Incoming NTLM traffic This policy setting allows you to deny or allow incoming NTLM traffic. If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. This policy is supported on at least Windows 7 or Windows Server 2008 R2.
 
 > [!NOTE]
 > Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM.
@@ -2253,7 +2266,7 @@ Network security Restrict NTLM Incoming NTLM traffic This policy setting allows
 
 <!-- NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers-Description-Begin -->
 <!-- Description-Source-DDF -->
-Network security Restrict NTLM Outgoing NTLM traffic to remote servers This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security Restrict NTLM Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. This policy is supported on at least Windows 7 or Windows Server 2008 R2
+Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. This policy is supported on at least Windows 7 or Windows Server 2008 R2.
 
 > [!NOTE]
 > Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM.
@@ -2373,8 +2386,7 @@ Shutdown: Allow system to be shut down without having to log on This security se
 
 <!-- Shutdown_ClearVirtualMemoryPageFile-Description-Begin -->
 <!-- Description-Source-DDF -->
-Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown.
-- If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled.
+Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled.
 <!-- Shutdown_ClearVirtualMemoryPageFile-Description-End -->
 
 <!-- Shutdown_ClearVirtualMemoryPageFile-Editable-Begin -->
@@ -2490,10 +2502,10 @@ User Account Control: Allow UIAccess applications to prompt for elevation withou
 
 <!-- UserAccountControl_BehaviorOfTheElevationPromptForAdministrators-Description-Begin -->
 <!-- Description-Source-DDF -->
-User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are - Elevate without prompting Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials
+User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are: - Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials.
 
 > [!NOTE]
-> Use this option only in the most constrained environments. - Prompt for credentials on the secure desktop When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for consent for non-Windows binaries (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
+> Use this option only in the most constrained environments. - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege.
 <!-- UserAccountControl_BehaviorOfTheElevationPromptForAdministrators-Description-End -->
 
 <!-- UserAccountControl_BehaviorOfTheElevationPromptForAdministrators-Editable-Begin -->
@@ -2788,7 +2800,7 @@ User Account Control: Only elevate UIAccess applications that are installed in s
 
 <!-- UserAccountControl_RunAllAdministratorsInAdminApprovalMode-Description-Begin -->
 <!-- Description-Source-DDF -->
-User Account Control Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are - Enabled (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - Disabled Admin Approval Mode and all related UAC policy settings are disabled
+User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are: - Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - Disabled: Admin Approval Mode and all related UAC policy settings are disabled.
 
 > [!NOTE]
 > If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced.
diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md
index f2cfa06fb3..bf0872d969 100644
--- a/windows/client-management/mdm/policy-csp-localusersandgroups.md
+++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md
@@ -4,7 +4,7 @@ description: Learn more about the LocalUsersAndGroups Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,10 +37,16 @@ ms.topic: reference
 
 <!-- Configure-Description-Begin -->
 <!-- Description-Source-DDF -->
-This Setting allows an administrator to manage local groups on a Device. Possible settings:
+This Setting allows an administrator to manage local groups on a Device.
+Possible settings:
 
-1. Update Group Membership Update a group and add and/or remove members though the 'U' action. When using Update, existing group members that are not specified in the policy remain untouched.
-2. Replace Group Membership Restrict a group by replacing group membership through the 'R' action. When using Replace, existing group membership is replaced by the list of members specified in the add member section. This option works in the same way as a Restricted Group and any group members that are not specified in the policy are removed.
+1. Update Group Membership: Update a group and add and/or remove members though the 'U' action.
+When using Update, existing group members that are not specified in the policy remain untouched.
+
+2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action.
+When using Replace, existing group membership is replaced by the list of members specified in
+the add member section. This option works in the same way as a Restricted Group and any group
+members that are not specified in the policy are removed.
 
 > [!CAUTION]
 > If the same group is configured with both Replace and Update, then Replace will win.
diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md
index ee17cf4ab6..c4a07c645d 100644
--- a/windows/client-management/mdm/policy-csp-multitasking.md
+++ b/windows/client-management/mdm/policy-csp-multitasking.md
@@ -4,7 +4,7 @@ description: Learn more about the Multitasking Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,8 +36,12 @@ ms.topic: reference
 <!-- BrowserAltTabBlowout-OmaUri-End -->
 
 <!-- BrowserAltTabBlowout-Description-Begin -->
-<!-- Description-Source-DDF -->
-Configures the inclusion of Microsoft Edge tabs into Alt-Tab.
+<!-- Description-Source-ADMX -->
+This setting controls the inclusion of Microsoft Edge tabs into Alt+Tab.
+
+This can be set to show all tabs, the most recent 3 or 5 tabs, or no tabs from Microsoft Edge.
+
+If this is set to show "Open windows only", the whole feature will be disabled.
 <!-- BrowserAltTabBlowout-Description-End -->
 
 <!-- BrowserAltTabBlowout-Editable-Begin -->
@@ -77,9 +81,13 @@ This policy only applies to the Alt+Tab switcher. When the policy isn't enabled,
 
 | Name | Value |
 |:--|:--|
-| Name | MultiTaskingAltTabFilter |
-| Path | multitasking > AT > WindowsComponents > MULTITASKING |
-| Element Name | AltTabFilterDropdown |
+| Name | BrowserAltTabBlowout |
+| Friendly Name | Configure the inclusion of Microsoft Edge tabs into Alt-Tab |
+| Element Name | Pressing Alt + Tab shows. |
+| Location | User Configuration |
+| Path | Windows Components > Multitasking |
+| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer |
+| ADMX File Name | Multitasking.admx |
 <!-- BrowserAltTabBlowout-GpMapping-End -->
 
 <!-- BrowserAltTabBlowout-Examples-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md
index 2805dfa3b0..ec7813abdb 100644
--- a/windows/client-management/mdm/policy-csp-networkisolation.md
+++ b/windows/client-management/mdm/policy-csp-networkisolation.md
@@ -4,7 +4,7 @@ description: Learn more about the NetworkIsolation Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,8 +36,18 @@ ms.topic: reference
 <!-- EnterpriseCloudResources-OmaUri-End -->
 
 <!-- EnterpriseCloudResources-Description-Begin -->
-<!-- Description-Source-DDF -->
-Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, `<cloudresource>`|`<cloudresource>`|`<cloudresource>`,`<proxy>`|`<cloudresource>`|`<cloudresource>`,`<proxy>`|.
+<!-- Description-Source-ADMX -->
+This setting does not apply to desktop apps.
+
+A pipe-separated list of domain cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address.
+
+Contains a list of Enterprise resource domains hosted in the cloud. Connections to these resources are considered connections to enterprise networks.
+
+If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the Intranet proxy servers for apps policy.
+
+Example: [cloudresource]|[cloudresource]|[cloudresource],[proxy]|[cloudresource]|[cloudresource],[proxy]|
+
+For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 <!-- EnterpriseCloudResources-Description-End -->
 
 <!-- EnterpriseCloudResources-Editable-Begin -->
@@ -61,7 +71,7 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to
 |:--|:--|
 | Name | WF_NetIsolation_EnterpriseCloudResources |
 | Friendly Name | Enterprise resource domains hosted in the cloud |
-| Element Name | Enterprise cloud resources |
+| Element Name | Enterprise cloud resources. |
 | Location | Computer Configuration |
 | Path | Network > Network Isolation |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation |
@@ -90,8 +100,20 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to
 <!-- EnterpriseInternalProxyServers-OmaUri-End -->
 
 <!-- EnterpriseInternalProxyServers-Description-Begin -->
-<!-- Description-Source-DDF -->
-This is the comma-separated list of internal proxy servers. For example 157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseCloudResources policy to force traffic to the matched cloud resources through these proxies.
+<!-- Description-Source-ADMX -->
+This setting does not apply to desktop apps.
+
+A semicolon-separated list of intranet proxy server IP addresses. These addresses are categorized as private by Windows Network Isolation and are accessible to apps that have the Home/Work Networking capability.
+
+- If you enable this policy setting, it allows an administrator to configure a set of proxies that provide access to intranet resources.
+
+- If you disable or do not configure this policy setting, Windows Network Isolation attempts to discover proxies and configures them as Internet nodes.
+
+This setting should NOT be used to configure Internet proxies.
+
+Example: [3efe:3022::1000]; 18.0.0.1; 18.0.0.2
+
+For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 <!-- EnterpriseInternalProxyServers-Description-End -->
 
 <!-- EnterpriseInternalProxyServers-Editable-Begin -->
@@ -115,7 +137,7 @@ This is the comma-separated list of internal proxy servers. For example 157.54.1
 |:--|:--|
 | Name | WF_NetIsolation_Intranet_Proxies |
 | Friendly Name | Intranet proxy servers for  apps |
-| Element Name | Type a proxy server IP address for the intranet |
+| Element Name | Type a proxy server IP address for the intranet. |
 | Location | Computer Configuration |
 | Path | Network > Network Isolation |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation |
@@ -144,8 +166,22 @@ This is the comma-separated list of internal proxy servers. For example 157.54.1
 <!-- EnterpriseIPRange-OmaUri-End -->
 
 <!-- EnterpriseIPRange-Description-Begin -->
-<!-- Description-Source-DDF -->
-Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges.
+<!-- Description-Source-ADMX -->
+This setting does not apply to desktop apps.
+
+A comma-separated list of IP address ranges that are in your corporate network.
+
+- If you enable this policy setting, it ensures that apps with the Home/Work Networking capability have appropriate access to your corporate network. These addresses are only accessible to apps if and only if the app has declared the Home/Work Networking capability.
+
+Windows Network Isolation attempts to automatically discover private network hosts. By default, the addresses configured with this policy setting are merged with the hosts that are declared as private through automatic discovery.
+
+To ensure that these addresses are the only addresses ever classified as private, enable the "Subnet definitions are authoritative" policy setting.
+
+- If you disable or do not configure this policy setting, Windows Network Isolation attempts to automatically discover your private network hosts.
+
+Example: 3efe:1092::/96,18.1.1.1/10
+
+For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 <!-- EnterpriseIPRange-Description-End -->
 
 <!-- EnterpriseIPRange-Editable-Begin -->
@@ -169,7 +205,7 @@ Sets the enterprise IP ranges that define the computers in the enterprise networ
 |:--|:--|
 | Name | WF_NetIsolation_PrivateSubnet |
 | Friendly Name | Private network ranges for  apps |
-| Element Name | Private subnets |
+| Element Name | Private subnets. |
 | Location | Computer Configuration |
 | Path | Network > Network Isolation |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation |
@@ -280,10 +316,10 @@ For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 
 <!-- EnterpriseNetworkDomainNames-Description-Begin -->
 <!-- Description-Source-DDF -->
-This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example contoso. sharepoint. com, Fabrikam. com
+This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example contoso. sharepoint. com, Fabrikam. com.
 
 > [!NOTE]
-> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. Here are the steps to create canonical domain namesTransform the ASCII characters (A-Z only) to lower case. For example, Microsoft. COM -> microsoft. com. Call IdnToAscii with IDN_USE_STD3_ASCII_RULES as the flags. Call IdnToUnicode with no flags set (dwFlags = 0).
+> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. Here are the steps to create canonical domain names:Transform the ASCII characters (A-Z only) to lower case. For example, Microsoft. COM -> microsoft. com. Call IdnToAscii with IDN_USE_STD3_ASCII_RULES as the flags. Call IdnToUnicode with no flags set (dwFlags = 0).
 <!-- EnterpriseNetworkDomainNames-Description-End -->
 
 <!-- EnterpriseNetworkDomainNames-Editable-Begin -->
@@ -327,8 +363,18 @@ For more information, see the following APIs:
 <!-- EnterpriseProxyServers-OmaUri-End -->
 
 <!-- EnterpriseProxyServers-Description-Begin -->
-<!-- Description-Source-DDF -->
-This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example 157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59.
+<!-- Description-Source-ADMX -->
+This setting does not apply to desktop apps.
+
+A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities.
+
+- If you enable this policy setting, apps on proxied networks can access the Internet without relying on the Private Network capability. However, in most situations Windows Network Isolation will be able to correctly discover proxies. By default, any proxies configured with this setting are merged with proxies that are auto-discovered. To make this policy configuration the sole list of allowed proxies, enable the "Proxy definitions are authoritative" setting.
+
+- If you disable or do not configure this policy setting, apps will use the Internet proxies auto-discovered by Windows Network Isolation.
+
+Example: [3efe:3022::1000];18.0.0.1;18.0.0.2
+
+For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 <!-- EnterpriseProxyServers-Description-End -->
 
 <!-- EnterpriseProxyServers-Editable-Begin -->
@@ -352,7 +398,7 @@ This is a comma-separated list of proxy servers. Any server on this list is cons
 |:--|:--|
 | Name | WF_NetIsolation_Domain_Proxies |
 | Friendly Name | Internet proxy servers for apps |
-| Element Name | Domain Proxies |
+| Element Name | Domain Proxies. |
 | Location | Computer Configuration |
 | Path | Network > Network Isolation |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation |
@@ -452,8 +498,12 @@ For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 <!-- NeutralResources-OmaUri-End -->
 
 <!-- NeutralResources-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of domain names that can used for work or personal resource.
+<!-- Description-Source-ADMX -->
+This setting does not apply to desktop apps.
+
+A comma-separated list of domain names that can be used as both work or personal resource.
+
+For more information see: <https://go.microsoft.com/fwlink/p/?LinkId=234043>
 <!-- NeutralResources-Description-End -->
 
 <!-- NeutralResources-Editable-Begin -->
@@ -477,7 +527,7 @@ List of domain names that can used for work or personal resource.
 |:--|:--|
 | Name | WF_NetIsolation_NeutralResources |
 | Friendly Name | Domains categorized as both work and personal |
-| Element Name | Neutral resources |
+| Element Name | Neutral resources. |
 | Location | Computer Configuration |
 | Path | Network > Network Isolation |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation |
diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index 4669b6c300..783e4f6580 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -4,7 +4,7 @@ description: Learn more about the NetworkListManager Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -26,7 +26,7 @@ ms.topic: reference
 <!-- AllowedTlsAuthenticationEndpoints-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042] and later |
 <!-- AllowedTlsAuthenticationEndpoints-Applicability-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-OmaUri-Begin -->
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowedTlsAuthenticationEndpoints-Description-Begin -->
 <!-- Description-Source-DDF -->
-List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
 <!-- AllowedTlsAuthenticationEndpoints-Description-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-Editable-Begin -->
@@ -79,7 +79,7 @@ Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing
 <!-- ConfiguredTlsAuthenticationNetworkName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042] and later |
 <!-- ConfiguredTlsAuthenticationNetworkName-Applicability-End -->
 
 <!-- ConfiguredTlsAuthenticationNetworkName-OmaUri-Begin -->
@@ -90,7 +90,7 @@ Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing
 
 <!-- ConfiguredTlsAuthenticationNetworkName-Description-Begin -->
 <!-- Description-Source-DDF -->
-The string will be used to name the network authenticated against one of the endpoints listed in AllowedTlsAuthenticationEndpoints policy
+The string will be used to name the network authenticated against one of the endpoints listed in AllowedTlsAuthenticationEndpoints policy.
 <!-- ConfiguredTlsAuthenticationNetworkName-Description-End -->
 
 <!-- ConfiguredTlsAuthenticationNetworkName-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md
index 1e4d224152..5f2769f2f1 100644
--- a/windows/client-management/mdm/policy-csp-notifications.md
+++ b/windows/client-management/mdm/policy-csp-notifications.md
@@ -4,7 +4,7 @@ description: Learn more about the Notifications Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -242,6 +242,67 @@ No reboots or service restarts are required for this policy setting to take effe
 
 <!-- DisallowTileNotification-End -->
 
+<!-- EnableExpandedToastNotifications-Begin -->
+## EnableExpandedToastNotifications
+
+<!-- EnableExpandedToastNotifications-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :x: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1620] and later |
+<!-- EnableExpandedToastNotifications-Applicability-End -->
+
+<!-- EnableExpandedToastNotifications-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/Policy/Config/Notifications/EnableExpandedToastNotifications
+```
+<!-- EnableExpandedToastNotifications-OmaUri-End -->
+
+<!-- EnableExpandedToastNotifications-Description-Begin -->
+<!-- Description-Source-DDF -->
+This policy setting turns on multiple expanded toast notifications in action center.
+
+- If you enable this policy setting, the first three notifications of each application will be expanded by default in action center.
+- If you disable or do not configure this policy setting, only the first notification of each application will be expanded by default in action center. Windows 10 only. This will be immediately deprecated for Windows 11. No reboots or service restarts are required for this policy setting to take effect.
+<!-- EnableExpandedToastNotifications-Description-End -->
+
+<!-- EnableExpandedToastNotifications-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- EnableExpandedToastNotifications-Editable-End -->
+
+<!-- EnableExpandedToastNotifications-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- EnableExpandedToastNotifications-DFProperties-End -->
+
+<!-- EnableExpandedToastNotifications-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Disable multiple expanded toasts in action center. |
+| 1 | Enable multiple expanded toasts in action center. |
+<!-- EnableExpandedToastNotifications-AllowedValues-End -->
+
+<!-- EnableExpandedToastNotifications-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | ExpandedToastNotifications |
+| Path | WPN > AT > StartMenu > NotificationsCategory |
+<!-- EnableExpandedToastNotifications-GpMapping-End -->
+
+<!-- EnableExpandedToastNotifications-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- EnableExpandedToastNotifications-Examples-End -->
+
+<!-- EnableExpandedToastNotifications-End -->
+
 <!-- WnsEndpoint-Begin -->
 ## WnsEndpoint
 
@@ -258,8 +319,8 @@ No reboots or service restarts are required for this policy setting to take effe
 <!-- WnsEndpoint-OmaUri-End -->
 
 <!-- WnsEndpoint-Description-Begin -->
-<!-- Description-Source-DDF -->
-FQDN for the WNS endpoint
+<!-- Description-Source-ADMX -->
+This policy sets a special WNS FQDN for specific environments.
 <!-- WnsEndpoint-Description-End -->
 
 <!-- WnsEndpoint-Editable-Begin -->
@@ -289,7 +350,7 @@ If you disable or don't configure this setting, the push notifications will conn
 |:--|:--|
 | Name | WnsEndpoint_Policy |
 | Friendly Name | Enables group policy for the WNS FQDN |
-| Element Name | FQDN for WNS |
+| Element Name | FQDN for WNS. |
 | Location | Computer Configuration |
 | Path | Start Menu and Taskbar > Notifications |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications |
diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md
index 1af9f3391f..a8a8f001c3 100644
--- a/windows/client-management/mdm/policy-csp-power.md
+++ b/windows/client-management/mdm/policy-csp-power.md
@@ -4,7 +4,7 @@ description: Learn more about the Power Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -332,9 +332,11 @@ If the user has configured a slide show to run on the lock screen when the machi
 <!-- EnergySaverBatteryThresholdOnBattery-OmaUri-End -->
 
 <!-- EnergySaverBatteryThresholdOnBattery-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting allows you to specify battery charge level at which Energy Saver is turned on.
+
 - If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level.
+
 - If you disable or do not configure this policy setting, users control this setting.
 <!-- EnergySaverBatteryThresholdOnBattery-Description-End -->
 
@@ -389,9 +391,11 @@ This policy setting allows you to specify battery charge level at which Energy S
 <!-- EnergySaverBatteryThresholdPluggedIn-OmaUri-End -->
 
 <!-- EnergySaverBatteryThresholdPluggedIn-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting allows you to specify battery charge level at which Energy Saver is turned on.
+
 - If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level.
+
 - If you disable or do not configure this policy setting, users control this setting.
 <!-- EnergySaverBatteryThresholdPluggedIn-Description-End -->
 
@@ -688,8 +692,17 @@ This policy setting specifies whether or not the user is prompted for a password
 <!-- SelectLidCloseActionOnBattery-OmaUri-End -->
 
 <!-- SelectLidCloseActionOnBattery-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action.
+<!-- Description-Source-ADMX -->
+This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC.
+
+Possible actions include:
+-Take no action
+-Sleep
+-Hibernate
+-Shut down
+
+- If you enable this policy setting, you must select the desired action.
+
 - If you disable this policy setting or do not configure it, users can see and change this setting.
 <!-- SelectLidCloseActionOnBattery-Description-End -->
 
@@ -725,7 +738,7 @@ This policy setting specifies the action that Windows takes when a user closes t
 |:--|:--|
 | Name | DCSystemLidAction_2 |
 | Friendly Name | Select the lid switch action (on battery) |
-| Element Name | Lid Switch Action |
+| Element Name | Lid Switch Action. |
 | Location | Computer Configuration |
 | Path | System > Power Management > Button Settings |
 | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936 |
@@ -754,8 +767,17 @@ This policy setting specifies the action that Windows takes when a user closes t
 <!-- SelectLidCloseActionPluggedIn-OmaUri-End -->
 
 <!-- SelectLidCloseActionPluggedIn-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action.
+<!-- Description-Source-ADMX -->
+This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC.
+
+Possible actions include:
+-Take no action
+-Sleep
+-Hibernate
+-Shut down
+
+- If you enable this policy setting, you must select the desired action.
+
 - If you disable this policy setting or do not configure it, users can see and change this setting.
 <!-- SelectLidCloseActionPluggedIn-Description-End -->
 
@@ -791,7 +813,7 @@ This policy setting specifies the action that Windows takes when a user closes t
 |:--|:--|
 | Name | ACSystemLidAction_2 |
 | Friendly Name | Select the lid switch action (plugged in) |
-| Element Name | Lid Switch Action |
+| Element Name | Lid Switch Action. |
 | Location | Computer Configuration |
 | Path | System > Power Management > Button Settings |
 | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936 |
@@ -820,8 +842,17 @@ This policy setting specifies the action that Windows takes when a user closes t
 <!-- SelectPowerButtonActionOnBattery-OmaUri-End -->
 
 <!-- SelectPowerButtonActionOnBattery-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the action that Windows takes when a user presses the power button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action.
+<!-- Description-Source-ADMX -->
+This policy setting specifies the action that Windows takes when a user presses the power button.
+
+Possible actions include:
+-Take no action
+-Sleep
+-Hibernate
+-Shut down
+
+- If you enable this policy setting, you must select the desired action.
+
 - If you disable this policy setting or do not configure it, users can see and change this setting.
 <!-- SelectPowerButtonActionOnBattery-Description-End -->
 
@@ -857,7 +888,7 @@ This policy setting specifies the action that Windows takes when a user presses
 |:--|:--|
 | Name | DCPowerButtonAction_2 |
 | Friendly Name | Select the Power button action (on battery) |
-| Element Name | Power Button Action |
+| Element Name | Power Button Action. |
 | Location | Computer Configuration |
 | Path | System > Power Management > Button Settings |
 | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280 |
@@ -886,8 +917,17 @@ This policy setting specifies the action that Windows takes when a user presses
 <!-- SelectPowerButtonActionPluggedIn-OmaUri-End -->
 
 <!-- SelectPowerButtonActionPluggedIn-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the action that Windows takes when a user presses the power button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action.
+<!-- Description-Source-ADMX -->
+This policy setting specifies the action that Windows takes when a user presses the power button.
+
+Possible actions include:
+-Take no action
+-Sleep
+-Hibernate
+-Shut down
+
+- If you enable this policy setting, you must select the desired action.
+
 - If you disable this policy setting or do not configure it, users can see and change this setting.
 <!-- SelectPowerButtonActionPluggedIn-Description-End -->
 
@@ -923,7 +963,7 @@ This policy setting specifies the action that Windows takes when a user presses
 |:--|:--|
 | Name | ACPowerButtonAction_2 |
 | Friendly Name | Select the Power button action (plugged in) |
-| Element Name | Power Button Action |
+| Element Name | Power Button Action. |
 | Location | Computer Configuration |
 | Path | System > Power Management > Button Settings |
 | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280 |
@@ -952,8 +992,17 @@ This policy setting specifies the action that Windows takes when a user presses
 <!-- SelectSleepButtonActionOnBattery-OmaUri-End -->
 
 <!-- SelectSleepButtonActionOnBattery-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the action that Windows takes when a user presses the sleep button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action.
+<!-- Description-Source-ADMX -->
+This policy setting specifies the action that Windows takes when a user presses the sleep button.
+
+Possible actions include:
+-Take no action
+-Sleep
+-Hibernate
+-Shut down
+
+- If you enable this policy setting, you must select the desired action.
+
 - If you disable this policy setting or do not configure it, users can see and change this setting.
 <!-- SelectSleepButtonActionOnBattery-Description-End -->
 
@@ -989,7 +1038,7 @@ This policy setting specifies the action that Windows takes when a user presses
 |:--|:--|
 | Name | DCSleepButtonAction_2 |
 | Friendly Name | Select the Sleep button action (on battery) |
-| Element Name | Sleep Button Action |
+| Element Name | Sleep Button Action. |
 | Location | Computer Configuration |
 | Path | System > Power Management > Button Settings |
 | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB |
@@ -1018,8 +1067,17 @@ This policy setting specifies the action that Windows takes when a user presses
 <!-- SelectSleepButtonActionPluggedIn-OmaUri-End -->
 
 <!-- SelectSleepButtonActionPluggedIn-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies the action that Windows takes when a user presses the sleep button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action.
+<!-- Description-Source-ADMX -->
+This policy setting specifies the action that Windows takes when a user presses the sleep button.
+
+Possible actions include:
+-Take no action
+-Sleep
+-Hibernate
+-Shut down
+
+- If you enable this policy setting, you must select the desired action.
+
 - If you disable this policy setting or do not configure it, users can see and change this setting.
 <!-- SelectSleepButtonActionPluggedIn-Description-End -->
 
@@ -1055,7 +1113,7 @@ This policy setting specifies the action that Windows takes when a user presses
 |:--|:--|
 | Name | ACSleepButtonAction_2 |
 | Friendly Name | Select the Sleep button action (plugged in) |
-| Element Name | Sleep Button Action |
+| Element Name | Sleep Button Action. |
 | Location | Computer Configuration |
 | Path | System > Power Management > Button Settings |
 | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB |
@@ -1340,10 +1398,14 @@ This policy setting allows you to turn off hybrid sleep.
 <!-- UnattendedSleepTimeoutOnBattery-OmaUri-End -->
 
 <!-- UnattendedSleepTimeoutOnBattery-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer.
+
 - If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep.
-- If you disable or do not configure this policy setting, users control this setting. If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature.
+
+- If you disable or do not configure this policy setting, users control this setting.
+
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature.
 <!-- UnattendedSleepTimeoutOnBattery-Description-End -->
 
 <!-- UnattendedSleepTimeoutOnBattery-Editable-Begin -->
@@ -1397,10 +1459,14 @@ This policy setting allows you to specify the period of inactivity before Window
 <!-- UnattendedSleepTimeoutPluggedIn-OmaUri-End -->
 
 <!-- UnattendedSleepTimeoutPluggedIn-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer.
+
 - If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep.
-- If you disable or do not configure this policy setting, users control this setting. If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature.
+
+- If you disable or do not configure this policy setting, users control this setting.
+
+If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature.
 <!-- UnattendedSleepTimeoutPluggedIn-Description-End -->
 
 <!-- UnattendedSleepTimeoutPluggedIn-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md
index d6abd1659d..61ca4d4ecc 100644
--- a/windows/client-management/mdm/policy-csp-printers.md
+++ b/windows/client-management/mdm/policy-csp-printers.md
@@ -4,7 +4,7 @@ description: Learn more about the Printers Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -166,7 +166,7 @@ Manages how Queue-specific files are processed during printer installation. At p
 
 You can enable this setting to change the default behavior involving queue-specific files. To use this setting, select one of the options below from the "Manage processing of Queue-specific files" box.
 
-- If you disable or do not configure this policy setting, the default behavior is "Limit Queue-specific files to Color profiles".
+If you disable or do not configure this policy setting, the default behavior is "Limit Queue-specific files to Color profiles".
 
 - "Do not allow Queue-specific files" specifies that no queue-specific files will be allowed/processed during print queue/printer connection installation.
 
@@ -238,7 +238,7 @@ As part of this validation the catalog/embedded signature is verified and all fi
 
 You can enable this setting to change the default signature validation method. To use this setting, select one of the options below from the "Select the driver signature mechanism for this computer" box.
 
-- If you disable or do not configure this policy setting, the default method is "Allow all validly signed drivers".
+If you disable or do not configure this policy setting, the default method is "Allow all validly signed drivers".
 
 - "Require inbox signed drivers" specifies only drivers that are shipped as part of a Windows image are allowed on this computer.
 
@@ -508,15 +508,15 @@ This policy setting controls which protocol and protocol settings to use for out
 By default, RPC over TCP is used and authentication is always enabled. For RPC over named pipes, authentication is always enabled for domain joined machines but disabled for non domain joined machines.
 
 Protocol to use for outgoing RPC connections:
-- "RPC over TCP": Use RPC over TCP for outgoing RPC connections to a remote print spooler
-- "RPC over named pipes": Use RPC over named pipes for outgoing RPC connections to a remote print spooler
+  - "RPC over TCP": Use RPC over TCP for outgoing RPC connections to a remote print spooler
+  - "RPC over named pipes": Use RPC over named pipes for outgoing RPC connections to a remote print spooler
 
 Use authentication for outgoing RPC over named pipes connections:
-- "Default": By default domain joined computers enable RPC authentication for RPC over named pipes while non domain joined computers disable RPC authentication for RPC over named pipes
-- "Authentication enabled": RPC authentication will be used for outgoing RPC over named pipes connections
-- "Authentication disabled": RPC authentication will not be used for outgoing RPC over named pipes connections
+  - "Default": By default domain joined computers enable RPC authentication for RPC over named pipes while non domain joined computers disable RPC authentication for RPC over named pipes
+  - "Authentication enabled": RPC authentication will be used for outgoing RPC over named pipes connections
+  - "Authentication disabled": RPC authentication will not be used for outgoing RPC over named pipes connections
 
-- If you disable or do not configure this policy setting, the above defaults will be used.
+If you disable or do not configure this policy setting, the above defaults will be used.
 <!-- ConfigureRpcConnectionPolicy-Description-End -->
 
 <!-- ConfigureRpcConnectionPolicy-Editable-Begin -->
@@ -576,15 +576,15 @@ This policy setting controls which protocols incoming RPC connections to the pri
 By default, RPC over TCP is enabled and Negotiate is used for the authentication protocol.
 
 Protocols to allow for incoming RPC connections:
-- "RPC over named pipes": Incoming RPC connections are only allowed over named pipes
-- "RPC over TCP": Incoming RPC connections are only allowed over TCP (the default option)
-- "RPC over named pipes and TCP": Incoming RPC connections will be allowed over TCP and named pipes
+  - "RPC over named pipes": Incoming RPC connections are only allowed over named pipes
+  - "RPC over TCP": Incoming RPC connections are only allowed over TCP (the default option)
+  - "RPC over named pipes and TCP": Incoming RPC connections will be allowed over TCP and named pipes
 
 Authentication protocol to use for incoming RPC connections:
-- "Negotiate": Use the Negotiate authentication protocol (the default option)
-- "Kerberos": Use the Kerberos authentication protocol
+  - "Negotiate": Use the Negotiate authentication protocol (the default option)
+  - "Kerberos": Use the Kerberos authentication protocol
 
-- If you disable or do not configure this policy setting, the above defaults will be used.
+If you disable or do not configure this policy setting, the above defaults will be used.
 <!-- ConfigureRpcListenerPolicy-Description-End -->
 
 <!-- ConfigureRpcListenerPolicy-Editable-Begin -->
@@ -644,9 +644,9 @@ This policy setting controls which port is used for RPC over TCP for incoming co
 By default dynamic TCP ports are used.
 
 RPC over TCP port:
-- The port to use for RPC over TCP. A value of 0 is the default and indicates that dynamic TCP ports will be used
+  - The port to use for RPC over TCP. A value of 0 is the default and indicates that dynamic TCP ports will be used
 
-- If you disable or do not configure this policy setting, dynamic TCP ports are used.
+If you disable or do not configure this policy setting, dynamic TCP ports are used.
 <!-- ConfigureRpcTcpPort-Description-End -->
 
 <!-- ConfigureRpcTcpPort-Editable-Begin -->
@@ -831,7 +831,7 @@ This checks outranks the signature check and allows drivers that have a valid si
 
 Entries in the exclusion list consist of a SHA256 hash (or SHA1 hash for Win7) of the INF file and/or main driver DLL file of the driver and the name of the file.
 
-- If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value.
+If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value.
 <!-- ManageDriverExclusionList-Description-End -->
 
 <!-- ManageDriverExclusionList-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md
index 24f10738e5..f4fa8a6e6a 100644
--- a/windows/client-management/mdm/policy-csp-privacy.md
+++ b/windows/client-management/mdm/policy-csp-privacy.md
@@ -4,7 +4,7 @@ description: Learn more about the Privacy Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -90,6 +90,7 @@ Allows or disallows the automatic acceptance of the pairing and privacy user con
 <!-- AllowCrossDeviceClipboard-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting determines whether Clipboard contents can be synchronized across devices.
+
 - If you enable this policy setting, Clipboard contents are allowed to be synchronized across devices logged in under the same Microsoft account or Azure AD account.
 - If you disable this policy setting, Clipboard contents cannot be shared to other devices.
 Policy change takes effect immediately.
@@ -372,6 +373,7 @@ In some managed environments, the privacy settings may be set by other policies.
 <!-- EnableActivityFeed-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting determines whether ActivityFeed is enabled.
+
 - If you enable this policy setting, all activity types (as applicable) are allowed to be published and ActivityFeed shall roam these activities across device graph of the user.
 - If you disable this policy setting, activities can't be published and ActivityFeed shall disable cloud sync.
 Policy change takes effect immediately.
@@ -436,8 +438,20 @@ Policy change takes effect immediately.
 <!-- LetAppsAccessAccountInfo-OmaUri-End -->
 
 <!-- LetAppsAccessAccountInfo-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access account information.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessAccountInfo-Description-End -->
 
 <!-- LetAppsAccessAccountInfo-Editable-Begin -->
@@ -473,7 +487,7 @@ The most restrictive value is `2` to deny apps access to account information.
 |:--|:--|
 | Name | LetAppsAccessAccountInfo |
 | Friendly Name | Let Windows apps access account information |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -502,8 +516,20 @@ The most restrictive value is `2` to deny apps access to account information.
 <!-- LetAppsAccessAccountInfo_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessAccountInfo_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access account information.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessAccountInfo_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessAccountInfo_ForceAllowTheseApps-Editable-Begin -->
@@ -555,8 +581,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsAccessAccountInfo_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessAccountInfo_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access account information.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessAccountInfo_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessAccountInfo_ForceDenyTheseApps-Editable-Begin -->
@@ -608,8 +646,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsAccessAccountInfo_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessAccountInfo_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access account information.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessAccountInfo_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessAccountInfo_UserInControlOfTheseApps-Editable-Begin -->
@@ -841,8 +891,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use
 <!-- LetAppsAccessCalendar-OmaUri-End -->
 
 <!-- LetAppsAccessCalendar-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access the calendar.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCalendar-Description-End -->
 
 <!-- LetAppsAccessCalendar-Editable-Begin -->
@@ -878,7 +940,7 @@ The most restrictive value is `2` to deny apps access to the calendar.
 |:--|:--|
 | Name | LetAppsAccessCalendar |
 | Friendly Name | Let Windows apps access the calendar |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -907,8 +969,20 @@ The most restrictive value is `2` to deny apps access to the calendar.
 <!-- LetAppsAccessCalendar_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCalendar_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the calendar.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCalendar_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessCalendar_ForceAllowTheseApps-Editable-Begin -->
@@ -960,8 +1034,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsAccessCalendar_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCalendar_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the calendar.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCalendar_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessCalendar_ForceDenyTheseApps-Editable-Begin -->
@@ -1013,8 +1099,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsAccessCalendar_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCalendar_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the calendar.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCalendar_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessCalendar_UserInControlOfTheseApps-Editable-Begin -->
@@ -1066,8 +1164,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a
 <!-- LetAppsAccessCallHistory-OmaUri-End -->
 
 <!-- LetAppsAccessCallHistory-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access call history.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCallHistory-Description-End -->
 
 <!-- LetAppsAccessCallHistory-Editable-Begin -->
@@ -1103,7 +1213,7 @@ The most restrictive value is `2` to deny apps access to call history.
 |:--|:--|
 | Name | LetAppsAccessCallHistory |
 | Friendly Name | Let Windows apps access call history |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -1132,8 +1242,20 @@ The most restrictive value is `2` to deny apps access to call history.
 <!-- LetAppsAccessCallHistory_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCallHistory_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access call history.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCallHistory_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessCallHistory_ForceAllowTheseApps-Editable-Begin -->
@@ -1185,8 +1307,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsAccessCallHistory_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCallHistory_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access call history.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCallHistory_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessCallHistory_ForceDenyTheseApps-Editable-Begin -->
@@ -1238,8 +1372,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsAccessCallHistory_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCallHistory_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access call history.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCallHistory_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessCallHistory_UserInControlOfTheseApps-Editable-Begin -->
@@ -1291,8 +1437,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a
 <!-- LetAppsAccessCamera-OmaUri-End -->
 
 <!-- LetAppsAccessCamera-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access the camera.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCamera-Description-End -->
 
 <!-- LetAppsAccessCamera-Editable-Begin -->
@@ -1328,7 +1486,7 @@ The most restrictive value is `2` to deny apps access to the camera.
 |:--|:--|
 | Name | LetAppsAccessCamera |
 | Friendly Name | Let Windows apps access the camera |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -1357,8 +1515,20 @@ The most restrictive value is `2` to deny apps access to the camera.
 <!-- LetAppsAccessCamera_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCamera_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the camera.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCamera_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessCamera_ForceAllowTheseApps-Editable-Begin -->
@@ -1410,8 +1580,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessCamera_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCamera_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the camera.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCamera_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessCamera_ForceDenyTheseApps-Editable-Begin -->
@@ -1463,8 +1645,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessCamera_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessCamera_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the camera.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessCamera_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessCamera_UserInControlOfTheseApps-Editable-Begin -->
@@ -1516,8 +1710,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessContacts-OmaUri-End -->
 
 <!-- LetAppsAccessContacts-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access contacts.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessContacts-Description-End -->
 
 <!-- LetAppsAccessContacts-Editable-Begin -->
@@ -1553,7 +1759,7 @@ The most restrictive value is `2` to deny apps access to contacts.
 |:--|:--|
 | Name | LetAppsAccessContacts |
 | Friendly Name | Let Windows apps access contacts |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -1582,8 +1788,20 @@ The most restrictive value is `2` to deny apps access to contacts.
 <!-- LetAppsAccessContacts_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessContacts_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access contacts.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessContacts_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessContacts_ForceAllowTheseApps-Editable-Begin -->
@@ -1635,8 +1853,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessContacts_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessContacts_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access contacts.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessContacts_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessContacts_ForceDenyTheseApps-Editable-Begin -->
@@ -1688,8 +1918,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessContacts_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessContacts_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access contacts.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessContacts_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessContacts_UserInControlOfTheseApps-Editable-Begin -->
@@ -1741,8 +1983,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessEmail-OmaUri-End -->
 
 <!-- LetAppsAccessEmail-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access email.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessEmail-Description-End -->
 
 <!-- LetAppsAccessEmail-Editable-Begin -->
@@ -1778,7 +2032,7 @@ The most restrictive value is `2` to deny apps access to email.
 |:--|:--|
 | Name | LetAppsAccessEmail |
 | Friendly Name | Let Windows apps access email |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -1807,8 +2061,20 @@ The most restrictive value is `2` to deny apps access to email.
 <!-- LetAppsAccessEmail_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessEmail_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access email.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessEmail_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessEmail_ForceAllowTheseApps-Editable-Begin -->
@@ -1860,8 +2126,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessEmail_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessEmail_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access email.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessEmail_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessEmail_ForceDenyTheseApps-Editable-Begin -->
@@ -1913,8 +2191,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessEmail_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessEmail_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access email.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessEmail_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessEmail_UserInControlOfTheseApps-Editable-Begin -->
@@ -2127,8 +2417,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use
 <!-- LetAppsAccessGraphicsCaptureProgrammatic-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies whether Windows apps can use screen capture on arbitrary windows or displays.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can take screenshots of various windows or displays.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureProgrammatic-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic-Editable-Begin -->
@@ -2181,8 +2483,20 @@ This policy setting specifies whether Windows apps can use screen capture on arb
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to use screen capture on arbitrary windows or displays. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can take screenshots of various windows or displays.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps-Editable-Begin -->
@@ -2234,8 +2548,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the use of screen capture on arbitrary windows or displays. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can take screenshots of various windows or displays.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps-Editable-Begin -->
@@ -2287,8 +2613,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the programmatic screen capture setting for the listed apps. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can take screenshots of various windows or displays.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps-Editable-Begin -->
@@ -2340,8 +2678,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies whether Windows apps can disable the screen capture border.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can turn off the screenshot border.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder-Editable-Begin -->
@@ -2366,7 +2716,7 @@ This policy setting specifies whether Windows apps can disable the screen captur
 |:--|:--|
 | Name | LetAppsAccessGraphicsCaptureWithoutBorder |
 | Friendly Name | Let Windows apps turn off the screenshot border |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -2395,8 +2745,20 @@ This policy setting specifies whether Windows apps can disable the screen captur
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to disable the screen capture border. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can turn off the screenshot border.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps-Editable-Begin -->
@@ -2448,8 +2810,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied configuration access to the screen capture border. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can turn off the screenshot border.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps-Editable-Begin -->
@@ -2501,8 +2875,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the screen capture border privacy setting for the listed apps. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can turn off the screenshot border.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps-Editable-Begin -->
@@ -2538,6 +2924,216 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 
 <!-- LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps-End -->
 
+<!-- LetAppsAccessHumanPresence-Begin -->
+## LetAppsAccessHumanPresence
+
+<!-- LetAppsAccessHumanPresence-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
+<!-- LetAppsAccessHumanPresence-Applicability-End -->
+
+<!-- LetAppsAccessHumanPresence-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence
+```
+<!-- LetAppsAccessHumanPresence-OmaUri-End -->
+
+<!-- LetAppsAccessHumanPresence-Description-Begin -->
+<!-- Description-Source-DDF -->
+This policy setting specifies whether Windows apps can access the human presence sensor.
+<!-- LetAppsAccessHumanPresence-Description-End -->
+
+<!-- LetAppsAccessHumanPresence-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence-Editable-End -->
+
+<!-- LetAppsAccessHumanPresence-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- LetAppsAccessHumanPresence-DFProperties-End -->
+
+<!-- LetAppsAccessHumanPresence-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | User in control. |
+| 1 | Force allow. |
+| 2 | Force deny. |
+<!-- LetAppsAccessHumanPresence-AllowedValues-End -->
+
+<!-- LetAppsAccessHumanPresence-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | LetAppsAccessHumanPresence |
+| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
+| Element Name | LetAppsAccessHumanPresence_Enum |
+<!-- LetAppsAccessHumanPresence-GpMapping-End -->
+
+<!-- LetAppsAccessHumanPresence-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence-Examples-End -->
+
+<!-- LetAppsAccessHumanPresence-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Begin -->
+## LetAppsAccessHumanPresence_ForceAllowTheseApps
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Applicability-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_ForceAllowTheseApps
+```
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-OmaUri-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Description-Begin -->
+<!-- Description-Source-DDF -->
+List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps.
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Description-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Editable-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `;`) |
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-DFProperties-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | LetAppsAccessHumanPresence |
+| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
+| Element Name | LetAppsAccessHumanPresence_ForceAllowTheseApps_List |
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-GpMapping-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-Examples-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceAllowTheseApps-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Begin -->
+## LetAppsAccessHumanPresence_ForceDenyTheseApps
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Applicability-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_ForceDenyTheseApps
+```
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-OmaUri-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Description-Begin -->
+<!-- Description-Source-DDF -->
+List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps.
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Description-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Editable-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `;`) |
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-DFProperties-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | LetAppsAccessHumanPresence |
+| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
+| Element Name | LetAppsAccessHumanPresence_ForceDenyTheseApps_List |
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-GpMapping-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-Examples-End -->
+
+<!-- LetAppsAccessHumanPresence_ForceDenyTheseApps-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Begin -->
+## LetAppsAccessHumanPresence_UserInControlOfTheseApps
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later |
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Applicability-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_UserInControlOfTheseApps
+```
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-OmaUri-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Description-Begin -->
+<!-- Description-Source-DDF -->
+List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the human presence privacy setting for the listed apps. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps.
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Description-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Editable-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `;`) |
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-DFProperties-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | LetAppsAccessHumanPresence |
+| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy |
+| Element Name | LetAppsAccessHumanPresence_UserInControlOfTheseApps_List |
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-GpMapping-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-Examples-End -->
+
+<!-- LetAppsAccessHumanPresence_UserInControlOfTheseApps-End -->
+
 <!-- LetAppsAccessLocation-Begin -->
 ## LetAppsAccessLocation
 
@@ -2554,8 +3150,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessLocation-OmaUri-End -->
 
 <!-- LetAppsAccessLocation-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access location.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessLocation-Description-End -->
 
 <!-- LetAppsAccessLocation-Editable-Begin -->
@@ -2591,7 +3199,7 @@ The most restrictive value is `2` to deny apps access to the device's location.
 |:--|:--|
 | Name | LetAppsAccessLocation |
 | Friendly Name | Let Windows apps access location |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -2620,8 +3228,20 @@ The most restrictive value is `2` to deny apps access to the device's location.
 <!-- LetAppsAccessLocation_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessLocation_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access location.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessLocation_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessLocation_ForceAllowTheseApps-Editable-Begin -->
@@ -2673,8 +3293,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessLocation_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessLocation_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access location.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessLocation_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessLocation_ForceDenyTheseApps-Editable-Begin -->
@@ -2726,8 +3358,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessLocation_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessLocation_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access location.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessLocation_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessLocation_UserInControlOfTheseApps-Editable-Begin -->
@@ -2779,8 +3423,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessMessaging-OmaUri-End -->
 
 <!-- LetAppsAccessMessaging-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can read or send messages (text or MMS).
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMessaging-Description-End -->
 
 <!-- LetAppsAccessMessaging-Editable-Begin -->
@@ -2816,7 +3472,7 @@ The most restrictive value is `2` to deny apps access to messaging.
 |:--|:--|
 | Name | LetAppsAccessMessaging |
 | Friendly Name | Let Windows apps access messaging |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -2845,8 +3501,20 @@ The most restrictive value is `2` to deny apps access to messaging.
 <!-- LetAppsAccessMessaging_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMessaging_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can read or send messages (text or MMS).
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMessaging_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessMessaging_ForceAllowTheseApps-Editable-Begin -->
@@ -2898,8 +3566,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessMessaging_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMessaging_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can read or send messages (text or MMS).
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMessaging_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessMessaging_ForceDenyTheseApps-Editable-Begin -->
@@ -2951,8 +3631,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessMessaging_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMessaging_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can read or send messages (text or MMS).
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMessaging_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessMessaging_UserInControlOfTheseApps-Editable-Begin -->
@@ -3004,8 +3696,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessMicrophone-OmaUri-End -->
 
 <!-- LetAppsAccessMicrophone-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access the microphone.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMicrophone-Description-End -->
 
 <!-- LetAppsAccessMicrophone-Editable-Begin -->
@@ -3041,7 +3745,7 @@ The most restrictive value is `2` to deny apps access to the microphone.
 |:--|:--|
 | Name | LetAppsAccessMicrophone |
 | Friendly Name | Let Windows apps access the microphone |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -3070,8 +3774,20 @@ The most restrictive value is `2` to deny apps access to the microphone.
 <!-- LetAppsAccessMicrophone_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMicrophone_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the microphone.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMicrophone_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessMicrophone_ForceAllowTheseApps-Editable-Begin -->
@@ -3123,8 +3839,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessMicrophone_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMicrophone_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the microphone.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMicrophone_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessMicrophone_ForceDenyTheseApps-Editable-Begin -->
@@ -3176,8 +3904,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessMicrophone_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMicrophone_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access the microphone.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMicrophone_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessMicrophone_UserInControlOfTheseApps-Editable-Begin -->
@@ -3229,8 +3969,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessMotion-OmaUri-End -->
 
 <!-- LetAppsAccessMotion-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access motion data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMotion-Description-End -->
 
 <!-- LetAppsAccessMotion-Editable-Begin -->
@@ -3266,7 +4018,7 @@ The most restrictive value is `2` to deny apps access to motion data.
 |:--|:--|
 | Name | LetAppsAccessMotion |
 | Friendly Name | Let Windows apps access motion |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -3295,8 +4047,20 @@ The most restrictive value is `2` to deny apps access to motion data.
 <!-- LetAppsAccessMotion_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMotion_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access motion data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMotion_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessMotion_ForceAllowTheseApps-Editable-Begin -->
@@ -3348,8 +4112,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessMotion_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMotion_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access motion data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMotion_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessMotion_ForceDenyTheseApps-Editable-Begin -->
@@ -3401,8 +4177,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessMotion_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessMotion_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access motion data.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessMotion_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessMotion_UserInControlOfTheseApps-Editable-Begin -->
@@ -3454,8 +4242,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessNotifications-OmaUri-End -->
 
 <!-- LetAppsAccessNotifications-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access notifications.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessNotifications-Description-End -->
 
 <!-- LetAppsAccessNotifications-Editable-Begin -->
@@ -3491,7 +4291,7 @@ The most restrictive value is `2` to deny apps access to notifications.
 |:--|:--|
 | Name | LetAppsAccessNotifications |
 | Friendly Name | Let Windows apps access notifications |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -3520,8 +4320,20 @@ The most restrictive value is `2` to deny apps access to notifications.
 <!-- LetAppsAccessNotifications_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessNotifications_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access notifications.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessNotifications_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessNotifications_ForceAllowTheseApps-Editable-Begin -->
@@ -3573,8 +4385,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessNotifications_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessNotifications_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access notifications.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessNotifications_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessNotifications_ForceDenyTheseApps-Editable-Begin -->
@@ -3626,8 +4450,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessNotifications_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessNotifications_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access notifications.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessNotifications_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessNotifications_UserInControlOfTheseApps-Editable-Begin -->
@@ -3679,8 +4515,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessPhone-OmaUri-End -->
 
 <!-- LetAppsAccessPhone-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies whether Windows apps can make phone calls
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can make phone calls.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessPhone-Description-End -->
 
 <!-- LetAppsAccessPhone-Editable-Begin -->
@@ -3716,7 +4564,7 @@ The most restrictive value is `2` to deny apps access to make phone calls.
 |:--|:--|
 | Name | LetAppsAccessPhone |
 | Friendly Name | Let Windows apps make phone calls |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -3745,8 +4593,20 @@ The most restrictive value is `2` to deny apps access to make phone calls.
 <!-- LetAppsAccessPhone_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessPhone_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can make phone calls.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessPhone_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessPhone_ForceAllowTheseApps-Editable-Begin -->
@@ -3798,8 +4658,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessPhone_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessPhone_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can make phone calls.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessPhone_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessPhone_ForceDenyTheseApps-Editable-Begin -->
@@ -3851,8 +4723,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessPhone_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessPhone_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can make phone calls.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessPhone_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessPhone_UserInControlOfTheseApps-Editable-Begin -->
@@ -3904,8 +4788,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessRadios-OmaUri-End -->
 
 <!-- LetAppsAccessRadios-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps have access to control radios.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessRadios-Description-End -->
 
 <!-- LetAppsAccessRadios-Editable-Begin -->
@@ -3941,7 +4837,7 @@ The most restrictive value is `2` to deny apps access to control radios.
 |:--|:--|
 | Name | LetAppsAccessRadios |
 | Friendly Name | Let Windows apps control radios |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -3970,8 +4866,20 @@ The most restrictive value is `2` to deny apps access to control radios.
 <!-- LetAppsAccessRadios_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessRadios_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps have access to control radios.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessRadios_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessRadios_ForceAllowTheseApps-Editable-Begin -->
@@ -4023,8 +4931,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessRadios_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessRadios_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps have access to control radios.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessRadios_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessRadios_ForceDenyTheseApps-Editable-Begin -->
@@ -4076,8 +4996,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessRadios_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessRadios_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps have access to control radios.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessRadios_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessRadios_UserInControlOfTheseApps-Editable-Begin -->
@@ -4129,8 +5061,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessTasks-OmaUri-End -->
 
 <!-- LetAppsAccessTasks-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access tasks.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTasks-Description-End -->
 
 <!-- LetAppsAccessTasks-Editable-Begin -->
@@ -4155,7 +5099,7 @@ This policy setting specifies whether Windows apps can access tasks.
 |:--|:--|
 | Name | LetAppsAccessTasks |
 | Friendly Name | Let Windows apps access Tasks |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -4184,8 +5128,20 @@ This policy setting specifies whether Windows apps can access tasks.
 <!-- LetAppsAccessTasks_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessTasks_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access tasks.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTasks_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessTasks_ForceAllowTheseApps-Editable-Begin -->
@@ -4237,8 +5193,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessTasks_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessTasks_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access tasks.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTasks_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessTasks_ForceDenyTheseApps-Editable-Begin -->
@@ -4290,8 +5258,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessTasks_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessTasks_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access tasks.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTasks_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessTasks_UserInControlOfTheseApps-Editable-Begin -->
@@ -4343,8 +5323,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsAccessTrustedDevices-OmaUri-End -->
 
 <!-- LetAppsAccessTrustedDevices-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can access trusted devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTrustedDevices-Description-End -->
 
 <!-- LetAppsAccessTrustedDevices-Editable-Begin -->
@@ -4380,7 +5372,7 @@ The most restrictive value is `2` to deny apps access trusted devices.
 |:--|:--|
 | Name | LetAppsAccessTrustedDevices |
 | Friendly Name | Let Windows apps access trusted devices |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -4409,8 +5401,20 @@ The most restrictive value is `2` to deny apps access trusted devices.
 <!-- LetAppsAccessTrustedDevices_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessTrustedDevices_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access trusted devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTrustedDevices_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsAccessTrustedDevices_ForceAllowTheseApps-Editable-Begin -->
@@ -4462,8 +5466,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessTrustedDevices_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessTrustedDevices_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access trusted devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTrustedDevices_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsAccessTrustedDevices_ForceDenyTheseApps-Editable-Begin -->
@@ -4515,8 +5531,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsAccessTrustedDevices_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsAccessTrustedDevices_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can access trusted devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsAccessTrustedDevices_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsAccessTrustedDevices_UserInControlOfTheseApps-Editable-Begin -->
@@ -4568,8 +5596,18 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- LetAppsActivateWithVoice-OmaUri-End -->
 
 <!-- LetAppsActivateWithVoice-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can be activated by voice.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to be activated with a voice keyword and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to be activated with a voice keyword and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings > Privacy on the device.
+
+This policy is applied to Windows apps and Cortana.
 <!-- LetAppsActivateWithVoice-Description-End -->
 
 <!-- LetAppsActivateWithVoice-Editable-Begin -->
@@ -4603,7 +5641,7 @@ This policy setting specifies whether Windows apps can be activated by voice.
 |:--|:--|
 | Name | LetAppsActivateWithVoice |
 | Friendly Name | Let Windows apps activate with voice |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -4632,8 +5670,18 @@ This policy setting specifies whether Windows apps can be activated by voice.
 <!-- LetAppsActivateWithVoiceAboveLock-OmaUri-End -->
 
 <!-- LetAppsActivateWithVoiceAboveLock-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can be activated by voice while the system is locked.
+
+If you choose the "User is in control" option, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, users can interact with applications using speech while the system is locked and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, users cannot interact with applications using speech while the system is locked and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings > Privacy on the device.
+
+This policy is applied to Windows apps and Cortana. It takes precedence of the "Allow Cortana above lock" policy. This policy is applicable only when "Allow voice activation" policy is configured to allow applications to be activated with voice.
 <!-- LetAppsActivateWithVoiceAboveLock-Description-End -->
 
 <!-- LetAppsActivateWithVoiceAboveLock-Editable-Begin -->
@@ -4667,7 +5715,7 @@ This policy setting specifies whether Windows apps can be activated by voice whi
 |:--|:--|
 | Name | LetAppsActivateWithVoiceAboveLock |
 | Friendly Name | Let Windows apps activate with voice while the system is locked |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -4696,8 +5744,20 @@ This policy setting specifies whether Windows apps can be activated by voice whi
 <!-- LetAppsGetDiagnosticInfo-OmaUri-End -->
 
 <!-- LetAppsGetDiagnosticInfo-Description-Begin -->
-<!-- Description-Source-DDF -->
-This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsGetDiagnosticInfo-Description-End -->
 
 <!-- LetAppsGetDiagnosticInfo-Editable-Begin -->
@@ -4733,7 +5793,7 @@ The most restrictive value is `2` to deny apps access to diagnostic data.
 |:--|:--|
 | Name | LetAppsGetDiagnosticInfo |
 | Friendly Name | Let Windows apps access diagnostic information about other apps |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -4762,8 +5822,20 @@ The most restrictive value is `2` to deny apps access to diagnostic data.
 <!-- LetAppsGetDiagnosticInfo_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsGetDiagnosticInfo_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsGetDiagnosticInfo_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsGetDiagnosticInfo_ForceAllowTheseApps-Editable-Begin -->
@@ -4815,8 +5887,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsGetDiagnosticInfo_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsGetDiagnosticInfo_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsGetDiagnosticInfo_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsGetDiagnosticInfo_ForceDenyTheseApps-Editable-Begin -->
@@ -4868,8 +5952,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsGetDiagnosticInfo_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsGetDiagnosticInfo_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsGetDiagnosticInfo_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsGetDiagnosticInfo_UserInControlOfTheseApps-Editable-Begin -->
@@ -4921,8 +6017,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a
 <!-- LetAppsRunInBackground-OmaUri-End -->
 
 <!-- LetAppsRunInBackground-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can run in the background.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsRunInBackground-Description-End -->
 
 <!-- LetAppsRunInBackground-Editable-Begin -->
@@ -4960,7 +6068,7 @@ The most restrictive value is `2` to deny apps from running in the background.
 |:--|:--|
 | Name | LetAppsRunInBackground |
 | Friendly Name | Let Windows apps run in the background |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -4989,8 +6097,20 @@ The most restrictive value is `2` to deny apps from running in the background.
 <!-- LetAppsRunInBackground_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsRunInBackground_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can run in the background.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsRunInBackground_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsRunInBackground_ForceAllowTheseApps-Editable-Begin -->
@@ -5042,8 +6162,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsRunInBackground_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsRunInBackground_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can run in the background.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsRunInBackground_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsRunInBackground_ForceDenyTheseApps-Editable-Begin -->
@@ -5095,8 +6227,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window
 <!-- LetAppsRunInBackground_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsRunInBackground_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can run in the background.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsRunInBackground_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsRunInBackground_UserInControlOfTheseApps-Editable-Begin -->
@@ -5148,8 +6292,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a
 <!-- LetAppsSyncWithDevices-OmaUri-End -->
 
 <!-- LetAppsSyncWithDevices-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-ADMX -->
 This policy setting specifies whether Windows apps can communicate with unpaired wireless devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsSyncWithDevices-Description-End -->
 
 <!-- LetAppsSyncWithDevices-Editable-Begin -->
@@ -5185,7 +6341,7 @@ The most restrictive value is `2` to deny apps syncing with devices.
 |:--|:--|
 | Name | LetAppsSyncWithDevices |
 | Friendly Name | Let Windows apps communicate with unpaired devices |
-| Element Name | Default for all apps |
+| Element Name | Default for all apps. |
 | Location | Computer Configuration |
 | Path | Windows Components > App Privacy |
 | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy |
@@ -5214,8 +6370,20 @@ The most restrictive value is `2` to deny apps syncing with devices.
 <!-- LetAppsSyncWithDevices_ForceAllowTheseApps-OmaUri-End -->
 
 <!-- LetAppsSyncWithDevices_ForceAllowTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can communicate with unpaired wireless devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsSyncWithDevices_ForceAllowTheseApps-Description-End -->
 
 <!-- LetAppsSyncWithDevices_ForceAllowTheseApps-Editable-Begin -->
@@ -5267,8 +6435,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsSyncWithDevices_ForceDenyTheseApps-OmaUri-End -->
 
 <!-- LetAppsSyncWithDevices_ForceDenyTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can communicate with unpaired wireless devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsSyncWithDevices_ForceDenyTheseApps-Description-End -->
 
 <!-- LetAppsSyncWithDevices_ForceDenyTheseApps-Editable-Begin -->
@@ -5320,8 +6500,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste
 <!-- LetAppsSyncWithDevices_UserInControlOfTheseApps-OmaUri-End -->
 
 <!-- LetAppsSyncWithDevices_UserInControlOfTheseApps-Description-Begin -->
-<!-- Description-Source-DDF -->
-List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps.
+<!-- Description-Source-ADMX -->
+This policy setting specifies whether Windows apps can communicate with unpaired wireless devices.
+
+You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
+
+If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it.
+
+If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device.
+
+If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.
 <!-- LetAppsSyncWithDevices_UserInControlOfTheseApps-Description-End -->
 
 <!-- LetAppsSyncWithDevices_UserInControlOfTheseApps-Editable-Begin -->
@@ -5375,6 +6567,7 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u
 <!-- PublishUserActivities-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting determines whether User Activities can be published.
+
 - If you enable this policy setting, activities of type User Activity are allowed to be published.
 - If you disable this policy setting, activities of type User Activity are not allowed to be published.
 Policy change takes effect immediately.
@@ -5443,6 +6636,7 @@ For more information, see [Windows activity history and your privacy](https://su
 <!-- UploadUserActivities-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting determines whether published User Activities can be uploaded.
+
 - If you enable this policy setting, activities of type User Activity are allowed to be uploaded.
 - If you disable this policy setting, activities of type User Activity are not allowed to be uploaded.
 Deletion of activities of type User Activity are independent of this setting.
diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md
index 4cfd15a4b7..247dadacdb 100644
--- a/windows/client-management/mdm/policy-csp-remoteassistance.md
+++ b/windows/client-management/mdm/policy-csp-remoteassistance.md
@@ -4,7 +4,7 @@ description: Learn more about the RemoteAssistance Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -277,7 +277,7 @@ For computers running Windows Server 2003 with Service Pack 1 (SP1)
 Port 135:TCP
 %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe
 %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe
-Allow Remote Desktop Exception
+Allow Remote Desktop Exception.
 <!-- UnsolicitedRemoteAssistance-Description-End -->
 
 <!-- UnsolicitedRemoteAssistance-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md
index a82841ffd5..6144dbef4f 100644
--- a/windows/client-management/mdm/policy-csp-remotedesktop.md
+++ b/windows/client-management/mdm/policy-csp-remotedesktop.md
@@ -4,7 +4,7 @@ description: Learn more about the RemoteDesktop Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AutoSubscription-Description-Begin -->
 <!-- Description-Source-ADMX -->
-Controls the list of URLs that the user should be auto-subscribed to
+Controls the list of URLs that the user should be auto-subscribed to.
 <!-- AutoSubscription-Description-End -->
 
 <!-- AutoSubscription-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md
index 1545ea14b2..1025e2c4b0 100644
--- a/windows/client-management/mdm/policy-csp-remotemanagement.md
+++ b/windows/client-management/mdm/policy-csp-remotemanagement.md
@@ -4,7 +4,7 @@ description: Learn more about the RemoteManagement Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -299,7 +299,7 @@ For example, if you want the service to listen only on IPv4 addresses, leave the
 Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter.
 
 Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22
-Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562
+Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562.
 <!-- AllowRemoteServerManagement-Description-End -->
 
 <!-- AllowRemoteServerManagement-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md
index 35fe66ae1a..f0153f08b7 100644
--- a/windows/client-management/mdm/policy-csp-remoteshell.md
+++ b/windows/client-management/mdm/policy-csp-remoteshell.md
@@ -4,7 +4,7 @@ description: Learn more about the RemoteShell Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -44,7 +44,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 This policy setting configures access to remote shells.
 
-- If you enable or do not configure this policy setting, new remote shell connections are accepted by the server.
+If you enable or do not configure this policy setting, new remote shell connections are accepted by the server.
 
 If you set this policy to 'disabled', new remote shell connections are rejected by the server.
 <!-- AllowRemoteShellAccess-Description-End -->
@@ -169,7 +169,7 @@ Any value from 0 to 0x7FFFFFFF can be set. A minimum of 60000 milliseconds (1 mi
 
 - If you enable this policy setting, the server will wait for the specified amount of time since the last received message from the client before terminating the open shell.
 
-If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used.
+- If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used.
 <!-- SpecifyIdleTimeout-Description-End -->
 
 <!-- SpecifyIdleTimeout-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md
index 1da17f0f74..f148ceb767 100644
--- a/windows/client-management/mdm/policy-csp-restrictedgroups.md
+++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md
@@ -4,7 +4,7 @@ description: Learn more about the RestrictedGroups Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -42,7 +42,7 @@ ms.topic: reference
 
 <!-- ConfigureGroupMembership-Description-Begin -->
 <!-- Description-Source-DDF -->
-This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group
+This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group.
 
 > [!CAUTION]
 > If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members.
diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md
index 00120ee4f2..dc4d67697d 100644
--- a/windows/client-management/mdm/policy-csp-search.md
+++ b/windows/client-management/mdm/policy-csp-search.md
@@ -4,7 +4,7 @@ description: Learn more about the Search Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/01/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -39,8 +39,8 @@ ms.topic: reference
 <!-- AllowCloudSearch-OmaUri-End -->
 
 <!-- AllowCloudSearch-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources.
+<!-- Description-Source-ADMX -->
+Allow search and Cortana to search cloud sources like OneDrive and SharePoint.
 <!-- AllowCloudSearch-Description-End -->
 
 <!-- AllowCloudSearch-Editable-Begin -->
@@ -73,7 +73,7 @@ Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T
 |:--|:--|
 | Name | AllowCloudSearch |
 | Friendly Name | Allow Cloud Search |
-| Element Name | Cloud Search Setting |
+| Element Name | Cloud Search Setting. |
 | Location | Computer Configuration |
 | Path | Windows Components > Search |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\Windows Search |
@@ -103,7 +103,7 @@ Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T
 
 <!-- AllowCortanaInAAD-Description-Begin -->
 <!-- Description-Source-ADMX -->
-Allow the cortana opt-in page during windows setup out of the box experience
+Allow the cortana opt-in page during windows setup out of the box experience.
 <!-- AllowCortanaInAAD-Description-End -->
 
 <!-- AllowCortanaInAAD-Editable-Begin -->
@@ -166,7 +166,7 @@ Allow the cortana opt-in page during windows setup out of the box experience
 
 <!-- AllowFindMyFiles-Description-Begin -->
 <!-- Description-Source-DDF -->
-This feature allows you to disable find my files completely on the machine
+This feature allows you to disable find my files completely on the machine.
 <!-- AllowFindMyFiles-Description-End -->
 
 <!-- AllowFindMyFiles-Editable-Begin -->
@@ -190,7 +190,7 @@ This policy controls whether the user can configure search to *Find My Files* mo
 
 | Value | Description |
 |:--|:--|
-| 1 (Default) | , and the settings UI is present. |
+| 1 (Default) | Find My Files feature can be toggled (still off by default), and the settings UI is present. |
 | 0 | Find My Files feature is turned off completely, and the settings UI is disabled. |
 <!-- AllowFindMyFiles-AllowedValues-End -->
 
@@ -227,6 +227,7 @@ This policy controls whether the user can configure search to *Find My Files* mo
 <!-- AllowIndexingEncryptedStoresOrItems-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows encrypted items to be indexed.
+
 - If you enable this policy setting, indexing will attempt to decrypt and index the content (access restrictions will still apply).
 - If you disable this policy setting, the search service components (including non-Microsoft components) are expected not to index encrypted items or encrypted stores. This policy setting is not configured by default.
 - If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. By default, the Control Panel setting is set to not index encrypted content.
@@ -481,6 +482,7 @@ This policy has been deprecated.
 <!-- AllowUsingDiacritics-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows words that contain diacritic characters to be treated as separate words.
+
 - If you enable this policy setting, words that only differ in diacritics are treated as different words.
 - If you disable this policy setting, words with diacritics and words without diacritics are treated as identical words. This policy setting is not configured by default.
 - If you do not configure this policy setting, the local setting, configured through Control Panel, will be used.
@@ -593,6 +595,7 @@ Allow Windows indexer. Value type is integer.
 <!-- AlwaysUseAutoLangDetection-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting determines when Windows uses automatic language detection results, and when it relies on indexing history.
+
 - If you enable this policy setting, Windows will always use automatic language detection to index (as it did in Windows 7). Using automatic language detection can increase memory usage. We recommend enabling this policy setting only on PCs where documents are stored in many languages.
 - If you disable or do not configure this policy setting, Windows will use automatic language detection only when it can determine the language of a document with high confidence.
 <!-- AlwaysUseAutoLangDetection-Description-End -->
@@ -704,7 +707,7 @@ This policy setting allows you to configure search on the taskbar.
 |:--|:--|
 | Name | ConfigureSearchOnTaskbarMode |
 | Friendly Name | Configures search on the taskbar |
-| Element Name | Search on the taskbar |
+| Element Name | Search on the taskbar. |
 | Location | Computer Configuration |
 | Path | Windows Components > Search |
 | Registry Key Name | Software\Policies\Microsoft\Windows\Windows Search |
@@ -853,7 +856,7 @@ This policy setting configures whether or not locations on removable drives can
 <!-- DisableSearch-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
 <!-- DisableSearch-Applicability-End -->
 
 <!-- DisableSearch-OmaUri-Begin -->
@@ -864,6 +867,7 @@ This policy setting configures whether or not locations on removable drives can
 
 <!-- DisableSearch-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, the Search UI will be disabled along with all its entry points, such as keyboard shortcuts, touchpad gestures, and type-to-search in the Start menu. The Start menu's search box and Search Taskbar button will also be hidden.
 
 - If you disable or don't configure this policy setting, the user will be able to open the Search UI and its different entry points will be shown.
@@ -929,13 +933,13 @@ This policy setting configures whether or not locations on removable drives can
 
 <!-- DoNotUseWebResults-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search.
+This policy setting allows you to control whether or not Search can perform queries on the web, if web results are displayed in Search, and if search highlights are shown in the search box and in search home.
 
-- If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search.
+- If you enable this policy setting, queries won't be performed on the web, web results won't be displayed when a user performs a query in Search, and search highlights will not be shown in the search box and in search home.
 
-- If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search.
+- If you disable this policy setting, queries will be performed on the web, web results will be displayed when a user performs a query in Search, and search highlights will be shown in the search box and in search home.
 
-- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search.
+- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search, and if search highlights are shown in the search box and in search home.
 <!-- DoNotUseWebResults-Description-End -->
 
 <!-- DoNotUseWebResults-Editable-Begin -->
@@ -1109,10 +1113,13 @@ If enabled, clients will be unable to query this computer's index remotely. Thus
 <!-- SafeSearchPermissions-Begin -->
 ## SafeSearchPermissions
 
+> [!NOTE]
+> This policy is deprecated and may be removed in a future release.
+
 <!-- SafeSearchPermissions-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
 <!-- SafeSearchPermissions-Applicability-End -->
 
 <!-- SafeSearchPermissions-OmaUri-Begin -->
@@ -1122,7 +1129,8 @@ If enabled, clients will be unable to query this computer's index remotely. Thus
 <!-- SafeSearchPermissions-OmaUri-End -->
 
 <!-- SafeSearchPermissions-Description-Begin -->
-<!-- Description-Source-Not-Found -->
+<!-- Description-Source-DDF -->
+This policy is deprecated.
 <!-- SafeSearchPermissions-Description-End -->
 
 <!-- SafeSearchPermissions-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md
index f4b72810bf..da0b3fb337 100644
--- a/windows/client-management/mdm/policy-csp-security.md
+++ b/windows/client-management/mdm/policy-csp-security.md
@@ -4,7 +4,7 @@ description: Learn more about the Security Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -302,7 +302,7 @@ This policy setting configures the system to prompt the user to clear the TPM if
 
 <!-- ConfigureWindowsPasswords-Description-Begin -->
 <!-- Description-Source-DDF -->
-Configures the use of passwords for Windows features
+Configures the use of passwords for Windows features.
 <!-- ConfigureWindowsPasswords-Description-End -->
 
 <!-- ConfigureWindowsPasswords-Editable-Begin -->
@@ -578,7 +578,7 @@ Specifies whether provisioning packages must have a certificate signed by a devi
 
 <!-- RequireRetrieveHealthCertificateOnBoot-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. Setting this policy to 1 (Required)Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2. 0. Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification
+Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. Setting this policy to 1 (Required):Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2. 0. Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification.
 
 > [!NOTE]
 > We recommend that this policy is set to Required after MDM enrollment. Most restricted value is 1.
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md
index e26697bc7e..4102db4c23 100644
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@@ -4,7 +4,7 @@ description: Learn more about the Settings Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowAutoPlay-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allows the user to change Auto Play settings
+Allows the user to change Auto Play settings.
 
 > [!NOTE]
 > Setting this policy to 0 (Not allowed) does not affect the autoplay dialog box that appears when a device is connected.
@@ -287,8 +287,10 @@ Allows the user to change the language settings.
 <!-- AllowOnlineTips-OmaUri-End -->
 
 <!-- AllowOnlineTips-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables or disables the retrieval of online tips and help for the Settings app. If disabled, Settings will not contact Microsoft content services to retrieve tips and help content.
+<!-- Description-Source-ADMX -->
+Enables or disables the retrieval of online tips and help for the Settings app.
+
+If disabled, Settings will not contact Microsoft content services to retrieve tips and help content.
 <!-- AllowOnlineTips-Description-End -->
 
 <!-- AllowOnlineTips-Editable-Begin -->
@@ -719,8 +721,22 @@ By default, the calendar is set according to the locale of the operating system,
 <!-- PageVisibilityList-OmaUri-End -->
 
 <!-- PageVisibilityList-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string showonly or hide. Pages are identified by a shortened version of their already published URIs, which is the URI minus the ms-settings prefix. For example, if the URI for a settings page is ms-settingsbluetooth, the page identifier used in the policy will be just bluetooth. Multiple page identifiers are separated by semicolons. The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI ms-settingsabout and ms-settingsbluetooth respectivelyshowonlyabout;bluetooth. If the policy is not specified, the behavior will be that no pages are affected. If the policy string is formatted incorrectly, it will be ignored entirely (i. e. treated as not set) to prevent the machine from becoming unserviceable if data corruption occurs. **Note** that if a page is already hidden for another reason, then it will remain hidden even if it is in a showonly list. The format of the PageVisibilityList value is as follows The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. There are two variants one that shows only the given pages and one which hides the given pages. The first variant starts with the string showonly and the second with the string hide. Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. Each page identifier is the ms-settingsxyz URI for the page, minus the ms-settings prefix, so the identifier for the page with URI ms-settingsnetwork-wifi would be just network-wifi. The default value for this setting is an empty string, which is interpreted as show everything. Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settingsnetwork-wifi and ms-settingsbluetooth). All other pages (and the categories they're in) will be hiddenshowonlynetwork-wifi;bluetooth. Example 2, specifies that the wifi page should not be shownhidenetwork-wifi
+<!-- Description-Source-ADMX -->
+Specifies the list of pages to show or hide from the System Settings app.
+
+This policy allows an administrator to block a given set of pages from the System Settings app. Blocked pages will not be visible in the app, and if all pages in a category are blocked the category will be hidden as well. Direct navigation to a blocked page via URI, context menu in Explorer or other means will result in the front page of Settings being shown instead.
+
+This policy has two modes: it can either specify a list of settings pages to show or a list of pages to hide. To specify a list of pages to show, the policy string must begin with "showonly:" (without quotes), and to specify a list of pages to hide, it must begin with "hide:". If a page in a showonly list would normally be hidden for other reasons (such as a missing hardware device), this policy will not force that page to appear. After this, the policy string must contain a semicolon-delimited list of settings page identifiers. The identifier for any given settings page is the published URI for that page, minus the "ms-settings:" protocol part.
+
+Example: to specify that only the About and Bluetooth pages should be shown (their respective URIs are ms-settings:about and ms-settings:bluetooth) and all other pages hidden:
+
+showonly:about;bluetooth
+
+Example: to specify that only the Bluetooth page (which has URI ms-settings:bluetooth) should be hidden:
+
+hide:bluetooth
+
+The availability of per-user support is documented here: <https://go.microsoft.com/fwlink/?linkid=2102995>
 <!-- PageVisibilityList-Description-End -->
 
 <!-- PageVisibilityList-Editable-Begin -->
@@ -751,7 +767,7 @@ To validate this policy, use the following steps:
 |:--|:--|
 | Name | SettingsPageVisibility |
 | Friendly Name | Settings Page Visibility |
-| Element Name | Settings Page Visibility |
+| Element Name | Settings Page Visibility. |
 | Location | Computer and User Configuration |
 | Path | Control Panel |
 | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md
index e0f18ffd48..c879d37038 100644
--- a/windows/client-management/mdm/policy-csp-settingssync.md
+++ b/windows/client-management/mdm/policy-csp-settingssync.md
@@ -4,7 +4,7 @@ description: Learn more about the SettingsSync Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -21,6 +21,9 @@ ms.topic: reference
 >
 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it.  For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- SettingsSync-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- SettingsSync-Editable-End -->
@@ -44,7 +47,7 @@ ms.topic: reference
 <!-- Description-Source-ADMX -->
 Prevent the "accessibility" group from syncing to and from this PC. This turns off and disables the "accessibility" group on the "Windows backup" settings page in PC settings.
 
-- If you enable this policy setting, the "accessibility", group will not be synced.
+If you enable this policy setting, the "accessibility", group will not be synced.
 
 Use the option "Allow users to turn accessibility syncing on" so that syncing is turned off by default but not disabled.
 
diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md
index 907c344a75..8c3978aae7 100644
--- a/windows/client-management/mdm/policy-csp-smartscreen.md
+++ b/windows/client-management/mdm/policy-csp-smartscreen.md
@@ -4,7 +4,7 @@ description: Learn more about the SmartScreen Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -193,8 +193,23 @@ Some information is sent to Microsoft about files and programs run on PCs with t
 <!-- PreventOverrideForFilesInShell-OmaUri-End -->
 
 <!-- PreventOverrideForFilesInShell-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows IT Admins to control whether users can ignore SmartScreen warnings and run malicious files.
+<!-- Description-Source-ADMX -->
+This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that do not appear to be suspicious.
+
+Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.
+
+- If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options:
+
+- Warn and prevent bypass
+- Warn
+
+- If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app.
+
+- If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app.
+
+- If you disable this policy, SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet.
+
+- If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings.
 <!-- PreventOverrideForFilesInShell-Description-End -->
 
 <!-- PreventOverrideForFilesInShell-Editable-Begin -->
@@ -227,7 +242,7 @@ Allows IT Admins to control whether users can ignore SmartScreen warnings and ru
 |:--|:--|
 | Name | ShellConfigureSmartScreen |
 | Friendly Name | Configure Windows Defender SmartScreen |
-| Element Name | Pick one of the following settings |
+| Element Name | Pick one of the following settings. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Defender SmartScreen > Explorer |
 | Registry Key Name | Software\Policies\Microsoft\Windows\System |
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md
index f0db80b75a..19a927a634 100644
--- a/windows/client-management/mdm/policy-csp-start.md
+++ b/windows/client-management/mdm/policy-csp-start.md
@@ -4,7 +4,7 @@ description: Learn more about the Start Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -601,7 +601,7 @@ This string policy takes a JSON file named `LayoutModification.json`. The file e
 <!-- Description-Source-ADMX -->
 This policy allows you to prevent users from being able to open context menus in the Start Menu.
 
-- If you enable this policy, then invocations of context menus within the Start Menu will be ignored.
+If you enable this policy, then invocations of context menus within the Start Menu will be ignored.
 <!-- DisableContextMenus-Description-End -->
 
 <!-- DisableContextMenus-Editable-Begin -->
@@ -668,7 +668,7 @@ This policy setting removes Quick Settings from the bottom right area on the tas
 
 The quick settings area is located at the left of the clock in the taskbar and includes icons for current network and volume.
 
-- If this setting is enabled, Quick Settings is not displayed in the quick settings area.
+If this setting is enabled, Quick Settings is not displayed in the quick settings area.
 
 A reboot is required for this policy setting to take effect.
 <!-- DisableControlCenter-Description-End -->
@@ -732,6 +732,7 @@ A reboot is required for this policy setting to take effect.
 
 <!-- DisableEditingQuickSettings-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, the user will be unable to modify Quick Settings.
 
 - If you disable or don't configure this policy setting, the user will be able to edit Quick Settings, such as pinning or unpinning buttons.
@@ -801,6 +802,7 @@ A reboot is required for this policy setting to take effect.
 
 <!-- ForceStartSize-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy and set it to Start menu or full screen Start, Start will be that size and users will be unable to change the size of Start in Settings.
 
 - If you disable or don't configure this policy setting, Windows will automatically select the size based on hardware form factor and users will be able to change the size of Start in Settings.
@@ -993,6 +995,7 @@ Enabling this policy hides "Change account settings" from appearing in the user
 
 <!-- HideFrequentlyUsedApps-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this setting, the frequently used programs list is removed from the Start menu.
 
 - If you disable this setting or do not configure it, the frequently used programs list remains on the simple Start menu.
@@ -1174,7 +1177,7 @@ Enabling this policy hides "Lock" from appearing in the user tile in the start m
 <!-- Description-Source-ADMX -->
 This policy allows you to remove the People Bar from the taskbar and disables the My People experience.
 
-- If you enable this policy the people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar.
+If you enable this policy the people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar.
 <!-- HidePeopleBar-Description-End -->
 
 <!-- HidePeopleBar-Editable-Begin -->
@@ -1363,7 +1366,7 @@ To validate this policy, do the following steps:
 <!-- Description-Source-ADMX -->
 This policy allows you to prevent the Start Menu from displaying a list of recently installed applications.
 
-- If you enable this policy, the Start Menu will no longer display the "Recently added" list. The corresponding setting will also be disabled in Settings.
+If you enable this policy, the Start Menu will no longer display the "Recently added" list. The corresponding setting will also be disabled in Settings.
 <!-- HideRecentlyAddedApps-Description-End -->
 
 <!-- HideRecentlyAddedApps-Editable-Begin -->
@@ -1444,7 +1447,7 @@ To validate this policy, do the following steps:
 <!-- Description-Source-ADMX -->
 This policy allows you to prevent the Start Menu from displaying a list of recommended applications and files.
 
-- If you enable this policy setting, the Start Menu will no longer show the section containing a list of recommended files and apps.
+If you enable this policy setting, the Start Menu will no longer show the section containing a list of recommended files and apps.
 <!-- HideRecommendedSection-Description-End -->
 
 <!-- HideRecommendedSection-Editable-Begin -->
@@ -1490,6 +1493,68 @@ This policy allows you to prevent the Start Menu from displaying a list of recom
 
 <!-- HideRecommendedSection-End -->
 
+<!-- HideRecoPersonalizedSites-Begin -->
+## HideRecoPersonalizedSites
+
+<!-- HideRecoPersonalizedSites-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | <!-- Not-Found --> |
+<!-- HideRecoPersonalizedSites-Applicability-End -->
+
+<!-- HideRecoPersonalizedSites-OmaUri-Begin -->
+```User
+./User/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites
+```
+
+```Device
+./Device/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites
+```
+<!-- HideRecoPersonalizedSites-OmaUri-End -->
+
+<!-- HideRecoPersonalizedSites-Description-Begin -->
+<!-- Description-Source-DDF -->
+This policy setting allows you to hide the personalized websites in the recommended section of the Start Menu. If you enable this policy setting, the Start Menu will no longer show personalized website recommendations in the recommended section of the start menu.
+<!-- HideRecoPersonalizedSites-Description-End -->
+
+<!-- HideRecoPersonalizedSites-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- HideRecoPersonalizedSites-Editable-End -->
+
+<!-- HideRecoPersonalizedSites-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- HideRecoPersonalizedSites-DFProperties-End -->
+
+<!-- HideRecoPersonalizedSites-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Personalized Website Recommendations shown. |
+| 1 | Personalized Website Recommendations hidden. |
+<!-- HideRecoPersonalizedSites-AllowedValues-End -->
+
+<!-- HideRecoPersonalizedSites-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | HideRecoPersonalizedSites |
+| Path | StartMenu > AT > StartMenu |
+<!-- HideRecoPersonalizedSites-GpMapping-End -->
+
+<!-- HideRecoPersonalizedSites-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- HideRecoPersonalizedSites-Examples-End -->
+
+<!-- HideRecoPersonalizedSites-End -->
+
 <!-- HideRestart-Begin -->
 ## HideRestart
 
@@ -1759,7 +1824,7 @@ Enabling this policy hides "Switch account" from appearing in the user tile in t
 <!-- Description-Source-ADMX -->
 This policy setting allows you to hide the TaskView button.
 
-- If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled.
+If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled.
 <!-- HideTaskViewButton-Description-End -->
 
 <!-- HideTaskViewButton-Editable-Begin -->
@@ -1931,6 +1996,7 @@ To validate this policy, do the following steps:
 <!-- NoPinningToTaskbar-Description-Begin -->
 <!-- Description-Source-DDF -->
 This policy setting allows you to control pinning programs to the Taskbar.
+
 - If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar.
 - If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar.
 <!-- NoPinningToTaskbar-Description-End -->
@@ -1993,6 +2059,7 @@ To validate this policy, do the following steps:
 
 <!-- ShowOrHideMostUsedApps-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy setting, you can configure Start menu to show or hide the list of user's most used apps, regardless of user settings.
 
 Selecting "Show" will force the "Most used" list to be shown, and user cannot change to hide it using the Settings app.
@@ -2064,6 +2131,7 @@ Selecting "Not Configured", or if you disable or do not configure this policy se
 
 <!-- SimplifyQuickSettings-Description-Begin -->
 <!-- Description-Source-ADMX -->
+
 - If you enable this policy, Quick Settings will be reduced to only having the WiFi, Bluetooth, Accessibility, and VPN buttons; the brightness and volume sliders; and battery indicator and link to the Settings app.
 
 - If you disable or don't configure this policy setting, the regular Quick Settings layout will appear whenever Quick Settings is invoked.
@@ -2140,7 +2208,7 @@ To use this setting, you must first manually configure a device's Start layout t
 
 Once the XML file is generated and moved to the desired file path, type the fully qualified path and name of the XML file. You can type a local path, such as C:\StartLayouts\myLayout.xml or a UNC path, such as \\Server\Share\Layout.xml. If the specified file is not available when the user logs on, the layout won't be changed. Users cannot customize their Start screen while this setting is enabled.
 
-- If you disable this setting or do not configure it, the Start screen layout won't be changed and users will be able to customize it.
+If you disable this setting or do not configure it, the Start screen layout won't be changed and users will be able to customize it.
 <!-- StartLayout-Description-End -->
 
 <!-- StartLayout-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md
index b466e095ca..c977508f6e 100644
--- a/windows/client-management/mdm/policy-csp-stickers.md
+++ b/windows/client-management/mdm/policy-csp-stickers.md
@@ -4,7 +4,7 @@ description: Learn more about the Stickers Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -26,7 +26,7 @@ ms.topic: reference
 <!-- EnableStickers-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later |
 <!-- EnableStickers-Applicability-End -->
 
 <!-- EnableStickers-OmaUri-Begin -->
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- EnableStickers-Description-Begin -->
 <!-- Description-Source-DDF -->
-This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop
+This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop.
 <!-- EnableStickers-Description-End -->
 
 <!-- EnableStickers-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md
index fd1abf6088..3af6abb66f 100644
--- a/windows/client-management/mdm/policy-csp-system.md
+++ b/windows/client-management/mdm/policy-csp-system.md
@@ -4,7 +4,7 @@ description: Learn more about the System Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -21,6 +21,9 @@ ms.topic: reference
 >
 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it.  For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- System-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- System-Editable-End -->
@@ -112,14 +115,14 @@ This policy is only supported up to Windows 10, Version 1703. Please use 'Manage
 
 <!-- AllowCommercialDataPipeline-Description-Begin -->
 <!-- Description-Source-ADMX -->
-AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at <https://go.microsoft.com/fwlink/?linkid=2185086>.
+AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
 To enable this behavior:
 
 1. Enable this policy setting
 2. Join an Azure Active Directory account to the device
 
 Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting does not change the Windows diagnostic data collection level set for the device
-- If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at <https://go.microsoft.com/fwlink/?LinkId=521839> unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing".
+If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at <https://go.microsoft.com/fwlink/?LinkId=521839> unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing".
 See the documentation at <https://go.microsoft.com/fwlink/?linkid=2011107> for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data.
 <!-- AllowCommercialDataPipeline-Description-End -->
 
@@ -187,7 +190,7 @@ See the documentation at <https://go.microsoft.com/fwlink/?linkid=2011107> for i
 
 <!-- AllowDesktopAnalyticsProcessing-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at <https://go.microsoft.com/fwlink/?linkid=2185086>.
+This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
 To enable this behavior:
 
 1. Enable this policy setting
@@ -197,8 +200,7 @@ To enable this behavior:
 4. Set the Configure the Commercial ID setting for your Desktop Analytics workspace
 
 When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
-This setting has no effect on devices unless they are properly enrolled in Desktop Analytics.
-- If you disable this policy setting, devices will not appear in Desktop Analytics.
+This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. If you disable this policy setting, devices will not appear in Desktop Analytics.
 <!-- AllowDesktopAnalyticsProcessing-Description-End -->
 
 <!-- AllowDesktopAnalyticsProcessing-Editable-Begin -->
@@ -264,7 +266,7 @@ This setting has no effect on devices unless they are properly enrolled in Deskt
 <!-- Description-Source-ADMX -->
 This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data.
 
-- If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data.
+If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data.
 <!-- AllowDeviceNameInDiagnosticData-Description-End -->
 
 <!-- AllowDeviceNameInDiagnosticData-Editable-Begin -->
@@ -375,6 +377,7 @@ Specifies whether set general purpose device to be in embedded mode. Most restri
 
 <!-- AllowExperimentation-Description-Begin -->
 <!-- Description-Source-DDF -->
+
 > [!NOTE]
 > This policy is not supported in Windows 10, version 1607. This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior. Most restricted value is 0.
 <!-- AllowExperimentation-Description-End -->
@@ -566,11 +569,10 @@ Specifies whether to allow app access to the Location service. Most restricted v
 <!-- AllowMicrosoftManagedDesktopProcessing-Description-Begin -->
 <!-- Description-Source-DDF -->
 This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows.
-This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at <https://go.microsoft.com/fwlink/?linkid=2185086>.
+This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
 For customers who enroll into the Microsoft Managed Desktop service, enabling this policy is required to allow Microsoft to process data for operational and analytic needs. See <https://go.microsoft.com/fwlink/?linkid=2184944> for more information.
 hen these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
-This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop.
-- If you disable this policy setting, devices may not appear in Microsoft Managed Desktop.
+This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. If you disable this policy setting, devices may not appear in Microsoft Managed Desktop.
 <!-- AllowMicrosoftManagedDesktopProcessing-Description-End -->
 
 <!-- AllowMicrosoftManagedDesktopProcessing-Editable-Begin -->
@@ -680,7 +682,7 @@ By configuring this policy setting you can adjust what diagnostic data is collec
 - Send required diagnostic data. This is the minimum diagnostic data necessary to keep Windows secure, up to date, and performing as expected. Using this value disables the "Optional diagnostic data" control in the Settings app.
 - Send optional diagnostic data. Additional diagnostic data is collected that helps us to detect, diagnose and fix issues, as well as make product improvements. Required diagnostic data will always be included when you choose to send optional diagnostic data. Optional diagnostic data can also include diagnostic log files and crash dumps. Use the "Limit Dump Collection" and the "Limit Diagnostic Log Collection" policies for more granular control of what optional diagnostic data is sent.
 
-- If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app.
+If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app.
 
 **Note**:
 The "Configure diagnostic data opt-in settings user interface" group policy can be used to prevent end users from changing their data collection settings.
@@ -703,7 +705,12 @@ The "Configure diagnostic data opt-in settings user interface" group policy can
 <!-- AllowTelemetry-AllowedValues-Begin -->
 **Allowed values**:
 
-<hr/>
+| Value | Description |
+|:--|:--|
+| 0 | Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.<br>Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. |
+| 1 (Default) | Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level. |
+| 3 | Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels. |
+<!-- AllowTelemetry-AllowedValues-End -->
 
 <!-- AllowTelemetry-GpMapping-Begin -->
 **Group policy mapping**:
@@ -741,7 +748,7 @@ The "Configure diagnostic data opt-in settings user interface" group policy can
 
 <!-- AllowUpdateComplianceProcessing-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at <https://go.microsoft.com/fwlink/?linkid=2185086>.
+This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
 To enable this behavior:
 
 1. Enable this policy setting
@@ -751,7 +758,7 @@ To enable this behavior:
 4. Set the Configure the Commercial ID setting for your Update Compliance workspace
 
 When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
-- If you disable or do not configure this policy setting, devices will not appear in Update Compliance.
+If you disable or do not configure this policy setting, devices will not appear in Update Compliance.
 <!-- AllowUpdateComplianceProcessing-Description-End -->
 
 <!-- AllowUpdateComplianceProcessing-Editable-Begin -->
@@ -864,7 +871,7 @@ Specifies whether to allow the user to factory reset the device by using control
 
 <!-- AllowWUfBCloudProcessing-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at <https://go.microsoft.com/fwlink/?linkid=2185086>.
+This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>.
 To enable this behavior:
 
 1. Enable this policy setting
@@ -873,7 +880,7 @@ To enable this behavior:
 3. Set Allow Telemetry to value 1 - Required, or higher
 
 When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments.
-- If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features.
+If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features.
 <!-- AllowWUfBCloudProcessing-Description-End -->
 
 <!-- AllowWUfBCloudProcessing-Editable-Begin -->
@@ -938,10 +945,10 @@ When these policies are configured, Windows diagnostic data collected from the d
 <!-- BootStartDriverInitialization-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:
-- Good: The driver has been signed and has not been tampered with.
-- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.
-- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
-- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.
+  - Good: The driver has been signed and has not been tampered with.
+  - Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.
+  - Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
+  - Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.
 
 - If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.
 
@@ -1029,7 +1036,7 @@ The value for this setting will be provided by Microsoft as part of the onboardi
 |:--|:--|
 | Name | ConfigureMicrosoft365UploadEndpoint |
 | Friendly Name | Configure diagnostic data upload endpoint for Desktop Analytics |
-| Element Name | Desktop Analytics Custom Upload Endpoint |
+| Element Name | Desktop Analytics Custom Upload Endpoint. |
 | Location | Computer Configuration |
 | Path | WindowsComponents > Data Collection and Preview Builds |
 | Registry Key Name | Software\Policies\Microsoft\Windows\DataCollection |
@@ -1129,7 +1136,7 @@ This policy setting determines whether an end user can change diagnostic data se
 
 If you set this policy setting to "Disable diagnostic data opt-in settings", diagnostic data settings are disabled in the Settings app.
 
-- If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app.
+If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app.
 
 **Note**:
 To set a limit on the amount of diagnostic data that is sent to Microsoft by your organization, use the "Allow Diagnostic Data" policy setting.
@@ -1384,8 +1391,7 @@ This group policy allows control over whether the DirectX Database Updater task
 
 <!-- DisableEnterpriseAuthProxy-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10.
-- If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.
+This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.
 <!-- DisableEnterpriseAuthProxy-Description-End -->
 
 <!-- DisableEnterpriseAuthProxy-Editable-Begin -->
@@ -1448,6 +1454,7 @@ This policy setting blocks the Connected User Experience and Telemetry service f
 <!-- DisableOneDriveFileSync-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting lets you prevent apps and features from working with files on OneDrive.
+
 - If you enable this policy setting:
 
 * Users can't access OneDrive from the OneDrive app and file picker.
@@ -1837,7 +1844,7 @@ This policy setting controls whether additional diagnostic logs are collected wh
 
 By enabling this policy setting, diagnostic logs will not be collected.
 
-- If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data.
+If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data.
 <!-- LimitDiagnosticLogCollection-Description-End -->
 
 <!-- LimitDiagnosticLogCollection-Editable-Begin -->
@@ -1903,7 +1910,7 @@ This policy setting limits the type of dumps that can be collected when more inf
 
 By enabling this setting, Windows Error Reporting is limited to sending kernel mini dumps and user mode triage dumps.
 
-- If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data.
+If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data.
 <!-- LimitDumpCollection-Description-End -->
 
 <!-- LimitDumpCollection-Editable-Begin -->
@@ -1975,9 +1982,9 @@ To enable the behavior described above, complete the following steps:
 3. Enable the "Limit Dump Collection" policy
 4. Enable the "Limit Diagnostic Log Collection" policy
 
-When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at <https://go.microsoft.com/fwlink/?linkid=2116020>.
+When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at< https://go.microsoft.com/fwlink/?linkid=2116020>.
 
-- If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app.
+If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app.
 <!-- LimitEnhancedDiagnosticDataWindowsAnalytics-Description-End -->
 
 <!-- LimitEnhancedDiagnosticDataWindowsAnalytics-Editable-Begin -->
@@ -2038,9 +2045,12 @@ When these policies are configured, Microsoft will collect only required diagnos
 <!-- TelemetryProxy-OmaUri-End -->
 
 <!-- TelemetryProxy-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is `<server>`:`<port>`. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
-- If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration.
+<!-- Description-Source-ADMX -->
+With this policy setting, you can forward Connected User Experience and Telemetry requests to a proxy server.
+
+- If you enable this policy setting, you can specify the FQDN or IP address of the destination device within your organization's network (and optionally a port number, if desired). The connection will be made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if you disable or do not configure this policy setting, Connected User Experience and Telemetry data will be sent to Microsoft using the default proxy configuration.
+
+The format for this setting is `<server>`:`<port>`
 <!-- TelemetryProxy-Description-End -->
 
 <!-- TelemetryProxy-Editable-Begin -->
@@ -2063,7 +2073,7 @@ Allows you to specify the fully qualified domain name (FQDN) or IP address of a
 |:--|:--|
 | Name | TelemetryProxy |
 | Friendly Name | Configure Connected User Experiences and Telemetry |
-| Element Name | Proxy Server Name |
+| Element Name | Proxy Server Name. |
 | Location | Computer Configuration |
 | Path | WindowsComponents > Data Collection and Preview Builds |
 | Registry Key Name | Software\Policies\Microsoft\Windows\DataCollection |
diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md
index 6c58c87151..398334874d 100644
--- a/windows/client-management/mdm/policy-csp-taskmanager.md
+++ b/windows/client-management/mdm/policy-csp-taskmanager.md
@@ -4,7 +4,7 @@ description: Learn more about the TaskManager Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowEndTask-Description-Begin -->
 <!-- Description-Source-DDF -->
-This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled
+This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled.
 <!-- AllowEndTask-Description-End -->
 
 <!-- AllowEndTask-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md
index 656d59762c..4d0a66c573 100644
--- a/windows/client-management/mdm/policy-csp-textinput.md
+++ b/windows/client-management/mdm/policy-csp-textinput.md
@@ -4,7 +4,7 @@ description: Learn more about the TextInput Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -86,8 +86,7 @@ Placeholder only. Do not use in production environment.
 
 <!-- AllowIMELogging-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. Most restricted value is 0.
+Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. Most restricted value is 0.
 <!-- AllowIMELogging-Description-End -->
 
 <!-- AllowIMELogging-Editable-Begin -->
@@ -185,8 +184,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
 
 <!-- AllowInputPanel-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the IT admin to disable the touch/handwriting keyboard on Windows. Most restricted value is 0.
+Allows the IT admin to disable the touch/handwriting keyboard on Windows. Most restricted value is 0.
 <!-- AllowInputPanel-Description-End -->
 
 <!-- AllowInputPanel-Editable-Begin -->
@@ -235,8 +233,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
 
 <!-- AllowJapaneseIMESurrogatePairCharacters-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the Japanese IME surrogate pair characters. Most restricted value is 0.
+Allows the Japanese IME surrogate pair characters. Most restricted value is 0.
 <!-- AllowJapaneseIMESurrogatePairCharacters-Description-End -->
 
 <!-- AllowJapaneseIMESurrogatePairCharacters-Editable-Begin -->
@@ -285,8 +282,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
 
 <!-- AllowJapaneseIVSCharacters-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows Japanese Ideographic Variation Sequence (IVS) characters. Most restricted value is 0.
+Allows Japanese Ideographic Variation Sequence (IVS) characters. Most restricted value is 0.
 <!-- AllowJapaneseIVSCharacters-Description-End -->
 
 <!-- AllowJapaneseIVSCharacters-Editable-Begin -->
@@ -335,8 +331,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
 
 <!-- AllowJapaneseNonPublishingStandardGlyph-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the Japanese non-publishing standard glyph. Most restricted value is 0.
+Allows the Japanese non-publishing standard glyph. Most restricted value is 0.
 <!-- AllowJapaneseNonPublishingStandardGlyph-Description-End -->
 
 <!-- AllowJapaneseNonPublishingStandardGlyph-Editable-Begin -->
@@ -385,8 +380,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
 
 <!-- AllowJapaneseUserDictionary-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the Japanese user dictionary. Most restricted value is 0.
+Allows the Japanese user dictionary. Most restricted value is 0.
 <!-- AllowJapaneseUserDictionary-Description-End -->
 
 <!-- AllowJapaneseUserDictionary-Editable-Begin -->
@@ -435,8 +429,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration
 
 <!-- AllowKeyboardTextSuggestions-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled. Most restricted value is 0.
+Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled. Most restricted value is 0.
 <!-- AllowKeyboardTextSuggestions-Description-End -->
 
 <!-- AllowKeyboardTextSuggestions-Editable-Begin -->
@@ -1005,8 +998,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh
 
 <!-- ExcludeJapaneseIMEExceptJIS0208-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter.
+Allows the users to restrict character code range of conversion by setting the character filter.
 <!-- ExcludeJapaneseIMEExceptJIS0208-Description-End -->
 
 <!-- ExcludeJapaneseIMEExceptJIS0208-Editable-Begin -->
@@ -1055,8 +1047,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh
 
 <!-- ExcludeJapaneseIMEExceptJIS0208andEUDC-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter.
+Allows the users to restrict character code range of conversion by setting the character filter.
 <!-- ExcludeJapaneseIMEExceptJIS0208andEUDC-Description-End -->
 
 <!-- ExcludeJapaneseIMEExceptJIS0208andEUDC-Editable-Begin -->
@@ -1105,8 +1096,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh
 
 <!-- ExcludeJapaneseIMEExceptShiftJIS-Description-Begin -->
 <!-- Description-Source-DDF -->
-> [!NOTE]
-> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter.
+Allows the users to restrict character code range of conversion by setting the character filter.
 <!-- ExcludeJapaneseIMEExceptShiftJIS-Description-End -->
 
 <!-- ExcludeJapaneseIMEExceptShiftJIS-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index 6aac2cbd12..28b396eb2f 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/03/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -26,7 +26,6 @@ ms.topic: reference
 Update CSP policies are listed below based on the group policy area:
 
 - [Windows Insider Preview](#windows-insider-preview)
-  - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol)
   - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates)
   - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates)
 - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update)
@@ -63,6 +62,7 @@ Update CSP policies are listed below based on the group policy area:
   - [AllowAutoUpdate](#allowautoupdate)
   - [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](#allowautowindowsupdatedownloadovermeterednetwork)
   - [AllowMUUpdateService](#allowmuupdateservice)
+  - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol)
   - [ConfigureDeadlineForFeatureUpdates](#configuredeadlineforfeatureupdates)
   - [ConfigureDeadlineForQualityUpdates](#configuredeadlineforqualityupdates)
   - [ConfigureDeadlineGracePeriod](#configuredeadlinegraceperiod)
@@ -107,75 +107,6 @@ Update CSP policies are listed below based on the group policy area:
 
 ## Windows Insider Preview
 
-<!-- AllowTemporaryEnterpriseFeatureControl-Begin -->
-### AllowTemporaryEnterpriseFeatureControl
-
-<!-- AllowTemporaryEnterpriseFeatureControl-Applicability-Begin -->
-| Scope | Editions | Applicable OS |
-|:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
-<!-- AllowTemporaryEnterpriseFeatureControl-Applicability-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-OmaUri-Begin -->
-```Device
-./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl
-```
-<!-- AllowTemporaryEnterpriseFeatureControl-OmaUri-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-Description-Begin -->
-<!-- Description-Source-ADMX -->
-Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*.
-
-- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on.
-
-- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed.
-
-*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS).
-<!-- AllowTemporaryEnterpriseFeatureControl-Description-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-Editable-Begin -->
-<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- AllowTemporaryEnterpriseFeatureControl-Editable-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-DFProperties-Begin -->
-**Description framework properties**:
-
-| Property name | Property value |
-|:--|:--|
-| Format | int |
-| Access Type | Add, Delete, Get, Replace |
-| Default Value  | 0 |
-<!-- AllowTemporaryEnterpriseFeatureControl-DFProperties-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-AllowedValues-Begin -->
-**Allowed values**:
-
-| Value | Description |
-|:--|:--|
-| 0 (Default) | Not allowed. |
-| 1 | Allowed. |
-<!-- AllowTemporaryEnterpriseFeatureControl-AllowedValues-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-GpMapping-Begin -->
-**Group policy mapping**:
-
-| Name | Value |
-|:--|:--|
-| Name | AllowTemporaryEnterpriseFeatureControl |
-| Friendly Name | Enable features introduced via servicing that are off by default |
-| Location | Computer Configuration |
-| Path | Windows Components > Windows Update > Manage end user experience |
-| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
-| Registry Value Name | AllowTemporaryEnterpriseFeatureControl |
-| ADMX File Name | WindowsUpdate.admx |
-<!-- AllowTemporaryEnterpriseFeatureControl-GpMapping-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-Examples-Begin -->
-<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- AllowTemporaryEnterpriseFeatureControl-Examples-End -->
-
-<!-- AllowTemporaryEnterpriseFeatureControl-End -->
-
 <!-- ConfigureDeadlineNoAutoRebootForFeatureUpdates-Begin -->
 ### ConfigureDeadlineNoAutoRebootForFeatureUpdates
 
@@ -430,8 +361,12 @@ The maintenance wakeup policy specifies if Automatic Maintenance should make a w
 <!-- BranchReadinessLevel-OmaUri-End -->
 
 <!-- BranchReadinessLevel-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value.
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive Feature Updates.
+
+Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo
+
+Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused.
 <!-- BranchReadinessLevel-Description-End -->
 
 <!-- BranchReadinessLevel-Editable-Begin -->
@@ -496,11 +431,12 @@ Allows the IT admin to set which branch a device receives their updates from. As
 <!-- DeferFeatureUpdatesPeriodInDays-OmaUri-End -->
 
 <!-- DeferFeatureUpdatesPeriodInDays-Description-Begin -->
-<!-- Description-Source-DDF -->
-Defers Feature Updates for the specified number of days. Supported values are 0-365 days.
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive Feature Updates.
 
-> [!IMPORTANT]
-> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703.
+Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo
+
+Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused.
 <!-- DeferFeatureUpdatesPeriodInDays-Description-End -->
 
 <!-- DeferFeatureUpdatesPeriodInDays-Editable-Begin -->
@@ -554,8 +490,16 @@ Defers Feature Updates for the specified number of days. Supported values are 0-
 <!-- DeferQualityUpdatesPeriodInDays-OmaUri-End -->
 
 <!-- DeferQualityUpdatesPeriodInDays-Description-Begin -->
-<!-- Description-Source-DDF -->
-Defers Quality Updates for the specified number of days. Supported values are 0-30.
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive quality updates.
+
+You can defer receiving quality updates for up to 30 days.
+
+To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field.
+
+To resume receiving Quality Updates which are paused, clear the start date field.
+
+If you disable or do not configure this policy, Windows Update will not alter its behavior.
 <!-- DeferQualityUpdatesPeriodInDays-Description-End -->
 
 <!-- DeferQualityUpdatesPeriodInDays-Editable-Begin -->
@@ -580,7 +524,7 @@ Defers Quality Updates for the specified number of days. Supported values are 0-
 |:--|:--|
 | Name | DeferQualityUpdates |
 | Friendly Name | Select when Quality Updates are received |
-| Element Name | After a quality update is released, defer receiving it for this many days |
+| Element Name | After a quality update is released, defer receiving it for this many days. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Update |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -671,7 +615,7 @@ IT admins can, if necessary, opt devices out of safeguard protections using this
 <!-- Description-Source-ADMX -->
 Enable this policy to not include drivers with Windows quality updates.
 
-- If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification.
+If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification.
 <!-- ExcludeWUDriversInQualityUpdate-Description-End -->
 
 <!-- ExcludeWUDriversInQualityUpdate-Editable-Begin -->
@@ -733,8 +677,25 @@ Enable this policy to not include drivers with Windows quality updates.
 <!-- ManagePreviewBuilds-OmaUri-End -->
 
 <!-- ManagePreviewBuilds-Description-Begin -->
-<!-- Description-Source-DDF -->
-Used to manage Windows 10 Insider Preview builds. Value type is integer.
+<!-- Description-Source-ADMX -->
+Enable this policy to manage which updates you receive prior to the update being released to the world.
+
+Dev Channel
+Ideal for highly technical users. Insiders in the Dev Channel will receive builds from our active development branch that is earliest in a development cycle. These builds are not matched to a specific Windows 10 release.
+
+Beta Channel
+Ideal for feature explorers who want to see upcoming Windows 10 features. Your feedback will be especially important here as it will help our engineers ensure key issues are fixed before a major release.
+
+Release Preview Channel (default)
+Insiders in the Release Preview Channel will have access to the upcoming release of Windows 10 prior to it being released to the world. These builds are supported by Microsoft. The Release Preview Channel is where we recommend companies preview and validate upcoming Windows 10 releases before broad deployment within their organization.
+
+Release Preview Channel, Quality Updates Only
+Ideal for those who want to validate the features and fixes coming soon to their current version. Note, released feature updates will continue to be offered in accordance with configured policies when this option is selected.
+
+> [!NOTE]
+> Preview Build enrollment requires a telemetry level setting of 2 or higher and your domain registered on insider.windows.com. For additional information on Preview Builds, see: <https://aka.ms/wipforbiz>
+
+If you disable or do not configure this policy, Windows Update will not offer you any pre-release updates and you will receive such content once released to the world. Disabling this policy will cause any devices currently on a pre-release build to opt out and stay on the latest Feature Update once released.
 <!-- ManagePreviewBuilds-Description-End -->
 
 <!-- ManagePreviewBuilds-Editable-Begin -->
@@ -797,8 +758,12 @@ Used to manage Windows 10 Insider Preview builds. Value type is integer.
 <!-- PauseFeatureUpdates-OmaUri-End -->
 
 <!-- PauseFeatureUpdates-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows IT Admins to pause Feature Updates for up to 60 days.
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive Feature Updates.
+
+Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo
+
+Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused.
 <!-- PauseFeatureUpdates-Description-End -->
 
 <!-- PauseFeatureUpdates-Editable-Begin -->
@@ -861,8 +826,12 @@ Allows IT Admins to pause Feature Updates for up to 60 days.
 <!-- PauseFeatureUpdatesStartTime-OmaUri-End -->
 
 <!-- PauseFeatureUpdatesStartTime-Description-Begin -->
-<!-- Description-Source-DDF -->
-Specifies the date and time when the IT admin wants to start pausing the Feature Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28).
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive Feature Updates.
+
+Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo
+
+Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused.
 <!-- PauseFeatureUpdatesStartTime-Description-End -->
 
 <!-- PauseFeatureUpdatesStartTime-Editable-Begin -->
@@ -885,7 +854,7 @@ Specifies the date and time when the IT admin wants to start pausing the Feature
 |:--|:--|
 | Name | DeferFeatureUpdates |
 | Friendly Name | Select when Preview Builds and Feature Updates are received |
-| Element Name | Pause Preview Builds or Feature Updates starting |
+| Element Name | Pause Preview Builds or Feature Updates starting. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Update |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -914,8 +883,16 @@ Specifies the date and time when the IT admin wants to start pausing the Feature
 <!-- PauseQualityUpdates-OmaUri-End -->
 
 <!-- PauseQualityUpdates-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows IT Admins to pause Quality Updates.
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive quality updates.
+
+You can defer receiving quality updates for up to 30 days.
+
+To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field.
+
+To resume receiving Quality Updates which are paused, clear the start date field.
+
+If you disable or do not configure this policy, Windows Update will not alter its behavior.
 <!-- PauseQualityUpdates-Description-End -->
 
 <!-- PauseQualityUpdates-Editable-Begin -->
@@ -978,8 +955,16 @@ Allows IT Admins to pause Quality Updates.
 <!-- PauseQualityUpdatesStartTime-OmaUri-End -->
 
 <!-- PauseQualityUpdatesStartTime-Description-Begin -->
-<!-- Description-Source-DDF -->
-Specifies the date and time when the IT admin wants to start pausing the Quality Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28).
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when to receive quality updates.
+
+You can defer receiving quality updates for up to 30 days.
+
+To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field.
+
+To resume receiving Quality Updates which are paused, clear the start date field.
+
+If you disable or do not configure this policy, Windows Update will not alter its behavior.
 <!-- PauseQualityUpdatesStartTime-Description-End -->
 
 <!-- PauseQualityUpdatesStartTime-Editable-Begin -->
@@ -1004,7 +989,7 @@ Specifies the date and time when the IT admin wants to start pausing the Quality
 |:--|:--|
 | Name | DeferQualityUpdates |
 | Friendly Name | Select when Quality Updates are received |
-| Element Name | Pause Quality Updates starting |
+| Element Name | Pause Quality Updates starting. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Update |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1033,8 +1018,16 @@ Specifies the date and time when the IT admin wants to start pausing the Quality
 <!-- ProductVersion-OmaUri-End -->
 
 <!-- ProductVersion-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables IT administrators to specify the product version associated with the target feature update they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows release information](/windows/release-health/release-information).
+<!-- Description-Source-ADMX -->
+Enter the product and version as listed on the Windows Update target version page:
+
+aka.ms/WindowsTargetVersioninfo
+
+The device will request that Windows Update product and version in subsequent scans.
+
+Entering a target product and clicking OK or Apply means I accept the Microsoft Software License Terms for it found at aka.ms/WindowsTargetVersioninfo. If an organization is licensing the software, I am authorized to bind the organization.
+
+If you enter an invalid value, you will remain on your current version until you correct the values to a supported product and version.
 <!-- ProductVersion-Description-End -->
 
 <!-- ProductVersion-Editable-Begin -->
@@ -1064,7 +1057,7 @@ Supported value type is a string containing a Windows product. For example, "Win
 |:--|:--|
 | Name | TargetReleaseVersion |
 | Friendly Name | Select the target Feature Update version |
-| Element Name | Which Windows product version would you like to receive feature updates for? e.g., Windows 10 |
+| Element Name | Which Windows product version would you like to receive feature updates for? e.g., Windows 10. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Update |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1093,8 +1086,16 @@ Supported value type is a string containing a Windows product. For example, "Win
 <!-- TargetReleaseVersion-OmaUri-End -->
 
 <!-- TargetReleaseVersion-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](/windows/release-health/release-information).
+<!-- Description-Source-ADMX -->
+Enter the product and version as listed on the Windows Update target version page:
+
+aka.ms/WindowsTargetVersioninfo
+
+The device will request that Windows Update product and version in subsequent scans.
+
+Entering a target product and clicking OK or Apply means I accept the Microsoft Software License Terms for it found at aka.ms/WindowsTargetVersioninfo. If an organization is licensing the software, I am authorized to bind the organization.
+
+If you enter an invalid value, you will remain on your current version until you correct the values to a supported product and version.
 <!-- TargetReleaseVersion-Description-End -->
 
 <!-- TargetReleaseVersion-Editable-Begin -->
@@ -1118,7 +1119,7 @@ Supported value type is a string containing Windows version number. For example,
 |:--|:--|
 | Name | TargetReleaseVersion |
 | Friendly Name | Select the target Feature Update version |
-| Element Name | Target Version for Feature Updates |
+| Element Name | Target Version for Feature Updates. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Update |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1214,8 +1215,21 @@ Specifies whether the device could use Microsoft Update, Windows Server Update S
 <!-- DetectionFrequency-OmaUri-End -->
 
 <!-- DetectionFrequency-Description-Begin -->
-<!-- Description-Source-DDF -->
-Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours.
+<!-- Description-Source-ADMX -->
+Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is a sum of the specific value and a random variant of 0-4 hours.
+
+If the status is set to Enabled, Windows will check for available updates at the specified interval.
+
+If the status is set to Disabled or Not Configured, Windows will check for available updates at the default interval of 22 hours.
+
+> [!NOTE]
+> The "Specify intranet Microsoft update service location" setting must be enabled for this policy to have effect.
+
+> [!NOTE]
+> If the "Configure Automatic Updates" policy is disabled, this policy has no effect.
+
+> [!NOTE]
+> This policy is not supported on %WINDOWS_ARM_VERSION_6_2%. Setting this policy will not have any effect on %WINDOWS_ARM_VERSION_6_2% PCs.
 <!-- DetectionFrequency-Description-End -->
 
 <!-- DetectionFrequency-Editable-Begin -->
@@ -1273,8 +1287,7 @@ This policy should be enabled only when [UpdateServiceUrl](#updateserviceurl) is
 <!-- DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection-OmaUri-End -->
 
 <!-- DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection-Description-Begin -->
-<!-- Description-Source-ADMX-Element -->
-Do not enforce TLS certificate pinning for Windows Update client for detecting updates.
+<!-- Description-Source-Not-Found -->
 <!-- DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection-Description-End -->
 
 <!-- DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection-Editable-Begin -->
@@ -1680,8 +1693,7 @@ Configure this policy to specify whether to receive **Windows Quality Updates**
 <!-- SetProxyBehaviorForUpdateDetection-OmaUri-End -->
 
 <!-- SetProxyBehaviorForUpdateDetection-Description-Begin -->
-<!-- Description-Source-ADMX-Element -->
-Select the proxy behavior for Windows Update client for detecting updates
+<!-- Description-Source-Not-Found -->
 <!-- SetProxyBehaviorForUpdateDetection-Description-End -->
 
 <!-- SetProxyBehaviorForUpdateDetection-Editable-Begin -->
@@ -1720,7 +1732,7 @@ This policy setting doesn't impact those customers who have, per Microsoft recom
 |:--|:--|
 | Name | CorpWuURL |
 | Friendly Name | Specify intranet Microsoft update service location |
-| Element Name | Select the proxy behavior for Windows Update client for detecting updates |
+| Element Name | Select the proxy behavior for Windows Update client for detecting updates. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1778,7 +1790,7 @@ The following list shows the supported values:
 |:--|:--|
 | Name | CorpWuURL |
 | Friendly Name | Specify intranet Microsoft update service location |
-| Element Name | Set the intranet update service for detecting updates |
+| Element Name | Set the intranet update service for detecting updates. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1825,7 +1837,7 @@ The following list shows the supported values:
 
 <!-- UpdateServiceUrlAlternate-Description-Begin -->
 <!-- Description-Source-DDF -->
-Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
+Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
 
 > [!NOTE]
 > If the Configure Automatic Updates Group Policy is disabled, then this policy has no effect. If the Alternate Download Server Group Policy is not set, it will use the WSUS server by default to download updates. This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.
@@ -1851,7 +1863,7 @@ Specifies an alternate intranet server to host updates from Microsoft Update. Yo
 |:--|:--|
 | Name | CorpWuURL |
 | Friendly Name | Specify intranet Microsoft update service location |
-| Element Name | Set the alternate download server |
+| Element Name | Set the alternate download server. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1882,11 +1894,20 @@ Specifies an alternate intranet server to host updates from Microsoft Update. Yo
 <!-- ActiveHoursEnd-OmaUri-End -->
 
 <!-- ActiveHoursEnd-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time.
+<!-- Description-Source-ADMX -->
 
-> [!NOTE]
-> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange below for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default is 17 (5 PM).
+- If you enable this policy, the PC will not automatically restart after updates during active hours. The PC will attempt to restart outside of active hours.
+
+**Note** that the PC must restart for certain updates to take effect.
+
+- If you disable or do not configure this policy and have no other reboot group policies, the user selected active hours will be in effect.
+
+If any of the following two policies are enabled, this policy has no effect:
+
+1. No auto-restart with logged on users for scheduled automatic updates installations.
+2. Always automatically restart at scheduled time.
+
+**Note** that the default max active hours range is 18 hours from the active hours start time unless otherwise configured via the Specify active hours range for auto-restarts policy.
 <!-- ActiveHoursEnd-Description-End -->
 
 <!-- ActiveHoursEnd-Editable-Begin -->
@@ -1911,7 +1932,7 @@ Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range o
 |:--|:--|
 | Name | ActiveHours |
 | Friendly Name | Turn off auto-restart for updates during active hours |
-| Element Name | End |
+| Element Name | End. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1945,7 +1966,7 @@ Enable this policy to specify the maximum number of hours from the start time th
 
 The max active hours range can be set between 8 and 18 hours.
 
-- If you disable or do not configure this policy, the default max active hours range will be used.
+If you disable or do not configure this policy, the default max active hours range will be used.
 <!-- ActiveHoursMaxRange-Description-End -->
 
 <!-- ActiveHoursMaxRange-Editable-Begin -->
@@ -1970,7 +1991,7 @@ The max active hours range can be set between 8 and 18 hours.
 |:--|:--|
 | Name | ActiveHoursMaxRange |
 | Friendly Name | Specify active hours range for auto-restarts |
-| Element Name | Max range |
+| Element Name | Max range. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -1999,11 +2020,20 @@ The max active hours range can be set between 8 and 18 hours.
 <!-- ActiveHoursStart-OmaUri-End -->
 
 <!-- ActiveHoursStart-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time.
+<!-- Description-Source-ADMX -->
 
-> [!NOTE]
-> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange above for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default value is 8 (8 AM).
+- If you enable this policy, the PC will not automatically restart after updates during active hours. The PC will attempt to restart outside of active hours.
+
+**Note** that the PC must restart for certain updates to take effect.
+
+- If you disable or do not configure this policy and have no other reboot group policies, the user selected active hours will be in effect.
+
+If any of the following two policies are enabled, this policy has no effect:
+
+1. No auto-restart with logged on users for scheduled automatic updates installations.
+2. Always automatically restart at scheduled time.
+
+**Note** that the default max active hours range is 18 hours from the active hours start time unless otherwise configured via the Specify active hours range for auto-restarts policy.
 <!-- ActiveHoursStart-Description-End -->
 
 <!-- ActiveHoursStart-Editable-Begin -->
@@ -2028,7 +2058,7 @@ Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of
 |:--|:--|
 | Name | ActiveHours |
 | Friendly Name | Turn off auto-restart for updates during active hours |
-| Element Name | Start |
+| Element Name | Start. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -2057,8 +2087,41 @@ Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of
 <!-- AllowAutoUpdate-OmaUri-End -->
 
 <!-- AllowAutoUpdate-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to manage automatic update behavior to scan, download, and install updates. Important. This option should be used only for systems under regulatory compliance, as you will not get security updates as well. If the policy is not configured, end-users get the default behavior (Auto install and restart).
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- AllowAutoUpdate-Description-End -->
 
 <!-- AllowAutoUpdate-Editable-Begin -->
@@ -2095,7 +2158,7 @@ Enables the IT admin to manage automatic update behavior to scan, download, and
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Configure automatic updating |
+| Element Name | Configure automatic updating. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2190,8 +2253,41 @@ This policy is accessible through the Update setting in the user interface or Gr
 <!-- AllowMUUpdateService-OmaUri-End -->
 
 <!-- AllowMUUpdateService-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT admin to manage whether to scan for app updates from Microsoft Update.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- AllowMUUpdateService-Description-End -->
 
 <!-- AllowMUUpdateService-Editable-Begin -->
@@ -2231,7 +2327,7 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Install updates for other Microsoft products |
+| Element Name | Install updates for other Microsoft products. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2244,6 +2340,77 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd
 
 <!-- AllowMUUpdateService-End -->
 
+<!-- AllowTemporaryEnterpriseFeatureControl-Begin -->
+### AllowTemporaryEnterpriseFeatureControl
+
+<!-- AllowTemporaryEnterpriseFeatureControl-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621.1344] and later |
+<!-- AllowTemporaryEnterpriseFeatureControl-Applicability-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl
+```
+<!-- AllowTemporaryEnterpriseFeatureControl-OmaUri-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-Description-Begin -->
+<!-- Description-Source-ADMX -->
+Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*.
+
+- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on.
+
+- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed.
+
+*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS).
+<!-- AllowTemporaryEnterpriseFeatureControl-Description-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+> [!NOTE]
+> In Intune, this setting is known as **Allow Temporary Enterprise Feature Control** and is available in the Settings Catalog. By default, all features introduced via servicing that are behind the commercial control are off for Windows-Update-managed devices. When set to Allowed, these features are enabled and turned on. For more information, see [Blog: Commercial control for continuous innovation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/commercial-control-for-continuous-innovation/ba-p/3737575).
+<!-- AllowTemporaryEnterpriseFeatureControl-Editable-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | int |
+| Access Type | Add, Delete, Get, Replace |
+| Default Value  | 0 |
+<!-- AllowTemporaryEnterpriseFeatureControl-DFProperties-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-AllowedValues-Begin -->
+**Allowed values**:
+
+| Value | Description |
+|:--|:--|
+| 0 (Default) | Not allowed. |
+| 1 | Allowed. |
+<!-- AllowTemporaryEnterpriseFeatureControl-AllowedValues-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | AllowTemporaryEnterpriseFeatureControl |
+| Friendly Name | Enable features introduced via servicing that are off by default |
+| Location | Computer Configuration |
+| Path | Windows Components > Windows Update > Manage end user experience |
+| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
+| Registry Value Name | AllowTemporaryEnterpriseFeatureControl |
+| ADMX File Name | WindowsUpdate.admx |
+<!-- AllowTemporaryEnterpriseFeatureControl-GpMapping-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- AllowTemporaryEnterpriseFeatureControl-Examples-End -->
+
+<!-- AllowTemporaryEnterpriseFeatureControl-End -->
+
 <!-- ConfigureDeadlineForFeatureUpdates-Begin -->
 ### ConfigureDeadlineForFeatureUpdates
 
@@ -2518,7 +2685,7 @@ When enabled, devices will not automatically restart outside of active hours unt
 |:--|:--|
 | Name | ComplianceDeadline |
 | Friendly Name | Specify deadlines for automatic updates and restarts |
-| Element Name | Don't auto-restart until end of grace period |
+| Element Name | Don't auto-restart until end of grace period. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -2548,7 +2715,7 @@ When enabled, devices will not automatically restart outside of active hours unt
 
 <!-- ConfigureFeatureUpdateUninstallPeriod-Description-Begin -->
 <!-- Description-Source-DDF -->
-Enable enterprises/IT admin to configure feature update uninstall period
+Enable enterprises/IT admin to configure feature update uninstall period.
 <!-- ConfigureFeatureUpdateUninstallPeriod-Description-End -->
 
 <!-- ConfigureFeatureUpdateUninstallPeriod-Editable-Begin -->
@@ -2632,7 +2799,7 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2
 |:--|:--|
 | Name | UpdateNotificationLevel |
 | Friendly Name | Display options for update notifications |
-| Element Name | Apply only during active hours |
+| Element Name | Apply only during active hours. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -2661,8 +2828,41 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2
 <!-- ScheduledInstallDay-OmaUri-End -->
 
 <!-- ScheduledInstallDay-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to schedule the day of the update installation. The data type is an integer.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallDay-Description-End -->
 
 <!-- ScheduledInstallDay-Editable-Begin -->
@@ -2703,7 +2903,7 @@ Enables the IT admin to schedule the day of the update installation. The data ty
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Scheduled install day |
+| Element Name | Scheduled install day. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2732,8 +2932,41 @@ Enables the IT admin to schedule the day of the update installation. The data ty
 <!-- ScheduledInstallEveryWeek-OmaUri-End -->
 
 <!-- ScheduledInstallEveryWeek-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to schedule the update installation every week. Value type is integer.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallEveryWeek-Description-End -->
 
 <!-- ScheduledInstallEveryWeek-Editable-Begin -->
@@ -2768,7 +3001,7 @@ Enables the IT admin to schedule the update installation every week. Value type
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Every week |
+| Element Name | Every week. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2797,8 +3030,41 @@ Enables the IT admin to schedule the update installation every week. Value type
 <!-- ScheduledInstallFirstWeek-OmaUri-End -->
 
 <!-- ScheduledInstallFirstWeek-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallFirstWeek-Description-End -->
 
 <!-- ScheduledInstallFirstWeek-Editable-Begin -->
@@ -2833,7 +3099,7 @@ Enables the IT admin to schedule the update installation on the first week of th
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | First week of the month |
+| Element Name | First week of the month. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2862,8 +3128,41 @@ Enables the IT admin to schedule the update installation on the first week of th
 <!-- ScheduledInstallFourthWeek-OmaUri-End -->
 
 <!-- ScheduledInstallFourthWeek-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallFourthWeek-Description-End -->
 
 <!-- ScheduledInstallFourthWeek-Editable-Begin -->
@@ -2898,7 +3197,7 @@ Enables the IT admin to schedule the update installation on the fourth week of t
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Fourth week of the month |
+| Element Name | Fourth week of the month. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2927,8 +3226,41 @@ Enables the IT admin to schedule the update installation on the fourth week of t
 <!-- ScheduledInstallSecondWeek-OmaUri-End -->
 
 <!-- ScheduledInstallSecondWeek-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallSecondWeek-Description-End -->
 
 <!-- ScheduledInstallSecondWeek-Editable-Begin -->
@@ -2963,7 +3295,7 @@ Enables the IT admin to schedule the update installation on the second week of t
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Second week of the month |
+| Element Name | Second week of the month. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -2992,8 +3324,41 @@ Enables the IT admin to schedule the update installation on the second week of t
 <!-- ScheduledInstallThirdWeek-OmaUri-End -->
 
 <!-- ScheduledInstallThirdWeek-Description-Begin -->
-<!-- Description-Source-DDF -->
-Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallThirdWeek-Description-End -->
 
 <!-- ScheduledInstallThirdWeek-Editable-Begin -->
@@ -3028,7 +3393,7 @@ Enables the IT admin to schedule the update installation on the third week of th
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Third week of the month |
+| Element Name | Third week of the month. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -3057,8 +3422,41 @@ Enables the IT admin to schedule the update installation on the third week of th
 <!-- ScheduledInstallTime-OmaUri-End -->
 
 <!-- ScheduledInstallTime-Description-Begin -->
-<!-- Description-Source-DDF -->
- the IT admin to schedule the time of the update installation. The data type is an integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3.
+<!-- Description-Source-ADMX -->
+Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.
+
+> [!NOTE]
+> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%.
+
+This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:
+
+2 = Notify before downloading and installing any updates.
+
+When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates.
+
+3 = (Default setting) Download the updates automatically and notify when they are ready to be installed
+
+Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.
+
+4 = Automatically download updates and install them on the schedule specified below.
+
+When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher)
+
+Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)
+
+On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss.
+
+5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions)
+
+With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.
+
+7 = Notify for install and notify for restart. (Windows Server only)
+
+With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.
+
+If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.
+
+If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.
 <!-- ScheduledInstallTime-Description-End -->
 
 <!-- ScheduledInstallTime-Editable-Begin -->
@@ -3087,7 +3485,7 @@ Enables the IT admin to schedule the update installation on the third week of th
 |:--|:--|
 | Name | AutoUpdateCfg |
 | Friendly Name | Configure Automatic Updates |
-| Element Name | Scheduled install time |
+| Element Name | Scheduled install time. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Manage end user experience |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
@@ -3117,7 +3515,7 @@ Enables the IT admin to schedule the update installation on the third week of th
 
 <!-- SetDisablePauseUXAccess-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This setting allows removing access to "Pause updates" feature.
+This setting allows to remove access to "Pause updates" feature.
 
 Once enabled user access to pause updates is removed.
 <!-- SetDisablePauseUXAccess-Description-End -->
@@ -3184,7 +3582,7 @@ Once enabled user access to pause updates is removed.
 <!-- Description-Source-ADMX -->
 This setting allows you to remove access to scan Windows Update.
 
-- If you enable this setting user access to Windows Update scan, download and install is removed.
+If you enable this setting user access to Windows Update scan, download and install is removed.
 <!-- SetDisableUXWUAccess-Description-End -->
 
 <!-- SetDisableUXWUAccess-Editable-Begin -->
@@ -3262,7 +3660,6 @@ The following rules are followed regarding battery power:
 This setting overrides the install deferral behaviour of [AllowAutoUpdate](#allowautoupdate).
 
 These settings are designed for education devices that remain in carts overnight that are left in sleep mode. It is not designed for 1:1 devices.
-
 <!-- SetEDURestart-Editable-End -->
 
 <!-- SetEDURestart-DFProperties-Begin -->
@@ -3399,7 +3796,7 @@ Specify the deadline before the PC will automatically restart to apply updates.
 
 The restart may happen inside active hours.
 
-- If you disable or do not configure this policy, the PC will restart according to the default schedule.
+If you disable or do not configure this policy, the PC will restart according to the default schedule.
 
 Enabling either of the following two policies will override the above policy:
 
@@ -3463,7 +3860,7 @@ Specify the deadline before the PC will automatically restart to apply updates.
 
 The restart may happen inside active hours.
 
-- If you disable or do not configure this policy, the PC will restart according to the default schedule.
+If you disable or do not configure this policy, the PC will restart according to the default schedule.
 
 Enabling either of the following two policies will override the above policy:
 
@@ -3522,8 +3919,12 @@ Enabling either of the following two policies will override the above policy:
 <!-- AutoRestartNotificationSchedule-OmaUri-End -->
 
 <!-- AutoRestartNotificationSchedule-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT Admin to specify the period for auto-restart reminder notifications. The default value is 15 (minutes).
+<!-- Description-Source-ADMX -->
+Enable this policy to specify when auto-restart reminders are displayed.
+
+You can specify the amount of time prior to a scheduled restart to notify the user.
+
+If you disable or do not configure this policy, the default period will be used.
 <!-- AutoRestartNotificationSchedule-Description-End -->
 
 <!-- AutoRestartNotificationSchedule-Editable-Begin -->
@@ -3593,7 +3994,7 @@ Enable this policy to specify the method by which the auto-restart required noti
 
 The method can be set to require user action to dismiss the notification.
 
-- If you disable or do not configure this policy, the default method will be used.
+If you disable or do not configure this policy, the default method will be used.
 <!-- AutoRestartRequiredNotificationDismissal-Description-End -->
 
 <!-- AutoRestartRequiredNotificationDismissal-Editable-Begin -->
@@ -3626,7 +4027,7 @@ The method can be set to require user action to dismiss the notification.
 |:--|:--|
 | Name | AutoRestartRequiredNotificationDismissal |
 | Friendly Name | Configure auto-restart required notification for updates |
-| Element Name | Method |
+| Element Name | Method. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Update > Legacy Policies |
 | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate |
@@ -3803,6 +4204,7 @@ Allows IT Admins to specify additional upgrade delays for up to 8 months. Suppor
 Enable this policy to not allow update deferral policies to cause scans against Windows Update.
 
 If this policy is disabled or not configured, then the Windows Update client may initiate automatic scans against Windows Update while update deferral policies are enabled.
+
 > [!NOTE]
 > This policy applies only when the intranet Microsoft update service this computer is directed to is configured to support client-side targeting. If the "Specify intranet Microsoft update service location" policy is disabled or not configured, this policy has no effect.
 <!-- DisableDualScan-Description-End -->
@@ -3877,14 +4279,14 @@ You can specify the deadline in days before automatically scheduling and executi
 
 If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
 
-- If you disable or do not configure this policy, the PC will restart following the default schedule.
+If you disable or do not configure this policy, the PC will restart following the default schedule.
 
 Enabling any of the following policies will override the above policy:
 
 1. No auto-restart with logged on users for scheduled automatic updates installations
 2. Always automatically restart at scheduled time
 
-3. Specify deadline before auto-restart for update installation
+3. Specify deadline before auto-restart for update installation.
 <!-- EngagedRestartDeadline-Description-End -->
 
 <!-- EngagedRestartDeadline-Editable-Begin -->
@@ -3947,14 +4349,14 @@ You can specify the deadline in days before automatically scheduling and executi
 
 If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
 
-- If you disable or do not configure this policy, the PC will restart following the default schedule.
+If you disable or do not configure this policy, the PC will restart following the default schedule.
 
 Enabling any of the following policies will override the above policy:
 
 1. No auto-restart with logged on users for scheduled automatic updates installations
 2. Always automatically restart at scheduled time
 
-3. Specify deadline before auto-restart for update installation
+3. Specify deadline before auto-restart for update installation.
 <!-- EngagedRestartDeadlineForFeatureUpdates-Description-End -->
 
 <!-- EngagedRestartDeadlineForFeatureUpdates-Editable-Begin -->
@@ -4017,14 +4419,14 @@ You can specify the deadline in days before automatically scheduling and executi
 
 If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
 
-- If you disable or do not configure this policy, the PC will restart following the default schedule.
+If you disable or do not configure this policy, the PC will restart following the default schedule.
 
 Enabling any of the following policies will override the above policy:
 
 1. No auto-restart with logged on users for scheduled automatic updates installations
 2. Always automatically restart at scheduled time
 
-3. Specify deadline before auto-restart for update installation
+3. Specify deadline before auto-restart for update installation.
 <!-- EngagedRestartSnoozeSchedule-Description-End -->
 
 <!-- EngagedRestartSnoozeSchedule-Editable-Begin -->
@@ -4087,14 +4489,14 @@ You can specify the deadline in days before automatically scheduling and executi
 
 If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
 
-- If you disable or do not configure this policy, the PC will restart following the default schedule.
+If you disable or do not configure this policy, the PC will restart following the default schedule.
 
 Enabling any of the following policies will override the above policy:
 
 1. No auto-restart with logged on users for scheduled automatic updates installations
 2. Always automatically restart at scheduled time
 
-3. Specify deadline before auto-restart for update installation
+3. Specify deadline before auto-restart for update installation.
 <!-- EngagedRestartSnoozeScheduleForFeatureUpdates-Description-End -->
 
 <!-- EngagedRestartSnoozeScheduleForFeatureUpdates-Editable-Begin -->
@@ -4157,14 +4559,14 @@ You can specify the deadline in days before automatically scheduling and executi
 
 If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
 
-- If you disable or do not configure this policy, the PC will restart following the default schedule.
+If you disable or do not configure this policy, the PC will restart following the default schedule.
 
 Enabling any of the following policies will override the above policy:
 
 1. No auto-restart with logged on users for scheduled automatic updates installations
 2. Always automatically restart at scheduled time
 
-3. Specify deadline before auto-restart for update installation
+3. Specify deadline before auto-restart for update installation.
 <!-- EngagedRestartTransitionSchedule-Description-End -->
 
 <!-- EngagedRestartTransitionSchedule-Editable-Begin -->
@@ -4227,14 +4629,14 @@ You can specify the deadline in days before automatically scheduling and executi
 
 If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart.
 
-- If you disable or do not configure this policy, the PC will restart following the default schedule.
+If you disable or do not configure this policy, the PC will restart following the default schedule.
 
 Enabling any of the following policies will override the above policy:
 
 1. No auto-restart with logged on users for scheduled automatic updates installations
 2. Always automatically restart at scheduled time
 
-3. Specify deadline before auto-restart for update installation
+3. Specify deadline before auto-restart for update installation.
 <!-- EngagedRestartTransitionScheduleForFeatureUpdates-Description-End -->
 
 <!-- EngagedRestartTransitionScheduleForFeatureUpdates-Editable-Begin -->
@@ -4409,6 +4811,7 @@ To validate this policy:
 
 <!-- PauseDeferrals-Description-Begin -->
 <!-- Description-Source-DDF -->
+
 > [!NOTE]
 > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect.
 <!-- PauseDeferrals-Description-End -->
@@ -4510,6 +4913,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead.
 
 <!-- RequireDeferUpgrade-Description-Begin -->
 <!-- Description-Source-DDF -->
+
 > [!NOTE]
 > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train.
 <!-- RequireDeferUpgrade-Description-End -->
@@ -4570,6 +4974,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead.
 
 <!-- RequireUpdateApproval-Description-Begin -->
 <!-- Description-Source-DDF -->
+
 > [!NOTE]
 > If you previously used the Update/PhoneUpdateRestrictions policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved.
 <!-- RequireUpdateApproval-Description-End -->
@@ -4619,8 +5024,14 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead.
 <!-- ScheduleImminentRestartWarning-OmaUri-End -->
 
 <!-- ScheduleImminentRestartWarning-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT Admin to specify the period for auto-restart imminent warning notifications. The default value is 15 (minutes).
+<!-- Description-Source-ADMX -->
+Enable this policy to control when notifications are displayed to warn users about a scheduled restart for the update installation deadline. Users are not able to postpone the scheduled restart once the deadline has been reached and the restart is automatically executed.
+
+Specifies the amount of time prior to a scheduled restart to display the warning reminder to the user.
+
+You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work.
+
+If you disable or do not configure this policy, the default notification behaviors will be used.
 <!-- ScheduleImminentRestartWarning-Description-End -->
 
 <!-- ScheduleImminentRestartWarning-Editable-Begin -->
@@ -4690,7 +5101,7 @@ Specifies the amount of time prior to a scheduled restart to display the warning
 
 You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work.
 
-- If you disable or do not configure this policy, the default notification behaviors will be used.
+If you disable or do not configure this policy, the default notification behaviors will be used.
 <!-- ScheduleRestartWarning-Description-End -->
 
 <!-- ScheduleRestartWarning-Editable-Begin -->
@@ -4755,8 +5166,12 @@ You can specify the amount of time prior to a scheduled restart to notify the us
 <!-- SetAutoRestartNotificationDisable-OmaUri-End -->
 
 <!-- SetAutoRestartNotificationDisable-Description-Begin -->
-<!-- Description-Source-DDF -->
-Allows the IT Admin to disable auto-restart notifications for update installations.
+<!-- Description-Source-ADMX -->
+This policy setting allows you to control whether users receive notifications for auto restarts for update installations including reminder and warning notifications.
+
+Enable this policy to turn off all auto restart notifications.
+
+If you disable or do not configure this policy, the default notification behaviors will be unchanged.
 <!-- SetAutoRestartNotificationDisable-Description-End -->
 
 <!-- SetAutoRestartNotificationDisable-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md
index 3e96dc09de..113eac5d6c 100644
--- a/windows/client-management/mdm/policy-csp-userrights.md
+++ b/windows/client-management/mdm/policy-csp-userrights.md
@@ -4,7 +4,7 @@ description: Learn more about the UserRights Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- UserRights-Begin -->
 # Policy CSP - UserRights
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- UserRights-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as Security Identifiers (SID) or strings. For more information, see [Well-known SID structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab).
@@ -170,7 +173,7 @@ This user right is used by Credential Manager during Backup/Restore. No accounts
 
 <!-- AccessFromNetwork-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right
+This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.
 
 > [!NOTE]
 > Remote Desktop Services was called Terminal Services in previous versions of Windows Server.
@@ -222,7 +225,7 @@ This user right determines which users and groups are allowed to connect to the
 
 <!-- ActAsPartOfTheOperatingSystem-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned
+This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Only assign this user right to trusted users.
@@ -274,10 +277,10 @@ This user right allows a process to impersonate any user without authentication.
 
 <!-- AllowLocalLogOn-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can log on to the computer
+This user right determines which users can log on to the computer.
 
 > [!NOTE]
-> Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (<https//go.microsoft.com/fwlink/?LinkId=24268> ) at the Microsoft website.
+> Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website.
 <!-- AllowLocalLogOn-Description-End -->
 
 <!-- AllowLocalLogOn-Editable-Begin -->
@@ -326,10 +329,10 @@ This user right determines which users can log on to the computer
 
 <!-- BackupFilesAndDirectories-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the systemTraverse Folder/Execute File, Read
+This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read.
 
 > [!CAUTION]
-> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users
+> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users.
 <!-- BackupFilesAndDirectories-Description-End -->
 
 <!-- BackupFilesAndDirectories-Editable-Begin -->
@@ -534,7 +537,7 @@ This user right determines which users and groups can change the time zone used
 
 <!-- CreateGlobalObjects-Description-Begin -->
 <!-- Description-Source-DDF -->
-This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption
+This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Assign this user right only to trusted users.
@@ -586,7 +589,7 @@ This security setting determines whether users can create global objects that ar
 
 <!-- CreatePageFile-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users
+This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users.
 <!-- CreatePageFile-Description-End -->
 
 <!-- CreatePageFile-Editable-Begin -->
@@ -684,10 +687,10 @@ This user right determines which accounts can be used by processes to create a d
 
 <!-- CreateSymbolicLinks-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines if the user can create a symbolic link from the computer he is logged on to
+This user right determines if the user can create a symbolic link from the computer he is logged on to.
 
 > [!CAUTION]
-> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them
+> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them.
 
 > [!NOTE]
 > This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links.
@@ -739,7 +742,7 @@ This user right determines if the user can create a symbolic link from the compu
 
 <!-- CreateToken-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System
+This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.
@@ -791,7 +794,7 @@ This user right determines which accounts can be used by processes to create a t
 
 <!-- DebugPrograms-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components
+This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Only assign this user right to trusted users.
@@ -892,7 +895,7 @@ This user right determines which users are prevented from accessing a computer o
 
 <!-- DenyLocalLogOn-Description-Begin -->
 <!-- Description-Source-DDF -->
-This security setting determines which service accounts are prevented from registering a process as a service
+This security setting determines which service accounts are prevented from registering a process as a service.
 
 > [!NOTE]
 > This security setting does not apply to the System, Local Service, or Network Service accounts.
@@ -1026,6 +1029,58 @@ This user right determines which users and groups are prohibited from logging on
 
 <!-- DenyRemoteDesktopServicesLogOn-End -->
 
+<!-- DenyServiceLogonRight-Begin -->
+## DenyServiceLogonRight
+
+<!-- DenyServiceLogonRight-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview |
+<!-- DenyServiceLogonRight-Applicability-End -->
+
+<!-- DenyServiceLogonRight-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Policy/Config/UserRights/DenyServiceLogonRight
+```
+<!-- DenyServiceLogonRight-OmaUri-End -->
+
+<!-- DenyServiceLogonRight-Description-Begin -->
+<!-- Description-Source-DDF -->
+This security setting determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies.
+
+> [!NOTE]
+> This security setting does not apply to the System, Local Service, or Network Service accounts. Default: None.
+<!-- DenyServiceLogonRight-Description-End -->
+
+<!-- DenyServiceLogonRight-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- DenyServiceLogonRight-Editable-End -->
+
+<!-- DenyServiceLogonRight-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+| Allowed Values | List (Delimiter: `0xF000`) |
+<!-- DenyServiceLogonRight-DFProperties-End -->
+
+<!-- DenyServiceLogonRight-GpMapping-Begin -->
+**Group policy mapping**:
+
+| Name | Value |
+|:--|:--|
+| Name | Deny log on as a service |
+| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment |
+<!-- DenyServiceLogonRight-GpMapping-End -->
+
+<!-- DenyServiceLogonRight-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- DenyServiceLogonRight-Examples-End -->
+
+<!-- DenyServiceLogonRight-End -->
+
 <!-- EnableDelegation-Begin -->
 ## EnableDelegation
 
@@ -1043,7 +1098,7 @@ This user right determines which users and groups are prohibited from logging on
 
 <!-- EnableDelegation-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set
+This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set.
 
 > [!CAUTION]
 > Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.
@@ -1144,13 +1199,13 @@ This user right determines which accounts can be used by a process to add entrie
 
 <!-- ImpersonateClient-Description-Begin -->
 <!-- Description-Source-DDF -->
-Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels
+Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels.
 
 > [!CAUTION]
-> Assigning this user right can be a security risk. Only assign this user right to trusted users
+> Assigning this user right can be a security risk. Only assign this user right to trusted users.
 
 > [!NOTE]
-> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right
+> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right.
 
 > [!WARNING]
 > If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run.
@@ -1202,7 +1257,7 @@ Assigning this user right to a user allows programs running on behalf of that us
 
 <!-- IncreaseProcessWorkingSet-Description-Begin -->
 <!-- Description-Source-DDF -->
-Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process's working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process
+Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process's working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process.
 
 > [!WARNING]
 > Increasing the working set size for a process decreases the amount of physical memory available to the rest of the system.
@@ -1308,7 +1363,7 @@ This user right determines which accounts can use a process with Write Property
 
 <!-- LoadUnloadDeviceDrivers-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users
+This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.
@@ -1605,7 +1660,7 @@ This user right determines which users and groups can run maintenance tasks on a
 
 <!-- ModifyFirmwareEnvironment-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows
+This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.
 
 > [!NOTE]
 > This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties.
@@ -1902,7 +1957,7 @@ This security setting determines which user accounts can call the CreateProcessA
 
 <!-- RestoreFilesAndDirectories-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the systemTraverse Folder/Execute File, Write
+This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users.
@@ -2003,7 +2058,7 @@ This security setting determines which users who are logged on locally to the co
 
 <!-- TakeOwnership-Description-Begin -->
 <!-- Description-Source-DDF -->
-This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads
+This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.
 
 > [!CAUTION]
 > Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users.
diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md
index 055490b65d..c0ee21c83b 100644
--- a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md
+++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md
@@ -4,7 +4,7 @@ description: Learn more about the VirtualizationBasedTechnology Area in Policy C
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,7 +36,7 @@ ms.topic: reference
 <!-- HypervisorEnforcedCodeIntegrity-OmaUri-End -->
 
 <!-- HypervisorEnforcedCodeIntegrity-Description-Begin -->
-<!-- Description-Source-DDF -->
+<!-- Description-Source-DDF-Forced -->
 Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock, 1 - Turns on Hypervisor-Protected Code Integrity with UEFI lock, 2 - Turns on Hypervisor-Protected Code Integrity without UEFI lock.
 <!-- HypervisorEnforcedCodeIntegrity-Description-End -->
 
@@ -71,7 +71,7 @@ Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Int
 |:--|:--|
 | Name | VirtualizationBasedSecurity |
 | Friendly Name | Turn On Virtualization Based Security |
-| Element Name | Virtualization Based Protection of Code Integrity |
+| Element Name | Virtualization Based Protection of Code Integrity. |
 | Location | Computer Configuration |
 | Path | System > Device Guard |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard |
@@ -100,8 +100,8 @@ Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Int
 <!-- RequireUEFIMemoryAttributesTable-OmaUri-End -->
 
 <!-- RequireUEFIMemoryAttributesTable-Description-Begin -->
-<!-- Description-Source-DDF -->
-Require UEFI Memory Attributes Table
+<!-- Description-Source-DDF-Forced -->
+Require UEFI Memory Attributes Table.
 <!-- RequireUEFIMemoryAttributesTable-Description-End -->
 
 <!-- RequireUEFIMemoryAttributesTable-Editable-Begin -->
@@ -134,7 +134,7 @@ Require UEFI Memory Attributes Table
 |:--|:--|
 | Name | VirtualizationBasedSecurity |
 | Friendly Name | Turn On Virtualization Based Security |
-| Element Name | Require UEFI Memory Attributes Table |
+| Element Name | Require UEFI Memory Attributes Table. |
 | Location | Computer Configuration |
 | Path | System > Device Guard |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard |
diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md
index 2862cf0565..3f32d7c225 100644
--- a/windows/client-management/mdm/policy-csp-webthreatdefense.md
+++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md
@@ -4,7 +4,7 @@ description: Learn more about the WebThreatDefense Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -16,6 +16,9 @@ ms.topic: reference
 <!-- WebThreatDefense-Begin -->
 # Policy CSP - WebThreatDefense
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- WebThreatDefense-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 > [!NOTE]
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md
index 62d4b45e2a..5eb3b2dd3e 100644
--- a/windows/client-management/mdm/policy-csp-wifi.md
+++ b/windows/client-management/mdm/policy-csp-wifi.md
@@ -4,7 +4,7 @@ description: Learn more about the Wifi Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -193,7 +193,7 @@ By default, ICS is disabled when you create a remote access connection, but admi
 
 <!-- AllowManualWiFiConfiguration-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0
+Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0.
 
 > [!NOTE]
 > Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that are not user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted.
@@ -343,7 +343,7 @@ Allow WiFi Direct connection. .
 
 <!-- WLANScanMode-Description-Begin -->
 <!-- Description-Source-DDF -->
-Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency. The default value is 0. Supported operations are Add, Delete, Get, and Replace.
+Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency. The default value is 0.
 <!-- WLANScanMode-Description-End -->
 
 <!-- WLANScanMode-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
index 020c169b11..bbe80dfd19 100644
--- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
+++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
@@ -4,7 +4,7 @@ description: Learn more about the WindowsDefenderSecurityCenter Area in Policy C
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,9 +36,17 @@ ms.topic: reference
 <!-- CompanyName-OmaUri-End -->
 
 <!-- CompanyName-Description-Begin -->
-<!-- Description-Source-DDF -->
-The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization.
-- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options. Value type is string. Supported operations are Add, Get, Replace and Delete.
+<!-- Description-Source-ADMX -->
+Specify the company name that will be displayed in Windows Security and associated notifications. This setting must be enabled for any contact information to appear.
+
+Enabled:
+Enter the company name in the Options section.
+
+Disabled:
+Company information will not be shown at all in either Windows Security or any notifications that it creates.
+
+Not configured:
+Same as Disabled.
 <!-- CompanyName-Description-End -->
 
 <!-- CompanyName-Editable-Begin -->
@@ -61,7 +69,7 @@ The company name that is displayed to the users. CompanyName is required for bot
 |:--|:--|
 | Name | EnterpriseCustomization_CompanyName |
 | Friendly Name | Specify contact company name |
-| Element Name | Company name |
+| Element Name | Company name. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Security > Enterprise Customization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization |
@@ -956,9 +964,19 @@ Same as Disabled.
 <!-- Email-OmaUri-End -->
 
 <!-- Email-Description-Begin -->
-<!-- Description-Source-DDF -->
-The email address that is displayed to users. The default mail application is used to initiate email actions.
-- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options. Value type is string. Supported operations are Add, Get, Replace and Delete.
+<!-- Description-Source-ADMX -->
+Specify the email address or email ID that will be displayed in Windows Security and associated notifications.
+
+Users can click on the contact information to create an email that will be sent to the specified address. The default email application will be used.
+
+Enabled:
+Enter the email address or email ID in the Options section.
+
+Disabled:
+A contact email address or email ID will not be shown in either Windows Security or any notifications it creates.
+
+Not configured:
+Same as Disabled.
 <!-- Email-Description-End -->
 
 <!-- Email-Editable-Begin -->
@@ -981,7 +999,7 @@ The email address that is displayed to users. The default mail application is us
 |:--|:--|
 | Name | EnterpriseCustomization_Email |
 | Friendly Name | Specify contact email address or Email ID |
-| Element Name | Email address or email ID |
+| Element Name | Email address or email ID. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Security > Enterprise Customization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization |
@@ -1455,9 +1473,19 @@ Same as Disabled.
 <!-- Phone-OmaUri-End -->
 
 <!-- Phone-Description-Begin -->
-<!-- Description-Source-DDF -->
-The phone number or Skype ID that is displayed to users. Skype is used to initiate the call.
-- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options. Value type is string. Supported operations are Add, Get, Replace, and Delete.
+<!-- Description-Source-ADMX -->
+Specify the phone number or Skype ID that will be displayed in Windows Security and associated notifications.
+
+Users can click on the contact information to automatically call the supplied number. Skype will be used to initiate the call.
+
+Enabled:
+Enter the phone number or Skype ID in the Options section.
+
+Disabled:
+A contact phone number or Skype ID will not be shown in either Windows Security or any notifications it creates.
+
+Not configured:
+Same as Disabled.
 <!-- Phone-Description-End -->
 
 <!-- Phone-Editable-Begin -->
@@ -1480,7 +1508,7 @@ The phone number or Skype ID that is displayed to users. Skype is used to initia
 |:--|:--|
 | Name | EnterpriseCustomization_Phone |
 | Friendly Name | Specify contact phone number or Skype ID |
-| Element Name | Phone number or Skype ID |
+| Element Name | Phone number or Skype ID. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Security > Enterprise Customization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization |
@@ -1509,9 +1537,19 @@ The phone number or Skype ID that is displayed to users. Skype is used to initia
 <!-- URL-OmaUri-End -->
 
 <!-- URL-Description-Begin -->
-<!-- Description-Source-DDF -->
-The help portal URL this is displayed to users. The default browser is used to initiate this action.
-- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options. Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete.
+<!-- Description-Source-ADMX -->
+Specify the URL that will be displayed in Windows Security and associated notifications.
+
+Users can click on the contact information to visit the specified website. The default web browser will be used.
+
+Enabled:
+Enter the URL in the Options section.
+
+Disabled:
+A contact website URL will not be shown in either Windows Security or any notifications it creates.
+
+Not configured:
+Same as Disabled.
 <!-- URL-Description-End -->
 
 <!-- URL-Editable-Begin -->
@@ -1534,7 +1572,7 @@ The help portal URL this is displayed to users. The default browser is used to i
 |:--|:--|
 | Name | EnterpriseCustomization_URL |
 | Friendly Name | Specify contact website |
-| Element Name | IT or support website |
+| Element Name | IT or support website. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Security > Enterprise Customization |
 | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization |
diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
index c2a2419ae6..3b22eda9a0 100644
--- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
+++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
@@ -4,7 +4,7 @@ description: Learn more about the WindowsInkWorkspace Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowSuggestedAppsInWindowsInkWorkspace-Description-Begin -->
 <!-- Description-Source-ADMX -->
-Allow suggested apps in Windows Ink Workspace
+Allow suggested apps in Windows Ink Workspace.
 <!-- AllowSuggestedAppsInWindowsInkWorkspace-Description-End -->
 
 <!-- AllowSuggestedAppsInWindowsInkWorkspace-Editable-Begin -->
@@ -99,8 +99,8 @@ Allow suggested apps in Windows Ink Workspace
 <!-- AllowWindowsInkWorkspace-OmaUri-End -->
 
 <!-- AllowWindowsInkWorkspace-Description-Begin -->
-<!-- Description-Source-DDF -->
-Specifies whether to allow the user to access the ink workspace.
+<!-- Description-Source-ADMX -->
+Allow Windows Ink Workspace.
 <!-- AllowWindowsInkWorkspace-Description-End -->
 
 <!-- AllowWindowsInkWorkspace-Editable-Begin -->
@@ -134,7 +134,7 @@ Specifies whether to allow the user to access the ink workspace.
 |:--|:--|
 | Name | AllowWindowsInkWorkspace |
 | Friendly Name | Allow Windows Ink Workspace |
-| Element Name | Choose one of the following actions |
+| Element Name | Choose one of the following actions. |
 | Location | Computer Configuration |
 | Path | Windows Components > Windows Ink Workspace |
 | Registry Key Name | Software\Policies\Microsoft\WindowsInkWorkspace |
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md
index 51b6c8cc5e..3969e76da3 100644
--- a/windows/client-management/mdm/policy-csp-windowslogon.md
+++ b/windows/client-management/mdm/policy-csp-windowslogon.md
@@ -4,7 +4,7 @@ description: Learn more about the WindowsLogon Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -21,6 +21,9 @@ ms.topic: reference
 >
 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it.  For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
 
+> [!IMPORTANT]
+> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview.
+
 <!-- WindowsLogon-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 <!-- WindowsLogon-Editable-End -->
@@ -114,8 +117,8 @@ This policy setting controls the configuration under which an automatic restart
 
 1. "Enabled if BitLocker is on and not suspended" specifies that automatic sign on and lock will only occur if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device's hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components.
 BitLocker is suspended during updates if:
-- The device doesn't have TPM 2.0 and PCR7, or
-- The device doesn't use a TPM-only protector
+  - The device doesn't have TPM 2.0 and PCR7, or
+  - The device doesn't use a TPM-only protector
 
 2. "Always Enabled" specifies that automatic sign on will happen even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location.
 
@@ -581,14 +584,7 @@ The locations that Switch User interface appear are in the Logon UI, the Start m
 
 <!-- OverrideShellProgram-Description-Begin -->
 <!-- Description-Source-DDF -->
-OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program.
-
-The policy currently supports below options:
-
-1. Not Configured: Default shell will be launched.
-2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell.
-
-- If you disable or do not configure this policy setting, then the default shell will be launched.
+OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. The policy currently supports below options: 1. Not Configured: Default shell will be launched. 2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. If you disable or do not configure this policy setting, then the default shell will be launched.
 <!-- OverrideShellProgram-Description-End -->
 
 <!-- OverrideShellProgram-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md
index 7547dce65b..982bf3c027 100644
--- a/windows/client-management/mdm/policy-csp-windowspowershell.md
+++ b/windows/client-management/mdm/policy-csp-windowspowershell.md
@@ -4,7 +4,7 @@ description: Learn more about the WindowsPowerShell Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 01/09/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -47,6 +47,7 @@ ms.topic: reference
 <!-- TurnOnPowerShellScriptBlockLogging-Description-Begin -->
 <!-- Description-Source-ADMX -->
 This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log.
+
 - If you enable this policy setting,
 Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation.
 
diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md
index c341176e4b..04eabb0246 100644
--- a/windows/client-management/mdm/reboot-csp.md
+++ b/windows/client-management/mdm/reboot-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the Reboot CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -29,6 +29,7 @@ The following list shows the Reboot configuration service provider nodes:
   - [Schedule](#schedule)
     - [DailyRecurrent](#scheduledailyrecurrent)
     - [Single](#schedulesingle)
+    - [WeeklyRecurrent](#scheduleweeklyrecurrent)
 <!-- Reboot-Tree-End -->
 
 <!-- Device-RebootNow-Begin -->
@@ -126,7 +127,7 @@ The supported operation is Get.
 
 <!-- Device-Schedule-DailyRecurrent-Description-Begin -->
 <!-- Description-Source-DDF -->
-Value in ISO8601, time is required. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
+Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
 <!-- Device-Schedule-DailyRecurrent-Description-End -->
 
 <!-- Device-Schedule-DailyRecurrent-Editable-Begin -->
@@ -187,6 +188,45 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule
 
 <!-- Device-Schedule-Single-End -->
 
+<!-- Device-Schedule-WeeklyRecurrent-Begin -->
+### Schedule/WeeklyRecurrent
+
+<!-- Device-Schedule-WeeklyRecurrent-Applicability-Begin -->
+| Scope | Editions | Applicable OS |
+|:--|:--|:--|
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later |
+<!-- Device-Schedule-WeeklyRecurrent-Applicability-End -->
+
+<!-- Device-Schedule-WeeklyRecurrent-OmaUri-Begin -->
+```Device
+./Device/Vendor/MSFT/Reboot/Schedule/WeeklyRecurrent
+```
+<!-- Device-Schedule-WeeklyRecurrent-OmaUri-End -->
+
+<!-- Device-Schedule-WeeklyRecurrent-Description-Begin -->
+<!-- Description-Source-DDF -->
+Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.
+<!-- Device-Schedule-WeeklyRecurrent-Description-End -->
+
+<!-- Device-Schedule-WeeklyRecurrent-Editable-Begin -->
+<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+<!-- Device-Schedule-WeeklyRecurrent-Editable-End -->
+
+<!-- Device-Schedule-WeeklyRecurrent-DFProperties-Begin -->
+**Description framework properties**:
+
+| Property name | Property value |
+|:--|:--|
+| Format | chr (string) |
+| Access Type | Add, Delete, Get, Replace |
+<!-- Device-Schedule-WeeklyRecurrent-DFProperties-End -->
+
+<!-- Device-Schedule-WeeklyRecurrent-Examples-Begin -->
+<!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
+<!-- Device-Schedule-WeeklyRecurrent-Examples-End -->
+
+<!-- Device-Schedule-WeeklyRecurrent-End -->
+
 <!-- Reboot-CspMoreInfo-Begin -->
 <!-- Add any additional information about this CSP here. Anything outside this section will get overwritten. -->
 <!-- Reboot-CspMoreInfo-End -->
diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md
index a1f1988804..98866efffa 100644
--- a/windows/client-management/mdm/reboot-ddf-file.md
+++ b/windows/client-management/mdm/reboot-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/17/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -47,7 +47,7 @@ The following XML file contains the device description framework (DDF) for the R
       <MSFT:Applicability>
         <MSFT:OsBuildVersion>10.0.14393</MSFT:OsBuildVersion>
         <MSFT:CspVersion>1.0</MSFT:CspVersion>
-        <MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD;</MSFT:EditionAllowList>
+        <MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD;</MSFT:EditionAllowList>
       </MSFT:Applicability>
     </DFProperties>
     <Node>
@@ -129,7 +129,7 @@ The following XML file contains the device description framework (DDF) for the R
             <Get />
             <Replace />
           </AccessType>
-          <Description>Value in ISO8601, time is required. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.</Description>
+          <Description>Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.</Description>
           <DFFormat>
             <chr />
           </DFFormat>
@@ -147,6 +147,33 @@ The following XML file contains the device description framework (DDF) for the R
           </MSFT:AllowedValues>
         </DFProperties>
       </Node>
+      <Node>
+        <NodeName>WeeklyRecurrent</NodeName>
+        <DFProperties>
+          <AccessType>
+            <Add />
+            <Delete />
+            <Get />
+            <Replace />
+          </AccessType>
+          <Description>Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule.</Description>
+          <DFFormat>
+            <chr />
+          </DFFormat>
+          <Occurrence>
+            <One />
+          </Occurrence>
+          <Scope>
+            <Dynamic />
+          </Scope>
+          <DFTitle>WeeklyRecurrent</DFTitle>
+          <DFType>
+            <MIME />
+          </DFType>
+          <MSFT:AllowedValues ValueType="None">
+          </MSFT:AllowedValues>
+        </DFProperties>
+      </Node>
     </Node>
   </Node>
 </MgmtTree>
diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md
index 4375aed8a9..9cb2712daf 100644
--- a/windows/client-management/mdm/rootcacertificates-csp.md
+++ b/windows/client-management/mdm/rootcacertificates-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the RootCATrustedCertificates CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -125,7 +125,7 @@ The following list shows the RootCATrustedCertificates configuration service pro
 <!-- Device-CA-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-Applicability-End -->
 
 <!-- Device-CA-OmaUri-Begin -->
@@ -164,7 +164,7 @@ Node for CA certificates.
 <!-- Device-CA-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-OmaUri-Begin -->
@@ -204,7 +204,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-CA-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -243,7 +243,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-CA-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -282,7 +282,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-CA-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -321,7 +321,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-CA-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -360,7 +360,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-CA-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -399,7 +399,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-CA-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-CA-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -438,7 +438,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-OemEsim-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-Applicability-End -->
 
 <!-- Device-OemEsim-OmaUri-Begin -->
@@ -477,7 +477,7 @@ Node for OEM eSIM certificates.
 <!-- Device-OemEsim-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-OmaUri-Begin -->
@@ -517,7 +517,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-OemEsim-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -556,7 +556,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-OemEsim-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -595,7 +595,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-OemEsim-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -634,7 +634,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-OemEsim-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -673,7 +673,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-OemEsim-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -712,7 +712,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-OemEsim-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -751,7 +751,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-Root-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-Applicability-End -->
 
 <!-- Device-Root-OmaUri-Begin -->
@@ -790,7 +790,7 @@ Defines the certificate store that contains root, or self-signed certificates, i
 <!-- Device-Root-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-OmaUri-Begin -->
@@ -829,7 +829,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-Root-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -869,7 +869,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-Root-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -908,7 +908,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-Root-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -947,7 +947,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-Root-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -986,7 +986,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-Root-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1025,7 +1025,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-Root-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-Root-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -1064,7 +1064,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-TrustedPeople-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-Applicability-End -->
 
 <!-- Device-TrustedPeople-OmaUri-Begin -->
@@ -1103,7 +1103,7 @@ Node for trusted people certificates.
 <!-- Device-TrustedPeople-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-OmaUri-Begin -->
@@ -1143,7 +1143,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-TrustedPeople-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -1182,7 +1182,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-TrustedPeople-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -1221,7 +1221,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-TrustedPeople-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -1260,7 +1260,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-TrustedPeople-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -1299,7 +1299,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-TrustedPeople-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1338,7 +1338,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-TrustedPeople-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPeople-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -1377,7 +1377,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-TrustedPublisher-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-Applicability-End -->
 
 <!-- Device-TrustedPublisher-OmaUri-Begin -->
@@ -1416,7 +1416,7 @@ Node for trusted publisher certificates.
 <!-- Device-TrustedPublisher-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-OmaUri-Begin -->
@@ -1456,7 +1456,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-TrustedPublisher-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -1495,7 +1495,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-TrustedPublisher-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -1534,7 +1534,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-TrustedPublisher-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -1573,7 +1573,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-TrustedPublisher-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -1612,7 +1612,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-TrustedPublisher-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1651,7 +1651,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-TrustedPublisher-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
 <!-- Device-TrustedPublisher-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -1690,7 +1690,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-UntrustedCertificates-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-OmaUri-Begin -->
@@ -1729,7 +1729,7 @@ Node for certificates that are not trusted. IT admin can use this node to immedi
 <!-- Device-UntrustedCertificates-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-OmaUri-Begin -->
@@ -1769,7 +1769,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-UntrustedCertificates-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -1808,7 +1808,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -1847,7 +1847,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -1886,7 +1886,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-UntrustedCertificates-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -1925,7 +1925,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-UntrustedCertificates-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1964,7 +1964,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-UntrustedCertificates-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-ValidTo-OmaUri-Begin -->
diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md
index d12b3ffc21..f6ea73293b 100644
--- a/windows/client-management/mdm/rootcacertificates-ddf-file.md
+++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/24/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -1071,11 +1071,6 @@ The following XML file contains the device description framework (DDF) for the R
       <DFType>
         <MIME />
       </DFType>
-      <MSFT:Applicability>
-        <MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
-        <MSFT:CspVersion>1.0</MSFT:CspVersion>
-        <MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD;</MSFT:EditionAllowList>
-      </MSFT:Applicability>
     </DFProperties>
     <Node>
       <NodeName>Root</NodeName>
diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md
index e77c419631..7594de5981 100644
--- a/windows/client-management/mdm/supl-csp.md
+++ b/windows/client-management/mdm/supl-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the SUPL CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -336,7 +336,7 @@ Optional. Determines the full version (X. Y. Z where X, Y and Z are major versio
 
 <!-- Device-SUPL1-Ext-Microsoft-HighAccPositioningMethod-Description-Begin -->
 <!-- Description-Source-DDF -->
-Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.
+Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.
 <!-- Device-SUPL1-Ext-Microsoft-HighAccPositioningMethod-Description-End -->
 
 <!-- Device-SUPL1-Ext-Microsoft-HighAccPositioningMethod-Editable-Begin -->
@@ -540,7 +540,7 @@ Optional. Time in seconds that the network-initiated location request is display
 
 <!-- Device-SUPL1-Ext-Microsoft-RootCertificate-Description-Begin -->
 <!-- Description-Source-DDF -->
-Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error.
+Required. Specifies the root certificate for the H-SLP server. Windows does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error.
 <!-- Device-SUPL1-Ext-Microsoft-RootCertificate-Description-End -->
 
 <!-- Device-SUPL1-Ext-Microsoft-RootCertificate-Editable-Begin -->
@@ -1568,7 +1568,7 @@ Optional. The address of the Position Determination Entity (PDE), in the format
 
 <!-- Device-V2UPL1-PositioningMethod_MR-Description-Begin -->
 <!-- Description-Source-DDF -->
-Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.
+Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.
 <!-- Device-V2UPL1-PositioningMethod_MR-Description-End -->
 
 <!-- Device-V2UPL1-PositioningMethod_MR-Editable-Begin -->
diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md
index 07296eebc3..af93e84137 100644
--- a/windows/client-management/mdm/supl-ddf-file.md
+++ b/windows/client-management/mdm/supl-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/23/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -245,7 +245,7 @@ The following XML file contains the device description framework (DDF) for the S
                 <Replace />
               </AccessType>
               <DefaultValue>0</DefaultValue>
-              <Description>Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.</Description>
+              <Description>Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.</Description>
               <DFFormat>
                 <int />
               </DFFormat>
@@ -375,7 +375,7 @@ The following XML file contains the device description framework (DDF) for the S
               <AccessType>
                 <Get />
               </AccessType>
-              <Description>Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error.</Description>
+              <Description>Required. Specifies the root certificate for the H-SLP server. Windows does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error.</Description>
               <DFFormat>
                 <node />
               </DFFormat>
@@ -874,7 +874,7 @@ The following XML file contains the device description framework (DDF) for the S
             <Replace />
           </AccessType>
           <DefaultValue>0</DefaultValue>
-          <Description>Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.</Description>
+          <Description>Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters.</Description>
           <DFFormat>
             <int />
           </DFFormat>

From 432aedbdf30d4afb552eb6cea237388ad698a024 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 23 Mar 2023 14:11:42 -0400
Subject: [PATCH 07/64] Fix issue 11377

---
 windows/client-management/mdm/applicationcontrol-csp.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md
index 8e4b0ab2da..f500aff927 100644
--- a/windows/client-management/mdm/applicationcontrol-csp.md
+++ b/windows/client-management/mdm/applicationcontrol-csp.md
@@ -946,9 +946,9 @@ The ApplicationControl CSP can also be managed locally from PowerShell or via Co
 3. Use WMI Interface:
 
     ```powershell
-        $namespace = "root\cimv2\mdm\dmmap"
-        $policyClassName = "MDM_AppControl_Policies"
-        $policyBase64 = …
+    $namespace = "root\cimv2\mdm\dmmap"
+    $policyClassName = "MDM_ApplicationControl_Policies01_01"
+    $policyBase64 = "<base64policy>"
     ```
 
 ### Deploying a policy via WMI Bridge

From deb3f68bedb7f3404fc01e393a7f20c01b525ee6 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 23 Mar 2023 16:39:25 -0400
Subject: [PATCH 08/64] Minor updates

---
 ...icy-csp-admx-microsoftdefenderantivirus.md |  2 +-
 .../mdm/policy-csp-defender.md                |  4 +-
 .../mdm/rootcacertificates-csp.md             | 96 +++++++++----------
 .../mdm/rootcacertificates-ddf-file.md        |  5 +
 4 files changed, 56 insertions(+), 51 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
index 4e89010233..07eef1894d 100644
--- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
+++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md
@@ -724,7 +724,7 @@ After enabling this setting, you can set each rule to the following in the Optio
   - Not Configured: the rule is enabled with default values
   - Warn: the rule will be applied and the end-user will have the option to bypass the block
 
-Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured.
+Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured.
 
 Enabled:
 Specify the state for each ASR rule under the Options section for this setting.
diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index d7e2211264..2f84f6c62c 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -955,7 +955,7 @@ After enabling this setting, you can set each rule to the following in the Optio
   - Not Configured: the rule is enabled with default values
   - Warn: the rule will be applied and the end-user will have the option to bypass the block
 
-Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured.
+Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured.
 
 Enabled:
 Specify the state for each ASR rule under the Options section for this setting.
@@ -2206,7 +2206,7 @@ This policy setting allows you to specify the scan type to use during a schedule
 
 - If you enable this setting, the scan type will be set to the specified value.
 
-- If you disable or do not configure this setting, the default scan type will used.
+- If you disable or do not configure this setting, the default scan type will be used.
 <!-- ScanParameter-Description-End -->
 
 <!-- ScanParameter-Editable-Begin -->
diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md
index 9cb2712daf..9da01ea478 100644
--- a/windows/client-management/mdm/rootcacertificates-csp.md
+++ b/windows/client-management/mdm/rootcacertificates-csp.md
@@ -125,7 +125,7 @@ The following list shows the RootCATrustedCertificates configuration service pro
 <!-- Device-CA-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-Applicability-End -->
 
 <!-- Device-CA-OmaUri-Begin -->
@@ -164,7 +164,7 @@ Node for CA certificates.
 <!-- Device-CA-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-OmaUri-Begin -->
@@ -204,7 +204,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-CA-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -243,7 +243,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-CA-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -282,7 +282,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-CA-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -321,7 +321,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-CA-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -360,7 +360,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-CA-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -399,7 +399,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-CA-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-CA-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-CA-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -438,7 +438,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-OemEsim-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-Applicability-End -->
 
 <!-- Device-OemEsim-OmaUri-Begin -->
@@ -477,7 +477,7 @@ Node for OEM eSIM certificates.
 <!-- Device-OemEsim-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-OmaUri-Begin -->
@@ -517,7 +517,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-OemEsim-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -556,7 +556,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-OemEsim-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -595,7 +595,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-OemEsim-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -634,7 +634,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-OemEsim-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -673,7 +673,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-OemEsim-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -712,7 +712,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-OemEsim-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later |
 <!-- Device-OemEsim-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-OemEsim-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -751,7 +751,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-Root-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-Applicability-End -->
 
 <!-- Device-Root-OmaUri-Begin -->
@@ -790,7 +790,7 @@ Defines the certificate store that contains root, or self-signed certificates, i
 <!-- Device-Root-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-OmaUri-Begin -->
@@ -829,7 +829,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-Root-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -869,7 +869,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-Root-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -908,7 +908,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-Root-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -947,7 +947,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-Root-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -986,7 +986,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-Root-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1025,7 +1025,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-Root-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-Root-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-Root-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -1064,7 +1064,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-TrustedPeople-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-Applicability-End -->
 
 <!-- Device-TrustedPeople-OmaUri-Begin -->
@@ -1103,7 +1103,7 @@ Node for trusted people certificates.
 <!-- Device-TrustedPeople-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-OmaUri-Begin -->
@@ -1143,7 +1143,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-TrustedPeople-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -1182,7 +1182,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-TrustedPeople-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -1221,7 +1221,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-TrustedPeople-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -1260,7 +1260,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-TrustedPeople-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -1299,7 +1299,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-TrustedPeople-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1338,7 +1338,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-TrustedPeople-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPeople-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-TrustedPeople-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -1377,7 +1377,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-TrustedPublisher-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-Applicability-End -->
 
 <!-- Device-TrustedPublisher-OmaUri-Begin -->
@@ -1416,7 +1416,7 @@ Node for trusted publisher certificates.
 <!-- Device-TrustedPublisher-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-OmaUri-Begin -->
@@ -1456,7 +1456,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-TrustedPublisher-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -1495,7 +1495,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-TrustedPublisher-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -1534,7 +1534,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-TrustedPublisher-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -1573,7 +1573,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-TrustedPublisher-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -1612,7 +1612,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-TrustedPublisher-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1651,7 +1651,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-TrustedPublisher-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | <!-- Not-Found --> |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
 <!-- Device-TrustedPublisher-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-TrustedPublisher-{CertHash}-ValidTo-OmaUri-Begin -->
@@ -1690,7 +1690,7 @@ Returns the expiration date of the certificate. Supported operation is Get. This
 <!-- Device-UntrustedCertificates-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-OmaUri-Begin -->
@@ -1729,7 +1729,7 @@ Node for certificates that are not trusted. IT admin can use this node to immedi
 <!-- Device-UntrustedCertificates-{CertHash}-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-OmaUri-Begin -->
@@ -1769,7 +1769,7 @@ Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certifi
 <!-- Device-UntrustedCertificates-{CertHash}-EncodedCertificate-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-EncodedCertificate-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-EncodedCertificate-OmaUri-Begin -->
@@ -1808,7 +1808,7 @@ Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string v
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedBy-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedBy-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedBy-OmaUri-Begin -->
@@ -1847,7 +1847,7 @@ Returns the name of the certificate issuer. This is equivalent to the Issuer mem
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedTo-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-IssuedTo-OmaUri-Begin -->
@@ -1886,7 +1886,7 @@ Returns the name of the certificate subject. This is equivalent to the Subject m
 <!-- Device-UntrustedCertificates-{CertHash}-TemplateName-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-TemplateName-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-TemplateName-OmaUri-Begin -->
@@ -1925,7 +1925,7 @@ Returns the certificate template name. Supported operation is Get.
 <!-- Device-UntrustedCertificates-{CertHash}-ValidFrom-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-ValidFrom-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-ValidFrom-OmaUri-Begin -->
@@ -1964,7 +1964,7 @@ Returns the starting date of the certificate's validity. Supported operation is
 <!-- Device-UntrustedCertificates-{CertHash}-ValidTo-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
-| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :x: Pro <br> :x: Enterprise <br> :x: Education <br> :x: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
+| :heavy_check_mark: Device <br> :heavy_check_mark: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later |
 <!-- Device-UntrustedCertificates-{CertHash}-ValidTo-Applicability-End -->
 
 <!-- Device-UntrustedCertificates-{CertHash}-ValidTo-OmaUri-Begin -->
diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md
index f6ea73293b..14712bc288 100644
--- a/windows/client-management/mdm/rootcacertificates-ddf-file.md
+++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md
@@ -1071,6 +1071,11 @@ The following XML file contains the device description framework (DDF) for the R
       <DFType>
         <MIME />
       </DFType>
+      <MSFT:Applicability>
+        <MSFT:OsBuildVersion>10.0.10586</MSFT:OsBuildVersion>
+        <MSFT:CspVersion>1.0</MSFT:CspVersion>
+        <MSFT:EditionAllowList>0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD;</MSFT:EditionAllowList>
+      </MSFT:Applicability>
     </DFProperties>
     <Node>
       <NodeName>Root</NodeName>

From 5db49126e20cfc98c9c59b24bbe66eadb3889132 Mon Sep 17 00:00:00 2001
From: Narkis Engler <41025789+narkissit@users.noreply.github.com>
Date: Thu, 23 Mar 2023 19:15:19 -0700
Subject: [PATCH 09/64] Update delivery-optimization-endpoints.md

Updated with:
1. Only MCC endpoints for content and service are here (DO has a separate page)
2. Clarify there are 2 versions of MCC
3. which endpoints required for which
---
 .../do/delivery-optimization-endpoints.md     | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md
index 9bdd82e8d5..9ead54c1bf 100644
--- a/windows/deployment/do/delivery-optimization-endpoints.md
+++ b/windows/deployment/do/delivery-optimization-endpoints.md
@@ -1,5 +1,5 @@
 ---
-title: Delivery Optimization and Microsoft Connected Cache content endpoints
+title: Microsoft Connected Cache content and services endpoints
 description: List of fully qualified domain names, ports, and associated content types to use Delivery Optimization and Microsoft Connected Cache.
 ms.date: 07/26/2022
 ms.prod: windows-client
@@ -13,7 +13,7 @@ manager: aaroncz
 ms.collection: tier3
 ---
 
-# Delivery Optimization and Microsoft Connected Cache content type endpoints
+# Microsoft Connected Cache content and services endpoints
 
 _Applies to:_
 
@@ -23,16 +23,17 @@ _Applies to:_
 > [!NOTE]
 > All ports are outbound.
 
-This article lists the endpoints that need to be allowed through the firewall to ensure that content from Delivery Optimization and Microsoft Connected cache is properly delivered. Use the table below to reference any particular content types supported by Delivery Optimization and Microsoft Connected Cache:
+This article lists the content and services endpoints to allow in your Firewall to be used by Microsoft Connected Cache. 
+Use the table below to reference any particular content types or services endpoints that are required for [Connected Cache on a Configuration Manager Distribution Point](/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache) or for [Connected Cache Managed in Azure](../do/waas-microsoft-connected-cache), or both.
 
-|Domain Name  |Protocol/Port(s)  | Content Type | Additional Information | Version |
+|Domain Name  |Protocol/Port(s)  | Content Type | Additional Information | Microsoft Connected Cache Version |
 |---------|---------|---------------|-------------------|-----------------|
-| *.b1.download.windowsupdate.com, *.dl.delivery.mp.microsoft.com, *.download.windowsupdate.com, *.au.download.windowsupdate.com, *.au.b1.download.windowsupdate.com, *.tlu.dl.delivery.mp.microsoft.com, *.emdl.ws.microsoft.com, *.ctldl.windowsupdate.com   |  HTTP / 80  | Windows Update </br> Windows Defender </br> Windows Drivers | [Complete list](/windows/privacy/manage-windows-2004-endpoints) of endpoints for Windows Update services and payload. | Microsoft Configuration Manager Distribution Point |
-| *.delivery.mp.microsoft.com  |  HTTP / 80  | Edge Browser | [Complete list](/deployedge/microsoft-edge-security-endpoints) of endpoints for Edge Browser. | Microsoft Configuration Manager Distribution Point |
-| *.officecdn.microsoft.com.edgesuite.net, *.officecdn.microsoft.com, *.cdn.office.net |  HTTP / 80  | Office CDN updates | [Complete list](/office365/enterprise/office-365-endpoints) of endpoints for Office CDN updates. | Microsoft Configuration Manager Distribution Point |
-| *.manage.microsoft.com, *.swda01.manage.microsoft.com, *.swda02.manage.microsoft.com, *.swdb01.manage.microsoft.com, *.swdb02.manage.microsoft.com, *.swdc01.manage.microsoft.com, *.swdc02.manage.microsoft.com, *.swdd01.manage.microsoft.com, *.swdd02.manage.microsoft.com, *.swda01-mscdn.manage.microsoft.com, *.swda02-mscdn.manage.microsoft.com, *.swdb01-mscdn.manage.microsoft.com, *.swdb02-mscdn.manage.microsoft.com, *.swdc01-mscdn.manage.microsoft.com, *.swdc02-mscdn.manage.microsoft.com, *.swdd01-mscdn.manage.microsoft.com, *.swdd02-mscdn.manage.microsoft.com |  HTTP / 80 </br> HTTPs / 443  | Intune Win32 Apps | [Complete list](/mem/intune/fundamentals/intune-endpoints) of endpoints for Intune Win32 Apps updates. | Microsoft Configuration Manager Distribution Point |
-| *.statics.teams.cdn.office.net |  HTTP / 80 </br> HTTPs / 443  | Teams | | Microsoft Configuration Manager Distribution Point |
-| *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com |  HTTP / 80 | Xbox | | Microsoft Configuration Manager Distribution Point |
-| *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com |  HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates.  | Microsoft Configuration Manager Distribution Point |
-| *.do.dsp.mp.microsoft.com |  HTTP / 80 </br> HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only.  | Microsoft Connected Cache Managed in Azure |
-| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com |  AMQP / 5671 </br>  MQTT / 8883 </br> HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure |
+| *.b1.download.windowsupdate.com, *.dl.delivery.mp.microsoft.com, *.download.windowsupdate.com, *.au.download.windowsupdate.com, *.au.b1.download.windowsupdate.com, *.tlu.dl.delivery.mp.microsoft.com, *.emdl.ws.microsoft.com, *.ctldl.windowsupdate.com   |  HTTP / 80  | Windows Update </br> Windows Defender </br> Windows Drivers | [Complete list](/windows/privacy/manage-windows-2004-endpoints) of endpoints for Windows Update services and payload. | Both |
+| *.delivery.mp.microsoft.com  |  HTTP / 80  | Edge Browser | [Complete list](/deployedge/microsoft-edge-security-endpoints) of endpoints for Edge Browser. | Both |
+| *.officecdn.microsoft.com.edgesuite.net, *.officecdn.microsoft.com, *.cdn.office.net |  HTTP / 80  | Office CDN updates | [Complete list](/office365/enterprise/office-365-endpoints) of endpoints for Office CDN updates. | Both |
+| *.manage.microsoft.com, *.swda01.manage.microsoft.com, *.swda02.manage.microsoft.com, *.swdb01.manage.microsoft.com, *.swdb02.manage.microsoft.com, *.swdc01.manage.microsoft.com, *.swdc02.manage.microsoft.com, *.swdd01.manage.microsoft.com, *.swdd02.manage.microsoft.com, *.swda01-mscdn.manage.microsoft.com, *.swda02-mscdn.manage.microsoft.com, *.swdb01-mscdn.manage.microsoft.com, *.swdb02-mscdn.manage.microsoft.com, *.swdc01-mscdn.manage.microsoft.com, *.swdc02-mscdn.manage.microsoft.com, *.swdd01-mscdn.manage.microsoft.com, *.swdd02-mscdn.manage.microsoft.com |  HTTP / 80 </br> HTTPs / 443  | Intune Win32 Apps | [Complete list](/mem/intune/fundamentals/intune-endpoints) of endpoints for Intune Win32 Apps updates. | Both |
+| *.statics.teams.cdn.office.net |  HTTP / 80 </br> HTTPs / 443  | Teams | | Both |
+| *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com |  HTTP / 80 | Xbox | | Both |
+| *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com |  HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates.  |  Both |
+| *.do.dsp.mp.microsoft.com |  HTTP / 80 </br> HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only.  | Connected Cache Managed in Azure |
+| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com |  AMQP / 5671 </br>  MQTT / 8883 </br> HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure |

From 480beb22a2a2e02f4b8a1624f4fe7fff462ad7a8 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 24 Mar 2023 12:24:29 -0400
Subject: [PATCH 10/64] Change Surface Hub to Windows 10 Team

---
 .../policies-in-policy-csp-supported-by-surface-hub.md | 10 +++++-----
 windows/client-management/mdm/surfacehub-csp.md        |  2 +-
 windows/client-management/mdm/surfacehub-ddf-file.md   |  2 +-
 windows/client-management/mdm/toc.yml                  |  2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index f0100f698a..532725ac33 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -1,10 +1,10 @@
 ---
-title: Policies in Policy CSP supported by Surface Hub
-description: Learn about the policies in Policy CSP supported by Surface Hub.
+title: Policies in Policy CSP supported by Windows 10 Team
+description: Learn about the policies in Policy CSP supported by Windows 10 Team.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/23/2023
+ms.date: 03/24/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -13,9 +13,9 @@ ms.topic: reference
 
 <!-- Auto-Generated CSP Document -->
 
-# Policies in Policy CSP supported by Surface Hub
+# Policies in Policy CSP supported by Windows 10 Team
 
-This article lists the policies in Policy CSP that are applicable for Surface Hub.
+This article lists the policies in Policy CSP that are applicable for Windows 10 Team.
 
 ## Accounts
 
diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md
index c16d7da169..87ba8d39de 100644
--- a/windows/client-management/mdm/surfacehub-csp.md
+++ b/windows/client-management/mdm/surfacehub-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/17/2023
+ms.date: 03/24/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md
index 0f0117489c..16e2b4acd8 100644
--- a/windows/client-management/mdm/surfacehub-ddf-file.md
+++ b/windows/client-management/mdm/surfacehub-ddf-file.md
@@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF)
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/24/2023
+ms.date: 03/24/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index bded40d8ed..4b7a21cdcd 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -49,7 +49,7 @@ items:
           href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
         - name: Policies supported by Windows 10 IoT Core
           href: policies-in-policy-csp-supported-by-iot-core.md
-        - name: Policies supported by Microsoft Surface Hub
+        - name: Policies supported by Microsoft Windows 10 Team
           href: policies-in-policy-csp-supported-by-surface-hub.md
         - name: Policies that can be set using Exchange Active Sync (EAS)
           href: policies-in-policy-csp-that-can-be-set-using-eas.md

From 30329054f8bad4b7bc9c12049d9185ddb252e103 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Mon, 27 Mar 2023 15:19:01 -0400
Subject: [PATCH 11/64] Mo Updates

---
 windows/client-management/mdm/laps-csp.md     |  4 +-
 ...-in-policy-csp-supported-by-surface-hub.md |  6 +--
 .../mdm/policy-csp-admx-smartcard.md          |  4 +-
 .../mdm/policy-csp-browser.md                 |  4 +-
 .../mdm/policy-csp-defender.md                |  9 +----
 .../client-management/mdm/surfacehub-csp.md   | 40 +++++++++----------
 windows/client-management/mdm/toc.yml         |  2 +-
 7 files changed, 30 insertions(+), 39 deletions(-)

diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md
index f846a1bb50..b5c76b1b14 100644
--- a/windows/client-management/mdm/laps-csp.md
+++ b/windows/client-management/mdm/laps-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the LAPS CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/28/2023
+ms.date: 03/27/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -746,7 +746,7 @@ If not specified, this setting will default to 3 (Reset the password and logoff
 | Value | Description |
 |:--|:--|
 | 1 | Reset password: upon expiry of the grace period, the managed account password will be reset. |
-| 3 (Default) | Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will be terminated. |
+| 3 (Default) | Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated. |
 | 5 | Reset the password and reboot: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted. |
 <!-- Device-Policies-PostAuthenticationActions-AllowedValues-End -->
 
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index 532725ac33..4c67e36e15 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -15,11 +15,7 @@ ms.topic: reference
 
 # Policies in Policy CSP supported by Windows 10 Team
 
-This article lists the policies in Policy CSP that are applicable for Windows 10 Team.
-
-## Accounts
-
-- [AllowMicrosoftAccountConnection](policy-csp-accounts.md#allowmicrosoftaccountconnection)
+This article lists the policies in Policy CSP that are applicable for the Surface Hub operating system, **Windows 10 Team**.
 
 ## ApplicationDefaults
 
diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md
index 66b14b8c2f..9f8cd9d3d9 100644
--- a/windows/client-management/mdm/policy-csp-admx-smartcard.md
+++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md
@@ -4,7 +4,7 @@ description: Learn more about the ADMX_Smartcard Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/23/2023
+ms.date: 03/27/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -798,7 +798,7 @@ By default the user principal name (UPN) is displayed in addition to the common
 
 If you enable this policy setting or do not configure this setting, then the subject name will be reversed.
 
-If you disable, the subject name will be displayed as it appears in the certificate.
+If you disable , the subject name will be displayed as it appears in the certificate.
 <!-- ReverseSubject-Description-End -->
 
 <!-- ReverseSubject-Editable-Begin -->
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index 7dc55c850b..821501520e 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -4,7 +4,7 @@ description: Learn more about the Browser Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/23/2023
+ms.date: 03/27/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -2901,7 +2901,7 @@ Don't enable both this setting and the Keep favorites in sync between Internet E
 
 <!-- PreventAccessToAboutFlagsInMicrosoftEdge-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy settings lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.
+This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features.
 
 - If you enable this policy setting, employees can't access the about:flags page.
 
diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index 2f84f6c62c..99bd8a5bcc 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/23/2023
+ms.date: 03/27/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -697,12 +697,7 @@ Allows or disallows Windows Defender Realtime Monitoring functionality.
 <!-- AllowScanningNetworkFiles-OmaUri-End -->
 
 <!-- AllowScanningNetworkFiles-Description-Begin -->
-<!-- Description-Source-ADMX -->
-This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting.
-
-- If you enable this setting, network files will be scanned.
-
-- If you disable or do not configure this setting, network files will not be scanned.
+<!-- Description-Source-Manual-Forced -->
 <!-- AllowScanningNetworkFiles-Description-End -->
 
 <!-- AllowScanningNetworkFiles-Editable-Begin -->
diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md
index 87ba8d39de..46e9609e96 100644
--- a/windows/client-management/mdm/surfacehub-csp.md
+++ b/windows/client-management/mdm/surfacehub-csp.md
@@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/24/2023
+ms.date: 03/27/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -36,7 +36,7 @@ The following list shows the SurfaceHub configuration service provider nodes:
     - [ExchangeModernAuthEnabled](#deviceaccountexchangemodernauthenabled)
     - [ExchangeServer](#deviceaccountexchangeserver)
     - [Password](#deviceaccountpassword)
-    - [PasswordRotationPeriod](#deviceaccountpasswordrotationperiod)
+    - [PasswordRotationEnabled](#deviceaccountpasswordrotationenabled)
     - [SipAddress](#deviceaccountsipaddress)
     - [UserName](#deviceaccountusername)
     - [UserPrincipalName](#deviceaccountuserprincipalname)
@@ -482,53 +482,53 @@ Password for the device account. Get is allowed here, but will always return a b
 
 <!-- Device-DeviceAccount-Password-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Begin -->
-### DeviceAccount/PasswordRotationPeriod
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Begin -->
+### DeviceAccount/PasswordRotationEnabled
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Applicability-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Applicability-Begin -->
 | Scope | Editions | Applicable OS |
 |:--|:--|:--|
 | :heavy_check_mark: Device <br> :x: User | :x: Home <br> :heavy_check_mark: Pro <br> :heavy_check_mark: Enterprise <br> :heavy_check_mark: Education <br> :heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later |
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Applicability-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Applicability-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-OmaUri-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-OmaUri-Begin -->
 ```Device
-./Vendor/MSFT/SurfaceHub/DeviceAccount/PasswordRotationPeriod
+./Vendor/MSFT/SurfaceHub/DeviceAccount/PasswordRotationEnabled
 ```
-<!-- Device-DeviceAccount-PasswordRotationPeriod-OmaUri-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-OmaUri-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Description-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Description-Begin -->
 <!-- Description-Source-DDF -->
 Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, use this setting to allow the device to manage its own password by changing it frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory (or Azure AD).
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Description-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Description-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Editable-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Editable-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Editable-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-DFProperties-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-DFProperties-Begin -->
 **Description framework properties**:
 
 | Property name | Property value |
 |:--|:--|
 | Format | int |
 | Access Type | Get, Replace |
-<!-- Device-DeviceAccount-PasswordRotationPeriod-DFProperties-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-DFProperties-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-AllowedValues-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-AllowedValues-Begin -->
 **Allowed values**:
 
 | Value | Description |
 |:--|:--|
 | 0 | Password rotation enabled. |
 | 1 | Disabled. |
-<!-- Device-DeviceAccount-PasswordRotationPeriod-AllowedValues-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-AllowedValues-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Examples-Begin -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Examples-Begin -->
 <!-- Add any examples for this policy here. Examples outside this section will get overwritten. -->
-<!-- Device-DeviceAccount-PasswordRotationPeriod-Examples-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-Examples-End -->
 
-<!-- Device-DeviceAccount-PasswordRotationPeriod-End -->
+<!-- Device-DeviceAccount-PasswordRotationEnabled-End -->
 
 <!-- Device-DeviceAccount-SipAddress-Begin -->
 ### DeviceAccount/SipAddress
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 4b7a21cdcd..e4247312ed 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -49,7 +49,7 @@ items:
           href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
         - name: Policies supported by Windows 10 IoT Core
           href: policies-in-policy-csp-supported-by-iot-core.md
-        - name: Policies supported by Microsoft Windows 10 Team
+        - name: Policies supported by Windows 10 Team
           href: policies-in-policy-csp-supported-by-surface-hub.md
         - name: Policies that can be set using Exchange Active Sync (EAS)
           href: policies-in-policy-csp-that-can-be-set-using-eas.md

From 750b34aa2e02d55c50e75d7e65454cddebc357de Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Mon, 27 Mar 2023 16:30:51 -0400
Subject: [PATCH 12/64] Add override for AllowScanningNetworkFiles

---
 windows/client-management/mdm/policy-csp-defender.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index 99bd8a5bcc..1f26de308e 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -702,6 +702,10 @@ Allows or disallows Windows Defender Realtime Monitoring functionality.
 
 <!-- AllowScanningNetworkFiles-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+This policy setting allows you to configure real-time scanning for files that are accessed over the network. It is recommended to enable this setting.
+
+- If you enable this setting or do not configure this setting, network files will be scanned.
+- If you disable this setting, network files will not be scanned.
 <!-- AllowScanningNetworkFiles-Editable-End -->
 
 <!-- AllowScanningNetworkFiles-DFProperties-Begin -->

From ab8f438f4b8f245023962a2a6157434977766aab Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Mon, 27 Mar 2023 16:34:10 -0700
Subject: [PATCH 13/64] Added troubleshooting topic and fixed other topics
 related to debugging and troubleshooting

---
 .../event-id-explanations.md                  | 110 ++++++--------
 .../event-tag-explanations.md                 |  58 ++++++-
 .../operations/known-issues.md                |  25 ++-
 .../wdac-debugging-and-troubleshooting.md     | 143 ++++++++++++++++++
 ...r-application-control-operational-guide.md |  10 --
 5 files changed, 267 insertions(+), 79 deletions(-)
 create mode 100644 windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md

diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
index 4b9c9e64bd..8a74cb79d7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
@@ -8,7 +8,7 @@ author: jsuther1974
 ms.reviewer: jogeurte
 ms.author: vinpa
 manager: aaroncz
-ms.date: 06/27/2022
+ms.date: 03/24/2023
 ms.topic: reference
 ---
 
@@ -20,43 +20,77 @@ ms.topic: reference
 - Windows 11
 - Windows Server 2016 and later (limited events)
 
-A Windows Defender Application Control policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations:
+## WDAC Events Overview
 
-- Events about Application Control policy activation and the control of executables, dlls, and drivers appear in **Applications and Services logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational**
+WDAC logs events when a policy is loaded as well as when a binary attempts to run and is blocked, or would be blocked if the policy is in audit mode. These block events include information that identifies the policy and gives more details about the block. Generally, WDAC doesn't generate events when a binary is allowed; however, you can turn on allow audit events for files that were authorized by Managed Installer or the Intelligent Security Graph (ISG) as described later in this article.
 
-- Events about the control of MSI installers, scripts, and COM objects appear in **Applications and Services logs** > **Microsoft** > **Windows** > **AppLocker** > **MSI and Script**
+### Core WDAC event logs
+
+WDAC events are generated under two locations in the Windows Event Viewer:
+
+- **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational** includes events about Application Control policy activation and the control of executables, dlls, and drivers.
+- **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script** includes events about the control of MSI installers, scripts, and COM objects.
+
+Most app and script failures that occur when WDAC is active can be diagnosed using these two event logs. This article describes in greater detail the events that exist in these logs. To understand the meaning of different data elements, or tags, found in the details of these events, see [Understanding Application Control event tags](event-tag-explanations.md).
 
 > [!NOTE]
 > These event IDs are not included on Windows Server Core edition.
 
-## Windows CodeIntegrity Operational log
+## WDAC block events for executables, dlls, and drivers
+
+These events are found in the **CodeIntegrity - Operational** event log.
 
 | Event ID | Explanation |
 |--------|-----------|
-| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required. |
-| 3033 | This event isn't common. It often means the file's signature is revoked or expired. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a non-signature rule (for example, hash) to address issues with revoked or expired certs. |
+| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required. <br><br> This event is also seen for kernel- or user-mode code that the developer opted-in to [/INTEGRITYCHECK](/cpp/build/reference/integritycheck-require-signature-check) but is not signed correctly. |
+| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where an expired signature will be blocked by WDAC. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a non-signature rule (for example, hash) to address issues with revoked or expired certs. <br><br> This event is also seen for code that the developer opted-in to [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard) but then attempts to load code that doesn't meet the requirements of CIG. |
 | 3034 | This event isn't common. It's the audit mode equivalent of event 3033 described above. |
 | 3076 | This event is the main Application Control block event for audit mode policies. It indicates that the file would have been blocked if the policy was enforced. |
 | 3077 | This event is the main Application Control block event for enforced policies. It indicates that the file didn't pass your policy and was blocked. |
 | 3089 | This event contains signature information for files that were blocked or would have been blocked by Application Control. One 3089 event is created for each signature of a file. The event shows the total number of signatures found and an index value to identify the current signature. Unsigned files produce a single 3089 event with TotalSignatureCount 0. 3089 events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the `Correlation ActivityID` found in the **System** portion of the event. |
-| 3099 | Indicates that a policy has been loaded. This event also includes information about the Application Control policy options that were specified by the policy. |
 
-## Windows AppLocker MSI and Script log
+## WDAC block events for packaged apps, MSI installers, scripts, and COM objects
+
+These events are found in the **AppLocker – MSI and Script** event log.
 
 | Event ID | Explanation |
 |--------|-----------|
-| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. |
+| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run, but would not have passed the WDAC policy if it was enforced. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. |
 | 8029 | This event is the enforcement mode equivalent of event 8028 described above. Note: While this event says that a script was blocked, the actual script enforcement behavior is implemented by the script host. The script host may allow the file to run with restrictions and not block the file outright. For example, PowerShell will allow a script to run but only in [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). |
 | 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](allow-com-object-registration-in-windows-defender-application-control-policy.md). |
+| 8037 | This event indicates that a script host queried Application Control about a file the script host was about to run, the file passed the WDAC policy and was allowed to run. |
 | 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. 8038 events are correlated with 8028 and 8029 events and can be matched using the `Correlation ActivityID` found in the **System** portion of the event. |
+| 8039 | This event indicates that a packaged app (MSIX/AppX) was allowed to install or run because the WDAC policy is in audit mode, but would have been blocked if the policy was enforced. |
+| 8040 | This event indicates that a packaged app was prevented from installing or running due to the WDAC policy. |
+
+## WDAC policy activation events
+
+These events are found in the **CodeIntegrity - Operational** event log, unless otherwise noted.
+
+| Event ID | Explanation |
+|--------|-----------|
+| 3095 | The Application Control policy can't be refreshed and must be rebooted instead. |
+| 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. This event's Details includes useful information about the Application Control policy, such as the policy options that were specified by the policy. |
+| 3097 | The Application Control policy can't be refreshed. |
+| 3099 | Indicates that a policy has been loaded. This event's Details includes useful information about the Application Control policy, such as the policy options that were specified by the policy. |
+| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. |
+| 3101 | Application Control policy refresh started for *N* policies. |
+| 3102 | Application Control policy refresh finished for *N* policies. |
+| 3103 | The system is ignoring the Application Control policy refresh. For example, an inbox Windows policy that does not meet the conditions for activation. |
+| 3105 | The system is attempting to refresh the Application Control policy with the specified Id. |
+| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL are not related to WDAC. |
 
 ## Diagnostic events for Intelligent Security Graph (ISG) and Managed Installer (MI)
 
 > [!NOTE]
 > When Managed Installer is enabled, customers using LogAnalytics should be aware that Managed Installer may fire many 3091 events.  Customers may need to filter out these events to avoid high LogAnalytics costs.
 
+### WDAC diagnostic events 3090, 3091, and 3092
+
 Events 3090, 3091 and 3092 prove helpful diagnostic information when the ISG or MI option is enabled by any Application Control policy. These events can help you debug why something was allowed/denied based on managed installer or ISG. These events don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077 described above.
 
+These events are found in the **CodeIntegrity - Operational** event log.
+
 | Event ID | Explanation |
 |--------|---------|
 | 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. |
@@ -65,10 +99,12 @@ Events 3090, 3091 and 3092 prove helpful diagnostic information when the ISG or
 
 The above events are reported per active policy on the system, so you may see multiple events for the same file.
 
-### ISG and MI diagnostic event details
+#### ISG and MI diagnostic event details
 
 The following information is found in the details for 3090, 3091, and 3092 events.
 
+These events are found in either the **CodeIntegrity - Operational** event log or the **CodeIntegrity - Verbose** event log, depending on your version of Windows.
+
 | Name | Explanation |
 |------|------|
 | ManagedInstallerEnabled | Indicates whether the specified policy enables managed installer trust |
@@ -78,7 +114,7 @@ The following information is found in the details for 3090, 3091, and 3092 event
 | AuditEnabled | True if the Application Control policy is in audit mode, otherwise it is in enforce mode |
 | PolicyName | The name of the Application Control policy to which the event applies |
 
-### Enabling ISG and MI diagnostic events
+#### Enabling ISG and MI diagnostic events
 
 To enable 3090 allow events, create a TestFlags regkey with a value of 0x300 as shown in the following PowerShell command. Then restart your computer.
 
@@ -88,56 +124,6 @@ reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x
 
 3091 and 3092 events are inactive on some versions of Windows. The above steps will also turn on those events.
 
-## Event ID 3099 Options
-
-The Application Control policy rule option values can be derived from the "Options" field in the Details section of the Code integrity 3099 event. To parse the values, first convert the hex value to binary. To derive and parse these values, follow the below workflow.
-
-- Access Event Viewer.
-- Access the Code integrity 3099 event.
-- Access the details pane.
-- Identify the hex code listed in the "Options" field.
-- Convert the hex code to binary.
-
-:::image type="content" source="images/event-3099-options.png" alt-text="Event 3099 policy rule options.":::
-
-For a simple solution for converting hex to binary, follow these steps:
-
-1. Open the Calculator app.
-1. Select the menu icon. :::image type="icon" source="images/calculator-menu-icon.png" border="false":::
-1. Select **Programmer** mode.
-1. Select **HEX**. :::image type="icon" source="images/hex-icon.png" border="false":::
-1. Enter your hex code. For example, `80881000`.
-1. Switch to the **Bit Toggling Keyboard**. :::image type="icon" source="images/bit-toggling-keyboard-icon.png" border="false":::
-
-:::image type="content" source="images/calculator-with-hex-in-binary.png" alt-text="An example of the calculator app in programmer mode, with a hex code converted into binary.":::
-
-This view will provide the hex code in binary form, with each bit address shown separately.  The bit addresses start at 0 in the bottom right.  Each bit address correlates to a specific event policy-rule option.  If the bit address holds a value of 1, the setting is in the policy.
-
-Next, use the bit addresses and their values from the table below to determine the state of each [policy rule-option](select-types-of-rules-to-create.md#table-1-windows-defender-application-control-policy---policy-rule-options). For example, if the bit address of 16 holds a value of 1, then the **Enabled: Audit Mode (Default)** option is in the policy. This setting means that the policy is in audit mode.
-
-| Bit Address | Policy Rule Option |
-|-------|------|
-| 2 | `Enabled:UMCI` |
-| 3 | `Enabled:Boot Menu Protection` |
-| 4 | `Enabled:Intelligent Security Graph Authorization` |
-| 5 | `Enabled:Invalidate EAs on Reboot` |
-| 7 | `Required:WHQL` |
-| 10 | `Enabled:Allow Supplemental Policies` |
-| 11 | `Disabled:Runtime FilePath Rule Protection` |
-| 13 | `Enabled:Revoked Expired As Unsigned` |
-| 16 | `Enabled:Audit Mode (Default)` |
-| 17 | `Disabled:Flight Signing` |
-| 18 | `Enabled:Inherit Default Policy` |
-| 19 | `Enabled:Unsigned System Integrity Policy (Default)` |
-| 20 | `Enabled:Dynamic Code Security` |
-| 21 | `Required:EV Signers` |
-| 22 | `Enabled:Boot Audit on Failure` |
-| 23 | `Enabled:Advanced Boot Options Menu` |
-| 24 | `Disabled:Script Enforcement` |
-| 25 | `Required:Enforce Store Applications` |
-| 27 | `Enabled:Managed Installer`  |
-| 28 | `Enabled:Update Policy No Reboot` |
-
 ## Appendix
 
 A list of other relevant event IDs and their corresponding description.
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index f358465735..31cf192cbc 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -10,10 +10,10 @@ ms.pagetype: security
 ms.localizationpriority: medium
 audience: ITPro
 author: jsuther1974
-ms.reviewer: isbrahm
+ms.reviewer: jogeurte
 ms.author: vinpa
 manager: aaroncz
-ms.date: 07/13/2021
+ms.date: 03/24/2023
 ms.technology: itpro-security
 ms.topic: article
 ---
@@ -37,14 +37,14 @@ Represents the type of signature which verified the image.
 | 6 | AppX / MSIX package catalog verified |
 | 7 | File was verified |
 
-## ValidatedSigningLevel
+## Requested and ValidatedSigningLevel
 
 Represents the signature level at which the code was verified.
 
 | ValidatedSigningLevel Value | Explanation |
 |---|----------|
 | 0 | Signing level hasn't yet been checked |
-| 1 | File is unsigned |
+| 1 | File is unsigned or has no signature that passes the active policies |
 | 2 | Trusted by Windows Defender Application Control policy |
 | 3 | Developer signed code |
 | 4 | Authenticode signed |
@@ -92,6 +92,56 @@ Represents why verification failed, or if it succeeded.
 | 27 | The signing chain appears to be tampered/invalid |
 | 28 | Resource page hash mismatch |
 
+## Policy activation event Options
+
+The Application Control policy rule option values can be derived from the "Options" field in the Details section for successful [policy activation events](event-id-explanations.md#wdac-policy-activation-events). To parse the values, first convert the hex value to binary. To derive and parse these values, follow the below workflow.
+
+- Access Event Viewer.
+- Access the Code integrity 3099 event.
+- Access the details pane.
+- Identify the hex code listed in the "Options" field.
+- Convert the hex code to binary.
+
+:::image type="content" source="images/event-3099-options.png" alt-text="Event 3099 policy rule options.":::
+
+For a simple solution for converting hex to binary, follow these steps:
+
+1. Open the Calculator app.
+1. Select the menu icon. :::image type="icon" source="images/calculator-menu-icon.png" border="false":::
+1. Select **Programmer** mode.
+1. Select **HEX**. :::image type="icon" source="images/hex-icon.png" border="false":::
+1. Enter your hex code. For example, `80881000`.
+1. Switch to the **Bit Toggling Keyboard**. :::image type="icon" source="images/bit-toggling-keyboard-icon.png" border="false":::
+
+:::image type="content" source="images/calculator-with-hex-in-binary.png" alt-text="An example of the calculator app in programmer mode, with a hex code converted into binary.":::
+
+This view will provide the hex code in binary form, with each bit address shown separately.  The bit addresses start at 0 in the bottom right.  Each bit address correlates to a specific event policy-rule option.  If the bit address holds a value of 1, the setting is in the policy.
+
+Next, use the bit addresses and their values from the table below to determine the state of each [policy rule-option](select-types-of-rules-to-create.md#table-1-windows-defender-application-control-policy---policy-rule-options). For example, if the bit address of 16 holds a value of 1, then the **Enabled: Audit Mode (Default)** option is in the policy. This setting means that the policy is in audit mode.
+
+| Bit Address | Policy Rule Option |
+|-------|------|
+| 2 | `Enabled:UMCI` |
+| 3 | `Enabled:Boot Menu Protection` |
+| 4 | `Enabled:Intelligent Security Graph Authorization` |
+| 5 | `Enabled:Invalidate EAs on Reboot` |
+| 7 | `Required:WHQL` |
+| 10 | `Enabled:Allow Supplemental Policies` |
+| 11 | `Disabled:Runtime FilePath Rule Protection` |
+| 13 | `Enabled:Revoked Expired As Unsigned` |
+| 16 | `Enabled:Audit Mode (Default)` |
+| 17 | `Disabled:Flight Signing` |
+| 18 | `Enabled:Inherit Default Policy` |
+| 19 | `Enabled:Unsigned System Integrity Policy (Default)` |
+| 20 | `Enabled:Dynamic Code Security` |
+| 21 | `Required:EV Signers` |
+| 22 | `Enabled:Boot Audit on Failure` |
+| 23 | `Enabled:Advanced Boot Options Menu` |
+| 24 | `Disabled:Script Enforcement` |
+| 25 | `Required:Enforce Store Applications` |
+| 27 | `Enabled:Managed Installer`  |
+| 28 | `Enabled:Update Policy No Reboot` |
+
 ## Microsoft Root CAs trusted by Windows
 
 The rule means trust anything signed by a certificate that chains to this root CA.
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
index a5642a032c..f2125eb6c8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
@@ -28,15 +28,34 @@ ms.localizationpriority: medium
 
 This article covers tips and tricks for admins and known issues with Windows Defender Application Control (WDAC). Test this configuration in your lab before enabling it in production.
 
-## Managed Installer and ISG will cause garrulous events
+## WDAC policy file locations
+
+**Multiple policy format WDAC policies** are found in the following locations depending on whether the policy is signed or not, and the method of policy deployment that was used.
+
+- &lt;OS Volume&gt;\\Windows\\System32\\CodeIntegrity\\CiPolicies\Active\\*\{PolicyId GUID\}*.cip
+- &lt;EFI System Partition&gt;\\Microsoft\\Boot\\CiPolicies\Active\\*\{PolicyId GUID\}*.cip
+
+The *\{PolicyId GUID\}* value is unique by policy and defined in the policy XML with the &lt;PolicyId&gt; element.
+
+For **single policy format WDAC policies**, in addition to the two locations above, also look for a file called SiPolicy.p7b that may be found in the following locations:
+
+- &lt;EFI System Partition&gt;\\Microsoft\\Boot\\SiPolicy.p7b
+- &lt;OS Volume&gt;\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b
+
+> [!NOTE]
+> A multiple policy format WDAC policy using the single policy format GUID `{A244370E-44C9-4C06-B551-F6016E563076}` may exist under any of the policy file locations.
+
+## Known issues
+
+### Managed Installer and ISG will cause garrulous events
 
 When Managed Installer and ISG are enabled, 3091 and 3092 events will be logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events have been moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy.
 
-## .NET native images may generate false positive block events
+### .NET native images may generate false positive block events
 
 In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image will fall back to its corresponding assembly and .NET will regenerate the native image at its next scheduled maintenance window.
 
-## MSI Installations launched directly from the internet are blocked by WDAC
+### MSI Installations launched directly from the internet are blocked by WDAC
 
 Installing .msi files directly from the internet to a computer protected by WDAC will fail.
 For example, this command won't work:
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
new file mode 100644
index 0000000000..91970316c1
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -0,0 +1,143 @@
+---
+title: WDAC debugging and troubleshooting guide
+description: Learn how to debug and troubleshoot app and script failures when using WDAC
+author: valemieux
+ms.author: jogeurte
+ms.reviewer: jsuther1974
+ms.topic: how-to
+ms.date: 03/23/2023
+ms.custom: template-how-to
+ms.prod: windows-client
+ms.technology: itpro-security
+---
+
+# WDAC debugging and troubleshooting
+
+**Applies to**
+
+- Windows 10
+- Windows 11
+- Windows Server 2016 and above
+
+> [!NOTE]
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
+
+This article describes how to debug and troubleshoot app and script failures when using Windows Defender Application Control (WDAC).
+
+## 1 - Gather WDAC diagnostic data
+
+Before debugging and troubleshooting WDAC issues, you must collect information from a device exhibiting the problem behavior. Run the following commands from an elevated PowerShell window to collect the diagnostic information you may need:
+
+1. Gather general WDAC diagnostic data and copy it to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag by running:
+
+    ```powershell
+    cidiag.exe /stop
+    ```
+
+    If CiDiag.exe is not present in your version of Windows, gather this information manually:
+
+    - WDAC policy binaries from the [Windows and EFI system partitions](known-issues.md#wdac-policy-file-locations)
+    - WDAC event logs
+    - AppLocker event logs
+    - Other event logs that may contain useful information from other Windows apps and services
+    - A text file containing only critical error events found in the WDAC event logs
+    - A text file containing full event details for critical error events found in the WDAC event logs
+
+2. Save the device's System Information to the CiDiag folder by running `msinfo32.exe /report $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\SystemInformation.txt`.
+3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device by running `citool.exe -lp -json > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\CiToolOutput.json`. Skip this step if CiTool.exe is not present in your version of Windows.
+4. Export AppLocker registry key data to the CiDiag folder by running the following commands:
+
+    `reg.exe query HKLM\Software\Policies\Microsoft\Windows\SrpV2 /s > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt`<br>
+    `reg.exe query HKLM\Software\Policies\Microsoft\Windows\AppidPlugins /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt`<br>
+    `reg.exe query HKLM\System\CurrentControlSet\Control\Srp\ /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt`
+
+5. Copy any AppLocker policy files from  %windir%System32\AppLocker to the CiDiag folder by running `Copy-Item -Path $env:windir\System32\AppLocker -Destination $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\ -Recurse -Force`
+6. Collect file information for the AppLocker policy files collected in the previous step by running `Get-ChildItem -Path $env:windir\System32\AppLocker\ -Recurse | select Mode,LastWriteTime,CreationTime,Length,Name >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerPolicyFiles.txt`
+7. Export the effective AppLocker policy by running `Get-AppLockerPolicy -xml -Effective > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml`
+8. Collect AppLocker services configuration and state information by running the following commands:
+
+    `sc.exe query appid > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
+    `sc.exe query appidsvc >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
+    `sc.exe query applockerfltr > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`
+
+### Core WDAC event logs
+
+WDAC events are generated under two locations:
+
+- Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
+- Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script
+
+Within the CiDiag output directory, these event logs are called CIOperational.evtx and ALMsiAndScript.evtx, respectively.
+
+### Other Windows event logs that may be useful
+
+Sometimes, you may be able to supplement the information contained in the core WDAC event logs with information found in these other event logs. The ones shown in *italics* are not collected by cidiag.exe.
+
+- Applications and Services logs – Microsoft – Windows – CodeIntegrity – Verbose
+- Applications and Services logs – Microsoft – Windows – AppLocker – EXE and DLL
+- Applications and Services logs – Microsoft – Windows – AppLocker – Packaged app-Deployment
+- Applications and Services logs – Microsoft – Windows – AppLocker – Packaged app-Execution
+- Applications and Services logs – Microsoft – Windows – AppID - Operational
+- Applications and Services logs – Microsoft – Windows – CAPI2 - Operational
+- Applications and Services logs – Microsoft – Windows – DeviceGuard - Operational
+- *Applications and Services logs – Microsoft – Windows – PowerShell - \**
+- *Windows - Application*
+- *Windows - System*
+
+## 2 - Use the diagnostic and log data to identify problems
+
+Having gathered the necessary diagnostic information from a device, you're ready to begin your analysis of the diagnostic data collected in the previous step.
+
+1. Verify the set of WDAC policies that are active and enforced. Confirm that only those policies you expect to be active are currently active. Be aware that [Windows includes inbox policies](inbox-wdac-policies.md) that may also be active. You can use either of these methods:
+
+    - Review the output from *CiTool.exe -lp*, if applicable, which was saved to the CIDiag output directory as CiToolOutput.json. See [use Microsoft Edge to view the formatted json file](/microsoft-edge/devtools-guide-chromium/json-viewer/json-viewer).
+    - Review all [policy activation events](../event-id-explanations.md#wdac-policy-activation-events) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx.
+
+2. Review any [block events for executables, dlls, and drivers](../event-id-explanations.md#wdac-block-events-for-executables-dlls-and-drivers) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx. Use information from the block events and their correlated 3089 signature details event(s) to investigate any blocks that are unexplained or unexpected. See the blocked executable example described later in this article for reference.
+3. Review any [block events for packaged apps, MSI installers, scripts, and COM objects](../event-id-explanations.md#wdac-block-events-for-packaged-apps-msi-installers-scripts-and-com-objects) from the core script enforcement event log found at  **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script**. Within the CIDiag output directory, this event log is called ALMsiAndScript.evtx. Use information from the block events and their correlated 8038 signature details event(s) to investigate any blocks that are unexplained or unexpected.
+
+Most WDAC-related issues, including app and script failures, can be diagnosed using the preceding steps.
+
+### Event analysis for an example blocked executable
+
+<!-- To be completed -->
+
+## 3 - Resolve common problems
+
+### A file was blocked that you want to allow
+
+- Use data from the core WDAC event logs to add rules to allow the blocked file.
+- Re-deploy the file or app using a managed installer if your policy trusts managed installers.
+
+### A policy is active that is unexpected
+
+This condition may exist if:
+
+- A policy was removed but the system hasn't been rebooted.
+- A policy was partially removed, but a copy of the policy still exists in either the System or EFI partition.
+- A policy with PolicyId {A244370E-44C9-4C06-B551-F6016E563076} (single-policy format) was copied to the multiple-policy format policy location before activation, resulting in a duplicate policy binary on disk. Check for both SiPolicy.p7b and \{A244370E-44C9-4C06-B551-F6016E563076\}.cip files in the System and EFI partitions.
+- A policy was incorrectly deployed to the device.
+- An attacker with administrator access has applied a policy to cause denial of service for some critical processes.
+
+To resolve such an issue, follow the instructions to [Remove WDAC policies](../disable-windows-defender-application-control-policies.md) for the identified policy.
+
+### An unhandled app failure is occurring and no WDAC events are observed
+
+Some apps alter their behavior when a user mode WDAC policy is active which can result in unexpected failures. This can also be seen as a side-effect of script enforcement, since the script enforcement behaviors are implemented by the individual script hosts and may not be handled by apps that interact with those script hosts.
+
+Try to isolate the root cause by doing the following:
+
+- Check for events in [other event logs](#other-windows-event-logs-that-may-be-useful) corresponding with the app failures.
+- Temporarily replace the WDAC policy with another policy that [disables script enforcement](../design/script-enforcement.md) and re-test.
+- Temporarily replace the WDAC policy with another policy that [allows all COM objects](../allow-com-object-registration-in-windows-defender-application-control-policy.md) and re-test.
+- Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](../select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) and re-test.
+
+### An app deployed by a managed installer is not working
+
+To debug issues using managed installer, try the following:
+
+- Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in 
+- Check that the AppLocker services are running. These should be found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created earlier.
+- Check that an AppLocker file exists called MANAGEDINSTALLER.APPLOCKER 
+- Check if the app is encountering a [known limitation with managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#known-limitations-with-managed-installer). If so, you must authorize the app using other means.
+- 
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
index 4a03e5ee20..ffa96146c9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
@@ -31,16 +31,6 @@ ms.topic: article
 
 After enabling you understand how to design and deploy your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they aren't behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature.
 
-## WDAC Events Overview
-
-Windows Defender Application Control generates and logs events when a policy is loaded as well as when a binary attempts to execute and is blocked. These events include information that identifies the policy and gives more details about the block. Generally, WDAC doesn't generate events when a binary is allowed; however, there's the option to enable events when Managed Installer and/or the Intelligent Security Graph (ISG) is configured.
-
-WDAC events are generated under two locations:
-
- - Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
- 
- - Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script
-
 ## In this section
 
 | Topic | Description |

From 6831e168e4a9ff654ae3b020c400ca75f23f72ac Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Tue, 28 Mar 2023 08:30:05 -0700
Subject: [PATCH 14/64] Update wdac-debugging-and-troubleshooting.md

---
 .../operations/wdac-debugging-and-troubleshooting.md      | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index 91970316c1..862a0bb9ce 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -40,8 +40,6 @@ Before debugging and troubleshooting WDAC issues, you must collect information f
     - WDAC event logs
     - AppLocker event logs
     - Other event logs that may contain useful information from other Windows apps and services
-    - A text file containing only critical error events found in the WDAC event logs
-    - A text file containing full event details for critical error events found in the WDAC event logs
 
 2. Save the device's System Information to the CiDiag folder by running `msinfo32.exe /report $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\SystemInformation.txt`.
 3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device by running `citool.exe -lp -json > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\CiToolOutput.json`. Skip this step if CiTool.exe is not present in your version of Windows.
@@ -56,9 +54,9 @@ Before debugging and troubleshooting WDAC issues, you must collect information f
 7. Export the effective AppLocker policy by running `Get-AppLockerPolicy -xml -Effective > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml`
 8. Collect AppLocker services configuration and state information by running the following commands:
 
-    `sc.exe query appid > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
-    `sc.exe query appidsvc >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
-    `sc.exe query applockerfltr > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`
+    `sc.exe query appid ; sc.exe query appidsvc; sc.exe query applockerfltr > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
+    `>> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
+    `>> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`
 
 ### Core WDAC event logs
 

From 480b0b822f2cd41b14e3719609f5b2dd6ff8c84c Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Tue, 28 Mar 2023 10:38:12 -0700
Subject: [PATCH 15/64] Update wdac-debugging-and-troubleshooting.md

---
 .../wdac-debugging-and-troubleshooting.md     | 80 ++++++++++++++-----
 1 file changed, 59 insertions(+), 21 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index 862a0bb9ce..4f6d9ae41e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -28,7 +28,7 @@ This article describes how to debug and troubleshoot app and script failures whe
 
 Before debugging and troubleshooting WDAC issues, you must collect information from a device exhibiting the problem behavior. Run the following commands from an elevated PowerShell window to collect the diagnostic information you may need:
 
-1. Gather general WDAC diagnostic data and copy it to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag by running:
+1. Gather general WDAC diagnostic data and copy it to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag:
 
     ```powershell
     cidiag.exe /stop
@@ -41,22 +41,47 @@ Before debugging and troubleshooting WDAC issues, you must collect information f
     - AppLocker event logs
     - Other event logs that may contain useful information from other Windows apps and services
 
-2. Save the device's System Information to the CiDiag folder by running `msinfo32.exe /report $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\SystemInformation.txt`.
-3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device by running `citool.exe -lp -json > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\CiToolOutput.json`. Skip this step if CiTool.exe is not present in your version of Windows.
-4. Export AppLocker registry key data to the CiDiag folder by running the following commands:
+2. Save the device's System Information to the CiDiag folder:
 
-    `reg.exe query HKLM\Software\Policies\Microsoft\Windows\SrpV2 /s > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt`<br>
-    `reg.exe query HKLM\Software\Policies\Microsoft\Windows\AppidPlugins /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt`<br>
-    `reg.exe query HKLM\System\CurrentControlSet\Control\Srp\ /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt`
+    ```powershell
+    msinfo32.exe /report $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\SystemInformation.txt
+    ```
 
-5. Copy any AppLocker policy files from  %windir%System32\AppLocker to the CiDiag folder by running `Copy-Item -Path $env:windir\System32\AppLocker -Destination $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\ -Recurse -Force`
-6. Collect file information for the AppLocker policy files collected in the previous step by running `Get-ChildItem -Path $env:windir\System32\AppLocker\ -Recurse | select Mode,LastWriteTime,CreationTime,Length,Name >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerPolicyFiles.txt`
-7. Export the effective AppLocker policy by running `Get-AppLockerPolicy -xml -Effective > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml`
-8. Collect AppLocker services configuration and state information by running the following commands:
+3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device. Skip this step if CiTool.exe is not present in your version of Windows.
 
-    `sc.exe query appid ; sc.exe query appidsvc; sc.exe query applockerfltr > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
-    `>> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`<br>
-    `>> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt`
+    ```powershell
+    citool.exe -lp -json > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\CiToolOutput.json
+    ````
+
+4. Export AppLocker registry key data to the CiDiag folder:
+
+    ```powershell
+    reg.exe query HKLM\Software\Policies\Microsoft\Windows\SrpV2 /s > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt; reg.exe query HKLM\Software\Policies\Microsoft\Windows\AppidPlugins /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt; reg.exe query HKLM\System\CurrentControlSet\Control\Srp\ /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt
+    ```
+
+5. Copy any AppLocker policy files from  %windir%System32\AppLocker to the CiDiag folder:
+
+    ```powershell
+    Copy-Item -Path $env:windir\System32\AppLocker -Destination $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\ -Recurse -Force -ErrorAction Ignore
+    ```
+
+6. Collect file information for the AppLocker policy files collected in the previous step:
+
+    ```powershell
+    Get-ChildItem -Path $env:windir\System32\AppLocker\ -Recurse | select Mode,LastWriteTime,CreationTime,Length,Name >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerPolicyFiles.txt
+    ```
+
+7. Export the effective AppLocker policy:
+
+    ```powershell
+    Get-AppLockerPolicy -xml -Effective > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml
+    ```
+
+8. Collect AppLocker services configuration and state information:
+
+    ```powershell
+    sc.exe query appid > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt; sc.exe query appidsvc >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt; sc.exe query applockerfltr >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt
+    ```
 
 ### Core WDAC event logs
 
@@ -102,12 +127,12 @@ Most WDAC-related issues, including app and script failures, can be diagnosed us
 
 ## 3 - Resolve common problems
 
-### A file was blocked that you want to allow
+### Issue: A file was blocked that you want to allow
 
 - Use data from the core WDAC event logs to add rules to allow the blocked file.
 - Re-deploy the file or app using a managed installer if your policy trusts managed installers.
 
-### A policy is active that is unexpected
+### Issue: A policy is active that is unexpected
 
 This condition may exist if:
 
@@ -119,7 +144,7 @@ This condition may exist if:
 
 To resolve such an issue, follow the instructions to [Remove WDAC policies](../disable-windows-defender-application-control-policies.md) for the identified policy.
 
-### An unhandled app failure is occurring and no WDAC events are observed
+### Issue: An unhandled app failure is occurring and no WDAC events are observed
 
 Some apps alter their behavior when a user mode WDAC policy is active which can result in unexpected failures. This can also be seen as a side-effect of script enforcement, since the script enforcement behaviors are implemented by the individual script hosts and may not be handled by apps that interact with those script hosts.
 
@@ -130,12 +155,25 @@ Try to isolate the root cause by doing the following:
 - Temporarily replace the WDAC policy with another policy that [allows all COM objects](../allow-com-object-registration-in-windows-defender-application-control-policy.md) and re-test.
 - Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](../select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) and re-test.
 
-### An app deployed by a managed installer is not working
+### Issue: An app deployed by a managed installer is not working
 
 To debug issues using managed installer, try the following:
 
-- Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in 
+- Check that the WDAC policy that is blocking the app includes the option to enable managed installer.
+- Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in [Automatically allow apps deployed by a managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#create-and-deploy-an-applocker-policy-that-defines-your-managed-installer-rules-and-enables-services-enforcement-for-executables-and-dlls).
 - Check that the AppLocker services are running. These should be found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created earlier.
-- Check that an AppLocker file exists called MANAGEDINSTALLER.APPLOCKER 
+- Check that an AppLocker file exists called MANAGEDINSTALLER.APPLOCKER exists in the CiDiag folder created earlier. If not, repeat the steps to deploy and enable the managed installer AppLocker configuration.
+- Restart the managed installer process and check that an 8002 event is observed in the **AppLocker - EXE and DLL** event log for the managed installer process with PolicyName = MANAGEDINSTALLER. If instead you see an event with 8003 or 8004 with PolicyName = MANAGEDINSTALLER, then check the ManagedInstaller rules in the AppLocker policy XML and ensure a rule matches the managed installer process.
+- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-managed-installer-mi) to verify files written by the managed installer process have the managed installer origin extended attribute. If not, re-deploy the files with the managed installer and check again.
+- Test installation of a different app using the managed installer.
+- Add another managed installer to your AppLocker policy and test installation using the other managed installer.
 - Check if the app is encountering a [known limitation with managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#known-limitations-with-managed-installer). If so, you must authorize the app using other means.
-- 
+
+### Issue: An app you expected to be allowed by the Intelligent Security Graph (ISG) is not working
+
+To debug issues using ISG, try the following:
+
+- Check that the WDAC policy that is blocking the app includes the option to enable the intelligent security graph.
+- Check that the AppLocker services are running. These should be found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created earlier.
+- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, re-deploy the files with the managed installer and check again.
+- Check if the app is encountering a [known limitation with ISG](../use-windows-defender-application-control-with-intelligent-security-graph.md#known-limitations-with-using-the-isg).

From 01014008b35c07dad4719a985f7a178acb6e4fcf Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Tue, 28 Mar 2023 17:28:03 -0400
Subject: [PATCH 16/64] Update Surface Hub applicability

---
 ...-in-policy-csp-supported-by-surface-hub.md | 152 +-----------------
 1 file changed, 1 insertion(+), 151 deletions(-)

diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index 4c67e36e15..49bdb3e952 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Windows 10 Team
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 03/24/2023
+ms.date: 03/28/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -26,15 +26,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#allowappstoreautoupdate)
 - [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#allowdeveloperunlock)
 
-## Authentication
-
-- [AllowAadPasswordReset](policy-csp-authentication.md#allowaadpasswordreset)
-- [AllowEAPCertSSO](policy-csp-authentication.md#alloweapcertsso)
-- [AllowFastReconnect](policy-csp-authentication.md#allowfastreconnect)
-- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md#allowsecondaryauthenticationdevice)
-- [EnableFastFirstSignIn](policy-csp-authentication.md#enablefastfirstsignin)
-- [EnableWebSignIn](policy-csp-authentication.md#enablewebsignin)
-
 ## Bluetooth
 
 - [AllowAdvertising](policy-csp-bluetooth.md#allowadvertising)
@@ -48,48 +39,26 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 ## Browser
 
 - [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown)
-- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown)
-- [AllowAutofill](policy-csp-browser.md#allowautofill)
 - [AllowAutofill](policy-csp-browser.md#allowautofill)
 - [AllowBrowser](policy-csp-browser.md#allowbrowser)
-- [AllowBrowser](policy-csp-browser.md#allowbrowser)
-- [AllowCookies](policy-csp-browser.md#allowcookies)
 - [AllowCookies](policy-csp-browser.md#allowcookies)
 - [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools)
-- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools)
-- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack)
 - [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack)
 - [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun)
-- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun)
-- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist)
 - [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist)
 - [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager)
-- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager)
-- [AllowPopups](policy-csp-browser.md#allowpopups)
 - [AllowPopups](policy-csp-browser.md#allowpopups)
 - [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar)
-- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar)
-- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen)
 - [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen)
 - [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit)
-- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit)
-- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines)
 - [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines)
 - [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages)
-- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages)
-- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist)
 - [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist)
 - [HomePages](policy-csp-browser.md#homepages)
-- [HomePages](policy-csp-browser.md#homepages)
-- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection)
 - [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection)
 - [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride)
-- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride)
-- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles)
 - [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles)
 - [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc)
-- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc)
-- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine)
 - [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine)
 
 ## Camera
@@ -120,7 +89,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring)
 - [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles)
 - [AllowScriptScanning](policy-csp-defender.md#allowscriptscanning)
-- [AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess)
 - [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions)
 - [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules)
 - [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor)
@@ -183,10 +151,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth)
 - [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords)
 
-## Experience
-
-- [DoNotShowFeedbackNotifications](policy-csp-experience.md#donotshowfeedbacknotifications)
-
 ## ExploitGuard
 
 - [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitprotectionsettings)
@@ -287,74 +251,13 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 
 ## Security
 
-- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication)
 - [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication)
 - [RequireProvisioningPackageSignature](policy-csp-security.md#requireprovisioningpackagesignature)
 - [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md#requireretrievehealthcertificateonboot)
 
-## Settings
-
-- [ConfigureTaskbarCalendar](policy-csp-settings.md#configuretaskbarcalendar)
-
 ## Start
 
-- [AllowPinnedFolderDocuments](policy-csp-start.md#allowpinnedfolderdocuments)
-- [AllowPinnedFolderDownloads](policy-csp-start.md#allowpinnedfolderdownloads)
-- [AllowPinnedFolderFileExplorer](policy-csp-start.md#allowpinnedfolderfileexplorer)
-- [AllowPinnedFolderHomeGroup](policy-csp-start.md#allowpinnedfolderhomegroup)
-- [AllowPinnedFolderMusic](policy-csp-start.md#allowpinnedfoldermusic)
-- [AllowPinnedFolderNetwork](policy-csp-start.md#allowpinnedfoldernetwork)
-- [AllowPinnedFolderPersonalFolder](policy-csp-start.md#allowpinnedfolderpersonalfolder)
-- [AllowPinnedFolderPictures](policy-csp-start.md#allowpinnedfolderpictures)
-- [AllowPinnedFolderSettings](policy-csp-start.md#allowpinnedfoldersettings)
-- [AllowPinnedFolderVideos](policy-csp-start.md#allowpinnedfoldervideos)
-- [ConfigureStartPins](policy-csp-start.md#configurestartpins)
-- [ConfigureStartPins](policy-csp-start.md#configurestartpins)
-- [DisableContextMenus](policy-csp-start.md#disablecontextmenus)
-- [DisableContextMenus](policy-csp-start.md#disablecontextmenus)
-- [DisableControlCenter](policy-csp-start.md#disablecontrolcenter)
-- [DisableEditingQuickSettings](policy-csp-start.md#disableeditingquicksettings)
-- [ForceStartSize](policy-csp-start.md#forcestartsize)
-- [ForceStartSize](policy-csp-start.md#forcestartsize)
-- [HideAppList](policy-csp-start.md#hideapplist)
-- [HideAppList](policy-csp-start.md#hideapplist)
-- [HideChangeAccountSettings](policy-csp-start.md#hidechangeaccountsettings)
-- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps)
-- [HideFrequentlyUsedApps](policy-csp-start.md#hidefrequentlyusedapps)
-- [HideHibernate](policy-csp-start.md#hidehibernate)
-- [HideLock](policy-csp-start.md#hidelock)
-- [HidePeopleBar](policy-csp-start.md#hidepeoplebar)
-- [HidePowerButton](policy-csp-start.md#hidepowerbutton)
-- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists)
-- [HideRecentJumplists](policy-csp-start.md#hiderecentjumplists)
-- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps)
-- [HideRecentlyAddedApps](policy-csp-start.md#hiderecentlyaddedapps)
-- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection)
-- [HideRecommendedSection](policy-csp-start.md#hiderecommendedsection)
-- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites)
-- [HideRecoPersonalizedSites](policy-csp-start.md#hiderecopersonalizedsites)
-- [HideRestart](policy-csp-start.md#hiderestart)
-- [HideShutDown](policy-csp-start.md#hideshutdown)
-- [HideSignOut](policy-csp-start.md#hidesignout)
-- [HideSleep](policy-csp-start.md#hidesleep)
-- [HideSwitchAccount](policy-csp-start.md#hideswitchaccount)
-- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton)
-- [HideTaskViewButton](policy-csp-start.md#hidetaskviewbutton)
-- [HideUserTile](policy-csp-start.md#hideusertile)
-- [ImportEdgeAssets](policy-csp-start.md#importedgeassets)
-- [NoPinningToTaskbar](policy-csp-start.md#nopinningtotaskbar)
-- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps)
-- [ShowOrHideMostUsedApps](policy-csp-start.md#showorhidemostusedapps)
-- [SimplifyQuickSettings](policy-csp-start.md#simplifyquicksettings)
 - [StartLayout](policy-csp-start.md#startlayout)
-- [StartLayout](policy-csp-start.md#startlayout)
-
-## Storage
-
-- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md#wpddevicesdenyreadaccessperdevice)
-- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md#wpddevicesdenyreadaccessperuser)
-- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md#wpddevicesdenywriteaccessperdevice)
-- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md#wpddevicesdenywriteaccessperuser)
 
 ## System
 
@@ -364,7 +267,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [AllowLocation](policy-csp-system.md#allowlocation)
 - [AllowStorageCard](policy-csp-system.md#allowstoragecard)
 - [AllowTelemetry](policy-csp-system.md#allowtelemetry)
-- [AllowTelemetry](policy-csp-system.md#allowtelemetry)
 
 ## TextInput
 
@@ -412,19 +314,7 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [AllowNonMicrosoftSignedUpdate](policy-csp-update.md#allownonmicrosoftsignedupdate)
 - [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol)
 - [AllowUpdateService](policy-csp-update.md#allowupdateservice)
-- [AutomaticMaintenanceWakeUp](policy-csp-update.md#automaticmaintenancewakeup)
-- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md#autorestartdeadlineperiodindays)
-- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md#autorestartdeadlineperiodindaysforfeatureupdates)
-- [AutoRestartNotificationSchedule](policy-csp-update.md#autorestartnotificationschedule)
-- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md#autorestartrequirednotificationdismissal)
 - [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel)
-- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#configuredeadlineforfeatureupdates)
-- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md#configuredeadlineforqualityupdates)
-- [ConfigureDeadlineGracePeriod](policy-csp-update.md#configuredeadlinegraceperiod)
-- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md#configuredeadlinegraceperiodforfeatureupdates)
-- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md#configuredeadlinenoautoreboot)
-- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#configuredeadlinenoautorebootforfeatureupdates)
-- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#configuredeadlinenoautorebootforqualityupdates)
 - [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod)
 - [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays)
 - [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#deferqualityupdatesperiodindays)
@@ -436,23 +326,16 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection)
 - [EngagedRestartDeadline](policy-csp-update.md#engagedrestartdeadline)
 - [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#engagedrestartdeadlineforfeatureupdates)
-- [EngagedRestartSnoozeSchedule](policy-csp-update.md#engagedrestartsnoozeschedule)
-- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md#engagedrestartsnoozescheduleforfeatureupdates)
-- [EngagedRestartTransitionSchedule](policy-csp-update.md#engagedrestarttransitionschedule)
-- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md#engagedrestarttransitionscheduleforfeatureupdates)
 - [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate)
 - [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls)
 - [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit)
 - [IgnoreMOUpdateDownloadLimit](policy-csp-update.md#ignoremoupdatedownloadlimit)
 - [ManagePreviewBuilds](policy-csp-update.md#managepreviewbuilds)
-- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md#noupdatenotificationsduringactivehours)
 - [PauseDeferrals](policy-csp-update.md#pausedeferrals)
 - [PauseFeatureUpdates](policy-csp-update.md#pausefeatureupdates)
 - [PauseFeatureUpdatesStartTime](policy-csp-update.md#pausefeatureupdatesstarttime)
 - [PauseQualityUpdates](policy-csp-update.md#pausequalityupdates)
 - [PauseQualityUpdatesStartTime](policy-csp-update.md#pausequalityupdatesstarttime)
-- [PhoneUpdateRestrictions](policy-csp-update.md#phoneupdaterestrictions)
-- [ProductVersion](policy-csp-update.md#productversion)
 - [RequireDeferUpgrade](policy-csp-update.md#requiredeferupgrade)
 - [RequireUpdateApproval](policy-csp-update.md#requireupdateapproval)
 - [ScheduledInstallDay](policy-csp-update.md#scheduledinstallday)
@@ -462,19 +345,11 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [ScheduledInstallSecondWeek](policy-csp-update.md#scheduledinstallsecondweek)
 - [ScheduledInstallThirdWeek](policy-csp-update.md#scheduledinstallthirdweek)
 - [ScheduledInstallTime](policy-csp-update.md#scheduledinstalltime)
-- [ScheduleImminentRestartWarning](policy-csp-update.md#scheduleimminentrestartwarning)
-- [ScheduleRestartWarning](policy-csp-update.md#schedulerestartwarning)
-- [SetAutoRestartNotificationDisable](policy-csp-update.md#setautorestartnotificationdisable)
-- [SetDisablePauseUXAccess](policy-csp-update.md#setdisablepauseuxaccess)
-- [SetDisableUXWUAccess](policy-csp-update.md#setdisableuxwuaccess)
-- [SetEDURestart](policy-csp-update.md#setedurestart)
 - [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#setpolicydrivenupdatesourcefordriverupdates)
 - [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforfeatureupdates)
 - [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforotherupdates)
 - [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforqualityupdates)
 - [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#setproxybehaviorforupdatedetection)
-- [TargetReleaseVersion](policy-csp-update.md#targetreleaseversion)
-- [UpdateNotificationLevel](policy-csp-update.md#updatenotificationlevel)
 - [UpdateServiceUrl](policy-csp-update.md#updateserviceurl)
 - [UpdateServiceUrlAlternate](policy-csp-update.md#updateserviceurlalternate)
 
@@ -486,31 +361,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect)
 - [WLANScanMode](policy-csp-wifi.md#wlanscanmode)
 
-## WindowsDefenderSecurityCenter
-
-- [CompanyName](policy-csp-windowsdefendersecuritycenter.md#companyname)
-- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md#disableaccountprotectionui)
-- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md#disableappbrowserui)
-- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md#disablecleartpmbutton)
-- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md#disabledevicesecurityui)
-- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md#disableenhancednotifications)
-- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md#disablefamilyui)
-- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md#disablehealthui)
-- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md#disablenetworkui)
-- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md#disablenotifications)
-- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md#disabletpmfirmwareupdatewarning)
-- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md#disablevirusui)
-- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md#disallowexploitprotectionoverride)
-- [Email](policy-csp-windowsdefendersecuritycenter.md#email)
-- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md#enablecustomizedtoasts)
-- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md#enableinappcustomization)
-- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md#hideransomwaredatarecovery)
-- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md#hidesecureboot)
-- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md#hidetpmtroubleshooting)
-- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md#hidewindowssecuritynotificationareacontrol)
-- [Phone](policy-csp-windowsdefendersecuritycenter.md#phone)
-- [URL](policy-csp-windowsdefendersecuritycenter.md#url)
-
 ## WirelessDisplay
 
 - [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement)

From cca3f13f8e8e847d7ec768d5e2894833b6fe947d Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Tue, 28 Mar 2023 18:15:33 -0400
Subject: [PATCH 17/64] More exclusions

---
 .../mdm/policies-in-policy-csp-supported-by-surface-hub.md      | 2 --
 1 file changed, 2 deletions(-)

diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index 49bdb3e952..e17a1d7e53 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -324,8 +324,6 @@ This article lists the policies in Policy CSP that are applicable for the Surfac
 - [DisableDualScan](policy-csp-update.md#disabledualscan)
 - [DisableWUfBSafeguards](policy-csp-update.md#disablewufbsafeguards)
 - [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection)
-- [EngagedRestartDeadline](policy-csp-update.md#engagedrestartdeadline)
-- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#engagedrestartdeadlineforfeatureupdates)
 - [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate)
 - [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls)
 - [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit)

From 0bc95b86a87c382b414f87c2edeb72201f449535 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Wed, 29 Mar 2023 07:08:29 -0700
Subject: [PATCH 18/64] More troubleshooting info

---
 .../images/event-3077.png                     | Bin 0 -> 308163 bytes
 .../wdac-debugging-and-troubleshooting.md     |  29 +++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/event-3077.png

diff --git a/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png b/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png
new file mode 100644
index 0000000000000000000000000000000000000000..2b39c88a49fd5c6227cf93ee5125efa7d19cc5c8
GIT binary patch
literal 308163
zcmc$`byU<_8#b(<sDz+M$LLY%uAxCiP`W#%M7nzrDJ7Neluqdy20=g=x_bm1x`v?!
z2KWZgV?677j>q?pcfD)Lf^qij-`>}K?YsB9QIwY=z@@~!aNz>M(<c(j7cN}Qyl?@R
z^ePVKfAlC(j+kE;9hIdXUMT6MUctP$Wd1<z!G#MSBJj{gmocxe**($145A4-|G5|e
zN0?r?aF+d4;(@B0{`v_)ncj%^ZI6;Q{*NGcLtZ)8*Gh7fZ<~u<2tF4R5}G7BDMhm6
zTjO8LcTtejx~;8Q8_MJ5|JfuRKZBhoFmj!fiwkQ{7F^5Z<Y#q2604d@wnK^Ied!Z(
z4dvUn^$nNa3Hd)!cZ<I;S_JN$SW4~lY}yi8nuW>7Mr?|BmPWuPmmKyd&X5Lo>E)C8
zX{;_?CAuyC^1?-|-~Ca4>+nfjhfwmr4Er{f_)VhM^Ai6)=T)NRH!sDbQ#lI!|6p42
z+rf_iw#xIzr_*EIJqWcCP8oATPO3RG&op^^Dp0Ci`~CjDExdXAsuv1sAfF=QzGE^Y
zuh9|x`8AiYV`1*^kog-uUtdyk0h$`mEm*YR1k2s7R1r@c4-P@8KUi_UkgpW2`#rT$
zmb=olDu3OT-dZ1#`1jAn4`5*_neFaU3IF@f(p@oQJ<Rjzek<d@F$g6kdd-!U3;S~I
z-)R9RCVD+6B*S~---T^fi4ir0$O(?Zzi(|h1v7S5tKiMQ(}E-G@}<n~<rSdYzi&-^
z>(Zsn-Ckw6KM*Gc>un-aNd?G9;(y<o2mNiLY}eQqfBowzy4wBxqAvrt#}Ps5zi+Ky
z2s0L3p-TMk@->viyDE_|Fa+!R(uapPHcdk7{`H;ernaLRe`!oBj&~Ze1lN_MLzR3=
zZ?3?Cv+P08R;ABUK;b4+vY#cXi*|>T09zAXskVy!DOUoUqb2q45DGLf{OUBl3HDK;
z?Ci1B7@-;1-<TTOI#{0=%DrI@R44OC#p&Mc6*-u;vvFtchzMHv(1;$?Jp9-M9OT9u
z6TVr}P-&Hmt>B+jy>2;OgM4;^rydB8`&4gyvY=CR+zg#d_;6wbqY9|Ej=@^ebJnPJ
z)M^X$Ul7{DJ3t$L2A7LR3&q8xSa!7b9&cW2<tYlT6KLX|cI_j4h}7!D65Pa}h^BR$
z&*2z=nw9C}wN7r$GLNE9LgetrboXaX6kikpfyDd8vupc}0doa0(AN8L;b%45hY0LB
zxOw{-6+gqm2;o1o$v5H7+xz&RtE1=@MrrJvWjk+~OLRgee9UWYCd%zBoQb6Q{MTLM
z^eJOm4f-F@g}WgIp^NtB>Sx(%4;b=yG!M${^t?{rHH`WPa6KDN=CN&b_cCjA2=tC#
zV#6!UcB0tVvYI^$und0SruAi5ZZ0PY*VGLwIFZm^a>E|o6a3`^OYQnQp;A0(*DFQb
zGm6kNg2v6>_;)XiuAI>%D`n!y{PO|hxPYZX{#yC7-CHb)BdiY`MV(w?pQt=otr3zi
zXV>0txK=N;$v2I4&t4-1u|<WaKuu04DL`A%XGN1!d52Z*ba#AZ+LXC9)S$}DL)Nra
zi6z;`Vy+Im4_|FRwKF01nV~VMD!%~1Xl1!A)Xh$j_MR%z4c4o87((gyroD^Hz3q0E
z@UiN?>weR-w@NN(Zw2ZnQpuhx&RD%U&uw^rv-1A>=3AFDL)j|^JT#^zxN$Os9rU`(
z275VI_zX1pqFyPL!!4fSrU+Hoe#s5x+-sb@dR#rN($#3EAPesILdChvY`|i~b*r<8
zm~Z*zKWo1<<wU~I?p1zBDRNo?%w4-J1Q>J2YuO3(=@2Zf9+P6z)zZCL#1#Kr`1A4`
z#S_>4FmIg}Zy~%nW~^Qhk-MvR|M{#hS2agp%1m}0SuHD)?{7t53$+p-%xK_xJb~Sd
z5EJ`=6z899$K}Ku`*b^+GJj#NnfO4>8!CKe=7H+vBsbktixpemOUP*w#YMA(ia4e#
z`gF(NCe4l*E}-iV6URT*Nj+UqjUl*yN=8q}CAh7u6&qb%Jv)Bpz!}w5Hy0KAZq1C8
z`gc&8`!ZgY&>~kKee<yMmBi-6j$heUSb-N6V#!-<JTldikyvU)(x7hIm;8%^!g%>s
zSg_#i_<^5YpPYg}_Q>ZY{hOq<17k}n3VR|XuPKOw3tc~HM(67!zRxvQrtr0(>t~>n
z_G}fVowZsK3)~oaVf)XA=^_^R=6Acf+TgxXP`_sbYZ5sD^`(mF)p*XTxdsRoVkw1h
zg+5>qdw$Y8*}@y)zsAP8*5ymzB4^(jZ&j#q=1XrA{D6Vj$$Ktw`^n<~dst&{;?grk
zsGLqq6LNk>tT3(v?$fT)Kpi3TUbuo+bnH0;BEC?ajWF&LuU}U<ZU<o_bt(n)m0j0S
zJZqApx&5`E-L)N;5a@Lp7{z7-Jzl>6dvcB415JUm$l6Bvq6Xn9S=sxJU*P5~<AhzY
z!}-8jLE+Ago>kB%+ntW|)cPUkS$CtkS20GY`)W}1CsArKee=+OYlW2NA5Il5V^B@h
z-j-7~j%eblsUwT=J<E(KT<Il`6=4Rpr!n$zh%pIMp#|tOwI;Uqh?M0$<rft>rw9+^
z7}6aftV1&-_I1g)XD#c{LsPvvP(79;f3Zr@%`~WRv!2^jx$D?<wxzJ83l8my{Sv&S
zrMqcjIRwv|cds{d?v_>B7c4puWNe8!oxRnO+)i?)|2|Huvngz%Tc4iU_*kuU<W--h
zHHUtW<@<u-K*yOph2k&>&nBI5(LRN3Rh7%m3DTpzFU<<X&Uj3v;{#ed=_w_5uj{+y
z<5v@VMMx6KTUg;}`3mA{E$faDlW&7K@2wSii)erykY_H{BCrjY;nUxl7N*PRhHE$E
zT(@TDhchO84P{sgxE!Zi+DUBNRDHvr3*kRj3i&8~WkGGjGhbdkT7geLl^*YFEjJ!c
zJ~gy%NuRQ$0a;QnlVt*=s4y;1+EkMYaAembjqtoT?W`8X!?F_S#CbJ)__&4ONT@Uf
zC|6Nm=)S<trstwpi!3=c>tqPs>b09GFSs3Dlr}+d;1yb2M1|~Z;V&%af|(BFmj{0&
zKQlz%nIx-@9?WDR?2*p}?F-;BVHPmTAOt{;Nv&!iblC_WKFyUDR7gxKT*>iv>D5Ty
zns6WesvA){(?I)X$zpG<tZnRR#>_J!=_@an^hl=q^yy7YN4!Qpyy{DtD^b_KOH-M0
z-NG1stS_ke+_VK>39l6`gV&(O!Z;);v=_)F3V{<R_t~1u<jSFewOn|k?s(-F;&~43
zo<<BB^Fjl6+6k)zQzkm?Hp>qWjta`kcGLV=(&-7mgkF3@EUD(=@r*zGHy#MaQ=$_f
zf=A5(U(74&;}YLzwy@1h8HKQaJ<yfeNI9mOi*lxl0EQG+<f^WdVT%>SN?II+oy;Sa
z*cvKqh-CCn&@pfd<;kcwuFI{?-t`}6Ru9W*&3&;VWXB^MTg%A}6}=OqBlZX3G}Es)
z7Y?VA-<)phYiH66mTWfXUjajV7uMK%Vq5DOr=3(XrVl>#DqgL9eWG1QSJYX4@(KU;
z-hqWfNv{EM1(Rul(kAnW!GI*+7(x;xr>Q}TR>uDeW3!~EHP&@j7rgD?l-#=1|7Co5
z4{n69)(&3g6CW7wDuw9a_hN)L9NZ9B<D;<J;XU`}R)C^gnChi$@H^H!>f^b!GV6~f
z#&rl}pSz-u+k-dch(bTufogg7j>H)*qpPOmd13bp*SfcA6-e_w)U$N0h5@Ek_z5?m
zeIHmnhY#!G%1zruO&#Mrw4G<~9rL4XWA_%qPWo>32DyzkHA3JNHeP>4$A*SXD7I6c
zkZpx+`+4Gececl0rZ;<+9dQdgcm64{0Xye{dPr{4%->PQ|MmoBW18<>$sE3pJnZYT
zJ(DAO)UeSGx9PGmn~j6fu&Fs(Xr{s#SQ{>CyVb9b$AA2*@AX@eDgMv%gYk&>55y`=
zAJ6w7=r=9xj77!P2cN};k{2nuFYv+c=x{wl<Jia?)L6EYtp!61r!@+4-HfXm*ASA&
zpEx-`0Pe#ONn6=W1>8K9LZ>ddo}c$&K=sBu2F|UZoxpb~QZX{B;1BFLD$(UtpBx2J
z_k;>#KXmO+Btl}@QUGM;1rR+-gR56kYw6i))F^H%4oFfTcLn1<TTHGUmd1Vj`T@g%
zDmx4**-huDfG^pZS}IUI9>D^Z(UvT-N+^s~S{RgSyHH)ZE8Da4z}DZJGyShK9f!^G
z5s}{KL!F1PtH%axI32p>={A9R0c}nU9j@*710o;OZ>aud1`QeMwf#sh7SL<mpC&o<
z&Xm71PMNY$ONez8oc-cym6NE64;~fEqtTs4G8bywGdPEmF4P@wVbBaNqt*toUhp}X
z_t9WdSmpCHa{Zloi@M8E=gY9<?a(4i7RCK_Q%9i5(Xvf$dz}h}A{cDkM@w2*2n5a(
zj{r4cuOHm$qh?qe@`oC#f|AafijR%?0uNb_SP?m1jRH+uVUtuy5@)FsSYFy<wsG_-
zqD_@xu8EaXMk1eiLT+|GlGwCZR}i8U{{VmFO_LbI3`_XJRHC^c!%A$J@rw=^r>+=b
zC<V{X%kbGNJeB<j>^}ecLhBfI-x0$!;66mRD|x3=l3A@yJTmZsayAPsXX^XLS4dL-
zmI6a!R%@<Qiv0QU!M6>Xl0__zpCx48#l)Jg%tdnKAJc?GcmU34Y;fpKv?;+#SxRsP
z(<y;PG>?f_UAiPiVPbL`0k>Y2oxW=$w55!zuYE^$0bg(dDjIf$dDc<k&Xi25Ql7hH
zez?$z`0v0JA&#FGj|R>beLj5`Hb1Q|CAk}#qx5($?ghil?H)oIpl}~vT9LN#;^5j2
zoU|RltZ`&P%@S#<%+QC0kbL~5(|xWn0IyZea=x72aue5e##uvqG{b`=;|Mq|^tg})
zhKQ^962EFKT=8%v!I3+~Lx%<?xFomnPKEPSe&)zW*Im4|{Aq7yzjSOCcDA$bWKDeS
zX*mn6sgI5{1><$u##`e_V$5b2@(*0|J3kPI-Rq;inK+7&bgPKJlojVgB}98hb^PcK
zqjU<~edkN!!h)8lpiM4*=_%~({B_&YqD9D^;^YSl7v(1gWh`4-kd%)Fs+4t-j)!%c
z^6G<wv;8PdjyvOMUnD9O^qfwl{7!*KT&4pOW$Q0d;oNiL8U#K<i0&MIBxXTyHmRKU
zoR;%NoUsfW@GQHzRqzdFJ}?)f0A(=|Wk)HIgy#b;M2R@gs#&(^MNCs{Hg49Jv9Rel
zSm;jP(V5LW)7dx-2R6Ikg*2qP78G}1a$c;mvQq(`p5nRAKGdR1uy9$Z9}rMCR@<+E
zN1^aIwM{N+hjpd2b(3(WNc)NB_nO}W2kU4Cvk(TZlw@~h2?2Z-zM+9_ib2CRH!iDK
zMWg$slLGB$dmDVoI%Kcg^-nLswUU~UN6OmQ9v0{d=J`IRev~@*A~RIkJ62WXe=Egr
z$qU~ctSIW&Tur-=^UX2Q6<B7RBUR4O>uX%#HFaOcb@ik6qeCTP5Hp0)Qp_a}v+-C*
zO_!C!NU07&{}hF3vdxCArpot^_97pgEKjJ83Ji6KWq42A6p7O(s}PrkOUON*>VOqR
zrI<4ba!p$|A^gneUrE{*YNpZ?&I%FLKe6Gi<Iv*hl0(=UqqE!^<Kg#pRu_B8-<B^H
zfC92YuL#ITU(UPLJoGi0^)llgqv8t(dI`(lI7mZkhLPAx5A(EI=(_YhX7n;N4lW*q
zZ4_zM-<k2ZbxX51(o_M1dM-^!QKnp7QY-y9bUO><DceY2{EIk-^;lbEhBPq79Vf`?
zv+wpN5uFyoeeeyYxDAV{CYOW49@W9;D{1Q9lWQMUBOu^e`L@~Y+pmZ!#6PVQavL$v
z46{>Nt>B#c(kC{Z4q75p0lW8KXUD)@R`(!N?rSz^_X~4}JHktPRl=!C6KTm^+2Qq;
zxl>Bj4qoV~T3eagrBwco1Cbjpw4eV{?j?w0YvA66!w0&`g`H#VECnO0xukiEd#?Xx
z_m@1FI97ZaIB#ZeZyW`0OqZ?qO5sB9sa_6ECiD5gq2poJqgKqCvE6>U?Qm4>iHc=y
zBZBPFW+}B7Mx5!#vsyUn%>}+dxqM03_6vk=4MWQu^fm3Cjwti5ByCht7<$ydZ*fnf
z?(>h_gU}sj_eMSv5%GS(-Jk5)`AQI}x;7LQ%B>=Ln)+-%zuenMCY98@<-SL|Uohom
z;<m@>FZz(8dmfoD=s^S{ed0>mlrMt0o<?KwB(jmX=zlhzr0Yr_VDqe5=)=B>SGt83
z=BITDSCi~<o|11^SbcE@+z$X))#XO>7UcRQh0s`<YNZmL$tY>pS+yW5*7wHjR%%Nm
zsAc~-wm(mNMgd;m^y8KWwigDzjeYw1B4dOwm;PoWve!<pdRJC0S!!VbasyOW#m6jt
zG<xjp+HOj|Q@;Q)ri-3@VXXd+j`687PMmUZ3^_x^Vz1)6_<Lrmowog>CNJL@7ZKEU
zzIs-IYq_aCq-Pdi*{wwT!co6=wM6g%AKcEiQ7cA-4(C#vbL6Df`%E*h4}^skFEf>e
z68cst)8Y<*p}Q;SPd2XTlo}pgsdjv#Y|UsmbF1y}#>rvN_R&WPL^{UMthyC4`qnzR
zw~jq!RFT4WE!5<qBYX+%?bFXTcwxK^Pq2tp=s$JWfS1P5vbzs$9LjVU+$3dTNxjlx
zaGjTZ!Dh;$wGvUX6sS;*kSe-$Z#b$N%4}h+mAd|V5H|28wm_%0eAl&--q%Y6P>TDz
z{N}AoIk$=KH>_3PpRTE(vwpg@_%#gR@3~n>7CKn;hTPu)7E8`FWEFCeiZd^ph=Um0
zl&yFYBAnIL^g&T%c=BZu3xk<fZROtcq=$aIzV{}$q!vyJ@Wb<gIg{DW&n{;hro_e;
zFyJ|S)_JnPjCWYKIoM^Fwjfj^|JFVy!FvL!7Xb;Y4)hxH)=6bB`AhI%&@FWYAdBkR
z?lR0I_q&Omy;<+5)m=Z-F=h>I*TTu(F)UkeW^o+Uo9mr_>f^PfIkM(vK+fDm)E5RV
zdv92lxF3AcsMyTlMIB@!yl1j>9TPNbqlAX#uOwC(aL8V?ckW07_}CnVp&;+D4p*-{
za+;DCGA@{`**!4yx|ZP;!E&r-Dp@qoy%fg2<%~AB4c8#|fh?A+Z+VhI+he%+Xb9nI
zV>CwYW#i7ALgQ*NAH5hoHCDuUuC#E6skk^_Tvq&@VF%xcPZW<HKLCR46l%BLq|Av!
zHZ5}vqur3;wxbBZI3@~boJCtF<}Dn4I+%~>@L=L9_=L}TFs(rxI+(O#nXE@Q;`8N=
zGF|A=Mq3jmXR=nZKINcdl}oaW$*=Stw}^-|yqVlMY@j_NQtSW3MD=vy8<bMY>BDsh
zugRmGVM0_h@x)raFnJL<QS6nBPoPnujzL(mFnKnM=4#0;JH@;#BBIeWPChF!!sjw4
z?2VF%_e@vw{AR+>!cN$8@ulPRJuLP+vW++-YBrpBYMuHIm7i;sDe>jHnpSH`=;?0d
z3Ex$>=-py53k&wCsfj(&6SV!fGw-fQH9Yv@tXIeGDd)l{V%u!!ti*&Jf;f{;ZYbi4
zFO3GTxfOnlEZ!dk{Z=)ybC~)vOemfwYRcfLNw^moIp1dRMc=_Y;wQ507QL}Kb>!FI
z0&bMf0M7Ru6rEy>5O*P@-uEyBTgbJYg#j4gSzW1phS-+HXK{bF<lA*><}6}wP`i@q
zv1js;Apk`E`gp|U?kO8ii?F@Hm4t`o>s%ujMcfUv>yl_9Ao=5^Hu9z3I-5`TcwE9A
z-C!a{GJUTUgTWgv=ox&E@$lj(aE`}S4D3!eacS>2k`<z!MS@F=#R^Z&OnjJK+Q+_#
z5GNmKy_HxIX5FuP`#NvC#>{-bCTG*K7KmLq1u76cqv{VDd!jYgK#B39TA?U+`!Cto
zxTTy&<jICt(5yo2%Fp}y=6x*p#Z(TbR5_QlUZu4NsGPV8;ng#K8l@pjVY|EE31g7t
zX}cZ`*G@2WYCDsE4_S&ii{aPzBA9hmVE!1XcR?`vcWxEoB}w^?joD*hc7ct4LxD}q
zRE@0y1Xf|LK$u8f&NLr+HA1xrObmIKYAR1rZnVty8|UOdZ>8(`TJgTJ5;`wAJt{Po
z&f&Q$-QZUt_V1s3+583fsszP!-2nIR4%gqbX;!?38C$S2sPzY9|8LG~!3R99_D`~@
z&o8pNcAQAF;Qj{-!oP(nN@3H_y#1Zh{!hK?ga}iVB2;s}`R|n*v-I<#6#q)#@9gS-
zOzv_JW-KVLAnG^#_|ID$*q6W4Bm>syqNevs!E2tF`)&K5EdLUh?|J$wU>sAoJUYSD
z5eKtE8G6b79i$7ssaGqbZ`_a2UwInBbmyNF)IV?`$Mt3RK|%A=xH9qEoL27rJLL?I
zu2#m}xNp#BeuNKu^1GzO_u^r}<)+iU(p-a{R1qPOuGjO_f3mQ6Ro`%~Ocwn{H)WxG
z&Oh1uDc-lrZ5XwX3k&8kgFcR|-&gRvRSw@+X8KmFP5%S7T*a?z9)q0j@w^ho4i05_
zB$`qG2gOWs7vEG93HP&;gP@rQXMez7ZuKvixI^AJ?uKc5Di)6XZ(P3ryhYC9n`$P3
znmuR&YGw^l{esugU)zgGwt)(uoha{oo$UXzARHfFT5_3R{U-EyQ7n3e)a0Fy(=Joi
z`Gj1VvMAN%e<!;5OYyp9DZ4*GnrJxybAI$03jF?H+S^wp>~H?bth*B8x1|-x)gJyk
zNVjhjwF&&ep}5^ojH$bd7^(hA$G}VRTT6eipO@ka=cQ+VrThOSfqz&HmQphIpNtc^
zfl+kCk}-b*6b8`ie=_d>4A5-CrDkqmxc|F%nl@fJgjI!+zk=a?(`~W6rK%gA)G{Z^
ztE9IvCl{B?#}4~?WD)t9_tF1fWa*_?*f(BB`fT$j09^Lf)Zo9Mz(e}kkEZ-(kOzDR
z+6s?@k@K}R`*-37a_FVtMVBm5_L%#@$maLct`U~_i1MDIk2VnWRKF;+D0(}7;fj@Z
zw-dFi*Gm~DoVC1$HWRIO%pS>ndy1jpHGGNNT~1iMq`#b>`de<NsBJV-r{!pmxn-I~
zC6G|8;S$Z)*0`W4pnj~N+eG_R>&}DCf~KD>5b=^&K@}IG-_;qlVN!QTg+$c)A56zg
z#k{R4!^Rc=)<(Xa=LRida`Km+0Ylv{<zaLED?@Wm?gCB>)Pj|F*T-w=ZnY3U%L!%G
z67LF|OGx!0VL#h9D4J??V&O2Kag1@)Ozxwx3|1?dP&z<Kg(%UZ5Pii-L-qjbCqMBO
zU&GQ;Z>`h1AT9j096IVxvm#jJW*vL#oo6SvzcRX3N&g?9(seOiHb~!}LiGK3Bc7YS
zJE20D#o*w%8ygM}HIo_is*#K)XHCb&yFnc-fLz-%g5K@D|7zhmAt5)Q<^Gh8SW5Ne
zVNn<}YEvJAEZr*Uq}3zy4>@q<8~$6X<rHFc!ir!;`{N&rHKe@y-iji7m{O+&V7uzB
z9c__ra`hJ;5ItA=vTZq+YcU3GX`f;ZpU6!7PjcLs57P=#dClzCd@P-oAu8)m#AA2R
ziC^qMf(fYSr<{J6K}^pOjqe>oi8q$@FgN#FFOz$rU(Z<<mXvx84vX?yY@bKQ*%lmn
z^Qu}vs0uY++ZLy|eA)P=#EJnJ3aQPhMaGtak2XB^yXOv5y@$f)cA(G_0?GNRmawE2
zZndYX<$L`@d#%%Z7IM3l>k25|HWOXK$^n=zBSgQhF`i^`n>(o`3~`j}#2VeM<Ibw8
zaJW5ZUJy=|zczfd?o?xbvR2k=q+-w3(V-&%i8G*$d%=`8#a|+aII^408nLgNU9-WV
zk^7D%hbopM8*Z9B4M-Hdq8UU%U$K_3J}cX{r{Q&$GMfb~;MNbiRod`^t*+~W%$TLK
zOF@$hKU%g?l3|9b!1Zj&?#Z#LF0jq=qZ1%sUrdh*f26Lc;#?FQ{aCG3uOnv-y9t=9
zg$>Z#wae6GZm@FD<M<@-9OG%hZpI$chmsOf>Op4(Q|349A%hMMR1Nfs_f_`(6acxI
zFWdm%ouNy?pb*{6;a$cL)Tb(f-JFMuPmq?9R2LC4FY40@>JQ`+j$wnBZTIKar%BdY
zV}mc6FZ7fIP+s|B4j}DIX~<lyJ-p%MKnV$?tW>#w-0Z#?+=cQ!MUjg~_hEDnf?D&&
zXvbP>Fn9Vy?GXpW&n#E$C!v@w#|8=ao}u;}b#Tqt#ZK+^FTY$rVr~GccpZCd*$1_F
z?mkR8nZ+HGKu~5VJwi~<wL_OkOYau!cWvH1S<!@(#pzM)dUg$ea|O6%4f(N^$_Xh#
zY&qC;D(+GXdJ87^LNjQL<n~MGJzJxEE;OL`%Q(TriMLx05;hQ?ZzrnhqURMSt<3{d
zgadza%5dk>VxT)JH)$lSX@BTY{;a&r%s9o;uW}1%bmF%F@bA?+(49M)>u+~couf3A
z!jLJet$7!uM_4%lqg)U>ad_RS+mc8V)L!Z*55N_|B@?l)U2Bb7lbAID44VN+&8JNF
zir7NN6cK`!{nhKO2ojxnY8pz&rcmYGv<531TYR9|gf*LGr2@4En6TxT7vhJL_X}_Z
zmtw^{^4$9FHN@QXn=p21qcX1ln1fP!R@Oefj(1^#_wfWcVQFx0_>lLhx_RnE8T+Bw
z$-*{#55ZK1u3xNkHj<y!#8vIXI#7{XsFFZcskpF`Z`~ysY`MiZhU1+;7jy2CHFuMe
zw}?l_XQH5Ow<Zx`y^e@S^MgqtR%}Zwgb|`-FbR{ha6mJusBJ2-`YCAc(Zo_=mTn00
zOqP?T%aqENFd!mD$imz#O;+-!uV%<~DOJoZuOLAoC@d%yFQTN-(Yh=vUdj}@uiXA=
z^k}?q&3E(Y*bBWsn@D5d2!)pVFZ#ndo9O^H8_s>)a~}^MSXb*+BNW|AQq@2-Bb5F3
zHl4MSVN#D!c1tV<WU0(O8?lGkuWI`sg)>Vq_(uU=B&-jWB0(wlll{w24COTsbV>Qk
zbI6kc-2O$cCmsb~WZWwZm07!mJvPMqcn_T52B2%86HxUc#27So*VKgaiTH9=mc0_o
zL3`7!J@zT`>mqS_^s3X3nWm*YcnEdvt@}f#kl)yyPV75}Cm|qAddlMsqRi4n+A@uX
zdI?wQrdE6QcEQ*iGYT4n6`EN3Oy>?XNMUcC#^vdwzL5W7`~=D3D>etpN>&})l&u|?
zNW?TxEb_Dm%;#~A-9-AGeHMc9YvPLOv_;<{OrH`42HT~S<G=M8CbD#|6(O8n_7e2)
z`I;zJAO<mo@&@1>N0(qf8bKe}gFFe-C4WBVgy=Jt6fHqto7Ej5<wTSf^QHHpy0mc{
zMe-4YgS?MJ5t;{EiRO7*9{iRMTh|f?Jx^FP!7MV;S$uj_P9juHf2;AmOMz@e@a^$5
z(owVyvhCSo<Pot@O?*wmu63sX^Y@wyP%-WVL>}>IrHp2Y;uq(@o21rib{c07aJ^3$
zDLZ~^j0J*dKX)?>XeG<<>j*B(b&SziSB+@-upghq#Aw}tPO)5`Rdu=7cVS{(@I~)q
zI4XaNQWoZ7BMe)RD`6}yozw=>nS*rJLcl-657~V2Zqjn}K&_XBZi$&O?b{tM-C2iC
zI0=QEHaO=q*YHvtN!0|4C(q!uO~RPjwYZtBggmt|9Faugk#D}6FOzQuMx;(<hnx<&
z#&#wq?~M|4WQAxzN80v!t?f|cSKIVa^nja_)zSuk$Ik~7E!T;!=)Ab&b(C4KOCMw$
zybP_d^uzck!6ZiBx)okBy7<C6EjdHQrDNFM%eI9JR`>I=M(P9IAx*to9IeYj-=S*m
zCV34VDU!L!NF@W^D@vo{&Qg6-=^*#cN6C$eLuPAF%v)*U!fAPU9bbH~)*#*a=ejSQ
zFM7pHd9mm?t2SL>nkjavGY+mrJc+)k2h_7?`93+u>#)8W-IPrV8_;O96>DVF6?J|5
z+MfQ7u8Wptg}oI2EfpESH+?F-@@SZka&4(ZWf0anSCzK!sJKe^)0sA$yxOfr7Pr>v
zr&R4PHmeGj?5m{6_x+Fi>wSy7UOZa)-bNx#0AXxW%u?6b1zp-E&DRpwd<50qkWOwx
zfFRZhu>$2f=P`MJx$MYKV_}xuj5+<n3q~Wy`-n;?Rcpr5x%$wdUHmjWs3xE?NxC++
zCk{ChLR`>M2=jIelqlM@1Wkz!Q2(+zqRWd#_z)kh4C4{#T4njPJR|h;?eO9Pg%W~5
z!$_xh=iXPKvf(n8lC))PT<o+(pSSy+oA>D+Q-sLuQ(rgsNo*3N;G1n~%*@0jyh}Cq
zf7yC^Q}f(*cNpiwQ;+f^Z_iVZs3`K7dF@IXwIF$G{}k-VQKTPo%133i(mFynrqsIY
zYhS^su<PZsSd&C65c|XNYc|CFDuakFVXU?))hfv?Us|A`7*l;;kxaEn;-`b*TNVrR
z!kBEzi?0VS9}a;?we76?^D7s=QLgzD)+4glH)DN1)He1WZNuf2TVle`hB)@SH5oo-
zph22iCo!EiQ}&BLb>Z#)l;%0}mK^9(AV~m2beUO)qmiCYzWntdIUikNx0X~i&#>2Z
z!TV#_#rrkhqXNu6kh0!m<XWrWNJ!(-NSmpj_WTP7>Z8yz=|$IV^4-_pH)4o`D_p@i
zeJC3Rcezfsl_HU<V4zxiHK}4V0{6gde(VyRcFEFq4tvnUhtL93wFQkUY)4KX8@3<M
z3F>Gy(Dcck>Wl3=wuObUfx2F}TK98SVSkI@n<cPX&-aLl0!UlT(hS6ay0ow-!%aqS
z>g3CTDnOe8q%H`JocprhQge6B$FqFOCE4vKkFHiS+a21?fzdfs?1Xn6HExMDH?rVl
zP~%3Z({YBX^<85QL1m^HoWaZT(XGSJh-8{F6=p!)bqu#euh1COJ9<Gtx`a*>Fc(hf
zLBv|)nbMrfLYZkBoEIPr04=uLp{Dl`^Ld9PZ8npX!N$j&kVl+$Dfhl}Fdl(*Wr6qO
zG>3zGBis0`t<q1HWnR$JlkS|Bst3XM>#U5)73g5=B2F&ra3dSUUsgTgQVTQ5UB%JG
z_i#S@)UD3SyU>g$Sw_O=257QF(%c9wRPw?b1gJ~NI<^43R2qDNZ#D&b4vBI97DFC0
zho&zBqNii}-8+uKbY1=Kmt2_GWloVcwA}RZN<5UkFCv9%u|yM4jjlW`T7uzBm)}2j
z`I@*bMbM-^VJ*}v@Y7seq9e*fp89M~w|JuVbb|3#b*t&t`FC~kALggwnxb{w`-1i+
zg7Q&S61dOa$e`B8H9ucccGaN`W_HcFeXu?btyl<wC9ZYsiMyU`Y+7lbE{B)pyd}-v
z{^&U2JT@KgvWVgpYH{>YMF&4~l_O{yIEja4kk`up%nv<@yNswe^lpUQEd97+>9-DJ
z9__&VLal4B*Ey5Or1N<Zrj)Rj8xLvtv?hk_H9a9p(>{Iv*;pc#y`d(mDoyW-+1S0a
z%>z#kkq;@4sK(w~eq5?K_jT20T@$HF$)H<+I=*G!I;L-@Nj#?6@N#A)r^p1A-%yZ?
ze;6Wa80`l?Y+?j=*0D4_n5@NUM%6vKeAScWn2f`=PV%6gw#2;Y9UG?+d8&mE%)hAD
z%f8TO>fyXp!1fE#Lvy>12puP4whm&*hPt!f+f~gd8bI7mg3yQ69Vx;#!iUfj#&YAO
zFu>69xi>U5BXDyH#1>w2=xdc<(k*0`ETEU<kkhaj_+@#vZ;J?Do9st!%dA=)e~{lh
z&rMG;>ISDiRq>kxjq)|Wb?u^X)tQ6-0Oq<u=kYA!qWr{?kL8w;JGS_{bBQLs^-`^l
z&Lt!=Cumn@%U4!{O-no#eGFOj-+1f%Bc)1ji^;ri%Kyl`d+0X0*|+s=LC!!&C{Nfi
zt=TVZF?-pZWZOg`it1G8eff^^uV2u(grm^RJMpFG4ed8Y<STz!K2>;PB|}7LvwF%#
z#(Bp3U}nXBe|=&FG5*1rL=3oUiRmBfH<MUN$P50(xc(AHeviEVK4~6*VeSRchyGD2
z7IR~U`X49y<zfGqZp>hAhqUC~`~|mP9{JzP@@44#6~liThsi}>l~}o!CH+qWex2k}
zCjXT`8TbDh(C_yiB5Th(mH+xj2F{9yqzbz`q#x%x{-X2$clxclo9OTpz32^`JK=NZ
zwEN-;^LF(}7V&iP5O!JDZ0id<(x$=O3hL_S_X+#2^xFTPy5AL(z4WFZ{cZvOo09*9
zvY{D9MhO&1tLXnd)pvVwP5|E~%ng$jp$|C!HN*d&ocodZ?XK>4^Q<2h=f5fRE6sNG
z4AZfc^u6~+-o~6AoE=Fsxr!e7sj8od0rDA8Tga20g`<+}U&-=M3-ArZ!X|nBEcKt>
z|8<T)4MS;crCHGN2Ii@KY2d`J#Sf4taL8%RS!|ary45GX%QWuHfJyrF*b9QLZA@*P
zol7AV`CAkH7A*X<=4hNud_WxSA6y)|%5yV5QaoDNxbtiWLW8U24j<7_t~&(!aL1et
z8Jt9@ihgjlWda;`p4DW2g`}NSqy-e|dTrL_f8G1K*A+Vd=?@kpn|gj5L3Vb#@(=Em
z-R983Qn~q>Yaeo^_PGnO(4kWIB?}VS)nVYp8DoF~oZXFyK+hcKcQ@InJw}bgjy>-%
z15PFos-mZ4h+0jMrOCaR#@WV{&X(cpzvBJBWnxH&C;Rkvmn;s@<yT7l!#Qyxi60h^
z)-dqqHG#A1qeE29(wx<qAUg*7a`3wVulO!@AA~*=py}9#34j{!V8+Of@ND1qk$Q{J
z*881-w9_TbCs1O!ku^~@LVENAwf}oj=ae3jG(0%supBMouv}TRbDG3|!EwdG2{~v2
zc0z7`Tu;|OHyF)|xUw&9cctUP&)&(|zMx}RI{~^W<|;yd%o`~E<vD-7r=upMa@$BF
z|5Msn2Vv9X>089|Vj0g!g=q9_Ibeo{uhc*r?L8}rc0XAxYtX`W4%e%9@*bbwZ7z7a
z><$SJoKZ7=F<BZ;?IA2ioSGECxwqd6pE2?V>GRgVUi+LqL#Bmy^0{Dr1QqMbe%9Rd
zvC10M%i}?zsta&E%sAWJTPU?08`ww%?tf>CY(VoNulU?#!H!_@igSmmQ=K25%$5rH
zDeKS_4WIRR5@@!;$O@fUk8Ke2ciidV`;<Up0=c;IHm0KQ^f*5m0Xy?#ngbiW-<dl@
z$TI<wkKCEI(hieU3u+*qYsHETK6>Z>08M)u`ChwwS@~Z#zHTIX{37NY{V&UlRIO-B
zpue>z9>680`Vd)7Fcyg7T+T`%-=0b0^DoMIoVC^xdFbYZJSuZKtukt@2Cp2L68M9s
z`1~!GI$p-%5WG*?b`GCuaMc;N+dz|l9`s0;Wj`jlLejw_rmMr7qYU923nXz`?O#LX
z`?SL!@M7R|5UNLgEVF)vE97iZ6VY?@Ze$FKEFL+9FUfkO@Zxn%Hr%m#vDBtXuIgr&
zdF^>s*8Y#nKJmAFvpC<nuN0xOEh`gUmk@%i;2>%tVaAhz&n9>**VZJ-vL%t0tDT#^
z`{y(;^!Ub+W@0u<0`?UC8}d91R22$U*1xC_Cq@qTB1-S_Meu=)LU`aVLIeF4IT;Jd
zs1^#fmH{LL6pFcmyo4!1=-q1am*osa9y{4xeEJ?-w?qv>F0zk}UUPW^XzpbP5nBxu
zbe)2CzZUQ;f~QIdfTP!r@-D9!L7r*$9--O{lY&9uTd6D{!&=u?bitQIHtL7$OS#Hs
z!o>2{igI!EYKU!wEpnu^lq$}}W4s9Pp(Hic*7-=?+xuAAOT?tqS1o`rVQ9??giJ5B
zHr{xgNqvGCQoCrlQ9BX$-Pjm%T`phuN0#=Kq?NPkKQbM&KzJL2BJLf#p3;^dvN>=y
z041#3#E;kUZdilzpDE(Folfdm^tu-Jl;lHe=4i*#F}+6^#bH*^{2nK>@o2K}4s(U5
zy*krfv12VJK&oI&*D*rODIYD@?SB(`#mDilnAMHeDEde0qKEF?$&oSZFfGQ-Gw9vY
zprUie^$tJfv-wFnzk7D4lVL^+llL=@?v^0qiU=BlF9M9F{4!$PB9uqpsMQ1wnwufZ
zFCg`d79x?%Q~W+pH5=AC%b1L;@Cem;%NmFVZa%vtGftA#55?>$GHfnexxXVPheF3=
zvUG2Zl*{W=^D8OlBWIB2O)(B?`a*3X@S`C8UIn;28Ky5U!7do!u#~bjaIIdbCNZz+
zy58i<Gv<?JIBHZG)*De8w9Z?`3Hq$-Q0h$+y{cWAM?^k4Z~4Jam-b}^QxQ{R|IfSH
z*i3Itm!K8Iq*#arUR9SAQW$ViXMYPVV&W2JVtLzcw`1-j0cUz{O($(`s%L$;<*Mo4
zxoYEnXsC>>Wagju;AcQ{yT7hEGNw)Z9e8deCn2q3oisq<NWHjQ?3Rew>~jMh;;&q@
z8TXCg1uY7m%#{3;*8wbOP-97#QSw<`As%qC^`o6z%Y8YIiBd#2Q&z+%U@X$voh~7_
zHA3cObvUDQxQbV7Z<Prr{VTx16_hhfOTiubiQO?rJhL6a>g~X|B`5O@gNyT#&TZ@B
zBc*;j^@{=SZTJrrBGNR8`S@sGI@{OQ9(t^%yI%j%KCoOPt}Bmd7pD5UEW_)2cw(b}
z^7pZ7-X%M?6u@xsjq;rj5k4$2gtJF$4+U;iBz%fA7esB_!mi~vV$4J?ruRX0XQS1i
zk*wU|$nQV}1&4v-q?^vJU@onG<B$B=3eUrz{26*|s8s7FANAprt$8+obUdSp9+g3F
zlB0di)9j@Hfsqy6u7*h{XoHs7<k1@_oW}}@?h7cK!YBXyV!byb0F|H6bl=EW3`<d2
z$R3q>E1;YqwAzttSfH)maYaw8y<zmL*V^)ZA5c7ZsoR&2t@aNJJ*L`>W;O~3i9LZl
zeORiRq|Ai)$GTEr2cqxhwb|q<H9?Xs3(HADIol{p2N#8RKhEE8a?D(&<0Ue!H`>$}
zWA08Qk+DBH%0eXB%2cFPlsgHtx)dJAc!jq+AIwjN%EXbbF^wjSl7;s1PEOjG*UP;|
z{4m7$kmi9_PS}%bUI?nmQ)RAo=&^>6%`1F{;>cuxsK)EX*Uax!S?yJd=9eSV*t|3w
zUYN!+Y-Y!u2nwd=n7-oc@WW-QXsi_6=i9e522JKwAxaQQiEBg71B2J%UUbE^Xz?5^
zAKsJ`SrHdSfj6bLdTaErSLBo^FGgD%S-D2Vy4d2b$W&S51nyOxF?}~<M0q5iv6m`j
zlBVdp=q9lAgATZM5+i8Ce5Wy++06fX@L<$7{NRE1bD<68#yDjcbde_PsHcJIlFnEu
z5K>cKS?jenFf(y{wgYNA=0%7qI@grL!;~RQWZ0hbV^>R9w`35r18#*Wdo>`R;IU#v
zlj@#Gej`|Yi(+Jb%u3gJ(~mdt!)m=wiq`QrhhQ5|*5Y>86(3I~6L_oZX|>|)af9lP
zEd3qmtDDd#PQB7iDIl>;VwpquN`dnD+3pp<d#(hX{Xk<78b`n4{)MCsS0_h&vjj1*
z;-2_Y`gk7$$F12zIy%uf@SH_8uVwB8BK61SZ*!1fxf4lM7)G#Qw~tpB1r@ezSbO`~
z3R|{j7DO{Im3mi}>2}T%7=iFv0B743+eUL}r#NplH;0z00ne$@)>6_Ejsi?eI1qEw
zgP=l36)-Svl<98k4f1f@H~A=r7-UF_?zeM~_hL*=^-8K}k`X%^NJ18?EFrReTN(w3
zFFEiM#&>#_HEh3HS2EPhU2vfO&Pj1@U*(tHjn$0Bc9ZMrf_<)@?05BydmwyGu+qlD
za@VOqH^4m*V~tkYAemptfpXVD*q-&2opoc5Wkz`YLf7V=Ro<#bqd^60VZ~`2X`(Z)
z2+YVQN@eEs)7q$3am0t*gHTddCKjEB8ZY;84_wrq{la}ao$`urSLN}uzq#PqnqYZ=
z7e{e!?epEv?ZG$1a}w$<BX926R2z8R<??xSC*D*^cTBj{QlkKwy=`)&DtuZa(lpn3
z*Kv)K&(eIdnd<M>m~&Up>Bi@#Yc&F(W_3+HQ=Ud1qcSP<?9}2FJeg6RPI={pD0AyP
zs%8g}W&?B6mOcs0wZkyla%l<H#q3o}0ec@rZ!pPk#1}ogU&x}FK1M8(@d#r<dlgFS
zJx`Zx2q&COWHxnA>O9u&#IOb+pU1%#yAv(G45opce43nBy_}F?0qgf!SxlWyC;6|e
zJal?AKD=xr-mQx?oVz?>hQa=>-B0XuvE0i%LtO}a)E`-oOU4~=m8ZXU3X1{XWrdVR
z&fvMPbh;4`L86n`u2WedPL>Ae$^4*O+3!8MR}R-tEQ_*cn&0Kxh8{ehZ<wSvV47aa
zuLnkf>6<>p^WI;ZKv}wy?7Lf362-ssw$E_VMSFwvri^?VT)I$`jpoBnx(&3ftb`32
zbB`Zd2^+jnAN?e6P!f*upPCi%&b?*#iatCoR9ge&$$c-hk2E}P3z8;%2oDOlNu2Ut
zd3x4;FXnBRWoh;f^g!%M_Q3wTioWYwol~7t)`BV%Kmc?oNA101((OUskZ~Gs#&zum
zllkZ`#G7$GFB8FtVCOa<LkyrI6%hLg$jc7@$UtRdm7G{Va>{f01NL`vUhoyY_I1TC
zWUH>iwxun8z2ypM?^Qi>{X6qw&0CUVa+Ocy)nFljQ&Wf@Pko7vc;^85>uo~>_CTcp
zI!D7I1Yjb{KM-Wasf3J3lQ)8kY-v<z@%!{Pnl*%q!CpPuw+8R*j&JlRtm#?QFQH^w
z+Vv)`G&iiW)De$W8&E<XBrH~3k=c>`I+zP`a&6)rDV(@N$iQTB@MfxDN=LKn`BTlh
zg0kakoHeAZOHT5>)aKRi2FRDv_Zs(t+}Du}aOjMY3gYB>J(;q%!F}*S_{Vz$4Me5b
zHY{ub#E^a+NA_&=;hR^OwgCumR!3{^Ye|{?Q`AgC3pjy3gl6)1H)2YApI%2auj15Y
zO_i@X6~-O>V6P^Q?Ixv3>6-;Mi9%@NavvcEGPAsMPfXTeK^?Nki}|)1ljl*kZ(|05
z3eky^HT^kT`DP~nab|rjScy~^3_OjIdyU8<l8}<?&QT`A++DBmgV$WlVewOH<^pL5
z)wU36*vqM^!fk?@xKtLeR#vDyf8l^~g7>P1LT=;bp!SU_eld{^yM->7(lmq5s{@9j
zQ>&6>Y$^L$Yslh>3u|5jnM8`J=tYazfQqM!8I5o5uLZ-lr}qt0*d@NMR8QeIzZmuD
z`w@NP=ZM!FaA^yIo@#2Km2C)G1^_{~&cx=*^A|o2Um*lo&)C1}rjglMUI&*3wib_(
zFDMGG+t$dFcw6n!s#9U>l$VpURI(0-X|PkddO}yK2d*@HD@==jBXk>?9(B3H{MSB}
zYmhyi00+Swv8VU7V@w}*!cUJ~`GQoNPBv6U(Nik<Jd=`awHzk*ZRu@mR%A^Wn=xdL
zIrGf4HLXs(?)B<qXRk6TmsCvbtAWe(@e98iq2m2q#@94IqRFefPYpZU%T+r9vKb75
z4LEfw84UUw>?K>!U}R>Y7!dQ<v#|=Q(~6zj(a-ijP7-nhbK!gy#rsrtoba8<DkF_l
z8v&fG;gH8GG7yi?u*gTV`eewVRyJT!!P`th(U}%5`JSVpSQ#}_nuEJIO-`Oom{k7B
z(t`G8q2$6%75Y_^x#aYA<XB(}8SOz}u8%J2!ReucYO#sNO3_&Ok47ePYG0cz(@GDo
ztfB}hAGDK~MxtJAakAaSumBlZxei}rgmREmi)A<FRUFL1mQ8Tu9BuGAR3z&SH+{9>
z=04BHw-%PxdmQ<`46T>A)x7nb?2&2|NT8z1h}6bU$8{OpjN%+OHXe`3H7wEgY#7#W
z^fmarIn@QMFVEI7YvXMSfx=CIur-s1oiCWZpYRP#j$|hxoMRa<5VZUCC%FSeyvoXC
zW_Blwg?Mao+fWvx1Ny>gqgm{|D_NF0xRM1ht2j2j-E-=ZbkrMEj+0<3js^zHE))-w
z9CSi1*1NXmln+m#98@Q~U-HFvzW5;5@T07?tDo-VGxueVFD^cRUFMvH0!_2agb;0A
zGcKsQmhNiRtg(ea7hA`~2ENl2Og^Q4!<D%M*qa>B&V0}E8FTnP#@TKDJMYn!Mtx1o
z{dfZ+505)LRLS@H3PAg*Qd*xKp6zYCmF^CVj4=>eO2)+B5$IM;1r|W>amTlyTYl^*
z58HPQf=O*i846!^1XtDQoT;nn)_7Uiuf#e%0%<%a@{3%S23+UUq6ZHIRiCVCh?e#=
zwZ$Dk_8)caQzxcL5%(z|7aC@ay;2Y?LLGsqidE2Ia(T9i&PwY_wwg?r)7qe(SiK0W
zUTuB(@c!DvJ3<~>s~dw3s#!)U{L$f>G~e@2@m9XdIq$#<K?NqRQT;KP_N<IF|MtMz
zH+Sp>&m8Agox&7j1UL=U^HShWL2lJf-|jiCo}aehr_b5?*RdCi0tbU)dkQPgL&d+(
zhi?Wk=30KG$Hs>6@xuyRwYJ-ST4RCMh!BU6d1YaGI&CxV6{qbx25t3UPFBa<NP{`%
zY7X0v#cX>~rpTF+N0zzL3n+_?!+cnw7+Y~f;S{oXFV>@B2{q>!ppej7eWfD1qTSD4
zTaT`==0xd7U!k}ZmW+BkI&y*(y8*bdnHTJ|TNso?tK-RTEWBo1u^^)bDAZ>37BC!%
zQiFocWST}9<w~z4UC%0{5nQvqGQrufYMOf`4KPYNx{VJvxYrp+qV4Pnq+k)+i27Dc
zHB`KWapB?fA?(++P`PQS-26tA4;qjkitgQdA8F2$-;Vk+oc}h45QdskmG?O`VnW3N
z;>M71A9}w9FxPQCz@X^aP%A2C8An~)J_I3awkYjaiV@%s<m4|)1NhnM`BhnTwYr+@
zoDX%~8y~AZY8dOd9evoqay5HESvV#r+WYg^y)O$L3S>j#aR<e=C&A$Eu{&wYQ^8U`
z)VMR+BwZR(7O;#e3QK;mVwzdFKEkh8k3iIr?YJM+sn%vD4Ums8|FjY&13X#Y@mf<Z
zOKR;i@bsL^dF&#(Nh`Kxlg2Qk2qX~vQG!k<#9Gk0UV;B=Z7THf%D%p2p$s<f(L)<X
z4p4C1w1x9CjNaH(WmkFbKBaQn1{W@4gqX4FRFAHv6sO)l&)78Y-Z~EhSDub1DaDBP
zhX4}9YEjQyr6X*bIN!tj3q?&f<=BURHVzvWT;8dAZ+yFRBn^)QCDLA<-79xkTu@F3
zp2U2=kO?OGZ9cHMN&vYPe<k_TOxN+~U=3JsU4uc!c^ZR41JL?4%(UB3J#cW9A*FiE
z>4>UNVd&8nqoAg`N?@%`Z_U2;>fS6$F63}y!V+(3CUd}fVM(tvNd@qo#Nq~*+P9=k
z3bok6J~D)DJyms0pYo(w^4VNf)a)^RWm!6Syf4_wep%G&Dp1~zJ)7N5j#-5Kx`v9&
zIIJWkala~sW;L|X>F|)ZWyrob*K0z1?ApfR<au&tNX1YZOG*7S?d-wluDYevq^=JJ
zCnKsL_Yt*xbQe4>d*>ZY7#O2r17?jm+c~S{jUn{e7*j^YK-m@Ui?Nl`mjZ3g`EyFF
ziuVYRt%Kx&x+oC*`8e3!BHrNj!)t}9)61<*bMczs9~plJvT?9z)7T8P3!wNU9l5;O
zV{|h3kS~g5yZ*1Y??-IaXh2m&(Ml<D*%K@*6XZKAlv5=sB(XMZK4P?Dvd|-M>kM-e
z?=@G*Glt$tDJeX_aJwzDx<37_k{jo2OP$ulebhOMT<^{pLRl<MtstcqxCCX)1GFk)
z15>@)r}Je>j|Wyzqxr^!5zOAVQ&)9wm83F=C=pJnk^BIh{c@~-7&}QR_k2uiwdI1y
zo9wmLMe?`GpnMmeQ#+@F%`*3sK_^z_@%qL%`_oB9-JWb4BH8-=M97_{5f&Catp;98
zF`>WKTpOE0$5M-f#+~LoPm?*=X_|m0AIW2Mf=)Ij^Ft6{gXH;35JyN$f3SirZjy4n
z{Ma>-evQkRbp-043kFA>Rq{)3T8#JSiFB5Yt)y7w*d{J}80oC;Mi_u=$y+P&h+9lI
z>6IdBfEs6;8_K*JdoADiXA*Js>iSIe9bF+GP|xuuinFz)dN&q`qt>WO;Wo2cQy>j(
z=kc^P@alt9veX-Ow#Pk0Y`CEvW)F`M>)=B)`G(R}yZrSjlU?Rdgtr03jwy<uFb?ev
z=R?B>P1r&5i@65$M*{#cO@8`SQ2G?8FeMd$3DQTA@)%M}O$XiW5+#aQdGkum{m8IL
z`agOFla}~&;M{=8Qx-9`d#=wku$qBG#zc`FTM^w6W7f!0FrU?H+pdt1=$uq%jJoV>
zZ=88ZB#RPBaM~b=8=rReyi=JqJ6d*f>yv(MT4V`(NZjL-CEc6tQC6hwQJZVG{9L~|
z4l@y+^Y$^TecbNtj+ky{F@!_?%z+HSIW`>l=d}#XR~?!M6`^6LrH(47;kGns__o1`
z8j}ynSxOAyDI6jTAG2x5#*|mi3Pae#kM(o~|3i0jy1%xJ_XEF5cp-t5uoF0<DFEn(
zSW?SEV59VmvJ{R2Eu{BizGptubqzb~w+ExL5Ustdwl!@B4V<5icRS-+-soYzZpKS4
z^)36Ap)HJITEE*MKfD3U9EYiWuw_@<wJtwWJ4^>Q$mcmxK_r(a?mv`54nb6ekInSv
z{1BkNlTXIW3SyHYu%o4En;z8Q!$Ov$S+<mu@5Oe%`*xu2(8&Lfy|<2va*NxB&k;o>
z1f`MCgM@&9w6q9FcS=i1gGdb}N+=>Ijl>YrB@GgT)X*SEmjlurL(j~2kLQ?2foH96
zt@nN2b^aUWp1JqlzpiWRVoYscu?Tr#+;2V@X*5~&)X{{Dbduq1MdZukePx&X57g#_
zBw^f=u(u0h*yHs%!=A8V3}4IE_w<wS;h}&jz5S=)Q?G=z9QEnx=9#U5oQGSQ4Rpjx
z$9HeCST25=4#^1vj@GGZ?eo!co}fvabXq~gDEp(U@ix#>+wpi$h*@X+W|_;{L;!f)
z3x(L+*sk8LD#1i<4cn$6pvY~Abg<Xjg#K$Nx`;4m-$&me9ZbEy17(~?phH4oFz@ch
z=FZlzR~!{;&J1Y|YK!=E^@D>`gFP^ulD#vC_l@Px;CPG3whJ(6d(n9^<%Z*3p|=)$
zJd`Je(e*Vm_L(%YDK+oQbQTVnW00!)tTX-4!Ge5xMvhqdl;9HJ2mu}e1LfD+OZC^$
zlP^yf(33a8g=U@d!O$SetetWtee_7)6&h(Fm}_GQYJWwCqM*QON?2}+8qsH)vR;T<
z6IOObmZS8=o4vp*k$~~#2#i+rgNY{ue_Jh`{>OU*2Omp5EE<^TlYa1&L*kf!?(_QU
z-KUCvytlK~(-6By(it6aj&PU)BBaOpmPK{CBf8ec{1tjLsjBFzW$J@Z<lnMDA_l9c
zf{?s~LK@mcm=;7YZZ7qI>`bTn<|6~?3lY4NLCa%=1;z|2Rbg}Q+j-8334=s3vCyJA
zn^+UZ(%w^NpC0gqm498-{fF$2-!Loq^)95ig2<n&x7&I;+@n*y{e>65ZTRcHzI@=&
zP3ZS#h?tI^GYeb$8k~L2F#hWU=nBv~ar;H)*L3giOUP{x(3pw{95&A{KFt>e|L+}%
z1f%D0&M0#ovebY6<Q>fdKtQH~|7`r$IQ-kAnSBWiGEm*j^!xWKfBqk~o>Kr~<t9hX
z&M}Tn5P(wcrjh)+{qy(RLchcGEwF@WPfXHdOpYepM&p5=%pgDd#A;+ofJv2}&Oau<
zW4hm+!=@xKjum`K?H98>KYt}^4h>(rM`mzv3{p^?4U7#MuG+Sh?i~f@DMu}St!{WA
zyX{ntSrrz@X<H=S;!rVDCA?32RPEEfU+hyCE7qaohT&Xy3Ty>Y1?e}DJNMHLt4PY0
zN`{qFe(uOXE2Ci-pckm9?a5zfQnu;i$^T7CK7yud=5P-^ldr|Yzd4xWrokP|q$VGB
z0(o7dukO+p?#2mz*qP;Lmb>}m6!Kews0eQct+y&)Bad%f<$d$~s%vjTn~&!YLL>q?
zm1=THx@0={*}f;3Z~mvf0f&B1{L+3b<9=m}#E-NweN@vlS2pT~O6BZ}>CesNpI#a+
zO&ebsETk7?(W@+*nAslp5=I=LrJpW}jOK8*L@NM;J7>_^)tus2C&@oH9~ELAect3w
zThYxQw(xC_-@n377U(W{As4m$gO2<4vzThYvk4u6o?m0~-@o9$-~GGa=YQWhd}+&?
z-$KLDE+N0b(S}lyu<GfoZS1c=gpKR^bbp})e%3wSI-h56QQ!4np{4zq8oC85z~LA+
z5)H$mYa&*@-ooV8efC(hnX*+60~u6=PlLX1xcZ*uzZg;UYVl9;wLDpGq6x0~NwNIA
zmCrvAm3jj3V`OMrIbO#KxE3r+ep8$~FU{u-HGlc7FWTrIVF_jKQj!RJ|Ngzya_aQ=
zYx&)J>12SUgi6L$G9@}09sc9Ig6KrVw7ux>h4b56|7QcL|4Sx*|8b^6>d_2LH28J$
ze{!PXS@SV;*BM!k&y)P-VrXjr?Z2Y=mcM&G>H?Wk>fl*J-lNIjopAw}hL?`NY?8^B
zcPwdH{(HDzdL4&>J?VjMCgyQOjO8RK<h;p)2Sv|Vcz-l=->CdOCm1lEl8@sHe+A6L
zGn(BTK6)R2o}l#(e)AI(|N3iP*l3JxMb&Sa#NWvs;6?*Ix>t_#tN-=r9<%BB3-a$3
zG?q$k)6aT)cJ^LONJS5F!Av)Xs+5Zt)Ei3Q&2cfZNDEQ3;&}ybx6$4C8j9=2#6My;
zQqiAAX{M`vwdCGr!{)xOC97ocZEjY%U~oomS)+;CUi<9qJ5k{~BdBJAi#^CVh1U8>
zyk}T5J<lroQlYi!d-+o{u*Vte&-6#ash$N|b4K-ZL<DIK7AstoQ<%!V&7Ia4={Y^O
z>Ea0WRJn1+`tT6O;QmR|_E&1}yPguz(^-{`A}S~wGE~x(iM~aayPujv9b?jiuD(2<
zG8}Dp3=sc^A{U}20vSe4lcMIe7CDn8U}d8f*f+!@K4pkYlhNtPK_FFOS^(PF^NyiT
zj#PJAcb?)<GiCGFgUd)<vlPy1T=PiR=j>yI+rtN-%QP)R9V&U8H*WH6WaSj~lPQ6E
z^D;mlIBux47P*RFOUpm{Ue?Te9*2HcGm9g+=&gQUj<MKWar)k`h4)9-^6iB;oC+H5
zaa6G>JDMTviD3na#%j83^x>{+V6Cgx70|nTVfk;Yds|eoZkuVt^m&5)RO827uY@;h
zM`YY}-s$sm%^0cPdZY>}^-6wKAVhgK22yZ2oS8scox5?_EXB0qlBwuZ+E$-#h!sOz
zN8H~7Nx$|DKd)D0|Af|b==>tR)-^56uyti!hvdnjm3N;gF5{crk1hU|9sY42-|aPO
z>q{!6TjcX#!ozPS_U}~4?b}9tK_w;39JkLbm<dKvv3lBTfU@N}l$w_FUFXcYC$mby
zlEGYBoKATP5HS2>!`xbf?)7Ae5f<Kp8-gr|Howg>9)xX4jx=ij)6?g3_EK#ZLabAe
zfyC=Ctp?uYJP_Lo7EfkP1v}?>RF$EM=ko98W$)4VtSEet+g4ICnZn!UZB$pM@G{=$
z-rUfrb$+&_VRGHvPDf6r0TDq}UG6E^d%CE?D>*TI8rE9`U83DS%RDdGYbS)wpBJE|
zUXbHg_0IlTz|2x5u0q<RMMqspCpfB{&W4G8q0*w<OT4Xwl2M<eAyRIjBxiNcWnBy=
zK*>}UWUC+y*^8FQdsaLC^!;Psexu>M8EyrViX%kl#i;^j1_En%LE5H+K$?7<bT5Df
z&M!#C@02|;gGR=&uI5V>lL+(d2zmSOu<JX@{H>}vBn<*Mk~o`U731<>OEm_ME|{fU
zy{PT_m!OSK_mxR$xzylH9Qs}|x%DmVQR`T#6hqU<Ju}t#xlbGy1Iq7^8!OKV0X9)<
zn#niFy;KSFRV8?7dHfSmsM!PqmwuaO&pP%saA)^P!kKc-n^${oUoLF!O>vFdDYHk3
z3MO+wxta!gRu9a>&ZoG<Z!cEPFCPTa+xhA{_=}?OBG^w%k-3t?lZ%n<nJovQ;B&=!
zGZ6}e{D+4&2KP=Hi;=y`=vF$8xy`^wYYkj>`45tx$cV{}V>Lm%l=d6BcT=A$`vv08
zZ8x~n6j!I<5c#I{by|D?pW_fN;!jR#V>;dQ($z1>gg-JB47pGpLj`ncawrpCyccqv
z?i1DcD-~YP$&jaReap!9My*%D8a?r);DIQrn9aMDeZ;|e&9CiY)2h&Jzi3VJHcJMo
z?P#Y?umqrH-1UmxJjZohJc^d=ZicqeCHC}-$K=hJ&P2`}PEIzl6YcDYs(4fNPYFWV
z->Rg^r#P8*#>Y_wQ}U~?Z8V3{FKij@Z!OJjyKOB>1ye_djamGFO7R<|W-x?}BXvnS
zg5OB0%yrX%5zj^_q~&EhUh4hTd6NudS5Za>-|PU07EyfQ`<q(LNj{9yZ8-Onw47cv
z3!I9u3alF;jn^p#swet*89HocdW>$9cv=}_K@>uy1qHJc*eV&Wo-;i#N#+f87O9lM
zh^65UWcxfe3G=hZn#8$!Mc2afqwr~%9z$^Vb~$DdmYj8Q)$ylMf$wh}PF~InP3(yu
zTK$wMTNORrlP59NK$1W$Aza~G2l~IH;oA}1_fEtTD>oSIy`JCLdszUHqgoB$tW>qp
zce}}$vh?VN7WqpyRx26W&IES0o@)M7jHk3RSjy3)uUBL8t)D43hs3--Nl&5|+md8$
zlo3d+vD075?W3Bj=X8^Ca`@#=C(UI#Ua1sS{aa6*wr$mlUSydrEoCVWIxS_Z_Ce9A
zn!n(Nlbgc;1-Mn3J9276D^w|^4E1<e-8b7<N?&;*@}R8hVr`{nHPJ$gboCUOV@ZR)
zvB|v-uv6!XJmsCZv2)v59)i$a08M?#b;J<k+~MI+%^%pGq7^eM24=T01i}Jxan&xh
zyh)h<0(|mY^$sL2=&-&dpNt^rxgX4*=YEotldXq{x|OrRj@F=&zK^qLZEWTgUJz$Y
z#t-0Wr+}q`FHQ?aQz=-rb?bi^ERZF$*WQbcV!2}DmgTG!POa~97m<CsXR?8HSvq)9
zN_`#K=jFM*r)7?^EG4?g&^xRJQ5SUmOHGv{dvu{^#Vnkhv8dk;b+<YkUf9^}$)sQ<
z8;lDg0yjekjZu}<c#X2x?A`49hc-3ipQSJ;p%MoxnHgghxZvCZHcCTYMW$l`?L2nc
zssgq%)=$iNC)7Ds+V`{^kg64O?qh*&&MtbzBan%}(xt8$WMrzD`d)u=V)KG)ZD>pA
zHwOA8Z*@Jd0sNe9*iU{=R^DenCq~Qe`)Tjr{g#N7K>&MFl(!*q6Gu&8j=)R5_Y9ZY
z*@EpQ;DCcO)yug!9AnxsmlL#+Q5tV?INe3)PXLig()9PZ2ESZ6;M;gtpVfSoW?R&g
zKQU^rSW!1nqLz`Zb3r*Dx3p&2*7}UrV8!f&DobEpv-Ef=Gl2{<9u<Y$)U*qWNyASm
zw12&!jtR&myUfUU9<Jg(J6IUBz_SUdMqT`&DOs8qxZ?++q+#^KAF(N(>Iz)oW{nGP
z$<_*=8j2dFV^UbY6Vr0aekFU;Gix4d7JshrZuwq?rOKRsMHThaU!)~}SXn|ffL~?y
zPq*;zg89$i_=aDFsg>};(s(JCAS0GnNte5ETu#C-X5Mo#U}+i4ax$;*?&0+K!yAUq
zCm%T6JNY~Ee{<Koy#XjccKn_Mf@3`Uf5-2B32FEo(3g+#7klh)ZSD)YZM}vzJR{LK
z5a8qEgV|$TSB^VIAlYW;&FZ=K%<*&h>nRLawN01Bf&2ilLcD<1cG>69-gM`z>CQ1u
zM-M=MoC|*q`hotx)_NQO2viG>@Six~Z<P35RNTen{j$ftVjC%!QH{<OYumy>LeEH8
z<@cA+>EfWEpsh^d`C}Au@S}{q(H5N;C?Wn}(bGRWds6YdzeaBQaSOk|llt+2@3tRh
z421rnIJw`?mVfu>@96{dU;%unYu0zj%-B~Ngfau-8}g3p7+1eV<pMR3)P**3lHZ;0
zH=#5L0m??Q>}AJE!1bWh-VfrmCcif2eZQL@sVZ9ll#Qe?`@c32|M=%05;1Q9xY6ib
z4ojV{oBizvZz=ROa?KxK9ia};8<*Ai!bIloJbAim&auC+usyxdvZR{R)b99WZYzSs
z7z}oeWM)3Wo}0-S101?XY}DKE0<Yt|>iqKJU}4W>z7dqsQwWW>3R8uK0jQ{{THvJW
z>WvP5*dowxOuhT$B%ccBDaRPZ6ss2*dP;P40fJn3{Nb9%5uEIOnQ&I^Qb5zA%drO;
zvjvyJG8DmOat`b+4oSCvdsLrk|355;;e6^Apmtxq>9SI_4dN8*-4y)@RI}#9x#nl{
zYqV{vOw8k{VlofA;sqcxhf;!u%m$9}r565`N`el7jW#xRc6Ndpr;m*X8(@?Ga581)
zQk1|vXw*iM#^LKH<@VM)m4vg{E$~RuZz=49{^7nWz*YvS*f>_e^e33~IF&`57=TR;
zW3D4;zlp@}L>ng^c=pdY($OQh0)6oRYk!xL%{va3WfptBgLg8^aONRg*7-Nu>#IQ5
z7^80qv|1w@9$SD7YZ(7|5#CCqp>w`^Z^_m_E)S1U5r<a_0r|__&0wE5-D&R|DBrJ7
znnN5=GqTZhH_2zrgf9wd>)jpKbAkD;4p^7^vbOQl=&beH`p4IUDyuo%_p>y7n8bo`
zx)&F)k5G29Mu1}Oak+om;T{-w-2Gs1b+OQ7s%pE|ZG{r&w3o{*9L1+MuLh42PwT!%
zDD&j4?C`)!pn9|C>k3xm%nCh)E>=4k24||`9`PRhC{wih9rWR*?pS`a+{RHCZI+8&
z5wjxj)J=z!MQ1CHG~qs*I|pWR{k^bN-@N76`Yo=b&gA5o2TW|wF_eOQMuW4lHS}Cf
zaNahZU=5%}x=+2mT}x9D{J?T%r}~TzY4z43ULCI1XfPtiKrOENQr3~V@J(@a>6oJV
zgkneK6&(lYq~Xd~)n(>8Ks!6rdp2a{_8NaJWxo~qo4`vR(c_nM9%$`|28g*{KG>(s
z(|8Vpzu6ep$JL0nm*AygMUx$kBhwG@5C_?eS^Ju}>XljRnU6Cu{-qt@sH>#jPnMr+
zyMoi3<M)QcovXONBjjd2GEYybr(d(``B$F$%?DW-Z*!6-1#Y9^un^`yXqmD4h2i(n
zDwr1@3ibiNzJQ|i^4y(DtA#&fiH{)Q)5R>##(#Q2&t=MP@WoxWCZdg65*s&WzjSx*
z5xY9v{CY=sJ(tS@TfVM|gvR&ZuMowzM(i|~beirHwXEodX>5aboZ{XJU9|LEEMfI=
z)n&yFJC$2sEwm--a@iJD=v$54@3*MaNo}npJ1W)RX5~Fc1T0;*Y<i6uqXiDjP!T>G
z6QQH%?8I7TAT_WV8dDn*Ex7$yaPI~<AdzlLo0xaq7k`qk)(qmxR=GV^2;(2$m1pj3
z^rFTYZ@VjCQz3M1$^ll8moj6sTP2DMMpS7B?0eF?TMzn9hI{V$t=2tW@!gK6%v%_|
zt2@eqy}4J4l5=6U<X>1Q)Dkv&x@7Eu*b8`<+RuNKQtis9;lvUfr0mn(aCx9fNVPLY
zcattI{`_OmNQeKeJLWTf)P80Vbz<3&JvYOhq5eV~MpmC;DjUbq7#CTbb6109uHqnS
z-~4szO(i~KNPf}W{hjdI0ugX^dP!a@OEywBCVcp?YiB-l15SEP(OIz@>rIHuzKH^>
zRdy-}F@|gM?_R#yf9VKo;poIMo1SW6s(U+nJ2NQQn{{s2(a_m_x@q}#?OUeSU@a1=
zj2o$y0mQ>M)+G~J7nGSUYlG6e@<c0qb2K$v_strGgbVnEI0Q@Lgk^WdYk6$7)V)Mn
ztMR+<3JH5$D=J-WUof2Mu=Tg~f@j$ef|+WGG-A(Br#y*VF1Z0_G&XWw9Cznhw930R
z%C-2b#*iNj9h>io9y<IfxW;6N!1aqQE1tPA3}K`?_orxKulT9(+>CVl^}RfppNS4s
z@CbOe)52PA&-*)4fIhX@HFG)pfc>mcniH1|S0-UWF0ujC8H0S5X4`KEO0DJ+1C}IR
zUdw|?8qN!NLb+fedz4YND!C1*c#sPYA@yCM3hhr(`yiL4v_bpplg*VJwPa==nCu7R
ziL+Q1i7^zbLE_n#dOLueV3!JRX~sgz8m2%t={f}IId?YVSPzCKVg6d;tOCT<FW@&Y
z%iYz)q;E%@JHjM-!_G(1c{ALuO%x@(88vKAAx+$6FV{37KrFb5mS1|qo>aN~gDc4W
zsZ|l;;QLU>x#E0=>mNS}`>fWqrqwEVhAdIHD#-gr7Gg|n?EnxKCbYnPP~b7@WiJ61
ze!}4!j*Ltut#}@Ld#kEj`{2OsUHS$g=(!Jb8y~?5zBmlUGQ;j$exwZSO1o9h?vRfx
zj8_Y}!}3Yz*9UF=sHxmp0ReM^4Vr;*I~#%RO37?IsL&;i@R%7~9eYRJSQEi~X$r7F
zB-0HK3CWb-hC3crSi#Ay;XEtmD)`!m;dzO>Ys~tT(*%Sm#CLIwaJgx|44JVS`l{H2
z<qQu3248Egf(6MHUzN{A)qy`SpMLO8&Wm&-+1UTUe|2(Qj4`f+ps>JwFJs6_^ohr_
zcdRlNC+t|xfcHnkUeQ+aS;^Eb9$4U9c&ZzG^Dp0U7Zw~64?ed8tDP$CYJzHl$KvD>
zdDot~@eJ$X@gqGVY^MOlU<M(MP@}Zl315z!z6$?XYXalHUIW;|b3ta3<;Y=c7U~aH
z0^bdV{>C|ae3?z|gc9&Vk_#_5M}(^GDQSj9^0_S`gM*>tje#@^5g+o5njs7)BMvqd
z)%-#i>LBTEO(CnS-G7E_LzkFAmpJF|B>K`AZUaI}v(VQt<(rEG7&p_hE8=}PgIjy0
zb!gnS)pjUE9g8t~BZFC{85=gfGApjy4(sCWyP}Vo-fyGj7Y424>0#45>+hypb!5S)
z=8rS7p(0^A>uE4W*R7Wa{UjrVk*&K@I(%u0)fzh7W+TG-L-eKs<)7N@Ox32tYC8ep
z$feJwUaJ2i%u%Bese2)}d^*SuIvMO=%P8LOzYueB=7C_Wp8Dz@pdmE!&S<n%T=R>m
z*P#`57jVyER%!Ot-v_nnUohgei6N<eTd2n-?R20~SGphouVv~rq;?Puusj>=OTElY
zEv62I!%A`qlIlTD%h{oD<D@^L^zLRp`;9&P8b--JN3$E5zTdR4YWCwEq4}f*qd%Zx
zQ_eFb`sQ&oLpC!#4wHWg6c4|=jdTPoP}J@fQ(4#fDHRydQQ`YArc9^vZ4qZ@f;FJG
zbA$h+*9eT{=-{P^y>6?g6Ex$yT5D!|W?W!LZ$};ux^bDs-eEQ7x`H$g^=@q?5HPLn
zkh-k*YUY;xMdc;o<c{_3sx?XOPF0bYz@_ETB{%UMivZPfw(Om%O<DK(zzK)^cvWax
z9goUT$Z|<PvYn*1k~bI7!zG=(li1fcX|W4-<td&Y?F<Nen_qZxq4pFY31x5O&$z7&
z5IU6#Dv<b;gFDXMA@p<}O?`6})1H%==UT=^{O&uURW>t{J8ND|5#!}T0&uj!&6Eu9
z*Qe}Can*bBC%p-+w%<%44?t#WDx4L;{kQ;G2BKUN&uap1tNySUo_d7QSQrVF8?yj$
zD>kb!)QjU_^<!Z;)N~)U>PHy3UW+|geZ99?+?O0slZ7yY28ZinSNiN%t5$r7a^$8@
zx;2PI=0Tl|>U^EBt-ZK02Z67@BQ@@E#P|no^am61qs(DkWwSn^B&y>%gO}GCNR8K@
zJxn>D)5Y-~N5{n;%joQ=sj4}5YnAm3{2#f{3Z`4w#jfj*_W*R8Ue&sl%NGCjKT_zh
zrQ@n~%b4Al`0Y^vpn^#V@jO-aB0tf7gxQ_)H}mD$K~`J|%#ySVW+pX~ZA~FV*&U|J
zsO^m9%r&8lkF6qfHA}|2jNe=OAIXv-HJfL}o*Kw-3lcdzu3uWStfkce9N`6t<a*}6
z9Furh%I5HT^4(U-u4HGqeSG=GZS?J`WW{+FHG;umCl;Kmo^+Vw2hadcHZ6UWW0{c%
zL6U5Dc@Ei8&WZ?-(nwXiB#k3}Hb%aRf=aSk?yhN=Ob3oxJfK*B{wZu)<bE3m>se=k
z_^Yf~BpL=#BYn?H*H$)mxFYKj6UghU#=6WJdRn~8ub^H-kLTu0_(^;^5jFv0Pdz#s
zwH9sX7t-o5&ek54oCT;EMd58u{3Ik%7vE;DIb(HQ1<z-J<eIcMt=snUwXmI@BtU(f
zjtAYSbf2e(rP8W3*}H<ll?SRWANLl^%20rYff@}~@F3k07_f}U$?GJW26sUN9jAB@
zSAyVs6TH|6-26ON@DQO;|Kr@uM@Nwa|58`xmnO_26uK!$(B@lZ3&^kK?zjRCG`(AQ
zhF0R7$IhC?IjYO-4`rZE2%~m8>u$`%_MrTVx=PTg03uIBzgN}L<aZFHzYgb4w)~xF
z{Hga1Tb)vc9hW1CSLvwu61}TbQ6MH%O}9MGEh)I@j8>f#*OenV<zbB~8mbJ-(faVp
z=;w{4CIaEVId6vFmx06IC%^Ecuz*-oB{5g-7)#(pL-ym+_r5sBIjCG_yU%B{JqEd2
z?14@M@4xwXB6vt`eB5;=E;q>84t1&npc#@U$+zUx7-%7<B-s8a7Lld)F6`iA!kw<e
z6JE4XL>J1TKNZSzAbhFD1}BtG@;z`A+Jt{(9(Z@K8D2Ko(k=&maPD8d$6sv}`a?|@
zw()l0>1+56-2%6~?vNd|9CSj54d|`MX%xVDz-oMpY-H{_&trZb(BZ=89nHW-D6>(y
zzg)p#Zxa}O^lM(66hf{A_e*NNf;Qj$4I_U~AU5k$%<UZ3X?-={|L>1F`>Q$+MVD#r
zR}~+==+AkDs1kJYVCe%n=}~D0;AHNjIX$<u?-)zyQ3nL5DDDo%aT2Gw0H-&@`^b;6
zgdue9wnW9!;Ol08`@y>zo$f9lyK|f+Xrq%gP8PU<N0W}N95^z%e(l3<xcp~P-sWgZ
z49VwsAEWz`P6IfyPaw-99T8yO#~MwE;S4UeV+i~w^pWY<<{V=QsX1t!!(WVf9L~`}
z7akUJxQ?-eA~YrbW8R^!C3uWVbO|0~^oJH%CQm9#$|bB>v?-j4b&#*)8w0RgbLTtp
zkP7}@@yPPsL5OTHYOX6|(`9`WuX~bS2>E_<XV{@rHrO(6r@gk*p<`ZZ9{_4iaPS7=
zc|pp98876_+}bLvZtgm2e|0U`O8_BY))Bk8(}^4umI)@&b1|HG&UXYJC&phd#tE*i
zbfB$p2VWL`&nnEH+NrlkB@OF3;ZG&<g}+PWS>|?ZM@#cV5f(NY_M`)t3X1Fbc10)E
z%Dw4+r2J)$mf2oN@B1|%%m;Ro2KMBmJOHCMyySx+8~hNUAO6~%FshAoNa?sIKO)vl
z+I2eGth*D8+)V44B!TQS02L6)!?{v6AKj}i@aL<4&y)Py%tq;Wo5um|jj{~AD(^i^
z!$vb&;Dxzz!NcTj@TB)7JscH%dTeWhcE%1M&p9(JGMZd;Yn+wSz^AyoyDrqSa(X)R
z`pM(lsb&@Zozg^tF7^aapaH_Ouu(k~O29)+W!E{jgCldzl`agjUjbo?9oNv0qgoK(
z?Y-Co+}s=EiTI$RkOB?%STvf;pKN2;-Ch6KkP%PfoFf<9o7X+Gu>vpBpL2xFH`nf#
z*h|T%*aIzcMdN1Ngih2;YYR;aDJkY}K4S{~U>m<_I`69_FV35^q=_60zLrkK;0|z2
z7n&t;Pz|MceWeGhh}sneFGY6&T^9<nt3pT%*qVmWo$VdePO<CUHbihHn|me`5-l>c
z*mh-6h>J`~)G;*_Gn#%~7T<_T;mR{&0#(^Z!)-Pb@P2GEv1$}zB@HUP^H^9iILA~p
zqpy`C`C!;<-?m2uwXTnB-Q)#WI4I#_JddkiQXXL@!se=x^wh$~k4d!~8eXMZn91`v
z(!LmOapxNrQj&XWZvNIp04z$UD<TmlMc;qv80=c3isf$1cyUEzI0lSpeG&d@De^jo
zG&5>;1!ckL<uqfPc7M;SoG(0bd4DG3Ai2<sHhk4^M3_l!cv|=w9D4VnqBl0{xyupa
z!;Q+#>(YexWj<-cc#MYCQwr`&Nj7kkp6C?Xw`yuxpK4WUPTJ#Z_X~N>AdC!P$~~jC
zyCIC)P~{tq7!e>ZxWD?YJ%i#Yk%`H6Dfeskm963o9el6I@Of)J+4QjRG-oQQ6j+HH
zvpOGfNzR?{mdr9Ebx^fy)n=@!?_q~wT2NDjBNp9EV6k}EV}IL!pwIqGo50ZLjv~aj
zyZ+D}|9`8qOw>x{hCDBz&&d1MfU(pPHIyv^hAcugJ7*O{yDO&Cw}L{fBawad^L_hf
zsHvRIeJ>;wr48HFM}Qf(_UoZWC1GWV(tVPW-aG+T=$;l{>Ld$Vz;v`(twlkpFQ7Ez
z!V3OxthHs+@Js0xvSovfp3ehqS%Q#Fj*H!sW6HJ~M8V@xRFSI14r})kk+>I2!h@QS
z`RESojokTjJon6$)+(b)VRH{gc3haCj%&}xuN7^CcfR)5uoZqu#iMR^b+AeZ;o0{X
zxR78(Z={%8uy38HK-NlcD51JCKL649Q{`K|h|E`DV!=tD6cAKhJvg~x55h%H3CY5|
zga8fMI*+-Ukxx<|yrV`>4GUG!8+D+9+$S%NOTtHiX)@hjH$Y?`9B5#rIS=r!Y;E#-
z3IQOxoo<E@4PgR~_<HLpbjR$$gU-(JJVM4Dn`$rk_;b1$mDc19ka=`V&|%a{RZJL@
zzF=DgSLa>GE>zAFI#{jC1v$@u$arw@Qz3Z|m=Xrspe@J`y`lMwyZQoKwpAny=vtQJ
z4zsF<1ilx}H;z^$H@Vg9v>)f?F3$+toD<C$lCR!3%!b5BCNc9gkG+9$6e>q^Wff!x
zKRs8#UQM(m?6T&pa^pM)gE4Juf?^!!Ydcw|)#W!x4u!P)@MrYOH|&!%;{&xW-gULx
zc&VB>Jh(dF@*;c<q0xZQ@U6O79WI@?weG}S@5Jrnst_+pE4*9*0{~vF?fbJi#|mQU
zNPLP*^Q29N2bKX;nNg!*QFZmvYVPn_C3s0KM{BNLSj)S*+se(Q%7RRhK5F@#<3k%d
z1^3mOq}zF&pg5%Y6gq^;uArHh0K{TbM;d^`+dx9xf-_psMyu7#p18?)QCcEe{In@;
z9z=T#yKjuDfSt8kppYH35u*Ca)>mV>MQvEQSsotHgJ|l&SMb?s0ThJE8UUk*;?9di
z4rU$}EY!4po|xpYC4V0EO<n&^Q?bEM^swVk5m2M<0ju9?-8Pa4+pYs6X22=k_xM-!
zQFO+%2kVakk_fG>=|6>|q)7@%dJKKU4LMD(HcMaKkh~567(}sMW}4JCL}eM>@yX^K
z4WbAlBRc2*Sc^Cu6s?gvN^IItu-)6Ql3|lZS6CMke%-sS<qczBL^yM~q%>PdY2iIi
z(;ZS=E%qntKKQPUPt?$K7+rTNdG4#0uWF`8#?MP$pgby{3}V%Ea%_^8<p;V{Cs33@
zbCLz!_a|OD39?r5`e+hU3dBk$1(<9Pyi?7sM$D^b?uXOfYL;%@7$JPX>pbf?9ijtU
zDjf%4)fQIN&9?U}0m@{$W?1dCOslT%+Nh&KVs773KPOanBfQ&nJqOp&nR(-GA2^${
z<De(ocPoAyWZv02c9`6p`9OjmSEY+N`s76n*3o0CEw-J49L6c8`%QU%_^t49PwsGx
z+bF(p_x(aJ(xj=ScY8&i)_t=dE5%}e>4uqaHV(3c(aB!Th28W{v$W%MIKlNLX?0Aq
z*1du&BLX0{@Y6ihQd3RSr&VsazzbCGbl}^+E5KJt^2w^}$ygkz;s~!*(C}w2mt{I@
z+URj-GuvjnY55IDME+xqv;wQ<0@d7ed8zArFXJ*EjOD$Hey6wjsTP|RM{5wc=$El-
z=o}><VL?d$xP29XlC#OZP*;4NUqRhw%*BB*+3*(Qcz_pQLHC2K8^S!$4F?Aow!Y|a
zbq*A#by_cFrQV(Jg0GM-zdRs<Gk|s=<T%E?pO@Hn(Tr=dL<Au#P%cCap(sR|Z+ju%
zt4@z2sa43z_uMiLHY%J`*Y&-SOc_A8Or>IGNeprq0L;a7sxXjmJIPMph7E`r$Ft2!
zh%3JvkB=+BYmb^ZqOG0*Gb6oAk4!Y6Vssk*tDB|DyL~;^>%^EfpqsQ><{nI+<eM{F
zTKp_|USD96N`bdAE`iib_BS=CaJ0xeXYb#%;$P^0r`lKzw_vp1&T@Q`IJ5ykn0pZy
ztOH#(sq27AOYNSEphitnqj-&{09!4Yf>@Fi_#_D+CA?FWfK&jw#!3&r&(oPR{BeJ-
z0<BB{yZzm;TGxWDE!T_(?w%#WFEDSrRBZ+-iyy|0rf)vm=64(BvxhzQk8Qq6@WnRs
z*?n%|EBHm`ruUCAAai2}ByBjelY6YrT#Vnd&FE<FM4D(ITJiMU8p`Lu$^8e(=N6bg
z-PROdc(>`Y_N=0Na>!3g=+)Brr(K#D6@-j1LE*!CYg@-W4Z&znhr33wr;P}U?v7>n
z+>TbiP1Zfb&(`&FDn|yXZJ|9;=3telI;fKS6GBH>@KK*9%MHRkd&gVbdalI#gW02|
zou%Aw%_}sJ&NF~3FHSzm)vpsuC5&7fVit$vuR|^>2*OoCdx0Ds3~i|1>w@y9wX<f7
zmOOnM$syGRvP^3$AG)LdWUz5?vX%{=G;>SdU`HW}%~964jYVjS-<I3xb&oOFYPWI|
zH20D7{#SI&Uof$E(5d-RCXa=j(poLExbS(vaN_aj^7F3(MU1%}K#J0!M$jO&1NZe$
z&2Qlv(6FW_-MyT=$57QGmq?=e$duM^I>nHs?8`F9m&u=8Z@U0E!>{XjoTBhkLQ5z)
zcu%-)jwpET^?b<a^jLP7vtJ%5pIZaCPCnQbGfcpt2k<0fJW&eBW?`w|I8#wFinD@;
zc6I?s^-WLML(Rqqj?ur%p=cmsEY>^&FYm`*AQN1NAWc9AXs4e_p?d!&=%5}d{EEuU
zP2Ldk8W2U>RA?)!fCFYcxeD(mfGs9vAj-3K&gc+@MAk5pQxJY44}t{EivbfU=x}sK
z|6qb-Zq0~#UlSC|VI~i%oCsj*p7bTr<AuldV;mm6J-B*_MmqB0&p-#i6bn)oZ?f?7
zCS|Fnbnq=n^2O=TZR}et(!t5-Hg(Gs(P%09$N5JjWJM_dBvXnd{^c8f3K%)0Khkhm
z6k+lwoX~0s#jYLFMf)&!H5j$%2nQ80AGAC;vby#GxDj`v=%?TP<-7lz(LCmi=6@H{
z{3iDQ-kJPAeK8GiYp=tX;Nmx_?axvGU=#dz)6a2c!u|&b`UMEf1l_t^+Wj+D3ILms
z%LlX;ulN9HGiipDE5HRM8gOUOD!tI!Q+Yhcqx-JAZh51#TMLHPaT;7|*Kw#(J5WnL
zM4z^;FS-JRK%y%^?uu(o=>GZ1pZe$f^wG!_(i%M<4GuRApSj!{egCt=clSSk&*VQ8
zFaG1Cc(%;{pE>D2(fsc~j}X%TtnvRd)))W|$g5nJZVJeO07iLlA?xT%unYoD75ou~
zF5VEmV?e~=crzg2YF{ts{Y4!1xB3QpSY7d@$4>o^z9W93_a=iY&&lLXTTuWquT#DK
zmwxp3zIF}aSxzj`<_a3p6k!4y{1o9_i=(GCQY90#fW=*V$4~{n1Yoi7s2vR`#wLCu
z2Q%^0C_!NN@Y4%Vy0sOGkFL?GTwznfZvi?-DGQWsfp1ovC3w=!FT-`5Z+0=CnNk7o
zsWt@|gdyc$h=d{cGLP(o#-A+|VFJ#O1UN%ycHj*AHI|M%LlNpzLuY|AyiA(nMerAX
zidTunch~#=#>d-ZUIidF`>ii)KcdIxH80}AmY8!WO|ym{vqK>&`b7I9#rxq;A1Rrp
z>TD+yKk2T51!fsSacK;VU)yW#tR|9~-K{xd@oc1@sZvD*P{kEETkTGBo#DjQ)mqWj
z=9U}+JO@+`iSJ8aywfm-o}CA5oQJDAoCJ}In+&`7z~R}jpGw;7xKG|+L<8Jet5oKQ
z+9bbwxv&-25V}bo@&0g)U?73@fZQj<=&ZzCyE(v=JV8BW5zGWFEnQd6w!8=w#!e^G
zS5DV5jl4`2W^;HjYtV@O;G$0m2A0GeQWapkD%fT&tSh*7d%;vxi?UH3d@e1kWng};
z-SELtN2Ph93XqiBw4^B&yF^dA<Hn1G_qu|ssVycHi3JGt_z{|#N@kl(RIQIx^sw=C
z*_X_5Ui?<R|MvJXMJ{1e%)$GD`P@dKH**xwz<08akaL0*#1RqUTBKA$oK2MAi#D!{
z5p2#cD$;F_SR(*<)Cn|8Y{ovoR4qgGt=0soLtPmJD($WWhCRB6h0+^f3rQVA^7y=M
zUn)yX9b0p148F0sT07y%RM+>)#uk^Ub>Hb$viH&%9@XcGUFwAi2_R_r^R&Ne(hXGd
zu=#D$xvU0y)zcb1k6K6q6dkqT@Qr51>}Tv*E?Vi5VbI(O@QJ!8gi1NZ#k>zeB`fk|
zv?fyfu4v?)D%yM1V)AhPkFfA!L)uAPYg~n53TBS?*;C%v;g2*6Cb#^xSp$f%sdI(n
z&t}TMqa_)=Q@E*=Vtx5V%9x@y`0<>RIyw64iy!>mpCk__6X^H285ezXu0Mdk_Exd|
z72h#yU9Be0?ki`EmamPU$;yHjqV{389sg1~hnU@0^CrWtz2%%uD$Iv18qM}cN~E0@
zev>$?Z@wl9Bv;RTouv4D;JPY~Xf$t-sR@ARTRhJ2N9w>+-qY6_FyJBLx`(a?kbnel
zV3a#eg21~R79s4)z!@Meb=vGEsd@A(Oqtnwce?%$5=lNQ{bETJSi+g|{skXpU>gn_
zERBm-ocm30YOQuz0yU=|ld0mycO2Gj+d&sC9*d|4hZl3GbEVI&=8?19P#s(Cd*hg7
z%+jD+nrn5zCuF5R<^!vB)4*2@<e$#yt6Y8nCcY=y?y<0KN4!}nrhCVb5s_nPf+MM=
zNl$9jKv@j!XYN!n(~3W(zvs@-kXYYfd#=xzUW>BYzIBJn_g($RXpgiyqXscX2irjn
z9A&bs_O=UN9O_i{A=D3MVTzO+A*U)oDWsXI3lQsNNt5*0H7Al!Ma@kW3#6MQ)kG6-
zx$TCRM4qw`n%nx`T>Vm>mVgmC^YLuR?fO5S_+G7$R4bqDE1<PR^Gs%8XH#vLvS^UJ
z#EVnO^$(xV*E|EMEkWQ(Lk3~xU_AXy`7GsP0fnUk0r(@?OzpsTtR9*%rcjKjF|8Q*
zKKr&xq^eW;yO3MGReFLYtbx!@&JMnwZqI!@EU~#yu}(Ng@Z2U4oJn^|r8)biEdC|O
z{(2Dt*H=5$P;c<eRyD7)5Mt#T&)2%1T}{U_uTtHsJwY!7aWuJZm!{#(>tD;ns?lk5
zd00m7VOI-r-$2F<T6KR*#?!>1W$uiszD4!PcSdbNU<Zk#rk3kyfW9o3X^S_YJ8duS
zzcmz*ZW~&!32G6_0}_SivE9ntjuBH@x&%4rHR>`7>pNX&CZq4}y|`lX<^X;qI4({C
zTB>5g1Zrql9y`3PR6Xg=d<L&d9qv9<>RuixMXou&qAB-K$^tQ^kr@%Fb$;0;-NGY&
zLYW&LF_l5!e}Ti_c&UmwGb@8?sV|(SxD}&V_C5o}$oP7P)8XxoXkG{av`j3PAbvW5
zL3cu5IT)p!jw3!ueU2(qH^S`QEoaqhttxtkI@4zQm+{TALB-&L(XH`4k@S}4?g`Bq
zKUcLi_CfX=M!oNDI(o%FGDsl4ZSwV&h2N33%NFPbLl9G~@8JnnvK1AywI`~pJgE<)
z8&Aig8r=JUp++W2?8EBeX(MwVum&7;A6i@1@4HMX%Jix(aq_s&hs;lw_*GCZrx(cc
zeLNE6f-MZ#qu>1@y3(FOb{-m<=aFv*?dv2p%Zp1Cu&XzB6<K4A8@PI3GHBmwfMHh?
z-U+;Q)v^el%^WV6Lv5hk19j;_YO`X|JWsmsG=eWdETmIR`2JHz=#h<$HLB>*(|Iz|
zq%D<85;&3>EbvE)qB;-L4An!4oPGQ)BC5&!H4)FX=P}>-ly!CB;$qx&@;PlYs-NO2
zwWBJ2MYf98Ip9ya-LiF&P@?|&2A6p&ZH+!I(u`m>vBIpZBh{lDaL%I_GZTYq=JP#Z
z5q?<<ZMXo1lO@A?VXue?Li_NZXlX^O(W>WvOyn0eQ6nhU9-R(Y9k9e}up|Ek>h4bj
z?LylF^^{Z)q`cI}BTd1-CqtI-)Ae3TTtoQ4+^S}%K}dP2d$MOEaM`Hpso)3P@u%>r
zh_`y5`b4|6f@Pzgrz91(>99$g5qxAg-0}c7Zviwk{Zv#cG+SP}DD#drPp&9JKGVjL
zlnJwi6I=9ZQT1OsDrQSDy#%SZo@z-q&a*_RkSh{D41t&G;Y%B)0T#j|CooOZgz67Y
zKz{8P_sOqa{qVL_@Tl5G4I4m2vgyH?`s$fKulfcu!&{7&OxSO1+LgIk_Wl7lF3a~q
zq-e8UvTyGD3UQqi$*{_TxsZ#$S2cc}L4^`C3Vz4Ir3c?yfqRC!+`o4um?|OQe((~d
zihV?TMq3)il^<om!MoDmF2VdA)ob1WottER(HB!ap^Nl*D+~*(K^JSqOV#}ov(Jr}
ziIcXl$z@d^?(6|@FctvMbUc+hzk_Uf$;PhC%#_vt>8v5335rUKI$v+zq50kWzgiX%
zet=d(?+a|bP6DTc6ypv<4rCr_FJ+SeW|FG!Q>FAK^;sXP)_x@J8cTW9%M5ma<HA8v
zoI{?O9=m}2lz2)Fp@UBaT6(~H?TpFli~`<K^c8sqtoDvifwuDrz|xY)gM+;3Qwmr$
zpQrJw+&&z&4LGfv1VF3mJ&q*dqZSH0dl}u<`kEl^7+{|N{q8@7>Hp66vqSkGKm6av
z4?NMMLO|pPpoes;qmu>AixYMw#gl#|vbQCOF|+G#^nyO$==NL9;2r%J;8v!#71_&U
zcq3qa&jS9uiA{Y@)Fbs>82O2xZ0%14uGDBiTbgqx`T=Esew(I85;kY}_ui)<O8uVQ
zjd*o&PkFbVa(SU_&oD*)D9g%;Zp@d+Nt|PSLo=dS;`6>G2SL5o7an>(kbQS@9uiA@
zSWJkH!l(fax|hgDFs~y>EDshMeY03$vMj4Oiy*yN7L;Q%@}VyryRNQpZVsW7{^JE8
z|NiA6070jlI~wDRY;{clv>*YTuP97q;#CIszN(pQwoX<g`MZGYpU4XXeSt*{z2x?p
zK<w-@!CY7pgL|s@0TVih_BsISIRlN|)62oOG%QR=rN?_gLV~fiR>HD*u`JPa9LV7K
zH!^iD0%3ix?!BzR`&{s#3PXXYWIbV<bn1EgS(tBwP#%u9<+OvPrq&n))3L~tyxt(}
z?ZT!Nt^!wp7~n5xYW6em$#sEqp}mF`Iobn9O^ad50TUhx?M+1sog;RwJQgHjgD3=b
zFD}cC&6ZZK6KL0!t#rE7^`T7F$6%|OGM#qu>s@ziFGYX`8bBI-eqla2Ohz?QT5noZ
z+j|2n=ULuwtTTnf`1oxYFi|=WEI-_PlXCsJPwu2qOC~teDb0efNal#codhTyiyL>A
z5Q8+6BaYBB7ppIwgf|~$5GN9L3wC=v?_9JdKCrHNwlL<HW+2k{drxF?Ysky8Ed9Ab
zSenf}^_4z5=VU9EI4LK)4*_;^)>aAwUT^HjqD-G#=?)GXgqbc)bt<S;<ZN{wl_BYh
z2Si}2a&h#fNL9^KKAC2UJ*D)gx3mz??PSy_T7Y1_Fd>_YpHd#o5;31*d6%sPVsX{Q
z*mB?w{dsBli|z5fnw<+ml&-Q{H?!(AZ9;{sw-hxMd!OexD-@knruT@?bmE`OGWs`*
z{_sBuB*2k?64QfHPcY5DULDx`5Y#exjxt+I)D+Iel)2@~JEBX(T<|fmzt(7~BFBZf
za!b)9N<2B`p#^{SC4tQ$7eyIISs6oA<gHys-p{fABeJYQV|g_;3Gv%81zaPB%a!wN
zA)tzBYhmI{!dp>pGCQG+$x+HFf62(rOwQ+ycBoNE9YHshYk*K>ni-@P>D#)-N9t#s
zaUWPyb>s`_P2@Xg0>vm*Ka~YIiRtpu7vyF<=R>3i5#xBm7KT%=dX4rO+1~)(t)5*o
zva5lSS1@|**6El$nWBk&zCRgK`kZ}ETl8^f;=GwFN>=H$Nkbf2+})H1Li!cvitIT>
z7Z;c$DOq#^^CG<as_p|<_`r@bZ*OaLY%a+kN@lL{0Uux7f`vzB?G^65%9N#Y+&ZgW
z*8(zS($+LeGu<inX1%<XAkQAj@)2ZzPtYHqxGn2W9RpV}pvSgjGj+!p>hZy2rv_xz
zDyml1j)FjWzzAHvqjCdUd`+=JKtbzc-RI02?QXhOMA{N@+QOgyqE$W&k?xs5?;#Xd
zOHrljVJPw~@Y@K=@S!8T%mgAp$>uN&rtzF`jF<sJ+#uEML~0L+X>;7XiR*-(BL*9&
zryQ0s)m7&V6=3Tfexw+W5BvkW&PU3yAduTA%S~uD!=iKsL+SG2hT+Tu^c_MpC7u+V
zJR=1wn<raG>u0t`FU()7?hYQ?OzYrl9kKFYWT7IsC7Y@2&g?Q9lxgBxK-G@BL9DuM
z<w%;PMV=l%S#8&9H%Wx)ISX6Ov&oUB3`Katd0HAvX#^Cj6yVCz!8x;agn*oSkOnXw
zwRaj|@09sB(p9{Nrd;*T<xvcskI$4`%fIA4w*gO*nD$f9RUTdMv)iuo=UeKqqa=B(
zNUZn3Qf)fQ>I^!67<MXx0z_M>!&LxkrC3TATN%5XIkZ$gV{t@Y%bN-f|9Aei#T~+Q
zt#~sp-ks#kny07qu^cBA?-CSyGhYUhNl9$?Zy7!Xzp{qn8XCju?3KV7L!k2v4u9u-
zKj4Z!HDtg;NcC8;YOmyS4%pW<)yr&iPFYy%RN0oALl=Lt%RlG_v{0%r0FsBb=Kpps
zhpDbf5+~@Mrj4Y`@&_BHT1q^%+`NtTZHWHMDWi9hLgOxHlU|8L+{J#rS6J{@uQa%M
z;TokXPFQms`Kh)~f?51Q&qS+wUAiyZH^+JOTApi1sHRI%6r%d<lm>N*q1_W@pfMY8
znhgB69>?FT)8zmVM37$1ki#3D@6nMpbsvU!c?~K&kC<w9);dq+wv-q!8B@&T+S!Rt
z7nr<|(;p7H$&g0Pq#cs>VIaV+ectpMbjqE|;;l-4h&r@)!71kXyNx4W%XSaYl$h2M
zrlMZco<f{~{Xpg;wYAL$ojbrF4`knt5I(DRR)3Ez`TCPj#XY!>6tUWKT&$R72~7(?
zR{CXADml(Mz4q|8qkV4o6prv}NKXQLe9VT;k&E}7!z#NvRnIS&PehBYWsWrPx}iwR
zJX^$4;YviK3}SP{)27U1d~WrQaFS914#S{}JoHjXc{?8!2ejS;YLTRbMdwJ6A**SU
zH97BC(cU=c`op_-P=(v5N^2e4i82q>RH;{C=2uB=MkJfuUVLnf)4e9b1vbUburuE&
z74P%)F>^aV(6Su(hu;p>i41!q(!1q@EDbzo9vNVqbT{2`=5_GnxOI+J`R&OwPg9~d
zX86oH6k}ty|LwU9(0NyVdbhPIjNE`oSnq9nA+(FEg;56^vonx`_10O4Fmh+I7UH!x
zmsY&DIRp0cTY;deivl6YJ<FVR4Z&StP)r-HI&*Xx@EX<uVtf2rL<vY~o2YKJooAeo
z95HMQ@wJ5@oHjSSkh^AZd0I2%8k9PD!)piT|K7_B0q^(qLLv88-mh<5r)5vd=E9Lb
zx}FE%5daB{>m>gYp<nRT9iZj08!K7#IM1F;io*ECPyFkvIl!>Jxv$dY<2-vpsqF|g
z{CC)<4h)AE)u!YBz%jp3Tiy)QUsEWDd=Oy*#ORKp>S3M8U)BaxM~>Ga_t`wLF&?uM
z<;GD;4}FAP0qEo)DbX=*6S#B<zk%X6r}D$e-2<@qq?rP-{w)yy{x<%TyXXE12@a)b
z5fFr>5J~tR=UIR~k2Ul7AA25~JwL+EY%0`_jg2ktzouTeBOGfSL`Lm(A<18ef=ux8
zo79I3rg9=_hvng1I01p6YFAtlx$WS6WiTP68zo$M=5dkb<7aj*BiggZD?4mDfu61q
z{m0MheE*2H*S9FSwxq#gH*I&3&k^!k#xmHIV|e1vtoKDbT%34(Svu6x3r|iBEc&|O
zYd`nnJ5(sV0oJ|ZLVDscD=f7uG-lNV`-IX&4G(Ow_sWxL!@!4n_ya=TW(uNduhkHt
zoG+$$nf>yf<1JIRh81}{&Nys>qXL~A(2$VkkHn^^Ix|{({xr;dP-WJ7wekjbo-xm$
z-^(sPF$0RI{J3FNNBO)uJKk)#hnpuGS?6Or<Q@ZGiMe06)`^tI8+I{Q-8?;6DHJ$Z
zq7PSYAAks0Ii|&X_?jIdi*0A!=J^LheapR$yra`1VXvR_nB|q+-A`De(#{zUteGg`
zERW0KR+(y)S@L%_3muUhEnQm>9$cR9-HhTqGqv~NvZXZnCOfu-)T4$mIM3KUqQgYY
zMG;NK4|YN|9S`y%%x*Rbi7m(aEy$WaZgpYzxpu2SyfXs#$@JoznvWCh##wQ+gNi~P
zQPz{a9u=fM>`S1T%_ZhK<rSc`K^cGH)gfa<c6h*xmjBcZKS_MjSeNbcnW9UIG#90n
zTR*m5F_OMuv7W@Kxx`QzwG4;vT9OuZ@rfV0Y-aSbTO}7})Uh{%6dqM#YYU2zmrk8<
zEJ%E<J1fv`^Raj;u3O*-HTILT;zzrPr%%g;8l6Dc6_k=}5myi6EI$bc_c@cYkf+H=
zmf+q1r)o!SrH}+E+`$qj)A6Z$)KH&V5QGJl9L)b~pME!g06Scb6~{7WY(eLGR!MSg
zzE?<0)>93Fgn?aulF&BFmv7A=GVG6ZDCFmb;;oEA;ZoCvPRk#xdMev?%c!{_Y<;BZ
zph3lMEIx&Jx%oNYbzSE@n33)MfkOJkLW$N`=|cj{kNJR~?P^7n3&A~w37cT^D5G+_
z2PSqT=-3J!H>29@&-}P+QpQ-HM8Sj8r<rX|e30)IQIz>9%UJ+R6lg?wqu7*wAURky
zX@%dwduGCA4_{cNcEa8ScjSe0&dp}3q6{b5mgg9>Mk+)CTxZ#z#(}NYiXh4csz$MG
zXD5-1U?Q`T_Ce2$g}V)@AKLxc8IiN%1y?(FvbIghD+@L4lh@U)3VZ%#@4vGO0;+(w
zi05bw&pPG3nTYayB4ETC5r_FFCyvAokO$Rzj8B*#scj+$w)pFtm*pNQ3DMnT$RF_6
zN|buoDkThO#2$#IxWSj3%@YI9wJj@mau>*WrBJn+${8w&JFaA)+CcijKV6`pK)Bg)
z&0;cI2@}@iFLg<F+nP5=R{uUAYxMnkpWez9R>)#lp6eLzXUGd_{`0%_{fh&s!U5xY
zn`?xBU{DG(xZ#>}>abUK!8Li0$4IF)Z_jNDQop)pXQ33SCI4j}n9SQag&EFD;ZEPA
z4=hGn!f#;~LydD@X?SBCX}x%$IbXdibyC%*swP2y;#Y+r6uD<~z1n(cc>04tK|E$F
zqRi^_eYvKBmix1>5WB191tyBaaD|oyNX)5cj`|e6Sy#%patq%vL@zx_y~!|F?5RuH
z3(O7QKFqmv5kt$(dxHfF4DWa1E}_`fyu1+H$ibPB+mSGC63P2LtBGzin;r~}NtIYx
zv@fGD6LkD)CwK03wMGKa{ik6EPUJog+V?heN*e9K5aNX@nw1u^H)~GD9)1l=(Gs`^
z6xFHT(t~-D6%r63UcA!igyaMFKzOMGNbqdx+gH{~9KtLl^+jwjqm<s+&UXLRtK;An
z?{qH_)Z`~oIcB~7z*|x>D-i7hU$yo9G5cO_Dfsa0p)e7_Qb4-Sh}_yE=bECs<S4E!
z&ER=Jnyy6*?j*X=$5waRz7Ms^Tc1z5`J$=p?Cr>xe}ri*?7?&mgA*ldZar1pp64qR
zm&$IRB(S7(R>65#&c8CHV$idsxhVx@CdOfJjtVuO|JdVi+!HsVLGE+kgS>$M{p*`_
zj*pZq^v@8T?psjME*5WTJ~>NK>0WK1q_=QMhoYnOl{7}1sa8;TLcG>if*$YKuvK3Q
zZVSWbyOn<<6E#(UK$r7?h-~v}F1aIOZFTn)L2qdlry)?Tt?Z2Xds*6>n{`szac=q6
z4gr7St))8MGK7Y9gucLjCncZbrc)ikzr{isELTc15&9|D^?lB(OP6t~32PNax0mkX
zw-kkS%neJXhR*Z7qE;#ucAU}LAa28WaIUs>X7EMqdchw3erS$+<Dd@K@XG7qEu6GJ
zMYB%%a;-e&_|1YpyUPL;XdyOZrZ!c0tMP0Qi+%V7j{hJtWyL5$bG4>@u%gShD+eh>
zeu)6+7F2w4t5oq4@g)cR_`YWq1GUJa-q$yGHVrQ%IIOaN2)Na3WB<V;rg=TownwR~
z@|D<`(O6$+IhOj8w`mlI>T)27WODnod?C+OwlgnJ62@e+UFF~S=%%g`;ycyre+Pb!
z<y>9&CuVbz&dqnAoC_=K3Hz%-a9iym`^YVRo&Jw1QP9K>!x8iq4N9dirs>V>H}6Jh
zrEV)-X*t(PD0c|{NEsSH+8HPJtuFqoPul5SC#SkzQSJyssniIrf+7lCKhf-_b~y%{
zmJnNQ;Y$8i%J9xB4z5KFtJ|M+@dqQEvTvw9&P#k#_~Dhf&E#B`RV&B%M7p6wbf<ou
z!Nv1MPY(%6YKVcrZSenN@4ere+_Lv!dqaw-pmYTR=>nk_vCxZ!9(t7;ilGIFh=__5
z=@6<ksiB5WDAJp>gwT;r=%Kf~4`;?XXJ)>~dH;aV4_;TUn2`PKz4lsb-|JrYu9xXa
zJ)oL@$JV`JH}5A*jey_qdhHHsuYU%<L+M7*zWswZn5{oO%HRec3pg5ybeY~VU9Pxn
zdGDZcb3A_Fl0n7rHG4GbCTd23rYGiU^yoWY1Uhbb6-D_wfNALs;0ft(v8YtRd{U@K
zAEgOf9vH8tngs+MD-4QPy}D!b$TlEh_Gq<Q$5x4G2HC?%c4oiY`g}kzSZYEQGY8Y!
zXwB18&ra=6c?zG_vQbMo832CC>~4n?Jom$s1^CszAGy9!Tc~55O2aGv5xW1)N3Wd%
zPJ0q>WcvL`FVR(huw+$WJYEI5l!L(?LQb1vanz^_y1mU^VbA0zoSdn)1(t1#+-ZN1
z88?ijFnt{?Q-KSS@(nqNYofAoc@|T2!=KpSozE_;&5jW7?fvM>Ta?4wo$z{*I@YmD
z6n3*MjBcx;^(uj>%5y9!Xg}AH<=3I_|FKX$7w<Ds%*c>stLE~Cn6Z{ilB@ib!62P=
z9|3*|@?z)t2NpoMcaAA8k-Dg=7&{A9s!&_C9WG6yckjLs<5V#kJ1h>ZCq(TCG+^Vo
z33lmZ^?kAr?&>s~!BUQ@pM5AfNlB`w+=apkJCnuF>G9iLd;c~y|8Zb+0RyhmJ~$Br
zd6DEylefxw>t5!8mv1q<T$GlQFL{L)c5<_owLq8sK&rZ^a~v=gg<zfryMZ_nz>`Pu
zT9eBHp`mC=yhLei+Q)Zoi;#Ng8<p%>82a5Yx;zioTz*yVz_Q4e^Wt3Tr0$J2){8H3
zzZnksGhj4l>D2YDpEHpv-Xf!B(4$sbeV@G<jqm$m@$;R9%o&Ar|5Q>fzf`s<ls-er
ztHRc=D?PAe@NjQX9CU6|?5clh&%~FN0W&hPn)g<5vRlvY;av0l2Tt=0oFARM=DRjy
z(YcsD1+Fq`I`4|4oJ(d32gStyCP`frIlmq1Z`VNF?IzM}9gh>YAkY00;m7Wq1VisV
z^UZNa_@U$Exb)FxpRUIV2D1yGElTaXcqAIb0UroM1JZIDYETBiCRUyrIXK?h?sob@
zV`bFX^@Mqp1flqw9p&<H0>FyKK533=U2PB^_k1}|1fU+OnxpOEo^ImaTw;kQfGq|0
z>`4Rt&GTpgQNja26Y*&0)!yF8wW}DK3v9q~%_!j91?ou+sY~~)40amxQorMXa>Z}Y
z?MC+i2gX?-dg5tZxqe7rhQa(NO(>A1@IvbC?e0g$*jQh}nl4=%J$dBfZv%k=@P~q3
zm$u?g`NUr@yKH%&P}^#-eo#ies=TvoHNT`M4f<`<wU0i))F{km&KL!(<{QPl0ck^;
zE&J@{-|R48$Uqi9Lsp;xXyyA<UK6=ASNitZN|P@4Zw&9;B{P7%5={<#WbnLCN;_ZG
zA`fJt&b^GDtii#JUUj*-h$JN|@OOWKAr5eV7ll*Bp1i5`y(#beT-Jy6-Z(Zx=CIY5
z-i!WsT6X!@ffUTeBwFx)=y{#|eEt#eSrq(p@&DpupM3WJ{_Y<c!vD>~KlaPN=Akh1
zA(3TidAYMjZNH#sf0D(yV|O=<Lb6yh?Vk$mpc9|r;6(g5o@gEZg`rnd6qHR%FI0(U
zcpo4WcD?j)umk_Tq{*zkGSgk0-GLFiN5*f(59~b_Bb5r~R|7d*`P@j2Yy+_7k+=CN
zHp;=%r?CrUS3_BUvEGINQg&}mCZ*QRmh+)zzKV)O;@aKM2_MrSLG(LR)+_X@O=pYh
z8Ydr}>MTQoh7;UhI#|EnO-i856N`!4VLFF#Pr2)47oN*3zI95h4+%qKu(uOg4k1)G
z1|3cTw~xMgEc4C}?}?agp2tX_(IC26M{FUIM3ZAeCg<G_=Ho6tY<eFoM8%myg7dIO
z+TcJnD<dr(8Gat9rHb;>)9CI`TG7Jho$=$$vvmsw%;Vz|dBs6b5VQw;GL09nXhv&s
z=F0V<pJp(+<g<>BzZ;hCG<SwL24;E@hvaD)Rg;6ANDYm1D*~=DBK<+*QCR~?GG!uM
zV+f_F4sK}XfX2nY9Lo3r?wSd|#8scVD2JExttz{PMTsLdmo1U3GD760?>65)boNQX
zP98Eza+foV+3`T0ue!OOp}mkO)q$x%kS8|zxb18~<))ksM~53dO0B(F-o(%GHq2A1
z)_5=?3>%Ju`%d+pfKjig{mq1jB`$XiN^{l}(vZ)tv%eAApD^-+-Vs-`Uj%B6H7j_p
zoCq9`c%p&SYDbgBa2{ebPS6JB;pZNPblhL#r;e&|7z7UaYx!=S1zE6tF}!?U(E1>Q
ze`7G6GWnw4l$qqGAp8}Ab=nrY-6v4yN{3s1a~fXB15(_SBlJDk<78TNRmxX%rY5p`
zu|Cj%RytuaYaDq&ROA%8k(rTiP%P@E*vgH+B=>J0-Uyp822#08qmR^pjAzgJ{V0B}
zQ^)OIW$Q{Hf~u7L$K`HARR&Y6=Z{<2hZBcFSN$7ycQjmPZb^51JCMOpiR)H=TRI!+
z8`a%##N)X9S#7yXJpYAJ<*Z!qNEd;x`rYGIl?FSnePagy4Sutq7dYtYeuUNn0iY8Z
z9|ICdaJTn^8XG4Fl5!{<?2CHler}_EhfK`i>8=m!_*o9cswg#-f*W)AAQtp=@Olrb
zH<XCdRtbZ$Q3!L_eAqZSUmsQx-{SeE*FUPLVA){Cpk2T7_&DI=?OZ;jrgm^Irt9oz
zj>52;d&xk0A^N_3^A|!2?`eoi31bV*Sn)7PGcsQ@SHlq3+P5Ta?gQu4j2#)bkl`+e
z)gKNi9Frwlh$m<iar1C)4_o~uNPPy<;OI-_PbS#)#uB=v+~ZxcU{HG1)t&pxLnr`5
zq>(BES1O*T807E)&Vj9u-y3M(Nqz)14B}}f2T?KP**o$n&I#(NF<do-)SW3^U(aNa
zkuy7wvh`;9!cH(MWQpqbSBvO5Lm1nX?gE6?h%#Eikl5-fMNA{U&m<pQVbO(YcSB{(
z;vcyr^y}aSWE4}9Gar;*NUZm_dK<M8kRM`biO)kc3y=3Q2qy}gX4Exi<JfZK$UmAA
zghW^7`AOxguke<JxNa(}n`i2w@;jli#a&{B+TOx?X-F>~LQFv@ni%>Z{{4;dxN1%_
zIcq6oY@VEzQmz7Yw&Af<Ish{08b)?D`i~Hy``Z+lHR!&yWa*ynfNXBx!Tf8^PWMx7
zb#)SD*44406Oju?+@!1>qbYqhmQ<fZJt;U7&uvNRWALR#e@WB+Q5!>nlh#^G^)!8#
z7z<-AUS9B>sfR@jkM@OPa9=Ii{8duGH$<-RvaT*}kJ&m@W^GPdvqtB-9-fkp82S0F
zBcLK>9Vb70(}Vg9$uOPZplX&aZA9fOLJE@ET@qSh%a*E>wfSU`fNh~N?!@|ag;@%0
zcWW%DSjZ?|G~SO(by7;~K;0gtM!64liH>=Wu^6*Y_6gRr?}cw2w4LfqanN<|a9Lc^
z%f=YUrAvCpoJ-c@xe&~4MCXSsvb|C85H(B4>hTCiHO3Y@_c;rY8pH)a%!G35Y)Qv!
z(3wp>a4cjF*=~K+Y~hY?fN)st#)h5HTpercO0XY#2Z5Z#7h}u+VrRv?K;_2k<vq$*
zT1*?QAugQHXndBbL}F#Xj(A>Dq2v%;(b)Jg?KNxMv@W#T(^uw<5TER7vUJvew!wNn
z6u-E<#9R+W8V_&SI>}>rE3aEPG7B5t^<h`o{+Nz;u?T2He0q~s_c}P<H)?WbQ&gdG
z+YVQo9zTY1JgOUBq@?Lam~DH-SX8)gPbZXS4_gm$+v;tJg$h+TdsMJoG9Ssctu^He
z$z89q&Syy50*9d-JVsxJQN4wr1zXOzsx4O&t#c=F4_;MimWaIx>v*YjmKduUeOYj^
zMn5#yjlq`kE_`(ysnjPWp77_H&Zp|6sQ0#(>{3ft{#oDDkBIBhUi&po+axxqy9Xb0
zo~;`>cV;nkEx3wEkzZVP+%ns~;1tiT{vx&mB{5q1W!ad4dfa7ad&25)5<Uer-h2E(
z^wDgxETx-+7^$0r6a-x3g{VzmPIwZ70VN2>IH%y;UDD@*E0fLf@?eg@IgL@k!zO_;
zbB#SHW?m<}bJ>uWxD;p+pZ}iic@?r@SKu0gh!7SRnaWLzG*7S=3NK0#7{1G({^YbJ
zQIq|<!)RFhr)rnKiZ_b_>3aJ2v)AOe6Gn$gU?k&q_PN(MrE^#LiW8y23SbYZqut%t
zZXU@cOILxKj&^?RpoYbpZw^7>^qht8P{!=)XF6N;%GK@bZcI@vs;(*56VP<4FTI?%
zc{YWIqB<J<*F@D<D6Yk{!~7e$-_1JLbj5y&8Q&vGf%Ajstn~$ArVu&71vY{h<odIb
zncaT+!vV~Py2jVRn|mVM+E1EX#=g46`v*cOZNgu=dUKVN_s42|F^(R7x)Mk#tuNJW
z&_fD!d9ITq?hMxvGth9hqTnH8GuMa|U@V$<Yi_zHbm76_yfz5t)wkr4=cE9aCSMY9
z+pA(Bc}jpL6JA$!Wsn;wO3Np>e|s=wl0gtu?&cWnwOj+~bT%9IY-{QZ7mZtDR!f@A
z1Mw2VPgLgMw($Xh9@SGEv);N6DO>3aRSWO-iZc<8Rt2Rve2T{r*a@CM1ujL$xR=6(
zRPdoyV}@>l2FJ0<>rk(5{4>X(0Uf!;964x^l^C)&Ev?BzFm^n#{<SN+O|Kgl11478
z(mU6s10$|dG4MLqYFpRi2;`Z0JhZboeN(Lyy`_mbzgM(~)W|)u!>Kk*rJ13gdTyr{
zRi&pP=N2nFI6hXpD4n@ziCiw)8CpaTbF{H`lTTkQzyeBiTvx<$;XVBZ(o|O?iSbd~
zMN3}qhqf@QpO}C7IvW6c)CuTrB{wwMZ(dwCgA98HL+Wwf8%bFkcQhVn&P7dTQ3N=R
z@M)VCbm1784=h`m6GD+=>+^S9m!)Y08b7xMhmVS@dP{LS99}qfL~0XHY6(>t>#syS
z$smSC35y=MjIrU&Qq}GE3y5b0<#A8i-yNAHSdQNk@$iyz*Vdi7ZjZC2fF{&8S4esh
zxQA*t-x+*Z)*ml6?8{np@{A1L*t|2j0je}`XmP8)f3E`xhpmf2fNBS{#9*S<E#3ef
z=akY)Q!y>|Yy?r=1dZq@#rgIFl{oRLuC#IcjfD;6?N2KKX<&ZkIsD-r`@GyR8%J;Q
ztez-wk<=yc+p;?o3wk<2np6G*8as;`$T^O;b&ZHto3Hk6Fx_LL<b{fm(cUDj$T73+
zXQq^?{q78`j-M2ScGP<8-kxM<20Q9fmogVUHx7E&mDCqMD}k|lSp@h>)slC3>qb5o
z-zyii*d^Y?xw(34yh@R~09+*E0$=<x_VTtK-Spm(Xt_XS#=z~w;?3hKUAT>Mx!>cV
zio8{8dJeCrhR*bvQv&EFQ-Xuuqayc`veE8dcVm@U(w@iqVT&DgqK{bD3Rup5-xd#q
z^>yjK+&VFyDqBxXwN_~#QMM?fM;AH=2MevXc@7s&BPZJIt_k4Y+28GHQNgZx0@u5h
zGg>$%;?Bw<(NSn`hf%60%`%cU$13I7SgV1VA8tqTsKV-m>eE%zk3T5XwjmZ^nWNbb
z@dx5Lj@26U>#%?3Zx5A#1FP;^^^V6k<QZQ@9u~x|+VAIQ&lrU-(N6U(YI-~@tN#HM
zb2P}y3LCwZ84`GauEj$~c(0mdI|G@TA}zhvzDsX)Q1g|~s#Y(V_NES(SwyloWO^#L
zETq2N<m5Oy3qPKKRU~fnDOkmM8~RyY)uDOAhv)_|M5^Lr&3)w==FzHBYva3|q>ozl
zLPoQ#hG&V@^mASYySkZ%eUvLsp4M+~9K_Qjv?6dhHB~T>M-e}`YoOg^W`XvV^U9&;
zt@j1cjrYBUOtsS=P;K|;6c{gbtXdVgKj3=u5L0Uq4N)K>r@#ySm)B?pGzBPZ9BWu(
zzS|QBo>F5er-CC_dq8Gi{XM;%MPhjaj!VPTmlp0%2{RtBg%v1{nb9G+r&gCrDs6{r
zO7iA<y8_QvH{lJf4Zbv01J<R(_E_Q5@!r13C?z|A0?(Ro&2-J2#v9Dr&{bG)v|%sd
z4IpcrfhTsQOOS?1b0|rMwQlgmM%+71<BJT_6S&CRU_#eMgI8&A53|3|XIP<miK4r!
z@)P%7TM;Pt$9PJ63p5_>&vjv|1gbwiAa(;CNt4GM5nw0uYEg&%=!aK>d&HBxj<+Li
zn3Q#Hn~f*0P}LzID^K_<2eq+nP^J@E7x_FI;XT33aHHhNW~YqTE*AtfP(oI}mus>d
zg+akb5I*RvKSn=$WdqV4Ar>lW)jFhCx>Uhaupy;#W>&6lBfzHbC*FVe;zhmEhWuUO
zwJS(>h9PK$*;rncHw%(vu7DkKcU6OB1)07RJ-zjF<|pk_PAqtb=JhY}A|raAX_e(k
z;!YnCvUx-VP`Utb;trg+!*_IyMIVFqyNH!bRTa|2apKYVB=C<I;f>|aSe|-8Yv{`E
zFhI}hTwb?R$LAhqvjGJuGaS!$Et4UybRuDT8zSXkTcwSOSI0N4AR9(sA82np%lt8C
zC0Q`e-R}sKQf6@Ei8I8!cZc8Q`Qj9s!PQ^_G4WPu%4sSfY0+7!ydB(hcK%)E^=N%(
zoDDj4za!4xQ{MvVf9MG~hkMS@XgyJdrMlgU4m~*n-d*Ql4y#=}8nd4=z^m6@0LuSv
z6X@NkXv;6vx~QjDWRpWqg4g#9lr}_>@zM^bGVg&(Uw^PHP3Z8l!PS)?Je~ZZd#nHy
zmG1W!bb+1=p#o>Y79A-&Q8z%&%kS<HO7pNEY^9J_u>HOG``+};$fSL&T?Nng3`Nvx
zm{3$l=8{Ap!;AKeEclmg<vg^kjdcq24ve%3(@Hs)HWeM?YL0z1P@xMQRbhQ9KGnM<
zrp6o_=@rpQbO%piahp3AFNR^i_1L&b$z5?aiQi&fe%9bFpeuP7nK6Yl4={-^6&5pZ
zh1OWWvztuyyy6c!L-7?D342F+8c;<V)U1`IJ4k<KsNcar18rZ#I*^E%k{Rg)W&UI^
z+yNQq+UzF8>uTH3pd*7u9$T(nj;JyC%yp#%Q`QK3Ixwy~voq*nV>e(^+zWQ=EXnc+
z%qnx`hM#`m9-P@UK6-D4%Zr%lpxRWtv85X*G&7!^ec(Ez2tSZ6#Jj{}CCC@V0y__M
z@rR*Xrme7>N`~2a;MKyC+SNbs&Duy3t^m%m_VE&W#Iw>WZN@&g0D#zMx~X3pS2%SH
zsP$V$d#j;0h<UVt+*O;{bBQjmvNO1F|1g8}L~s2|Vrq9W1fBD3z4gc|1EOAud*Pd9
z;fSI|wT)&x!n=)s<MQnEb=FnFZA$x^Coe~u+q=9sxDQ%a4tqdB0bW-;l$uNj9A6tK
zosr{Z#mQRRLi%1r1T?ZFK8l%p#O-;-+}oBdPPMO;1s6J|Qh3;pBQvg<dFt-5XRhDw
zO$m6jx}2n~eGupDSTmbl>vIwPLJj#*HId-`aI>#1UO(9746)pHnr4+HO~)ED>dO19
z2S9%B-CLbwsbkQ4p!C$`vze_yNALMY0j+n+RPTKW*n7hpf)0#d%=st7ZAV{ZROZsZ
z6hrdko7~Ps<~_i1+e*Rdb3}Nj@apm2K`2BPLMV5#;)nZ&ZST7lG3jV~_Yg3nCG-iu
zYe$!YREl8?b&c$5R1QgdDU~%JWLTFsvV&Oe>{(f9MHOQS84p^mEU*=b!I$LE^i=%e
z$%Gypse1`=;$8{b*mn<z#%~IUrU~MQ3hh2%mLW6!+2U|(11znfKZkhuRTW=oYHFFE
z8j&^eH5|QkoEX{TV8E>(+`EyZaQ{&!wrNU+tC9_J6kGgSQ4KW{o7NmKigx{;x$Tx$
ziMb(z)oCC}<F3@Q#2oyj;)6D4S`f3N>UXb!uvwM6!%hP{w$oLyJbo2@%IxjO-@q+T
z)*p0S-^9d|?^M-{Zb64JHVOJ@Rg&wuE1o)q-e%)b`YlwW<g4iiiZ@4ezqv9~=REqA
zaGkJ$EzbIUs68}Z*^C-p6WW-aJya=bb-ZUasU@d+Ebk6aU=iu^zGu~Js4sYlGUnL0
zYUz&gEIC3)Bk}R%o~D9ag%+-VvOp+UEeEQ{a>@eMWV-d`wFT`NxydaSqpam5q;78Z
zR*2_|7qfNqOEQkEX=^|^wgaKpHzcqyQwe!IKnOQM92m#mkrEVzk9v2~6#m?uMlmSd
zwWUT?wGd$uqo%W(@qDl@{Ri`-)He_Af*h3=V<9SG*=4y-S*(s0?U`Gp?n)@lS2y1A
zmy=f~jCKF4GxJqrtarN}anDDaw7Pd9b)n*#SG2(lW@9y~D|-oLG)jHXM?}F_Os$?v
zj~QK}cs+4Y41|X`@uGPQ0tn$ftuAsf{|K<2`H@ZTaE#ClBSq(&oKz!>wdFo_hpvq(
z=+@NCRH+$fFzZzBPmkwf#HgU7O@mN-^Zv_fa=edBePj$-u{LJyDJ59M%~iHm4d<A#
z$M(+1_`c=x$S!OL9S1JKvgW*!H|^KWSWhunZq4yNO-zW&Y<F)#d=-PC3*5$(-r9@)
zW7SUuR3pMJELzHp3rA(Y-tnGb-Rcn@X`@1O=N)<2Xm{IL`J$9(PHJQOAgdAo=chCZ
zpN{@?wcs4@!7zS7m%BD*Du`qCZNBb|X<*kH>m$+c6UVTj&KrzxtjdX`1_sk)x#gO6
zhmiIGSbmIvO~o{awA-G<YYrMgqB!^Uq+v6u&u!?8ty~51;WB%$M`zIi*2?}xi69w{
zoLSZI<+fTnI8N>iJvhr%0GspTmtCFIqb<((ysc$YF0D!=W>E)`K*a7r9(79X70Wce
zLWLHsE#4*GpBJ;cwc2jrdDd><Uj_9U5dyEdiM+FY%H%l2)?0OSYNNy!=hkoR($RFz
zBJr@zjK-?Eup`5hN=gR(GXq{o{xSvPq#_>Tem$B0(p}5~E~6wY37N(8X=#sp(?)kB
z{<B)&>D5H89QUorW#4Bp63Ln1?a48*WAhpHa<j3V1dGex5d9_v^P5uq)t0F`d0G6)
zW?cpqiC(M}c&3dcSC@EYMsNRTE%nb#LXOm7)d#vaXJ_GP37FjM9mUB=+z1=@*WJts
zH^yL|zKL+F$QTwr7a|L#da0Xz5j2^LiHY``*45sH&nfq=#E7TINY)pMYQRKna!Ab0
zN3kAXirJ)yb6tL?k{7DYZd@Gz0L36Xg0mS_^fi)LYvXDwA&AqO!V%W*P5A4Y$ct*+
z)zWN5o;33~FPN@p(!e8llxjmd!SaRnD83?RB?6oL$;LVYYGyFK3yHy1SGiEMmA$hd
zWO+&|3ix=&${Ib%J8kn~k7aNGWVKMta6XA;r@8RWx0`vBFh||w_!;CKOqpd~{`>A`
z%RmqCGJKhuy5}rDPlNVo*r}RFPy$9#qx^O#GF}^d4=kIDrZ#~a=JGKzG(v~lY!dt(
z<9Rv;Zq6!s9(8!;^SXEA2U-=PS!b3F8qd%RACww4kl-f&iQo7Dx0T<xZd!Rh())!J
z!q2p_vcMi+c)uaTyitH79NVuZC0Zs7b1SnCh*O(LILA+3sMI%y#1+f1QgR<OX>89`
zPia5Y+O{m1$V)X=LWM-b3xz0)HB!_F+aQ=}MufM@u<OOCmkM7<Byj4r6Io+>+oc++
zX-Z;8p-gXWWn=av^2k_kMI}nLbY4gntS0Yfw5Bc$Gn4KtnGOr!bT=Q<<FPk?DQE8*
zWVPkNv+T0*amL*`d@Y@W4>eiA2YW+X7=xQ7XE*V2S>N1@;d<VkpzclM5|&ccTNNny
zD$Pl8mbf&j!GjnVtTkJdDAI4a!B0-fL*l6itF{t>e4P?@j}|rDi8Q+@;UPIpR<yQn
zLN%}B4L7JnE3r<D>R}O8XH3k6_2hc*_Hs}1!`oAb(<7yJdGV?Z?iwhDG~o6r|8z|1
zjmkQkZhif*UW0UJp2%|KUFPn*oKbKoMo^~#tX+@FB0{lQq{nvUJXW4ZIXqA+3N!sE
z9S|udy;ZaieN(S=#<ZjrE1@A^mYvt9Yzns1nr-+XTs<ao*0@zuHWvf-TiyA!U^jtM
zWzMC!Vt=k@t9`dzIYYdPTy&j7(@t0|o$@=+3}eqTk?!h1&;h#3+RI6Hbio52KXZi6
z@xvA)Q@agIBXMl=4c4dcwBwP-#qjF>S^T!s%Q=X*XJm<lK7PZ8ZO{J#xU%2QTHa|U
zNcy9<IBY`fc#8#(H6B1gE+!Ah+fzkJ{O}SUe_Cx%Xx}b^z(^u0mK{evow*6t<cb`!
z)&J1-MThBO>sdcrRJ_#?LZj$Ou6&_$MrRWr;xun1cXz5>QErmS!eW&4gbw6nXGQMu
zO7Pw9{1$mRyuG?cJND?_%XN>V(em5H-oA(&W~-0|Tct8VS}dQQ@OT5Cm2=U_+@H7U
z-JeS2HO6C8w=1h&d~}^Ceo-mp_M#f(=}TG`^%dAH!w042#<ch}_;)Xr`e3~005tO@
zhMs|N3JFHK3yH%wu-zM6P=sAT?=N482M9DeT0i#4pD{&lNZ|qmwihz$yJNk@s!osh
z%+#~t<SfTVKBr7Yd2cmT7L7dLQx=Gl)9@RaS}lDovGRPnM@tgMoS}83aG0*$nqilb
zsTOu*7ixET){r24wu$`V*TfH>bFY`<@$*~m8|6KloX5{rX9!vPIaBev(1S0ieUQxn
zYqKTJjn#C=x&mX4DH~u=2gQq2x_EA|u56i+jjPU?dZ>w#9KhO(QY5^*B+=AcK@A3d
zM_ylt3H>9HY*s%N37(DWttE2MXFHvQp?i6rMtH2Vl~SZF`3>=m)(VOk=AwshdbwT1
zCR>XX8pD|0?y;Q{zNTKbL6HkJsU*Oq-WOeE>hs56R1>&uHcMV^kw|&GX?(a}go%{P
zMhX+SOz`8YbHmi{o<-iaVt5@=E!}NM-9Nl-A9x(u5mZ^3hmB3(jMIbA>s;cexAQ5S
z9S3vg$YD~~9i%HjR(?7)N~*(En0}oGExH7p6&Op5wHZi1M(JS%Itm#F1~=Tdb&r_T
zkGb{w(w-kM!#S7Q_Fd2f)Df^hrd-fR+z|cBWkuAT4zJL)*(Hq+_mXW($2h#uzbIKb
ztN`;1By1`9%BQ2@vyL<tezuCVFr_`4MecC}vgK^yAnihtusSUjdat3>RYGXo74-f5
zEP127l&4~7O6kr3+*RoEisD-pgSj)su~jjs9EC68^+mQ6B@BxZH)<BQneDc0Fgcxp
z-TW9^*}(e2PSrRFTfs_BYmMmM<jXCtxKc>LEUHbXT-vXAF6LtXJwF~#{t}>;Vg^h2
z1N+TrFMXzCoPZ416}M{S$~QJ2fr%7s;mdQ#Rf-}&I@E>E(@KR+-KB$~+J$y~hj%n8
z($s{??$fF}lADIA<A$JPi-)`xr(z5^-RClwHxtA==}@*3UwZ?w2v$P6UxB^{T#9@z
z>U;!9XazEGRNd52)h27#cN&EGVjE&b^X^5#dBy56P>k04*1Rc1FATJ>z*1HrQOhaK
zIs=f<w8IuV^Xs2i7P^e%Y(Cti7xo&$Y@ug$OES^i*sTO}btNh9bw_uq#=VL)E{V)T
zWm%P|=Lh&v;ki{mbN=dbdqn3OlmS6~paP0rNUh^WWyAS#S6pv+ihGflnZa7A@VQ@i
ze&Iv4SpYty8R0zUOV#52(_*LxQFOGS=AE(dm9tdvl`j|SsT#ov2B9i7oKIZh9<Ru7
zznPm*P(9USEqoL6&}h3Ai6Bpwz4|aWv<R$CABQIQ`@D)1?sLLE%e`W8ac2BgqBLKw
z=OuK`S6eEdBG=ZG;aJ1mEgOSz)~1XsVFGtVWR*|MWw&n}$c-Hw_j!)9U-`)!3Fm<r
zW$qir$VU`3ul84vi;7wH3N;FE7?dkk%<8a*hS;wPkoRVODgU}IflRbZQ~zcXf1iY3
z*I8au-0LjXx%dvJEv(N>Kl-9Qi_ddv!e@c*NXht?R7v96!pmKLg$q~_Z4=PmCz7Q`
zu8=aZH%_e{JsXFKh5@*V_?C<>8K@K+W13s)Q!m@^aj0N`Rkgq|buc>lJ(CLFxKEq|
z09Og?-tkwAD~lCl-$x8JEdrrt3`}um8MgO;dPfo~fdj>$QW}!aDoM`ECcZt|@3CBd
zm{3Jx)2kTOdJ>s{{ReK)qKV&A01py9YzE!~`!7sD$EqP<A>&)5eWrN#1lToT$b)B!
zO#OV_JLOu!qjX{HvZ8>|GO!Ix>?fgO)=o;xZ8dBlZwNbq!6CGIQ{x!261kXb^5@!$
z0c(rtab9V-*&=aEZ{BRbb+x+srz?-$Pg&z21Ajs*t#`>{>!C5fxOeeUeHEiC?oijR
zi?O(Ks^EoxTrsM4DKL3D>`tri(pC*XXm{XUvP3~YLgt)q7^v~q3?feX$!<10ZEe`|
z6COGMii$mF`)J4~qg(_Dr?_$3b7k9+_m_daTBX^XF*fg#pi14e>0^Buw|6$z!<<K&
zgD`8|=y^-8>dGE{@2okn<WCd#se4}6WGkg+M$gr;Tjg6U8-;h!R!$O{*X%t{vqaVY
zbkSZ%fe>>?VMj4ueGifD6w@l~ogQIF#m9@$+zI6?TY5G2owP9u)bXA#kS>uQSn-c$
zYlwRdX0*|5Ag7wnW)-KdU77X8I!bOb#TV*etb02_T7Z>tteSQ_;A>2II;xc|Kw9OD
zZ>0H}wR5$O5F`}8nyN{m=YnYa1Y5RUxwjLFJ1RF}D8Y;u9$+i5(8{9nisDGjmkyVY
zP)1eFQah*bvG|_dJdLf2&e(9q;5OI>PmV$fo6dGEy-sBqOalzZ_nQoTr!mO>S?Ie`
zMuZOOI_C~`j7LIgM5I`cjQZxi3P;8hady6K$3paaRSL&WcDu2;>FwVJrzNY*;Z)s)
zYN^@#k1S-dcCRlKZ^vdFAL>eM93%U7Jt4{Z<+<-I#U(6JR=oB-eUGZM$@~a^fG9xe
z3<RVu{qLLxO|Q#;?Sgb$X1*`Y-f3n0zKSU3Cak3tGq(z{%moS`l|PQOV+a;Ed!`|q
z6kSs(+AVU*90EB`5_^rTci5(e7kuwpIM87lWLJ72c)hoHWNIxr=Q&PzXk3}05aV&l
zu&2EPabp2t4-nUSCVV%;gm6hd7$CG70Fblo6Y4_SrMUx1hOntI8If0%En2OT<2>96
zARC71*FTmc$6gi==jFca+L-kQ7;CMb!Cg3(d?R=Tw}x;Pcj{S=_!b4ewy!ePe^`ca
z^$$d2@-(V}BO8U0P}>i$x+6teECEpHm3WrjRAOqo=gU%YKVFoY*_JMlRjh0s-qRnZ
ztei(|TP5zWE_@BU?R8vZ!kKm+2N(+L^1jOG!?YzT8sRWI%wnn=1ck}*cx{7q&nCd_
zUHb5W9Y15FXPdXWSZx}M*pyH`Cl(?Fky4wrv9hS2Ryk_G#i=mx>+7=y>qdF0%o$L=
z5vr6%b6Y5Y*-fgCc}CC%=7m%i4BI&{eWVyfOA-kjQP#|z=y}^simXYndcnQcoQ9=3
zVY4YOcm8k}pPcR4Fe}rKkL-?eUxsA@6$FdMd;X(PVm25I7)}3p<N)c_JJ$toc|fR$
z+sY^#cj+T0IWzI@O-S#8zs%R$3QBn7LTHty3UM0`G?bh5DzoFzH+y$ZUx9O$*)uce
zkJ%)Mz06vShE=OZb?j^nMN~o7tdDngHSGDjd@DYIH*>Tg5vcKBjb|8uI8<1ZOv#Y-
zu%dYZbs@!!n1q~6^xC~9UUfolNbF~ymm<f_u9vAr$?3TQ-AL1ukV0rfXexWk#g+nP
zS=_1cO`pYO2P=xUXpaXZPg=~WX|Q3JZFM$gaSOxiDR@NBV@&Gtkk$D}^8KC}KE2L_
zPizqN)Vho1$K8eKj!)Lvh6L0AeIh1(t-d09b;nJ)w`66x2xF~$rR{v{%|eSnyoxVV
zo}sk<3rFxw|2+70m&F+p`)r2ZS-iF_Y`KHoPgzSNk;^bgIDW3QXw#^`U23`SJKDuT
z1(l#TVd?GJ#~$^1b)}seG_kr7;*vMlgV^3HagKb%tuGLUC5yK>vM%K5D549*i@53P
z;|_g}Q}rXrKOsus)hWZ3UBhuif}Naf+vE(P%y|rT@Kts~TM4g{>wZ0#Gp3=4sdAHn
zFXv{6Q0IHW8tIJn3!r_miez33IyysX5C%Ja402b<*KTqYiYtl7dsK^#94?_SUtWp!
zU|sIXy#A7ojnxVxY~a6utepSI6=Dr9PYJk~F4ts~q&I>*2i9*Vx~d%+_Ra%QMWUs0
z8ORw3%D#xaIXGh0K&jjJStvS!rsiAD9A$m`PT18TKXl(LoRjN-?-L$nb|Gg!)^hZ6
zNg8&c0xu`zYc2Rn?7%?o4lRB=7o2;w=%0PYJ{JKU$eFsUX+gG6m`J^Ev65#*T}Wkt
zMP@V?mqFa)Ys^x{vV+wayjkqxq~j729@xXC)IMrymBlcl+$4nhjMI3iqv0ksJFJAu
zKUr<9E`)FH(+jyL#U3Z4J@w_!lJ`1A)g(uHQJ`%Dd|8iT=nyr=LO=_LN-On)E1%h`
zaM%}Ui-;0FDbj<4nx5PG$UY+<m0V~T)QaK87rRZjz}&4SYw%2X%)P{UunVse;}4-q
zGX9%0XU<RQ=x>m=o8xuw7#RtU^}vS9@^pcN6&-D$(xEO*1iX3YIBWI}`FGh<r-+*h
zPh`});ONCI3GZr(#BSyR#~%hMAc5gUfaz;8@wk)Q#cB8&hK%VOdF9v_ZiBhpPGZH*
z*Ym?!%XUKs5XD&lUw4*z)+ahVv9(e!6b*Vit*dQF?JJ*=+ikh2vsGaL84{9)_2K0S
zRE^!*UXoeW%TXXJS;K>bs_Qnri_Q+&*cF}9l~=jAewv#7HRZ0Vlw+*DC4jE4l)S7Q
zi@j*!d%tr1s!0l3C1o`ev<uGs5f{soGVwL__$R_x;bYj&2FDnM^Qgrd0Li~}w$Pw+
zQNvozcp4__D>Sv@F8W2<!eYBU3!|%@{5*zlUrPJcUc~{Bu7%h9iR+0(kl5M@>AL5-
z_wn9bPd9vTCJJb5KU{AH8rwJf)FN(ji%)b*6R(cLiCznLPCDLoXOJEnz~zjki<w;~
zv|FD_3i+2S!BWdrLm7nCuOEXe$fgM2{0-+WKRKU6!rH`f##Ic`Yd64uJD0{=5f-r`
zI+t*6<+Z`+OGXW)H?=Dy+Sxx%wP!=^?}@hkoRfSznt15(i$>2*y?d~VE`2*!V{)rz
zZx->02tQaZT>~z-3-Ue&hLtlzXl8_e?jiy=@5&N^!5LB?9|7NxYwtd}b*d1<C-TQV
zf-4$Km5kdNb=5*oXRe)|GS#JE3Zc&DiN2nFX=J8q0ZnU{ttpOg<T!HdayfZtD2T!4
z{OL25>_)ktf@z}k<2r|we>DcKwVZT66rRTF10`4qE+195;|-(!G(?eWGBICl=ah%3
zCqpgM;u)Vv;PJVAr9ywMSdX#bo{gm@epRi}9TQspa<xAQO30fX2r78RbNURJ75EkM
zOHtg2Z?TVm{mR3nlV<VMlQs;Wc&hoh8Wk5;RkX(>(D#{3t29*vef(AC+=_l}g~RIO
z{4mn8Fn59W_mn`}5kUJ+4VM+Z2D}4w`UC+I?GK;S>fTJG($nMllT(B`X-sel4#u3&
zBp;^LJ};vqYv9|fk;sx5JnhP3<hc^3=XVZeP+O6|^|&~KbY!jSr1fD+K`0ym-)?|K
zFADX1Bkj&s5!8tRX5rCk8x7AN<r4J)GEu*d`sZBaf!`n_jZFVVO8p~E0SeYuYpr7j
zgG%U~?)uJegZ5>VxFO1XlV3^9pMzw`1~}i%VjKJaE-xnF<4YK3X&5pOG3xwdg8qZ9
zo`0g3v~?Kw@87Cq{~=0>4O>3y<vz|+6R#X3vHPb~L;4xHs1!Sxe*=C3We-@!FXJmS
z1c2QgJo0}l_XCu4K&N5D==}@1|9*=9dS?f?{CvjyXy7+(5x<7u#s_5h3?0uF|9^-e
zOn3v?-v|=@za)B2ER0+hSQ_8kiuAv2RQQK2jv#^QJlN9u-!~CFoTvk&CEWQQXZ~;P
z%u_xGK<|MQ`q=sxuJGr?|7!()y^y#CtOU6QJM_0L>i;kUhm-pjR<MTuTa5qIpJDDd
zzy0gKR!**=Kibd!-xmWgtr?woi0I`0Ykwix{+Aj2!_I4u07R_Z5MFYUfYo9yZ#JCl
z4e+ki<)d7ij0=BZG5@lOUy}kf+yk>REX*2Q`t&Gl#CQDAccKx_XmFJQIY71J3G~9;
zZf<yHQwA{2`KV7B#YK_3bRck4hD^Bh0RzI~xw`LfEqg&lUFG6G(||qv>pB1Hh4>u+
z?_qndz-)R3XgQmD<A2@#3JU&y<Xw>#waomF?ci{#l>~tBPAVcwR{g3EHYuXRcAjl{
ztjzkse{9S@pTI~9u+^o-7ONe-Bv-Cm=G3zd0Nq%Fle>-QwJfcxz7buOBO3SUf}yn9
zt;$Jjk*f{8tL+ZzXA&&Fizdh>y+%5j>-nurR|z_(@wMf3>n{Jj5iPw3%y;w_TW$`e
z{M+X&vYC%6h~og8HLLV#_mQv$2}4}%PYkGNBG7JruCDKgPBwkm!^n2evNpgaTKGO6
zJHMBLdFujj@BeO!9+Cpf01BaV3O?hfwoBeHu*rN}Zm~5sxIe=nmt`@4n$NsE!v~zr
z3|MjMZ35}<SfbkS1YZT6>b2)AiYi+Ezggp)lP*gQ(YaAXZI3x{Eb5HnD=XE^EJHm6
zWCFy=8*H3K*CwxAtr^J~E$>>eT0lwm)r)r<zPDm;n?q{0mh{~GbI$)2S$@69R|l?x
zx?C7`Mh@9+Nv=6Zze^`!IvO~+M4vc#*G%}mBIoL(30xScbhbP|Hp}-<YUY2<#Y0J8
z3bx|tN}SL5IyjaAT}*}JKuc5T)g*Z6-k!0iQes`B@yg+zsDIyEnldiV)l~k+^3ri!
zo9082?ui_TUg`VG-D6{+wILea2+%yxo;SDi65zTos%p7dy{?_OODAhbnbIa^l6O1c
zL<oR-wl9?%&;i)Y^IOl&&~WU}TK?wnxigvdVFAGsYnQsx0g^<o1U*LnI51<dm{aW(
zYRsFNwW$Ysd`H@n?*Gn<)M^5>JY3e~kLXU4&y2c^)QR%lSqV~RW73@CLQ}K0aJv5I
zQ*~Q{^2R#uGq)e5p9U59&s&9^5chh6LXBddXQY#_M?uBhpAa7~UM*U5FOc!{zMXfa
zfW0~Sg5g4V^m+JF;=L>P3;~EuB=<%4KLi1m%A&e68mHQ52J3fGPCd3+^kGh>&JaN%
zjTlE(8P)<q7<a<<4$V1}lKC5zk#aWmh4}o4eJxJ2wS|Uh8c~4a=Bmm0UFYvi^knI*
z0Y3v6V*WDaJUZYUBVE;1jc#q}Dh`r)`2%6^S2bKlsYxMH%Di5?5<C#A!{!&5%{zzQ
z+LYu1(&Aq1j5cyK%7uz&H6<YmaFgNtTVvmgdWt27dy_%{#ec>yrtld@aVrWHF{$?1
zm%RaI-r?9`;8D(${6ixEeWDRi`3%qqVA5>7Rcs>2lX{{NuxssStFR!U(=n!gO%L-;
z%@=qaL3O;2+g-A>FA2W?$|U~FC!LEu5%Ra6{S2d$7tr|r_8ggk6nT4M!Pq;*1`As&
z88342yw~)B;l^6I;U0yzs2MSJ_f0hnbhTk}T0GGt^+ym3#jMJMt@gUT<*LumbxMKe
zkKss-Zcco+%5JFr$9_@LRccN}%8H!b3Gd`A`?A<rWg-m5KvfYA9OLHGs6CYUXO**8
z=&>Yk=5M~}{H&x6_Z%*#_?MD^t!0*W<<P=<R$BiOK;l=B2gf62b_>lU6_J5Qu{u$a
z1CjbzvMxja6fqU&-(3yh0|H`6j?Y}bIK>CED<3Sg=HHiQfTS1U4h;51J|x(TWP!3v
zNRv#tjb^I1LQNO^{1+75zuXF$Zjt}-eT`$!YK7Cuo93ZYjMpd6*SGDRedvWr$m>kW
zD@;}69XupE!mAhE2MEc|`%=`Kp+nVIvRS@FgAJ${^W=ODYWlBI$R9XTbU`v?r1u`i
z+e+Ke?d;hUjA=HN4pnY^2rOmB3vk(Y3tCUit$`TJpSv7Q=QST52LD5Spz4#J<sRN~
z@=QR4W{R{hV||A17k0Txe#VD4N%)npwX6%C{GF<$w-M%Uic4cyeP&L!ptJwI)PKGc
z4lMcuafUY!_Z>tiKT~)G#hpt|^<gU?CzbM&7usv_N+Yi(X-=1+EvS8G(85~7&JDR`
zW4Zs(V|}hM*Z-%FP&`{V6|MdrMHO|Bmd7{X$=&<EuX;&=6$-1{vS-1YboxBB1aCL3
zOI)AMNrZPC1ClV&(nY}~?w%&OQ}&-u^C4)*EuskN!v*u#>wC<(ZkdHXVC&ngz?#yS
zy<oeQ7NfY=v$fy%$W9>y_bB~q8d#zcuOuL6?)%IHZ$QGWaqho7=buj1=Pghu4l^k|
zFMFG^Q08oVWuF)L>LZ2jTTixI*u{l#rmS%_+|zuQ3EbKzsv4f!N|am#DFfGnMxZa)
z`8Y#?Nxniw?pQp5!NO_dx!ZGFi$Xb-P-A2DE@K7OP>t?v(FonquNjQ0COp5?45(Zi
z0uGPw#k1X^-Uy4+-6`|rwhM%)toAktjRt*C3$0`oV{^8%b&_;Z9j6kwlB;xG5^WD(
z>?+EV<+<=M!fsui%iL3?Bl7*Lhx!_$-fF)B%l{+h7(syukv%L*kUC$XHMJ~s7pKyO
zfKnvLx~_hd4B-_=sb-jhhb2hVtXJsNGu~G;(^Yp_GPWkfnBB!OUM!ssOU>~x7<FlU
zd-2LJt;UT=3(vuT3vvB+ep9HINy~UgahOiFM*Q65Ox<+LAeGwQqfqWZG6C$9ig>Le
zP@!fv-IL!9F7u>DZ&rCe{WP1^4~6Xm{=`C)%F3P`Xu-osi+deGs)fON<fh=u+>u!E
zF%o}j-#u~w+j9{JTmF!@v7j58!;6&a=P-6~6zSfj5ND1T_S>+z>2>j9iAar2i3@nB
zK$DGOw>6$`*o(8UvG38`0h=*|Xj|B*U7?TT)9c=e@|aMq_|4rM`6@t8i?R|do;hI%
zz%047YpR=)%3M`NqSL?&?=t$hE);D@`6FXQf@kOh<Ht$0_Kf1@(Wb*U?twk^g3r1~
zHd@>e2nD9F(^#T{3pF=uvBBh}bNgs*g{ySyxs;Jr_SuLbhVj@jzXntqeKrd2G&W(w
zzGPNn@ukwmgC@E}cr+km(#5<IqqY2-OTPxaPcl+zSzWh_XW~t!<>$SYqWUE+B}z@7
zxf9Bq*ttFS@gfRnB;w>XR9QMSa0~0yF8tcsGb32kq0utOe7SY%u+S(5uvP2X9`hXf
zo0d<{kXP`2y6v>j2-6rC?^_iXuIUsj=3f3LKn$}>Rm@8~1~_aX7S-c{K<~v3dI{3?
z_(q=kY%3#8ns>dgDho%S{ZRbd#O;*NC?x=Pf~V3-Xes9<;J2?RD0?&;uddzYV&%X6
zE}-EkM6KmoXnv3_*Y}<PlV~~l_F?hMeh%SvPenS8BwUVxHoZad`<E>gN@v)Mp|>&5
z-MkFu9Z5%lIKn9g6xISQrpXqnb?7pVTgNtXVX<00i?<Ps;~t%(K%+kx>~S<bOWdCt
zQGKH&xqLHd5sk<NUF1!aJNtYV;A>%6WY{^G#QpyC5dY~slI(!lwhQ2Z2%i_rn6zVY
zVHt_@JF2c`d1JOuPx9#U<isIVyQS4}Q|$YcgvX>?a#iZck-V&b3iX%I_bxB9N8cMx
zXeFwZ&S?Kw^$(jKY<R^Q(XuTxsdI}Bs<Tyf)4!%aE48XCEH$khIU@2@RMU1$R@KJb
zvmGpSMfX!@*g|*uX?j}w<~A45@PKWcDfpV-G-bDT#Ceb0kuOkH<-7)+i<OhhRxFH)
zl;5{4LU%LrFXX-~asEwMzm#)w*dUe2km3T`#D_yCzI^g_LDoYj?>Mr>86fkQJ94sE
zUbZZ|KTvAFGQFPkZYpHFjFrd)8z96AKPd1RPesbziFB|i81r@TW(eT29;@h#>lxe4
z!`9eY$<<Jk^3S}kTu;h9qs%4&FIS{W+IrXC#h^zQY571=fNr@H*|Rb*W0Evn{G%?4
zZ<NKh1~h0fl&${vCUp7?^rYqz;WWZbA@3{qelknuu)c23?v?@1^rKdhd*proHs?}U
zbaeB;S7bA3s)`vKjbgKkdX@RI<F(jD7w`ucz~|}pd0dwb^!@wT2A0uS<`oCesBLHP
z&=<&bk9k>c?DdOtliM3lmyMU=Y7Dstb6iMC$+^t*+AKvB&t%#AC%^vKs*V*8GE?Me
z{Zyp!(U2xoH16-M#^?YTur2YH)g(O$oj%ZiUnaqn1_Mc@i@7nA$|?lwQ;K|%Qf7=a
zlaTj4*Gm9!-`5Qq9vxd&+9OpdV%gu>L(+c)YjlGlNwMcIf7TC>d2AXWM!tfzu~V`{
zf@-)+?r>WGW5>S$<RW4c*Oi~9*zm;@e36sRcAp&cb<E!=EpKQ_=UdkVW20G;I0~7&
z7fZx`rx0E{dm<6>;~x?c1DmVF{nA%~e<J~^yZ?I$&|3OSso;^NL>1w0G3wE_Q5p%E
z^JFw>SN?v1eF86?=z`MTFSSbkr3)In|8KgW8CF_ULBy$GX<6d&|H2_vj2x~R%m5&L
z(`&<UyC^7xTjTFf$pG{xcLK!sTrCL#Ff=3obNfKxSmo2Z`qOSDamlaxs3@e}kMdFB
zz<`Y-ySU(w*x#s^t^GIwC5o>NFai%NamxqcfJ!_Uw*;uRz}8h=#uMIm`7WS?{uTuQ
zjuwL_r@TsG3*A4U&}%*`1AKaI?@jD~_nk5=;5$2QNT-t-);64AiW|T3NN4={<=-7u
ze$}8(GQT9df9gf>ZcRvxkog;nRFP$DPg%jvh5sgCKK!f3#yKILkP9iF&!{NYAk}<#
z!vcffUimYr{O{2V0#Tv&LwnuthWP9I=0ITXApLvu`Ipc3`9Fo!|5Hc>yt2|C$`26U
zrF-LSN1)UpjtqtC`)nyLtIPDiq#tz97`ia-)%4lrq*^b%Iq{a%RzN`I9K&Mu5Yw+R
z?JxTi2e4#wOaGPALK1|BuMTT%_I4(HJ!rO1H5a8S0WzR1gBZ`U7<WE_c*fbfvkBt(
zs$_;3PIH?!U76Faorw$B>h2?G6B~d!z7B+loH`0ysGelG--vx%E7TdBYK+^endA$u
zjPTOWe{p)YS?tXE0o3V;n>OGk#?Mx=1Y5F1W9VvcHrw||66`XXBVZv8Te(6=&p{Gk
zPu5pI3=wQB@021ZIdhqN?9B{>xef!%rb`|M5UdZ(N<RE&jQW@MO8%3H6QJeCvz^oD
zTDhqJVH+e*{p0<lBP!EX)xHyAi*Ipx>!Dj|d5G`W`pP+>tHAkBu*p!EQEGG*<SaK;
zBz}GS7+j%2V4gh5>tv%GHU<s`4{285ODbJbm*$YcD~!7Z#YU9T1#lsKJ16>8`Y6k7
z9b^5Lt}p~I$nf&jnhs38nbW`(#rCd@sBZBhRl8v*K|3AyNE(o>aL=$h)wcc`_u*kW
zT>O%3dCF~6msqIHPdD4($DXeM0CW$=Czi+EkuBc)g7jY=;GZuhWB?$>J)~j3MJz&!
z;@aoJ17B}vDuY(1qJybHYjUy4z4lhqrC4$r(*ee~@%NJsw}>^17OJ<UI|gTGSPp8p
zCuRtI@bDoH&(8Xx+ljFeqB-wtU4X@^i=Q+0xa>cMct5<q*&snSW8U(ev_Hf_p7RWl
zKnS5-EHE8oj$8=b6?}cYgcXf?==P@buI_C#|0Mus)kyGTi)nNQ)B-dwK(JSIjK?}E
zL@rVL!;Jqbw$RNEYd+htS<)-U&zK~b(q?O0sa1}3(lXu$g!avfyQ+qo6gFChHlHCs
z$_ah0`1e~jf=_BrQw&7^z5|w9<_JaxX}bB&?P-8x*l;ldVHe!HYMA7_@3Ik+Osy&Z
z?b#^c_}3o?`uS&r=|1<K)NU>|U^8}T--rIR_w>w?`*BUjha17zdNt-^*u6bYDbK9W
zRM9)>M91xgodfa;56`}(8I3|7gG4Id(O!@<%Al!817t{DNJ#C{O}zYqhEyf69JG5w
zO8I)#Yr}VbhhkvYQHh#8RM(N2!#am@*v{uOYJf~a=ER>e3B_KWh3Y)u!C5gCT}yf$
zE;MakFIFmQuR|MvHE#F0^R-nza!H-VKaWokwdgxTz7;!IjM(`1e76>L0x+Vk^(2fO
z1nsHSM8Llm>@;C`Dy6+_dx{QB2VKa6>H}J@zYjE+T4)#;ChQ5_Z6;rP*=k4L`K?Nv
zCNZ#BKiTz8e*Ute?{aDz>Unv9ko3M-Xzk}dbMZT!s7m=%DR`jmHH;^q%IYp;O4N%O
zGowm<O+m)0P{dKX*=jq}=Vgq@SdN?OoKumv7|*bJ_dL{n%FF!C>~oP^2@7$kOP+=e
zlDUrot^D>G54CSI6<<(2eqAc4Rf{XcF2cRUd5Gp;)zDvO{Xs<_(1S&}XiAisj-Hqb
zR&RGkwKPyfinE2-_7L*W&bgQg(kpZ-%+Kwm-mzZ3Nh5sU{ndsPfp1DXHcj`PtB_QQ
z?o?9lb@{yP(xTvOZ1sD)_9Ez1*^eaE=*GbCs%`5k9=hsiOVGDV+BC{LgQ9M?4OFMJ
zI8c!G3qq3BM6(yel2to{6-@+I_Zgyj?7}QA3^tax!Z7JlxVQ*qS=OA}e60X<2~6SM
zG;1?~3GP7q1kJyf2v2exv6IITW}#7+o0#8{aIQPt?M_~NTnue<={O?UG)pNX$_%Dc
zbx3&`njZLph9%V|6K<&gw-f<Ieis$TeH9CE!pd;VHeYZ6q!I>O6Fgo+uUGJO>rzBs
zpts;RV)40{(f6?N)&IxdTSrB;zHj44R8l|@L1~o|C8Qe^kq$*b8kCS2x>H0zNu@g^
z1%?_Ja!3Jb0m&gmVx(i}e4p{0^Z6V-=is~6Z@qtf*YEqEOJMJ3Kl|SIbJulUj4y8_
z{yP=HLPsuqB;{{xjCI#ZLC+Bv=g`L91>o?v8^(3F_Cajej95uF^z^(u(Q8t|x7o0Z
zwj;_q%TuSVrt9$4*OUJ>+-N+jEptOjb{|$&W=M%C4Ox8Jcn%UK(ZlkC4HLvCP2K>I
z;@-N_f{@*bacgFI=$QA>cbC^x&ZwWjlQqa|X>F+av=DGqHY1y$?QH<Vv*RR|kZ`cp
zvar~`X5MyCE;wjmT#dfSU?(yVCy_C@vJUm1-!d200$||zuI~Q)*j>S~MbFz6uzQ1Z
zv)h5rNb^Vx;eZCYd1vlNj$7kXw&?0R@W39Cy{A?WCHOuMOJ-~wY1(=f@C9-fTxV&I
z4b`wucrryo>2ulBJ}(YJJpc#?(zt%48>mDyE9`K(Ak?090=CKJ51bgz0eg6c=3JDh
zPeH4h=urT?Y`!w~P?W1+kS3ZZA5A6Ow@a&qdXlEQQXWu|Og8!qVJc`PXdnuiH`dl%
zglz3)>mEmqCTBGP9Gvm^QnEr{C4GUH+>v8z=!2<+y`;g^uT;6Pkk1;S^HhEIx<+l<
zTTb^l)rJN7M$8dk^`j36)u(g|w=^Sl8yLJUs*h7LQCFmyzq4TcT%$%dqH*kCJG=k`
zGy$;<AwP9yh5qE*RKIk&*4tg!qxsSe<2_^Kfx_h1JD9#4-<jNrqNKBkTQ>`YPk-FF
zGi0-_F)=i#z>icKDOwD!o1^S*7o^^&U&}#3Ik~&p1CgwoA>`wu5Y5HK&e}uRG}jJ;
zo(%OI|G?$uyQk9DuN!TLz|im9YglR22kOY0Yj2E3(TFKkjT6xFQNAXbH?)e$zu42x
zGOTMR7OOtYmx<CyFf(*$HTKCylZx^hM-E!CSHC{<nP+LRWWI_jc}B&4?~V0toW{-U
z>%;3;37=_K+AC6U=~{ht2w5TLp&?^1Dpggi=rL5#C}!Il|KP(FUCD%oIED%VD#XSG
z>&n7InK27;Q`XqUOJn46Wro?+dP@0Cg4^>|+Iwxwv<CJ{ab1x{PkB5a>o}}vZo1|d
zgVEF2YQ{OgvcS^_YqLIwt5t~m1s18a?y;kNOm}3#c}bELL;rA>bnKlC=sYYs)WMh*
zR@zkrJzvWv+L$f~>Ny;BCq|Eja>kmFAbRUkh7acf4P{c94g`a$m_3CplWn#hSFTuy
z`g*S0SmRcrQ=dxIc(VF}RsUwxv4_^+rVdmhqrloc|GI<w?4Yv+O^Dnx-hy7PoE9z-
z7PoGT!_x79f*Iq!(rK&6^#0O;9M!>?-56EM{EfJ@u5@WBYZ7sl?NZlb;z#94OUG5y
z5*IL302<Ycs^wi{IFy50FfpQ^sPC#UB-`Xt3h@%hI`rjVz8EoA<0QfMR&y37rw<5Q
zj80uYySI`0!1TQIp?}QURR!AYW&dG+`siS{y+YQ3kPX5PL8S+1qXO4)3Og?NSTEy5
zLI*DoA^v;UlxUHor|Zqj>*Yz@uNbLojnJ$f+pZdg3ItQN&CV8M?_1*=t(achvCxu2
zkvknsi%%sptT?&{Ut5+_fI7pL$ED0&kKW&24p--_720bK-lDv>E`IE=?tR>>SFup$
z773ZyIkxJ~ip81DDEM43H|HcE%5x{+uq&i9SHmx__$!7yK+_90qm8&llPKB|Ux2f_
z%TcOG^XwKufLs71H^DY(BZ<2<>%(l5_115hjJB>r4eoM#Uept^S&GjGvj^h59|xj&
zTJs#@lTqk3nzPQI52qb{@(XOgq4@mMc8kAxQO-tB?@X#68*-|R<#y~9J1?;zn=PRW
z6(vun#0%E;qT}?~2uWpW=Xo^CxE2hVhmDPDL>0@<w4J#YVKK+G!$~LwjW#eDF86fd
zqp1aRDv`|@&;@tsZZd*4QZmMnvpb!}XnU-FP$oaN!F-ixAl?rRSd<d+jPoy~B+`Ca
ztj-+@D-hP|!#@<MOz2GA6%p_v);KqBzED|{>%i>E%A+mCLOx>g=`&23!hGPFZvW-(
z4F|oWq~Td}#3j9Ug$lp~FrfMLesH!y%(m8K9CJL)O}(2kl(QI=f5D}2Pefb|@muYJ
z=s@<*>iK21NkTsr#uu~2*Tv0tjt@7EDLsyBkGGHCVPO5oBJ#Dzn+0CMHRxkDp@QXZ
z3;}@C4j=*W%9wCyH{CD)+&oB)ukGO9YE-h5DEz+Fi@}QMQm9;)91Xr95rUeL*x_Bv
zrFnjS+DsEhE382w(TV1}V^hWvr7-2=?CNEXiN2v-0;&rIg4lsA>8#XRo$Vn=)ns+6
z{0|9P4lSN#$}3B|94_uP9EwejGlzljR(<j|nIx9r+4`@8{Tz5Kk6m;>v{br=M0X||
zPw80+JI-ehCx~5U(_Su8G;A)n2#MGd5fWQBSKg`&%u|};<Qh~q*6l=X7jJc=wErLl
z=vewV%D%8caTs@L*w8)flGUO4&4Jq7$=%}CA`6S_+uprblN>9fkl*|Y3qwfT#>54D
z1qUh^+nV7$?(IP?_J~d$p||@_Z1NcvOq=M8Rx*6e&E_^qYeS}@l@Awq5$qr0sVcUk
zHdx&Xf@mI^i>huG95_5m<0<W_eB;4Nro|+e5FPT=cs#N*GRL8GelJlzz_B@_Y4h5)
zCby6!8s5Bev2TKwN?w;zs$h7R>PE+Fhk^LDz?9ZFjVVvswPeH*i;g*2!E{>@C3VfT
zpdPGNb?SD$s2#28&R&}Jkxrh(?w|yZUM-)8P8@YrTj~4dYR#v@S}xGRZ{u+nv<#p*
zuF#5g5l6zto?P$Yi5WuOc3xKqe3}NNZC`s!pNyH8%uPE9|23zfsi-S1e^GUygDk>x
zXb;@H9b5)jQ^oEBqqrfo>;=I4eskL!H;-2;F$y`0&wlGkGu<*=i0I+v4_|R+449dl
zB(J`Y#5NQaNc40Sk}29}iE^d)TIAS&KjZQqu(F4Bp5fFRjzADZl8dn>SHpzcQ#gdU
zZ9VtqkiNt^49P=nCOnVj<-~Ad#HYIPLj)We<~BK0w!kqbc2g*8g)14KHrmNfEwO@5
z7yVgq{q@qc%3DAMa1}!Zu!o@n*b^0HYDV?*vu(X!QET=(TpOw+3DK3$kEB2%Ez;Lo
zv*=J2<pjwu64Yb0Rr<JplYzf;3U5jUlY(eg_O`xu_Jt8)tw+HYXVGU(pq`xp729hv
zTDGK$(H57&re~8OQxBqS3~ID>S@SE-?o^_$0xE$0qCcnrhNBp-mK2G|grP;Lx{9mQ
z7a;#(1Mt92#(ukHT+Bh0P|MZ|@2T^+7uEVwrP!hUepF!b-SBfv6~xL)Asu;?Y00Ew
zrXsAIRlc350+)}KqH7L0Ax+P!-dCD_pvWfxT~9`ZS9zcYYmne|y-c)g{*~c!Ok#M#
zru`wrCCtA#W1(Rk>N_7I*Y7Z%lE456bf_klE#o9-hmmDd`<Azm^0Th2c{djF`3O-8
zBOkcAWG8tXI+rR0v%)<YXCjPswBUq2m50#k)%g&&&IQ-01!W`uu)%G@fwy5_$%>We
zy<iAE$75Q=z3g2<+u${esnT(?f*D)s_JN!Z_u3nVk~u<y&6|<qPX{^jl0@1=vXMs&
zgR)yIAAA=h4_7VsJnz((`MM4+l>e0|4l^&M26E})HiMpQV=O|N@=R}rw~*7bZh<Cd
zAvE#WkPleIWD_6RS=skemYKC@J#|N2nQ5MJdA;E<b&}ECb18^gbV87NfZjo{;rivP
z2{mF$G`Edv!?+g;*eK4tmY=w+v!%?9zW+5Zr#p33xFCIZEY~7u<8gco(|{lw$#1ZV
zH7h|Hq~pN@XAwL)&2yENX^sP~(xRqvf587)-LE=B>@^t??%R-T*QAGw4r1;JOBxfP
zF|*HO{xM)G9O+8`x=?3m{o3)0s$*!ZmP5m$fKyY+Tut^6`TN&e4+q`N<FuO~ktz;X
z4B-iyUPzdsx$pfu%;65ZoAw@|IN_ZuiE>y)6s{TdGJOu$_c#!3(3uJLMD<}veI<Ka
z8DdTt4`v;FAn}1ww8+71V8Z4Na7cXkq@sDFUs)FP%*VP)ZX7?i7ZqDaS{c4bu&qxl
zoqgnUTUXRm4r?qfNG@<ea_&G+aI4QvrZVyYlQ1=cIq)pDhm5D7YiT%Dv;@HUYOHyN
zY4b$SiA?iuYZlwq7|$xVZV96ysn@i;^T#FvWQGinZc!s!7y690%XkM;2L|7MyqRRE
zRXxo6n!#)0Qg@C(!N8U7QoRM}jwajS@JxY0=AeV^Ls7b#R&C0D4ckzimcsftZT=FO
z{b=o*!^BeZdR&_Ti=TfVOA=u56Z3_lf2<{0q=A_)2-PJ>4m(HN<Kl9!z2fjHtMEmp
zx2H3c4?2!=7Ka`be&9ylnSHs-#0+zbR3essVKm;dz{YEGz9vL$J)TvB%A~lVgY(0O
zzDD`3_UiXF%8&L|nLB}F`OUN+Jx`46y`DBK+trX8IMjm5ou^unNbbz$Iy#=Cd_9b|
zx;rW1-ShP+vGy$SSya|%5jH&;ttmYtSbS}=M=y7{Y5Hc8p=eXZD&F2Dv9VZ>7(wFu
zuiWuP(2R~o=kMk9!IaFILeJ*DU@k_LeJU`uapDwJz^V2sF2ug2!)szh`?75sPhqT>
zcza-t{bp7h1KRr5F0<>9(m+F{3@cfn;$Z(A#R%PbZdUs6x0#nC-c&fz+@sl0r0n@D
z0_6=iN*fo{^R3vOVDBD(>+<Sxxv#v>={TdB8=fqp<1K0J-26syMvQo*V`3T|xa0!R
z;Yww)^KS@0-^8A?Z|))S?VyGYI<?O}TAIu&VvC6Ew;zX>>PB<{N|8y;gmJn1^~#B>
z2Qx#wVp7K5SBg^JlMTchqZx6MKYQumO3R?kT~<H$?%Q#;XL%>})DmlcTj@0&vOki?
z&vny@?nkT(KC)4O7Kd~MQq{tf$J)(tQiJ5Oc?t%ox=VEzpnIB@^#??QImJB23XLP}
zARP6MC8nS+h}BI@cxn3Z!?NmhBhj{faQ@=-y&uc+)>4?kP+UzORswmkJG8Bq4|P?B
z<86y@j?JsRqYZhOEnkNpZ&<d|Ff>tjih9rp(RoOCQl-E3x?C~u0@-AVzviK7EbMd7
zCHQbUJZ$ZGI9&66g4>0U!XMcbl533{v16qR7adOzCvS&5J*7CD-1H(b%#U^W?vta|
zL+SG>!J?hWL5oAP486XsvHG1y52vw|w&o?19+Ab1>8q|NM5<(+o@=cA3uJ$sulNr0
z=IJ{vs6Rpb3J2>h+|RgK4H&jNBo4o-@j6U9qGHqvP`#E+8cfC)-;<9&Ivc>NO>TUL
zq4mBnTHXjfs8%Fiwc~g>wgam>DWdCr)#b6sSxCCU%}5o_V-w<byWx$@Q;aI8*rmIf
zZ+6X5#dR%!#={TIC>Rp{JYu)9jJ|!mXJL5jjqe~i?921@ee}qo4(ElH*~*&0n^(1@
z8XXMnPfNpJwx0>lLPil$9<s)a`_0A%Mj=A-D7t-FHPH6v)dN~{6jnCh)N*Pqf;IMe
zq|hOyu24f!DjNW~;u4RvaQSS8=&V{g_u~sIEX7PcI6mXHpjU<)H5xTV;R$t;6Bud~
zNu=?8`96*jEgB@;Au6p2y4CR-!mRtV8yjV<TjF3EBj@TEm**S|Wv>e@tCfN}<~b?{
zPSt9jh9Bg~-+vdjvAf`?pLEr<^!b~aO?9u4W8ji^qo@`fEvLRi^&PGvw$R>8X*jB}
zOP=tp-ie)|pqrPyNJPB!qz4AMwLTm4^FI3y)=!E8VEwX<2ihf4YtOx>cfV#4heJf8
zEZXg)?&rL}T4+d+_;t8*!1o(f>{+acGb2W@CHcPbk}!=FzovW|PRd4$`{j#p;qZ`7
z_=`5f^|-Skti<lxzr*$k8}BOLF}+_ZpQ63I+0?tp9vd*Yu#&Hs&NDJ*NG;<dZ=%(Z
zF<kC9S-DH&C-ZcnJJ)Cm;81rz=`HlrqIGH+*O6b?x=9{QG`;<?nf0XzGpK#*Iy71C
zjG#eOsh8vDb%<thvTIxtr`J=KC{D5c_v1PBuM(3NB@<oV#Cc>_?i?2>WieTm>t+$t
zkc;6ZTS?xY`j~?P5$x<rC>yzGg_z(17%NG!{XSM=u@PIkt1g-X21{Z`XpZB?tL%ps
z>m`GgzVa=pubU!G=a&q<;(edL*^Td+!l9cPG+1`3*yZi!C-utSUU#uLT{It(S9vI{
zbr@G_9X<sMx_YHbz0X|CuCrh(C1=E~EHtKIr4fndAY{E_H4GCLYU>*uM3+`XTWk*4
zdnJF{66PtJk@=(^hq{^BQ6SRnQy{Y(vb1A%2skbV!j`<Bptv>2uL1fIT;<9p#o5wP
z`d9i#nvjcke7CvAm%5I3FL!ZD$on`EB^h&m?4Zq2;==F5YB7Vjl<c{3bzg%Y9eUR2
z$l@BszMZ|JJiL!SaJYkjtPFg!YAva(TG-1+IUpPiuYN3<gy;3p@Mwhg)<w2XJRsO^
z@0nnj+3rvUXPtd;8NbENem$2^$Z;I=f^F5HY%$@Z<#0m49DMf{-s7rGIDbmOwLc52
zzmI)y-va&MBpmTg<W&x((_&UiE|s$#r(yDFl$P^{(^~UhwqP!0&#Ep<f!d3O^{@ti
z49ml%umc3cLX}d{MUH9_6fSg^-K;s>vP&(mYl(T;O-;C}tU&8_C5iykby#QN$o_n-
zP`r^5zgJ>=HMg8djj%GbnCETDYA1l_e=hthJRkW7JU<B1q$cpB=X5c#IjF)X`J%U2
z$p+N~ayPFD<Q6(e&YrT6NhKIQOM#Pi4~}ZJXz%lIt8^!byfnKjt3^l;WyXG=pXctx
z1osq)=0TWl<pZduV~D%Vz|Jn25RM!i5{E;PUSLvOuP~evP(>MFp#arELA#EhV859w
z4RcBwQCz9$>o90<zFuRU8M{~P-J`mo5bn~~FvNxsOZGo#f6+#v{#b9yQi<u5k9o~e
zw#BLrt@2aqR_s_H<D^jb^|hmElS|~4ZWqVWFoEiMkVxmRsYyY6_bA7nA}bl&1joLL
z6atKWfHmm>_hEdAp<4mj0>nZ1()}NE=VcAh;1D5xK3^uGe}wl@-mTZ)+!un6K~{@R
zU$mrm!}TSPH5nLI(&>_wZx8h7buXFN{mS&|DQY5NDcWmYSV3K<BIEAB9&@#5vIlle
zJsp_X@?jw(3WoIbRp*VzH!U&lF}byuEt~2}=9*Y|9%w<95v08P>2sa_%Ga?|)F@$E
zf`5SYVM};-KX$*@ywpL|CUy}23zR<S{us#^ah@Vpol!j!t;!HL5`QH8+~$##*32Vb
z=iO6iC97x?g2&~7+Q#s0nPn>iWR+?OL)E4%MY_OWf%+xGmlotT-t@#t6pzeNmM5hV
zY8W8n85bIat*^U$bi3Wn&qcf!T*3nD@9<YjZitq#EorVN$!%5F)@L_9Ro8ziLT(^1
z3Uz#-*@3-s58e_t5|Zz0s{d&o`HV-yDy}2m$mdO`@nZnfN5VT=o+P?_POt3|9qo5O
zysoIt>!4WpC@jw3N;E7BD*bmr;e2Cs{<h9qsqU0{^~@b}?PIg;A+y>``~AJ8VTbYh
z2P490KGQHfl&UDJtlVb)ka^aR!}#7%j6g=IM4EvU%NuvW1;}m5kMuL^x+LP9haqQE
zUs_uqxf&3JPLH*o4@H0T?MeDNyfW;Gils53k!Rx%dZA&9$~x}KAf!nSPrs<>N$$me
zdANpAo_0Lnb=>cM-sj@<nhr{D*!BDGVJOQ7`Gh=P8BesX97mdsCx#naMKC4H%hMPZ
zY)4|pEcqUGz}eQ8v^l*W7xASM1b_1ne0;P#UGD4eb*MDi_|4li*nd?{D9+_MSy*Z2
z56Jv3F0Dutr#P`sIqI|PX|u`MihXEu8d*a{8tv+UGaQP<&vFw2L^s*r%}uLEORFq(
z`#k8?Zyf<bXE-|l1kK;|s4`6%6lPv!j4(#DdTM$(bdYsxZ@aSTmCXisSf~R6wCX>g
z`Jy|!js7y3IXQn~^PQ{G`+XQRsUp&|;rZw&l$Wu*Xtf((4Y_0)GIoUViU1(3^ofGB
z_szP(EXL^vCuCYZ9BmGY3*2tb_MD8)_pL3>p)5LhWrWVjSkqoA)rFb6>-c@$?VM*v
zw7?BxUN$pc$^VLw7kkXHSLHmpX-P0BYnj_JOcWmrc^as-QKD?M@ALlWsBr}oHG1H3
z>ua3}DNbIt?9E<QWfm<_r2Pafgm&bOPphbxp~AUG6)04M9V28i&R28F@FWNbA7ifo
zuRAz0H2ivIpOGxqUnC<~02hTS`k1z*Rjc`WDfrlIbEQF}iS=w;nJd-v;<9Kw4!L|3
zfM1}VyiV-fhS9-#ct|?$akFmoyEB_V+M1k*Z<QF(B%ZwK8tW1+9E3GUlva;3$0P!~
za~e=?3{>+rXAQq%GaMf3-gXmaY(e-~7s_&Ghh-X;5eJ$;<8TD1?W;1(UA1Ozk?)fL
z7T;Z(M3{_z{VnEV%5k#ZQ;~|(zHT~)0C(?`AFunZ^Q*Eg(jZb*%RDL6hb7C~A5fth
zv}RBj+_;E)g?fUUQe!?UXo+|1!2lwuR$iCy-qYb;(G>+f3Ht5c?MqrWSU>V=kaKF8
zjD9A3)Mhzn$Azb>5q9<cFbQm{=XVEQF|1I)#~EmH6hk{G6mMa$z1SKCDH+kWit3K<
z?i;KyiajM2i-Rg~t5S~+te^6Io7jb*{|(~k<*C&X2Dct}J=7`pLbMsKwF`IXZCC2L
zVe#Ec`2%t9U&u}Qun`_itjAlB(*he1vFjgnEzMs$zg{q-_T*LKquiq$H;d9qXQR;C
z+3adY&O5R)aSgtMl?ysITNmK!eGtL$Tf!COL}+=oCRW#h+_KUhmGgfse1T>m3#M7f
zLq%a%3own+juU(H1L?%@Hd;-l`ZKV@^xSq9s<+FjV-GoGRhLY~zFwh=N(Q-v>e6eC
zYOBIX<t+oHynKx8s7G)4B`3EA>X73x$2`P{V3rjVu~#^hGKyaEHIC{GmU7s6Z!~hU
zmoCDlog5~f9?MZY?AUxqZ>>WnP$XIGRqYiKLxuT*L^b`2$sQv|YPoS{B_Cqj`e(33
zcG$a-`N3+4LrYfamABelXoqVPD{C?7gGWdcXnzc81OdfOLny_dkmk*QMbzs@+?~zJ
zu^<oJ%tRkJI_kaZMDO~b`d3sd#6KSFWIkY%x&H?FUpW2vTJbrHxwzO-xpsIx%baDn
zgF({FGwq@JzWFwMEmru2FM}hWN}UqR1ddTiy5NY$c9adO8p2n_WEA`0zexJn4xh1H
z1L*S-Q{MEoLji?>M_kgD{YS=JT*mGEU4AgQolY5VqB+^;0YMU0rYHu^U5&Aq){%fR
z(3vs!c&8NE>oz-Iu&L(8s&1!jMl~=(0qZe;mv=o^@8<A1$DWkZMf1+Pyw&{+(A)Gx
zKX==1fF=q?W`OU;o0>IVDmG$inTd~zq3?;tf%H)C(`Z8}8QLd=ax@1S^|*7pa;G1L
zDVb-qkZvh-FB<7!@#3f7*m&9xG!|G|r;g<r1LotJm(_hkvqPa2UMw}04V_d)13Olk
zGDy|=gNtYcU#!x3K2yWEQ%3f|046U;q^aeo(_8@6ZY(DL8V#}elr9$jv}Iw)9U0+%
zVGRe(x@oSaK`_-<xRThnuu~p1FifbkAHHD!J37AeeT_Ojszg;WR%0CxWn|~*u4isb
zZOGDgwyO!&I87PVu3LJyuI^cN^k{*(j=!p%1vlH8x#=U%$#E^!FFJ>w{R=Mc$3fkw
zlBMtzgepqbI4~~9!R_{H>MWU1#nP@B&iT>d!XUjtC_*<VDky5!Ys{_Z1*CtA7gE5-
zupQ1Yh;o<CvV+%)=o@H#q_|_tnpY6$jng-P;@Zn|1uV#Ck_TXO4(ZUNh>l!}DUJOk
zjqSYvd(+ZETgY%;Me}ElJlD>mjku54Rt`_E1ge#*g$3!s#FrS5T{B$Cx3EQ_%2sX?
zne;zpiw;<Bt&}^zkBRaueh0N<A042((~^(Z+u75OF=Ac>$47Hn$piC4Kw|7l4Nz|H
z<pi=`1*L6zo6{>b`<DGGiQlIRovyyg9HsRbaVb?oO-Np(b)arWJs_^_y7&tJF}Zw@
zD!{Lgrz3NWI5l|`4q>v#33g%t<zBFy6=?R;cs%ig-&Mve$NoR5j6JVI;M*tpN8^|h
zST^`8`M5y>+OA_Yx0KL{)3NL8a4@M|C~tS^^Wqy(gAA)l=GxZ_Xfazyqs<7a3S@rF
z{lHYI0;X)5o?ncaOwn(|N?diPdQD>4HST-lXRhL|a%!sYQODXDnwsYhlarxqjIPe=
zXvS8*^-R8H@pj}a<gR4w0{&=!wPsmj*WZAbix~9v7$p}g23_qPB#zpEd<!`mBcPRh
zXE8R)A&MEUxc6loVB@z%&j<}a7mDSBSukI<$4sCq%9`3=^cIR$SD=`F{Nw8d#op5x
zjI}uSLq0J4w(5K~q+!PTvR~`=OwW|+(0CGM@)9*A>vd~AtO4Ksu!$vCK4B{WeO+}9
zBg}A{;c2o|io%9YtX7+SBJuwLkd7%G(u9FU`*X+b{V3wTd8YSEI08`^?YWZd8{eZb
zX3bDsnv|UO=k(oQHZ}qz)VFzl_`#PR0;+@w#w!DCK4;8BJz0MH4|4ZE|9GqdGKRS4
zia+e4H#O-upa|W%<vB;@HJFu1z4(&x=ea*{=Re`UnkPY9{zy=UWWY%!Bw+FPftUX*
z<v;)U-|PNfO#a_}_}e~+=l&tw4dA`x2A|BR@qZdV_{#_JeXiOY12J|f6u~+SZ_@X6
zUll(BQ?E;=RZ-{ZKsokp-MgL<Ymz)%C+;&jKb^ooT&eILxXfHp6&7O3=1aiyh%ssj
zR;Ewl09}loK;^Hyk)X@3IN;MrP+>{&Mlj;XUce9Y-Qo)%n%87f{gOzKe(J`H2g?bF
zyat=X=ZmCTTy(_gK#ix-S~ysIPS<zRI%XGCPh`Y^+{M{6;WxJjPnh!d9s{FT#qm>_
z{Vv}0mnCntc_;)nK_42|V{P|SZHnr9Tb9e7R%Q#e^$^C7ZnWTN6GCnXf6+)W|KTZr
ztn?sRK?qXSBDH`YOYApk7Pm*2)we%{lEla#I%5=v{M>Qds;dC=^ltrhGD2U#x$xqh
zmLD9@kJSmdHt;o3#BXLVoeg2LYFu=&+Zs%+^*hA@++R9y)8D7#+A+dr+@v#T_1t=&
z1YAKN^7v!S`yV$!SGb8O&w9S%F8o~{jFu05(mVY9>EM!J5%8dwj(O~>i!$FLqI!v$
z+}sQbRy{7W#nCH%OD1jSuZ}T%^7`}b{jqd|BDB&IEqua;CW9ITQ>rUEm2B^d`BVpF
z+z)8iefY}1fxnEfPACo8x-IhFcPk{|bx^x5b-`v<BFPCGf%%a>8(>$l7`o%_>FngF
z@@%`l@A2g}?v(3fx89Q3VD#Ldhq~8Er*6p9eXzMbeeFB2%I_2_G`H+iw<(8IUMOs9
ztD$B7SqufjJQb0q85JZ)LKBYN7|~q!`B{d9qn!TgoP@1pmL3kEiCQl#8JmwB_}i)T
zmo*Nt0ta2iqpK-|FZ}9kq<tf@@4yGOF?4wTwZ;v>%zFBadS)XB<3O3ynr$z1cttE&
zH@FDz0ws=KV_MB;E7<}L%?vNc*F1vd;*HyK$S%KBqRl*I*4=Q?hPmG`<i9WNM;pVK
zU*RcmXG(EZ!$9zLjjHh%rMv*6fNobpZ2PyA0$Lmk{0#UL-1QvDy8(TIuH@F->&U(*
z#Di>Rhn|eXGUKFN2yn=CLGK#_47L8!EMwI-;Sd`QJy|>jFzH@ke8&VNa0Cl?!i%YX
zoCf~M^y}t<HK~=^&8p$rH}<azl7^+8W4kK~zebo>-f=${$T}mn4Vyasl?>i2si!CO
z6cBecE^((Y>{`_%2&I{3B>Svp6!ty1)hG{uV#FqXATX9mX;b~^yFovu)WUFagUi<{
z0|8{trg{;Y=aO1+D948DvcIvN#U}SR@QT}GuHc;@Cwp0C5nTC~*YdZG6Sf4q73y~2
zRJIKhfAfSfqD1A;$;99`{2JNg3wKeiFiD?y;z<=o5+m^b^Ao05OO_Y<-i+;DCu}PZ
z)sKMhX(ZqxtlfL9JUmPK$9ruwUUAFDC7+=rJeyV`8iIVJ50sm);xc$aELF5hPr&{?
zuX}nPL_?SF?_S-yJ$&E9YlY*UW3P;>5SZmg2_>FUTU?rf@5&r`Xpe?5y3MA<u+ZC2
zuwkdlhpr^l1RG)x(|c+i3gfc}+)%h10||UIJ6d7|DdoE|i9H2oA4b>8xgBf{%z(EK
z)9!=G@srTOH7mM)szv|!2KA}I&MbTra6)6nLe&CZvswa51g$$HMfo4Fn1HCD1xrLH
z!Ke%&Ae(5sW2*2T&Hu{ew9G@bZxd5jqAyv~wA^SNkoR|MF`&2~Wm(13VRXZl>b$GW
zzxy9?{e6IFvY3c@_TY70&kTg0{hl2C9g+gJFe>KZf;+G1JDi{Avu?qF?y~>w2}$_)
znl67(R_gmn<P$gZ&$DlESTNGN`+d+dqK4fi4((*ox^IOzg6@?k_`KCs0G<;*xa}z}
zviP!Z`)vnxE3Zfa*^BFflcrboGbr=@8aeU~YKU%%_0hN!`ciwV4HR4~>2VahII&Rl
z;P!q;^>r}Oa@Q-vvvh1cF8G;)w%Nd3VKDAFHX;<#G(&6c++evbU+-PtlY9k+7>a6$
z)tla~W&eq0MB!zs9z3O_nW}yQD+-hKSCQd{`Yz<ejhEf`&Rgbi3n>L^ec2EtJ1t~(
zR;i@F`$<|TTh<*R^;E5$P1LHx?XwE11x&S8xrol@jAP3<ku+m2YIq`6tD|s17o+-P
zikDArCM{7hK~H%3&Kuy{r8y)W5_yi%ySKi_PL<qo`d)}GX(N+m*H)wMY>aPG7Se-i
zwrmIQs+uB@A#ao6;#pLp4dY|fv2c@ac&KQs6?%(359%2;2*^jJu)K1rE)yS^<{}(g
zGJq^{h+99@;lma|$LWBu#rrRm;a+toDfE8n!C)*(Bx>8K#qgtx5KqH?d#jPq+7l>U
zDBFwTer0G?u%kl;RfZ*u++hZ&aU%m{ihEUv#M02~xTW|_fst<dRfgLFLB>II{!YHX
z#hXmZFbR1*(OP~<FQ-7V!&RC@B!6>BVLo3Ygf2p-ri%-rRGeBJt4#`gU1QJbxu_E{
zan7$W+x0bD)K8QeK~!{)8o}3>$0$?Sw&Y?%nb6G3aEHAJNRd0Qwl@?dt_oAU4!c?C
zMzf?>Gy>m?B>-*21yY|U0p7py>~ovBYb`<Cv?-L%F^y)_eQCEq=9&aPP<9%|clfc8
z{nH_?EFn%OOGxi;ktPm=(L>L~fdfvxuY)GB&wA`WM;iuqI+8RC0C&1I*=K>GO0Dom
z!$$*XO`~8Uv)p7JGYkReU>3ogGNVHFHx>9Id<3~({`p&t1YA7DiK_J(X}fL2L7oLu
zKI=C>#vdZEpTY^}Ld;$)eiD5V!f=Yvs;bE|Q>&qaMm*~daihUyHbUvS-{r}b&lO#c
zo)AC~HBLgfpQpQ(9*jOA2&ao%m`?b(b=NedrPwhdWM1<yuZxY-O#KNd!QEKg;Jrsz
z3b~f*G?x-@mI$$heu?Xm{5h%oaXA)`_1Rs@g%3iH4+<Xe93K^U1*&bMyTw91kJ{O5
zgO2vWU>n=Pepa%lW^U}itC5eVk$&?JM~tfRnmUFvoMH<NlgauK1oGo;!6E#j4iM}i
z8Z?%YZS`)Sn{Y=fq;l0BZfWgoA+4mujsdE5V1AL->)^KFu|KWn<-_ekJujV|Z6IJy
z!zxCL5yjDL{9<_W)BPTiW4I3NynkN6-{S)DluN*&LpfMZV$1pSG9Ww`_=ijU&3S(c
z0C~3B<^MNGz&H3*zU`A7=U_k<JoU8ypKJTuBK}yYFbU=;H%xIj34Hv=MG8&9@5Ym<
ziT?B*{lhbVd5dYS)1QXM|9C$B(=xmj0HeupN#Rcrp?_R?D9C}@u3vdJM*j~t{psQs
zn&5XceIrj|<oM%Hoar$iV5|57<F6l0zYqK_FKeFrukEbvI;L17jjhRdvf+P!mUuFd
zJ((KJ{6mrB=Kzf6H83D4&QGB^@rU7sWo3N(qH`<HR%m6#93zfB<Hv}ZVg-bgx|s~r
zv(^tab50~{^R5C}n{D*Syczu`F#sYnJS~@b?B#r$If}0w*S`hf3nqDpB^E#353X47
z0e3JfCuAcc$MWx83l4z<7gPOMEBgD}{*&iV_xxo*CSmiNEL&2#_4Ierh-zGdNoF7R
z$xLU%9g^1?!)6Emy`j+i1N^_(*=GPkCyRX7rX@i)7GfxtaOt|te6-8PHG2Xn+Lu|0
zdy*DSZ;3N#wY=Y7`1^W(_#bO^@Gh5SHAOCAnKDL96_&s6VtFPtxxOV#WvKX_j6jFr
z9v-+>ZcwV-Nf9w7nfimxO{Bz;Sk#xeN1l1inup5IV0k|$X3LNbgWZdrVh?pBT}a({
zDz(cK|BnX#-{t*D?nH<SfStI${1M+3CFN~>z#uh7dj@HJWN|w90sSv6wh&X+iyTTQ
zp~eDaM=lhOmV=2)b$utm{eQpYr%Ld512UI};_3h`-Jq4GrdYz_k}tw{C0toU{+QlL
z@nQ3%<mI58&<KJ3u@a9<o6T)v8Us0%htI0U6Sha#6k4ptrk>Kwx$~bRpQ`Whz+|wV
zHH*HDJN2!P9`h<anc;(UR~|b3!k_%fIp}filMBhj(=4ZiGkCWMhaN{;lQ3J4-Xx1S
z)36wg&G8xPMDp$Y&06qd>Cd=f@3s0HY!(KpOrs+OOQ+LK#anG&1sU3o11L~8Hn~Ee
zZ1H^c5?LE!ch!{SWywx%{b0B6Q(|4wP{SFGQV~cMbLh$M#|gt<X^H4pW3=87OrVW8
zuq7?LKydAGG#4S9nLs-xDiNFG5w*&ANGQ|(<f5^LklUn!##S&-WtlD_-bo|P{H;pg
zmYRT)A^<3_4_k!jzP!r}nC+zL+UVT(-q3dVtggFw+GX<~``AKyPc}X4EQ}RLXc^65
z$ruN0qf&2?8QG6BOUP6P%L-}S+hfYbiTO;~s{5^}&+b-&r`=Y*>q3g_CB+cUg7MBO
z?s@r{`l78rQ{0&b`7oCav#UEO=4$49?=~7*4!UG~lv2<8_j*t&+SxEKlw}pS6aDOx
zeq3SQ0H(G+lIrr3Z~+u?kpcP<7v$Kfm`>gBUoa#A9IAXpbZ;^COsFq?<favunX$Y>
z^%9MAQNAb2_(Z!6gycX0ud)UDcqOso^O97P&D$*+fCFw%>u`~Z_O<D-LfAbDx`&5w
zr*HcrS6tuyRef6${%+cdwKR)?y6L1?i%$GY7f4@51uF2P@zd*>c}|Oi=v<xX{uTE<
zWn30qz}UTM`jN5x8(><w6x55T)cqI(u!X9l*o>yF(NU)#s6n^$wMQ!P_g1=Wr-lfv
z&^Khm+60x7Sk+w6SKZs<THvVN0|x`Qq@x!1>4$vNQ_7m=N?PJ=CzpllsKFsv@zlD%
z|DyD1@%vi2j|`<N1l%sE$pmrkgmptM08-m0=i5p$68p;Det9c+$c)YM@;nkdQ&B@9
zL<2EiWn<bKZPY^4Fxb625el1GoT&}X-I5LnYQI}3o1VWMXvhuIgTS*`uh0BqcPufx
z11%eg!<XkwkHAR>6qiniei_YJ*uUqmehi{PjkINQHf~AsnQ`@5t5?aZ9t}mI4CJv8
zzpx5TV5b9L?bZ|Vg0LPwL5|R~euSjjnm``*h!C8+OJCGE4+*g7?%U@lvSqQ<AZ-`y
zvvpHjdChh5>1l0+G5=uQrcTfe0i2SvSx~oT3~|$MFw0ot$pbehKn~?Q_lZz_E=n<S
zVsNtL%_*j05v7%<(h?8WwaCDzP#2^<oah;H$ptt39_^2&{F4`Owg5MyLB6sw^}-?d
zpG<Ei654(KyuY#!lYDmHn)sS^ynJig(MSV20u?hK)PAzG<jY6y6PXc+M7tB|;T*0O
zMYFC0{2UFk<^ADS-slCU6SG`#AcqCs$Hi(hOl1lI4tsJUIV?Od05$1+l}=x~xxO7G
z!xmty*Yw<H`e58<s9mx#qJKCKJ|^IbxjRAt$sROif#FO6lui+TIizq@1)iSh4Chxs
ze%QkwksdaHgbArg$(_8(9Dokw$u*0_I_5WYc+#z2EiaVAI3mIpNiU7DoS~8rQSy1f
z>Cmz;Dp<TlQNqAxWT(%|+xI**ZYeQQT_B}tDOuEOr|``M6Vop$3rnU}&mvFm*8n<g
z5S5U(%@4(hZ_f)R@GAIonsq)Xubv+;S1+S9qtPg+hKiaEYKLu&CoxS*FL^j5)oL@Z
zfXdr#71b{)`%9(;CbB1F>%dY0r4Fc^j6Ws>yjQw}jWazIzO<mgh7LFn#3!xYcAo^x
zI<9`!v6}-PjMwLZV0UACv1yNo7WK|&M>j`neA5%?P=VEiVyJSbsQ01sE`S8+oPXnd
z-5YwoR#jVV*F{Z$T^J8tKoAx=M{s{Ka`vDQ1l&MqHB(5<Z6Q<`wpTj(iK%#-;d1)Z
z%80^?NzwP-+3S4{ayKg#iKn&VIr$4tVf98#dmpWe9ieOQ&m8X89<gdJ1DbH*y<PU&
z1J1pbP_d)()s<w=JyYn`!7eI!5^#mHvrZM%9%<$ts45*TSFNat^t%vC>jV1St?ptZ
zj6QKe*VlmZEr-zJ2P1zRrM{DlWijP@8g~g=Q*hbOs%AIy)A5AoKC3(6EC*d^kVu;E
z0%mpEG_=>wq(7ip2ZZH-X8mY?rDq+DK}Y5BoKy5%#qtSUWubi;W?$)O9ORGxVJ0;s
z&-27|UR)njJ~m$yaLGFRABrFZ5cK(zBB-I>#aYMBKPqu!vN*gkv**9D)<1pnL)hSI
zNDllF>rgDdNeeMN{^6URwA)`h=W9d=6WuJ<#vXOfSSIwJ8~}U!Gk`e3AUJE>;&BR~
z-i#&|pll29)K+_GM{#oGMiT?VFC5;KO4to=P>a5an~~jaq{5|G@rz|kf@N3nn~jWy
z0JhxAx(?CN4uB=ozmbDV*T2udmbQE7g`5yt?#9WNaej&MbCW3xw)g1>D=(joi*VOV
z_G=;WD&}A>FPHzP4f~7p*FOsuaWh5Wq}uJDjx_~9b(`}3^2a}=asM^;XP|8&dou|C
z<dgLG>jG~@^xwby_p6s&qdT8*>Avs(&F_NVHqI{|{QKH9LDtucpZ150#K~{@%)6M=
zC%=i`*A4~ww5jidtN%B@3&@yGzUl7|@js1>X?l|2FTCK7TlSd<S`zOOn_VM&zrT9z
zTpa0IO32Jwil2(fi7&}n8DrU>t(T2W_Lz2m3!R?eN#g_kkBTpE_E47h%&jjFg}M<)
zf~>c(X)2gv7#DUI&+u&X!t;fW6Rot65L_2-KuY668KP?sPV3M$i|ZBFar7+lQI2|4
zW69sX$T7peF}h!PW$X3y-7L;6j;;`xms<5ajdhko@SmT<KUjaA8m2%pKj}grEaZA2
zAeA|}aj@-6u;)&Bj640Q1;70u3A~;fDv<h)QMcPP$Av*&IhJW@*7RZZEyadN7~l=f
zd7AzJSN&;&yvHzlH~UX_esi@Z4Ul<&8LqkXmiaKW$^R3MQsZH>JE$ok(bjLSL}CW@
z5EJ)#60Z08A55`^+X@l#+-jdZGjcJ;s)>hKT!8<hE@Y`c<EOc#pQ<%#7s37F;$fO(
zuOQua=t-5wWC5HzdljDoe4@Ko1kN*<K16YA69b;J-J0r_#21=0j7=AYu3<XJ`9%w5
z-SBLMxD)*@ro5*wbmocH$f!H+jLZWJS!}#ElDMHAB^2puD70AmqD~Pn=(Mt5V>?|l
zpqN*Ddcu+RXT1eE(YdoFtk?GN-8oTTpm^U-M`W}wrAdI7$MQ)4LH4|uCFwsZRR8p$
zj=lvhUFe0HLaDfgThe%o=f;QnEaKER#2IE<Nq}r*6iMJ#v=Z(t(hu#T?IC9JU01qm
zG<O&-U1gR)ZvG|UkV>0Mam1R+)z=pAD<KOW7Cb&yK{r|#StMs*Jq@Jk#Ob;6Pxt+c
zb1QrYmT+k@0e;GRXiFFo+CvvoAH9cM-%w(#XWBRM{Sv9c?%I+@7c}toff-sJi!UTF
zmG&wgj*O4kJbcb`UjVQny|=sdilGS*Qth{{5VJR|J4b8@n-P1TK4Awj2A9GE4h84~
zmS-N{Z>=mJ&`V5<wxPsX0$>QCe85HJ>D8AKSX>wEGKZL&e;NnR81u|L93nQ^9ZGqe
zX4%!?Y0A-d=)%2ecakw<T;B%}*~MJZVmOaXLZJt>iGq(>8U}9Ts3O;cT!#tOK~def
z)(Ujs6jQb{S<Iz`3=hM%PRlp5Rv|r`_j(X*{GiiY52X0i-+H+6qI$ZVZ~W>c%K>+M
zL@Dr<?d&xqdenWVq%cvgHin3y+I?K3x6M?)*@(Z5wjU5`ciW{h^Xaj`LrqT^T3;Cd
z;5ap>%ZlAL?ZY3XhR_ug${Gx>EC^GMI#6dTpRv7mWv&GfX~rD6KEm`PI<KHwxGg@U
z`Pw`@^9vXMCx2f&`6~<XiCuM%W01V^vLM+Gnhlb*Z=590Id8tB9lx{{u}ifs^LS)=
z`%9m{@=z<L-@$gzn!c3r4pn1ZJ@a-?_fZv0TdWdrnBHd2Mo$l4n{0^jE5r+hx5&Hv
z!rGL<_(sOa#|uuklt+_LjP9}6m@kL80yo4JnA~@fhnwy#@RrukWvMm9HKYy7810r<
zvktEfU*E7A(AnZ5A&szzv!}8X4ax9|-F{+6LrEdtbaKY@TpTlR^Sa0bD>3V8nT8_Z
z-whqn=t!_pE@D-}Jq+jmje*SCR!=ANtTphN?T+L*J)f5rOoH!+N|naUFvgx*aQzG&
zv-!oNeZoxmZQY9e93_r&an=CE2vcU+t9JLB;KE>jrjYxJ)OOC+03XD`>f+3(k{Hg_
zupy(1V=BKYFfYCWm!-av-O}Ho=&TE_O1po!db_N#eI4SmH#w$ZNsz$3YRI49rAGr1
zTl!+YQ(Y3d-QTU~97lW^f6O{^llAZz(8QQw$H;~*(LQ87xlUdu0gxT*%2JLk`~5CQ
z#f2i>s8CwFQ&%n_*Y9DG0n%Y_rbBo8_U0vwimN*V-{j($^M2}q`tg{?N8i3%G`3cU
zL7Qph<J#va@ZpO+g^vEes9uY^fkScx_UK_e*4rf)OIJkG^Pm8T%ahJIL<R0J$LrrY
zf=3orGV{{N$DXtzrV5>kF9#Ky?T@UO2-ndMgvP@T?}`~GE+xN2G&bFq_9`<CB_vFH
z@(bTX#{`1Rh@poV&l9MiQ^TrcYk`tsW~9Mr+`1W9t$QRO=TTi8A-eSOL-%TW^&>Ku
z%n`{&tWI|?pN)}6@)E|p9}XRMG5W&OUQxDI345J-?c^%;A{@NPF`8POu|054G?BVR
zJD1=p^9Pd9Tkoh}qS4Q!Kl(vJ8)j5HU8}~NKegrgLbhRoxX(huH>S3#3xglpRr89(
z4KDu#2mR?F#XbK_3IxSMA+p0S#ewpx1`j~|2~<{VQhew^R1#$=@%HRc7|~$TTAvvl
zngo9^p&sd5I@S%O4VC*#G|~WPa%Hf71epj+J=Nc?{ZrUX3F6w~3u?ab>&i*7X|`HP
z8mGhLDH{!#8EHX-avBvawNzr?|4=Y%5b%=*V|&<xsToXaTZ(U0m5kxp&m)S6g|h;F
zU15JPEZ#iZzV|svij^DZ<h1U&csrI`<MhJ!e75Q6dp>*cFZrzT;lJmzzxbem0#qQD
z*YTlKU<Oq8vquw$JGzt4_x>^HJx&6qTk69DFfOfuP-%_D2!nk)p!M7_*qG4sI&_$v
zs69S%D>-nNe;veZPUsW<3uF8q;$?ylq2uhyHuU}6{+|}6|BvaE{>t2ez5M??i}dzq
z!b}IbxxrS#k3t;RzBjH`%7(!}RBYqat~-gN1It7~#>rY+<#HhGb9xU2JQauGE*vtv
zg@${_Kt14zi%+1n^QhL2%gPSN2O`Mlm@3ho)QvPh<d?73SFM?;C%z30Ft`6I<F)=%
z>FTWaopOFEoRsOWGWb&C2}}Nn#=ye!A)GrTmH|?J>~CWtq0L^*heKwD!M~c<g@a(O
zgf*v{=S=UC^j4$B?XYyuSSj|qW!4*aoJZd4eNdy?Ro*MQ6hm?6AJVnIW^zuL>Q8=p
zzsl7&#&-pX0^{fNUO1AnVPenO&zM|ltW-Q=6<n+Bvf!_J^^U5bpqL*rDq+6;MP=uF
z=gZ#jk?d?uL4c{!>@_g8k|=Pr{!FTf2Ga-D`-vsyudDj*2~#S-0X1vfHT1j=6ZyT8
z5WrB(wbS!SuPp$wPsIvCR5$OZ%aXqcw!n370xnOD*PSxRtDo?)qO%N8j$^|_!qA^i
zkH5QLC`fBf6CZg)@xb7X(_v=D=6__rBAYgpY*F+^RJt$gv-hN9VG{~S^#@jY2jNE0
z9Aqebq0^;csn`BsKty!*ZI^$e^=+Dt(Lp+Gs##P!7;vLakoPr0)2n&*ZRH`oP$vf^
z|B;Mi!b)UX6LEBHk$F?s`#jhIkI5UW1@YvL3|)t(>2DHau1wxUMeA-YGSBY?)5TV*
zvQm{<BH|r2-mAzd#$iWL`G1sVM2)?K9a>oTlw{NAb|EcOM**Ik@s4z0Ert7`Ha~{8
zR$47d71;+5T>mKv|0$lgE&~U|@_-h^2q;rE?%ru-mpVmRMEAl$pidv<NWP}SU`hSA
zXO?!Hi)p(oqe@}q;}J#^kJH>1`m0=`c`C^Scpz4h=;;#fa^~dD*>94}FW-&2zdrNs
zTtgP|ZoM#&O9FgvnlO>2ugoV^AHWNC0<?=WiWRDAY;O!RoxNz<o;<jZ3g(PRM`o9V
zOQw4jyFQmeyj}Fw6&7h}m;<wYIb}pS>XXyioAYDUa%o+UXsFDsw#_d4HMVZ6vUSkM
zN`YxXFF^2mmtL0Ly<;VTdxsR?hIy=PlAGMW*wc-rYVo&|PeuzUFkUEioYYWZmuYzo
z6!-p>qKyU{k~g;Hii~gTC7mx4kYMb&?>E2c+OiB&&H0e-JN&hYIFi#(uQg|2Ix!CI
zxo)EYo8z%^W1f$w$W2#3o>eZ~mf&Qsak=GSKuD@dI^t8i)Vp&v^ppp;JRS55Z_0WO
zK6KOUeQ=Ug5qOQum>KiL@LcQn;uJv-xqh1lJkB%v5g^s~O?mMKJ5@W`&*DX3*W9LN
zJ@Z)Zf^X0jsc7{kh<;d<yQ#o=qkh+wwhU-)3TPzpg^aE8CcmS9p9k`;Cy^NSpgb2)
zI_TCThok1aI;7YfBt(faO1DbRrvHr^^~W!Mv<U2&5VpFGh&T6dh9#x4l712KFm;2-
z4`2jica#iZk1&(5S|b7;lz24n`$C_j+{G<|=+8&=Psj8xASk05Jv1B_fp}QL@gcuf
zm+sMixmjrX$MRcea_`O0*GS*z+V3}Z8{vFN^phq3bj~iTf!!H%&4s?NqnD6%5pPrA
zcN?^NY<5fk3!QLh=3UdrUmN)kY^q4hP_2eJSKRSwZHwf5Aucq{^q&Y$wu(I9ZH-t(
znI>ZEnCTecP=($Xqhu^j1B{o(V0Co&NRWBsnIAD#k14vWuThdkd0ebzCYwq8znFd6
zW(4Lx{!MjM`wQSC5PRl1QfYFo#;<{hV<Bqyd{?bgw4$?S3=zn_Eax8WdQdA8T(JgK
zfDKVUZc>I?qn`TRg;BWh+;jL?l0S#c#))HR-YuA$6$S4^Z8?GNi=x?LVK_1FW2jK#
z>a@mD$2zMg=sVxFRFCS<8QX(7b}|f%>pI)reymYh4wAQ3hfl<`Zo}6wb*>_hgb}Om
zHfoz|zjz-q;C+bH=fask0a+h#*iRPHze&N2o04N;H5*X@s?X_n&$d+0@k@8DQ2Qga
zx#cwyJI#=ZX-=5CgM6%kzw3UA7s(b8`(4v)S<v~8U!755yWUmbem+=2hQ$;iQpM#^
zauOm1nCf*9B``J&fX*;p*z<@3r(3uTcoH{S6(96K@7C2%?{HscP;sj6f?hW-xTE#;
zAuo>cQ!c{GIm6?_E|I4-M~~*v{=@`VY@)D5OUIM8{M7!2_xo`d$_X%0Norn5FrIxu
zexqrhJ#*RssB-37A{-s6QfJ?8wjt-!!2X)9EV+<`d>&Uv?Y8@_TUr)Va;csbEuBc(
za{U>6`IDjJTIhnEoel0Uy!u@wf(H6v2h?yx3UCehfoqCpAILVuQ5xfk1|H0k>v9HK
zxcXK+*;rY>w-Thx1SjjwKjGc}d#D2NADF@(FPg|na#Ad4wC2wvIwxZruFcSr(UO1Z
zCFk5>`8e`?pp?vM9Y2gf+75-NRph`dCCrY^bX7`_JqkNrepXR1Qw~pP(nW?|c3ZOZ
zW0o2cw!5Zw`p3Qc?>&Ei!V!`oIht?8$5Ud*=8wi}j~6E1&HM|-)U5m8F{azk0XD+l
z;P_URh+J>Qvg&2{1w2@zqPC;+D)&hvYjs5U7%>v9p85R%gPqxUEBwP_poQE}HsL9>
zw+l2;U{T$_8WNqxVdnsfaqD-OWwOjonw_)7wQ1%*&Xb?~-~$+?B(mgiCrymGZxJ;%
z(TxWlwdxKb#Rw|2nXghM_z&_pJsXyxW&1VE&>I5Mi(<mG6vAz0>+fKjaKzVb8}{+M
zWn|x{iWag7g?{bjW)0TA2Tp(eALqv)PM{fZp6~PnqGFBKyKi8rdEZ)$B>8`0@%Z`C
zzIcPM%|-uoj!--aKQ5~5g>pcpHZRXq#EA%%-@J7&D6hb@%+4iTfJd2Bb#l?bK}|XW
zb<#<I;osR`3t}xV;i`=|u|5wpT|nD!<^oYAo5`8pl)wimGOgR2rp~w4m<Z4>0^5I;
zM5<x-4l7RO<QVFAa}B^`+P|E31Hb#fnfCvqndF}x<6rs_fBxuyQl_nS^OM*xI4NfU
z{?i8vsq(u(S15zYK5yj{G94-m4BsEt>Rkr?oLhNN|J2>E5j8LP`vgEbKklU1FrZYx
zo0-k|?}p2Y>GYm@Z~=nfK`TwO9Tn|n2d4#R>kI1$-or>q{VEJtOXm5ACx6uqILs*l
zJIlhPuFkQ<jl{6Xi!8t$Gpn$cTagLxPlm9VP#ri^eJx7@&`_*LXT&YH_fj1G>OKDI
z+Up#_orgngJ_WoL-+RM-^xTCyWv#KP%8TDaZ!`btj5d}QD<}u-_u+mYMWynaoZjC$
z(C^)#*H1C#XiD64xH*!TUx20yT<#xb<Efrk<i_-DRLx@HdoanF^i#KCUs{&?Ep&rX
zgQ_v;MS}YkFajybe_c*KW`?l;t(*0dB3EjJ2MNN|guF~GyDhJ`WMh45C3k$wHH97v
zdGn37USFU9A!)fNVWRv~&_FRD3ko}<QjLuBcmz)y18OdNu0Xxhe{%hqO?oJszg_Kk
zJOgs01nkdErp<4Dx!kMtp%(#={_b~3s>RCPRHJ`g6d7iZUflWg@}B<c4fj_TrMKNU
zVp`n`SLZyOfua<?cYRZQYt#)Hx~2tf(x!VDDUYa%ciYB7@THLeM`E^y_&HB5Ork?s
zA08_L2yP4#9y1PSX3>XbL60o71g=(N<R-%3gcld2tqO)apr!`S2#N%>>oNUXQPG<k
z(@cGOdP_N8XlLW9%SP-z1q5-yizCL<)r-FxWbrgPufXIC2RXn)_DPpAc#~emyY74&
zDKR6l!(DFG$ZER%rQOhjmH6uwIfn*xbU15>EA4d+v61<1cx3p-!FNpTJrMqIjQuu`
z9&}6A-WI9o|M#hSX3$f3V!K!fKsCB-mfb~-i9PmMfE%3iN;pwcR605)!Hqlg9-iK^
zkea^ShzMx=ZjH_h$KK!eAo6`22y6v1^LfCA?&tIBzm*no49LzQf(p=0@R_6<I=y=4
zh6yCBtk`!&lPo6Risbzt_TDop%5B>gHDdrlKoF3iA~|QI02LL<ITSe~Ip<IU0xF@%
znJRJ)k~0WM4kaKthoZ=-h(&rIYoB%R+OD&ByS-oczIOiDXpNGZ-~8qrvyU-*?}Ip4
zv?1Od{$^k4eR&~YH-&=3N!nrL$~wGzyf{xv7ibj0xlTduhTowWvTT;O2G(Zit%HXu
zGkPJfl>|~e0l5`}@SfYlT1%9fG^V=>ea<>g;sk2xz8KNh^>P?i^ljkBnv)r?j_KYT
zf6#Mc`PB<#v1dHqX>)o>CA$<zqSKY6ee)UE&I!--?$pgMcv&-jFc|#$6xBnqv;luu
zffYwFEkJQI*u0W{b<Y%|b5dE6mY{X`=u0EGP|uiPB=0*Ywe3~b`_Ex(MLX1zcCHf!
z3Mux|&3l7@aRfD6{+gcjHRUNu*5nPPN}-;c^@>`?bz4UGwf*8XcBKQ~E0zplH#XO4
zR~1dRBolQzZ+uy(fScqBk1I=)NA1QO5!qhobiaPgs`h;m{O{T0Un2I_l?&YY{nca#
z3n1J=VLfMt-|$*1+cr7pw(0*KlaKvQj53%N=OwsgUYhpX!)u7wO0Of*dqCCLXw?Yb
z<d`+;j+eWpq#;8%D$$|=Ey#irpoJQ?f53D_pRak3ql{YUt>iWMq~uv-sa5huE*nls
z75})lYUT@swsi52iBGujs7;k$=aoPgmd-wDNZ1L_Y7olYevH9*bdBUf@w@LNH?6E;
zeMxOj^&;gFH<vcmP9l(=h9k;<eU1`7Dup12xEOg^&UJWQzPqcND{M;L8`sX8XdU^|
z(ToP)^*`Fg?X|MQ?Xc?d@lXTqZf=({vH@QASF#i=X+g~QOeLg+T?OkhteU`<n}v-n
zxokn`B`r-qU$zK)GdTF$uycNUTXtIhYJwJ`IIDDYBjiS7H$bD5WNy|i@DMX&^+%hz
z>n5&%a9L?-0Q<wISNRBr&3R&OJE)(ImfNm$=d4Ze@j>eNcvlE#9{pn`{QVh#Qg=Sz
za$Bv5vrK$&=Y+0YU{v{8@#!1P73YLR9T<s@rzK0f!R(!#U8f_gnvPMi_$d_U;|cdW
zqY2k?hsTFLW53?!_u#GVv7*Nh(}AxZHlxecQXXGZXAP;#2sf8NV~YZQ)D*t*w>g#@
z;*G=sL$8X^GQCuC#I5+Z9A(`r(goWU;k9&PGgF{m8nUJ68#8OfoB~1RCt?+}tB%I8
zN<3rf<P7dl2zmfUp0=vGQx@kXP5UaZU!-au^S<7?X2K?pFNr@rrB{?-fBdC+Zi*C#
zfsE4CzG^Mmc5!w$Zvip8x--d4T9JH85T=uuKOvHJ3S$U;so(|NcYz&~Ocq1VI&2<U
zi4)x0UGg6d<_02h?>ycuc$2+KOsDx{QC1@_YIw;#rRwtD{pWX|Od6T9-dT$GgqGw}
zdq7UP+%4~7K0-I)YdxHOKxfj5;Y_jjaMpi(6<56e=!^%=CyX&9$!-rRwvYevPH@#f
zyjx`S==#`l^Rl@v?`)Uy&6LN!#NpJp?`cXG3kDwBsMbFeefA8CVC1Hksvn@q<Rp0=
z*8QYVTDr;JDYq#Kw48kk4X28vR-A8X@)KnCW&$F(M2w~M?wZ&s+voU`*ADjlourXp
zL}SY!wUNVmvRdKQU-2ATlkZP^L~_>Cc020hf08%;_E_Y92i4#9`y(JZV1H1qt`qje
zP?a<!%$$>b8lsn8p9XiH9uK&gkf%6Nmten(0X>cw0!@8=h9e$IjnwiJO*aD^dZdk=
zO3dG2$wc3<FeqQDTHb5*qL}<+;7}~>O#avRn~I;JC(Uyw(U^c($zrfn>$!Ga6uD-G
zdJMCtw#-0nx3|_;4~st{ldkK1mL}a+8^W|_1f6jzMgK@W^=hLAG79#feU<|U!Vp{T
zaa+A)M!?!Zi6G)aSPXZD9#P|F_!sS79XI0NsY<lql^?3L7YODl=Nv2FFhevG0iB|h
z8+?2U%POKeqHDOU(>?DQiCX4NGIFKw)1#B3ji12X)BiZ7@9|yet{^-eFYPXng)UK=
zf_k6VKY@lTUTpvm0%-$158gWiDoCt|<Gxx>pzW}E^=!++8UR1y>1S*e#;t!@ScF^9
zhpoRWXanDmYU!OwsJnMsJtz?To#!?%s~l&)Mu-^0`{t2o!|@Sn^}_CbO%kVK^V~w0
znKwb05-sL3H?4C%wx{r(wB6~TVW8Lgu5K}nqxPq!m0@{EQ+XsONeLI5jnxa<{(NV@
zVcj@7BQloj7JmhS|Go^?E|iLzB-vO~y}MU+5-s#^Y1?`|TdjP<L2Iu~cwGkQNWA(B
zU)X7%iU++q)u#9Hz0cbH(XWf@RzHf{xyGl`PJ0<cUy6A3hO_m2=|8Rn1)752LCy0|
z!#jw0Qa}1EJA|3*@2#Z7=+fKOd7h0?oy)7QTjE#tg*eV`HD<CwMZVmaEgOPIwU*@X
zr`^7gV`q4MSx)%&5b=Vu;~$x@-=6_|ww-p`?>r8|lRQRNh3=~{K$>n(mI%<xnu}|(
z=7si~;saK&+Us}&aFe@M@-~$Vr%cG8#3?pmfjA}1PgjO3oejpp2Fe!x=-YYEtO>R3
zX;E$0%8lM4N*)7(0T!d(n8(qRVY$cqTwq}UJ8}j61VmDi+Kd-8aWRezBNAUVQzxF8
zrxow=Q>&dfs5ENh%*DcQ=+y?(_?Tu3e{m9+A64dmvO6tRF~97`_=;{_it+hB!Uw24
zaAKuC-e2F??HN4-iks(&<8Sr*zxc>bc%~A--Z^f8>3DGt+d&hFU#M}D4>$oXJ`*|@
zY~|{@*a%32>*ggJXi3Nz{2A}4(&Nm0F&B<lh;o)EuTlW#UcU{fru$aWfL(pvw@2T&
zty*U0r0{K{JX?l*J8VX~i93`vN+!*MS&Y@y9#$-gmDjln1bm{;7hdd>uHn3DSoAXX
zb<3%>+_NnfH??yEVMzk-Kp(p~?e$&SPx%bAu>@8$UkamcvP~l0RsOlaq7x0kinX03
z6F1<@^dD#<7?5@rlG6V6iw<pq>7NJO366HJ+COxjbRDoYr5G2)MTI8CsY=XU1-0l9
z;i~1f_H9<kC)trs$*}ry=`dDAtHdD<AoyZ7)@MS+ENOs2;^}R%#Q-p2XJs3D=5srd
zVC>6Cw!4o6u!~forR4sj+NJ#)1}%IZ!s_?l4P$f-?j@H({7vwtZ4N^yf1HVR@Xx<2
zH~Bf)c(e}Uqvd&^wj$G?Ow`J$DXvauy!Bj?*TaoQ+=`JE67-L%14jwqC0YhW4;kG6
zDmDFB8KeH?T|a|a3d7p^klLv)qiOd>SBK)GR9(!A1zXpVXiVfVABRV~yJp}-woQh}
z?TH4!p~f|;%-}IL2O@zB_cc9y-X}l>okyt>-IDKC{0b+u`<ZBTv&*U265u<*ZZ}X$
z4$gNN7i3}V=(P0^z?JMWv?5jSE{S_1%IMk)Qf1auSk1!)UX<qbVKRgX<v0T^vsLw5
z4JJmFGvg}NtmB54rT=(DP<?w2R94Cjs3_bx`?0<>&$3M@XPmz;enbsaAQ!_(7H$vt
zmpgO{+>I6ktN4D1uo3K9{T!qQyg<9Qw)+8*{#-f+&YJatt$ICTlur!}pd^veyP3Tr
zi)}*0dytx&{W>AD>-O<5bM>}i^X11f9NyjDZ^EbwhefwN7dfE|J~;38a5=9&snYB8
zu2Z%=czqPk{cP-f+bew-)3@5cCO%*nm*)gLT*vE@73al?aR%cW<A$Ms++#N!MF8PD
zpWwfQ?`G$x+UG<Td;dT*nL7I)qRBsJX#eXJdC3SY5j9=K+yB95FF3pZyx9IM6ahTa
z|Jx+_|9j~F_;~*}mB0QG=KSRy|NmC5;Dtr~^AEEwtJ!1fU8iLK({Nu$_}ZIPr>n|j
z|5T#+V`Bb|2jl*-ajpTE_15-|E$*)9t2<?|6<k0aUDT_VNyAKUu{rye&cs9ts!=n<
zya{tRb#z4Gs+&v!NO;!9DtWVRzFC&1#fics|Nal}p#D|I$d9Re1xIDovzMA*-~znZ
z&g<kOlj}n#jn*4g?#U8B&qQ6T$)v!cB+Tr*-s8sF1;DszASaa0<YUtmP+>I5Prf_$
z`FkANaqBsu{~?V#*kQ^%4SJxx#Mh4E`@vcU6c)XE#jpRe?V;3oOk>zmm_N0h<HdYn
zm3H&8b+U2M1=j=m5yN@SB*TXsr+Nv(<iZDY+@x_=eS&Ye`_to`2|r1v-#q%|J@o$4
z+a;nG4tOxf^4!dW(Ks$^1EPeXy1T%MgZAJ?OI-iO;3F57_wsmPsQ^&!#nZ1|lqGwp
zzZsfco7_;)n!IczaX_MDvWQ#?x|2roypx06Jg-0MuJqVh1`~N_<yU~cVQPiooE%GM
zcqS<kq|&W+&7x;K)!N04BI603NqDu&@T?-0xTSsdECUW{6{zzRv`uE@BRA#ixm-!(
zB{C4ei1VRJ2nW2_yX+8iGxdV#g1ni}ZI|%3-m!l{;WNn>&OKSrYRpbaf&1^2afBoV
zh}A&&kzcMJ=JWBYP1-sZ)@X=#nn_tXN{rKNt*1n2LL2%^LnW!lW&FZuz(wnGS=M+4
zmfJ)Z^=%}_f{5(mq~P5`&QVFBs2d^JEK`!j!~hF*c)K64SvDq7cC}(L#R?TvbtS)y
z8};)gz%{+j<Zmf`VeDpeFRm|&WE%@18ogZp7%)B?T^v)aSkSvrSwtWC<(CV}O!Dw;
zc;0YynVN!*tdu!Q0~uj*VAnbb!r#S!K3b)cAEk1Sdspi)&C<bVN2n#~GiiD=G=GZK
z_%hOw^9SHep&0utlyhd^w2Yi9Cv}=W?e<wWL1M8sqX&pf0`Cq`@{Yoc-KE2dW=(Bs
zqG~qbq~pXRelFvlg^npdByYw0WOf}0zK9b|`NUcTNcES#y}RriE8Q+C5LN}P)j+{<
zR<mQD)FEKx(5A@3MN0@bk=m(wjeo!NLD@0qWbl%!SgT*qf%)lOz;=~w)bs=EzDK`~
z&N1ya$2%nK)2-*ejV-##dCdV)so17ayC~;c=7AKYdMh7m8`U}RV#0|#zeC<sX>jvT
zo-PbQjxYW#ZKK#|m>`(qGyV%1#^T)4pA>KZQjPoD+2Z{1Vs>VdHuR!j$jrH|?FNVY
z&q;X`ZB(NBEL>nvN^1lsLpRyraV3-a9G%Af0cQWX@duMO!^#B(5RN-hBf^Z96<o|^
zPN2KhsxL|hu0+gFg_Z9%$@h=O&Qk@Smc+jXUqlT+O`L}xT%3#Mp{^sxDtqi-xpC2D
z)w3a`t25lVhX6IKUo1GZ@S>ZD{}AJ{gYc0J#d|)ALW#u`i1W&)<neR-yWi_y4i8|v
zI!j(W#lQzEJ8kGir}MB|(%wWvu5?1o`eKWp>*@eUKn2y5A>7R!+O+W<Ndo4_4=Yf2
z>Yza!&J&{{7C$np_e_%H0M5W4_JH!5j{BdXv=8;;4cJ}E#P5bkA;yg+^IYuXZl*74
z$N=qWX&ybVks2!b2AUNc+%%Ja5%|9l%zyKPmp1@a!u5crF|)g;N9K%y=fZ9Wn`9Ms
z%=g_CGsNN|OjOt=DnmogUwM-`IXYa;uIi}>xf|_g6QDtiZ|#;{Ch+WI^7=GK2q~{$
zvV}s%9dBUozhtcvu9C3jr#4n$JbIu*O&R~V7sT1D$&7$0jAoxCJNw%*k&(@8nbF7p
zXsl#HtQq5JMR}X)aXOpl4Xc|wE9=oAb~sM$v|;nBxVfY6i_OU?J6&GfXW1ZL4;-&4
z#MM$GMLJY!MJpP*u1!W;kr$_|9aalg-rj^pWx6}7^?KXdD#WD5ha(B9Z!MeKq$8tA
zHS6QC!pJph5nuHqA@77cNo-bXz-5pM5MA_TVPfmXMTNLg%&lCLBEfh3>r3Aq=fY+i
zq7d7W=RR*=*Uk<PF8K}GQu%CQEcko6Fgu_-0*4=@dalVbh+`Ytow#uC^-Mw|uY}0a
zwcShj1T_x8gLnKarV1JNw^n*+BTIVxs<Kl1hI(GBS|D!2F@C*64x%LAL4afvlx0jb
z5q@rktnXNy-Os~&6d7b=Pok{vzH<fsyg4=3x`9J<(%Zhg;)-are?YMWc&i81uQsZs
zt?}i*dCz|?$?t`LPbN}D`)Uo(8R*e-w{P_rs@j}*C)6?YQ6L9)I$wk=%K^LdX?X(D
zP^Ak^t#(gT<>6I2bU9-uiSOpDvHq3!MDB{<X4--QTHcD}NAcG74g|_Oo<F!1oqnYj
zjOYF8J#$g*-3!H<ia_Zen(S5PT!AzFK(*u|LmhGYmorHn_P6Y<=x-xExesY_9$wCu
z4-p4~G=tbW^}|OAlhPc*T!4{;0E9RNKQ&=O(Kw9GDDpGQUKmbU3X=?<ivkN4hckJn
zn4IG`kc=rj<fdp~7hV1teY9_feCQ`i2`@U)St+H6_Py=Wy5>rLcwu|^Rz?JO`U+|8
z>4%22@WSy{76Ze;`?=!lOjuKraU{O*X%(^r17e1r0h>3>sjc-En2#N#@lM=bpTc-<
zr!#OOGTPES{<&g$^_q+}01XD<%_u={lZ-Ezj}bN2XC{>nKDJ<3-aYioFLOSpr`Gie
zIeHVrC=D1bLbj+v<)Jmcu$1T~YiF#%Vy3ZOy)gSmDE0GtPR-zn{%Ueq)UZnSFX`yB
zO$<NyOLB7)X;<3`Ug#aeEn8&<Mw)wwYqK**Q*f3hR=@CNBZC4W66E%pW>wJl!$waj
z{>V+?5)EASlMV`R$WlDp97d!ok3#*iHdG>r1(%qFA!n?EvvA@KVG9Z3z@svz1?Si9
zGRArHK^N!SmloEO%4){oS3<;Qc+3vlu?B~aV19Kj^eMGB`a~-8$<aHHBgOCM$2avM
z@;*dRUN)>7V*pw(VO%^ECFHxi8UK`^{AW#H1uK|6wqDq2wyPrF53##${o|;4%Y^&1
z%d`WYD<71=y?(!G)Iu3X&j>GNaYSyMC@A0l5Dnq^W?7;Wcq*Th7;as{!`M#MP2k;K
zRcsg4sUTI`1<4UVHJ=9I){n*y&UHv^gG$$iXOLV2(r-vI`k>1~!nduoyFM46jyhgq
zG3S+e!6wb_o#0$`I{V0<(cQTudX5+3X`i~aE)gd*;c-+xDamqrYs%g6?X552yvXn2
zoyG5P@+mcYyr1P1&y_Nk^n*eUpHUc2E*hE`H9kTYEXKYnXu`0;Upa4^I+zd7HX{k{
zeC}*LwIp&6$4Y(^F-PCCF!MI%0as)j>1hH|#O0yZXOS<{gu$1nqYjZk5IfnC&~du5
z!@=n0wwJE#m+2O1sC|E`{=T}KGzde~X+syjLp2ynodJPB*n57+Zq*;-!!+e1B9Zo|
zv$pgj8J73wRc3D$2mH{k-DzJh7?-Pbchc%?x3eXPCRtdLs$%M&Jn|gL4Y=0THS?GS
zp(|6+n~5vj(>fV(WH|XexG7-<vl=J)B4AAji+Gdln)?gfjxU#iSy(zyuQle+mvNJw
z$C?Mf>|BA%<A2^}t5D}jEoMSAj{j7x(%*VfE2x?nZLAE-46)D?>aRh6(~jv{;n#2=
z@f#TXnD%u?7#tj+*{)g?<RAc=#7+MSBAI4-lwmskn1~bhxb6;8Hp1q5q?@JIEmV;e
zJ(wo~cQ{;n7YCc)RrucBn)_|sSNT%AaCL2~)~B>7;z#!`ON-I~B2U<BIWi~>Ui_V>
zQdqfNJ3kB!NInfC-$!iKcA^Q3rG9xEkLt59h&&NDR>X3AEOY$^k^cdX<ognyv9kV)
zMeuR%n#<50l1@X(5M?rax=tyGVMkm;=UDyfn_+UVk9p^dyvoPeNLPhE;~GQF%-Qjc
zt5v73msDTIjP#Paxat3t!&C9p+7^vh5L|AX-SO5B&QL7(!&vfBt>^Jt7y7a0q@wXe
zjPwBCmHD^T`~sDgxD_%?@=2@J<foMq*Q0OhO$fE<L@X~28$!T6w-r=uK3F@FSsHE2
zGLGsHy`qz`vPcJ0sa<Ah@KXi|=fc9qwD|3m*uo&tr(<x2_n4zhla!-|=bEyQZ1EX(
zgS43s;W3dyl(D0`lnV?k)BNUZ%}>cFn`iOyM<Qn~(KKixUSlvB@>bNXXh0!hHdEvy
z3u~&**Ldi{CSDI60;qroW9wk&V6j)h1uLz>BnSG1`I;j=n7_fxzho&%0pGRu*$!qQ
zX9wr4s53wVRoKaMc7hUyo}aNoj=F%h*oSSxET;$Xv)xRVVHg~ZfShrjoE<b2TFh&o
zV^j+FYhWie)29Wi*}a$HiGK|O|L)20^ttqi+Cc^dqu(rV!;w_>0OWXly2%RocYFFA
zC49atl(p6kIhm)NN1t!`3kRMb6hcl{`vFzgCZy0D!kzKvU4+)ae`XOG3xGVcOS!uL
zg%7AM-1w*iNiTbgf6gON=fSxQz5hAA)PU43?33KH%QpL;6ryW#d4D36OF+yOuM3aE
zFgDZwH)`F*p9S=@+<y-F&msMH!wv!L7{&451^suw`~Cmlep7Vo&mmv-SYg1v6Kl$P
zaOsivUw_DpZs@W{{&QMhUYJ~pJ>tHclK8Jr13FRC%O3g9$9fMKhdjTN`tCn@q#G%!
z|B=au7-028t^4agES8%6V>R(F<NrTnal%5svn6Z*-ht`DnYxF8?>^97wgP~z9)`dR
zs{si#I8Xa!=3c$ob?)KJpF>0nE4cC00F~JK>1kjSQuioMF4IUbdwp}(Fl*Ul0lRQF
z*UAmLK)|o+|KKy;QiTdJan@apv3qiEp7td7C0@x49^_^1Gl(XdCiu2SV<x%Z=lYMw
zjapQrP*;r{qEfq>cRYmQ@QuT_rA=ndx>;_^ByhYkmZ1tcfvAkVp`9{a+eE+ZKz~L3
z_+nwrVZ(?6b8Y3ovX-O#X!$`iAd-)JsMehiAq*$^xi?FOaLW7hT*xEKJ>iaO-Rj+>
zto!+Bk1Uis?WD1s5c#6H34TDK4D;9u-=>&HRBPzUUY@9c9J*{#sC>RKH{Qi#!<I7P
zW%{NJw5o7YA;8UUbr{BUQvW!D@@R@@j=WOjZ!6CNSU#nFwrfN;h$zh|wF?_2F3^S9
z(Ts)N^+$e%4ySb&xl+&@5(r-%W$z}>upKjjv-q`etlNWba~Qt!8KI5jjRoC#o2;>N
zi?J_7@ukGm6)iqtXY(5C(@W#g-zpO|{Bg}v89GxXHp`uL`t1>gr7)rI<ApV1T9nZB
zap87)4U0qiZNWp9giYhsCwr^Ixx~77B~+QX*`_@yW1soxs)a{=8eyv(DZF*K%f(PP
zZToDm(c{#WW94?o{pemR9zE9=lexzzU$^$PS{}0(N&@U2!Gakm54wGhc)o%bA@zFq
zc>dfa=hfr6XFbQHaK%F7>@l$lkZS=-u`n0-(SdT}B}BgGRKeXU-m=d0_r%V*7YKte
z^qNpr5t1@Ns4ppCcDNI3ES!F6-}=MJtP%1$oR+ufg(Owb%l#nqQ8OA)DV}fPQDi_i
zSnp>HSKe>K!97Ido}gag3Xa9%tjx@LPC>zt#d9}1`A2R;6){Pl-^??mLYpdByW}jK
zwCmp*n~SeUrH88Bzoix%@Vx6dfGvKuvqjOtvhfU4*}}UY%@QJba{d$VA-JSEceq6=
zrttFxBzy3LldmRUTgI0ge#|s<`l`|y^6MMI2$y#C8cB}Kv<Adzc(sBhb$@nbohKpx
z%P+AysHkv*OpPPHrShW1k&w;9I3t#>s`A~ltenDtvY+3ur7h!zhX+leJFBciJsmxB
zQ}Iy4`a#p7-4xO6F>q<6<J8kd!9kC#O?N9(xI-OozV=&-&45#sV3|zLaEao2S~WCX
z4KaU~=Bg<*D4lbx<9)V(hM8{=)S)DX;9Q#{Wq%8>j{u2Z5uW24s`Cu18h?F({_Q-n
z9?JF#mk|Mpd(-p+-#3z$?s)yUHtLf%n$b>~HU(oggtSx2_fY;Y!W9u7RGROse{gIW
zCHM^TsIM$>q>o%viUPxO^KD+&&(IGEN~dHV_eub3R38&nQS;V}AC~i0=e<_816X^E
zc12vD8o`x4k0lUoB|cM&xGlN8J?q3W?aeOhDXN^Y`3-y1rEI}XgUueQKcqZVwO5QS
z?0_7pJW57r=oXl%6OTztABCR&HK}|~F$|Xv_ZTwFJ=^1}+!JEaSe-F6$cU>xdpJ#L
zcvbWOceea#3QYr+@~H<@4k1Gh>mBM{z~mlpE#=@5I%qazD3pckNxG2HZ;GIW_F$VC
zeGU`G5<UC1xMj7hmQGX8+~w<F>86<`ozKn%k*?Bv)p0qA+nZ|WX@Z(*tngjq7n>$i
z5;U%e3Vkzn+m64Lrw(rdTmR%*_zAV2sxw~M#Po_4KI?N5=e4WKyLG!EtSh>k3*#%-
zWGUQUYeI-`zKf>J0Q;|S3S;*Q^_EC!Kq~XPcjcI_+V0r!#~AW#q&wCRy)7+O?4&dx
zE_T%bZkO@IxqEY_aD;orO@V?8d|H|_@Q0zf_)0nE`@$2NXK#X>h>~o}SrUKr9l!nA
zb^z}i)uvHV2T{G?r#C7$;Xg=k#+uz52YW`>Y^CZim&cUJZ!9lx@9od$*89*UPUj29
z+Cm*--SMPw-fhfh7>%7AFYQd$a{cP)!Q`=6j0Fktj2EKQUYcEl-7<z}x-l~z$v@nU
z%t>4d=6xKqBNUM%^I+Y6(ioXhGv%)~MO*>eWEaZTLdcg9u&?*{r)eOvwN!w25G2&$
z!6pYWLJM`V4x{P}x?Lxi56XKO2YxpS{?2+)@*&o~Qp0gF=U;^u3R0j|5l-rE@Hh^E
z<bqC1N{6VC^^~6~tW*Su4!%|FwIsfriN>Rg*ic1NaT(lXnd+XqY3kkZPIwV|zbSs~
zir;I2d>`T=$@lws3wA}HWV4whs%@g&*s-;Z9~wzdeM)UyWef1F6gZFY)yO*+Lq&Py
z9!)-_S~Sumil8=g!_(@vY;zJ;yP48WiDyXSTrfqw++7>mSgW8p9&|W#E<aF`)JyS7
z*sNx(T)3naliyX~TGwkf(H1^L?3RHT{8}*j!n|O10HrsG3idR(c?%8C*pc!5?zdWq
zbQ8~U3=3pC^`Pr<=fx>l70R`&=<>+g^RUT9Q=r0E_L!6eq)MhvHkXId7&AwRrluut
zd7{N6);y-9c38%>Hd^ukX5}=bhc<Qi-IZp`47gr7DqB2`4RXZmEy&>{HMdIg#eHB*
zEa*(81+R-WHi|iQh~EK)+ZFo@@e&W@-5e(iWqdHg@1?gK9PLv!DWLWyMbRkkQEh@@
zigSV-QNt*yGUX7>V`CHh=E8wMjwcC$&#b>r`!(E``l20H^-%o9W1wL9+Q0m8Aj6>b
zWE?4lJ6*E}*+sim5M&y+xCgj8des_qiNNzX9|&3uz|$993%WiRSS*B;9Xs!RE!47S
z?cqEa?S2v1Xi}m~?1eMkjEIyJ&K~=+Y&XvyUyHjJyXhC~G-b@aULG56LqNU}U{O$H
zdCJwhT<O*mJFw&U$5y5_GB<;cF1T8*Xv7Z>I#}eJq1ZQk%rN2RQv~%uxXjEr+TZ*g
z1bIaPXOo&Yzk9$nCsZ;+%`uVNPxtJcVvv=#F>c~rl7~k5Z=lBeJ$s_>8>c~YhtG<!
zi2T9X$#prx>5_P6apW-N3U<qi>RK^PGXTxVtNTZjuj>7f;43ctenK|*q}H`a2=BRD
z6Bq6jrXEAhwc0lKYPfnP;B}PW0`9|r1HVZBvO8^6;zAl}BC!xRr!7}y7_9+2`>I_^
znoU=ISzXrl10fjDm1Nq1QwYKyjWzFP*NvDPM`97fn`x>^4%U&?^{pPO!bWK(!OK(d
z`c)38^P19PBT8sInJ=v9UHG8Dc!kSHvx&KNju?AX_h!SSgmjQVcurzxsKuO6gi-yl
z%$oxb<zpBfgUHC*TF*4`agSTAOx$pZrn4}6)i5Y%crZul(E+Bm?pQ|y62*CE&zUuL
zOHez9J8`4srNrN66v)j88FguItn~Y6QyMqkvhXG<2gP+3g9b9+26STwNasUF+z1OO
zcEUvB84|ydC(JH$9U4HCJyYkZhuh{qhLkA?+<VCn8zjhHf!NXbcYsH+_Wa#+&)t=y
z4Eu&I0G2?lxl*ydKv)3>fvS5dhKh^&O$Qv?_wDnjuT-h2fGzPV?jV{1@BuC0RO}wx
zL5`<D#oEAY8bpLV0q3fnufrlA9q}<5+Mhnj3+fP`<GCAvf`MI<3O+LTs&^yB>}R^R
z?1clZ9)eve5%Hg2cWhXcjH^ZGvBhh_nVo5!hTEBLq&q6)b(JSdIlE5^NjrUcZ7s6%
zvC_Uy!!&zKr;GuQ4U>~SmR&ouzbVo;uVtr$@=zW&>N@_}x*0GZ-;sx{c-vxFh7nF(
zXbgrZlnt19nL`AfTr~4Z^)v*=Yj9iljM+B>Dr6>sBgg|$L10!i{Mzw%^V2QKi=zL)
z7Z2O!7p{~nD-1@GK18lJ?{$x5b^T;NJ6>*X`%nvjB4ZR`Lz%{*to77_DShygnZ@Dv
zphK<$eq62`>~|eLvO~9$xGFS3bE|8Owv#5{@;E1s)KU?Th*WLgj8AkulbzS<H!`0W
z7Q0Mq-+A3xve<nsiYF2$HKr`Rx`Dp6>VwMzHYdEPf;6SikQmtad|5wa5_?LP3(YVk
zJ9g%%hX+SA7#x1wex>24d2}rSu`JOLRKn4-VL{6~Tken~k^Fd~qb<n5%!GEjPS|9~
zux5%zusX!U#G*#2uu!fM8i3V}K9!F(S+n-Q10!Csa?not>dj~<l>}h(A|U`QLd-6h
z7%duh^4L<YfTma94SB$o%EmB4zvk;J6J4xU!)Nx)vEy?RDRNy0R$a2q$hB1@n#~4!
zc{Y43FeNbu_M6WYYEk1}Wh43|0+GLEx6bt!;B|9Cs3;VtX%w~GJX;Mz;RXpr=#M^n
zGuu2p${i&kjNQ~FZ!Kkh3mUZN8i0ck$3}v+G9X4*ulQ<3l*khf1hU=-0rw}RoR*vQ
zLe3^85yP{tn(~p$MF3ds_*&dD*taMjz(K=qth8Pei7u9;ssKt@uRo44-9|1fCX0l;
zlsu1uRvpW=f98-O#vhRW!PnM9NbyrC@__C}H}{6uC(EGcQF^x*+ax(Cn4_->PzamD
zCV2I_5)5%uGhRKV_YP?tjZ*feB=%w-6<o^^k&c<o6f2KfLoG=8qt&b4J)Wo%zB7zm
zqtKew+?_TcDW4O9*=L5NCw;Zq_cYQ}`__lps<YnU8&@^VD5|lppML75p+B=M-ci%I
zy5)$`THH9%^!O?9q*)5tDK^+EKCg7l<Ty1j>5t!iP`y6n0{8uSF7yjsUzzNpJ-0IV
zuLJJRhW_#pdVwNp(V@&(pkvcV@R(EGd9>CaW_O-2J^rrN&HDGWd@BH`R2;pf!H8j(
z9C}TS-PiV?Uz?qxp=4-rj%+xpiL=nb(?Y<e2uU@xVYG{#HJ;r}SJIzef5p=VS5cUr
zI90uKCEGPgK}q@9J*{ew+cpSWbl~lPk1_FJq4lT8$!OWEu;SHr%&>yap^4OTR^IyR
ze58MoVBx`sOk#?k%vha0uJ(je-TNXxD3<2S--|Q|25pOsWbIfUHD`-$b+(G{bo&e9
zJpSDIwaA<sGTG62t8N<TBTzU%*HC^cR?AXRk)l_~#aO0t`$xh}10wB@J4qqcdtf?+
zot3ssG5*Z%BhR7ULx@$=3DR6sy=bxkRPcxn1g^=|q%a<7_c4%`COV}r15lWj&z<-x
z+~+Zy+|6U%_0THZ^h#Ds&#4;Bu8Sa}v`UU+b>3P}9%@hU3q(`uXD`vFk7ny$jGcBm
zKyX+t&Pe>7h7Mu{(tm`R5d7@Jj!wkdY^R4sBCG`ujf+jm`pEE+5n>wftIAZ?N~30#
z>?w#siIutr7Ys#y&!RJq@IW1-p3=XOVlAFY&GPRU%!E%c8NcDHW&qVna9Q?%9(r|D
z=o$~oiN`uFg57pLR`f*Gj`)o{)hW;b%BQD#f0R$-EZ2+2sp%|WE+&{H&$C)c!d1Of
zjbN5(Db64RFZ&7;@tuegJ}C?z#DmPZ<wH^HT@u<HpReUbDR+mL`r!7fwtesyo1@hq
zv~QV+z(iHLNa~9BMt64{6EpWZ#rXvzhKwk#$hF^hJWZ~Wl$q+4XX{#-%D(@!j`_yV
z1;f3sU{RV_&*D1t8B(4oI!xz`g7vL{ub-3WltA}Em^#!Ws$u{o6tPxc>E!|^bJ!8v
zbB)SL)U1W>K{OKs8I%OTAFacVb-tcSE_zf<Nn~gTkh$Lc#q?)6?7xD_R=@=|YoR&G
z#&)uH6mXH1m+MUD^D8r%3&7$50)xWJbF)g|mQb1YNiI>tj>3Df`om~)CPerct>j96
zVO09ac)ZbLRlVwazAMzD4TKzAgwXhCf)Cp>j_zk-bSmGns#{HkVV#zJ2t%*E=lFh^
z#{(aI#G(@Vo0o0aCYWUDk6RCGx^|z(-<{qPbmm{;^TJ7|YRxCQwkR#+S5hrOUZ)*V
zm2)RTVwT5wJ7-?CCehJesrykV<hX&Rt7nUgNt`49UfSvqw7={18HNX95umM~YNg$j
z#vtP%D;G!6TGn4DygX#6A;W90Sm;r!5&Vr`L5*lZF8++sY;_(4=<$oQe`(Es{OT_o
zDQAwq_N~^*wChuvY36*X<*^XgveEdF7Iwk0kUB1xC%kS$C<1d4G&bkL=l0A`?$%u2
zq%E(5rE05??HgA(@;FhN55PxjWjYruR_hiBoUO*UVQXB!l`&^rfQ;B>3VpmQ%G(nn
zPZ<&>_#^l9*7>5JHcMByrWpmD9QOAZ!CkEl3A9LN&z{EsGp-DJTjgfL5ACC+)3^J5
zmXipsM0cX4{$1vsL&g`j(Km0g8s|QtaqHEiPN#x4@n$wxe-C7Ov|_qn%H5?FiXl>v
zOxJc-jW<u=^w#^Xfjl*FEM%C<WVnWuufoylJ=i-~<a+-l%0QQ;q)C91MWvtBP+uS+
zqpgE7qb(96{<BOkwm6HM=k9d9WRq-D<M>v!*@?V&flM5*(iK-ZMpdi16)T{r>WsH?
zJkP=Rof+4nJ6{gZ`36sQOUz9$i#on@qTT=AaeW*qjQ&{fV%_`d!`C8-L22^_RGVO@
z2VITpfV;~5v^Jptuk0FJi>>+?$0>osG*?03Gu@zkfkn9?yXIBX-I%9iqbnY4DZ(u-
zh_=!BI)mZ^_nKm&RMh0}%8T!X7g7+Fxb;lXP&(61#_QRxA4@ul3OsL*BGuTJ(KV&V
z?WjN&T-0+JhMF*At!&JTy_LrKBbErVED{whika<BPC<@+R{JC6=|l3<JZ7At!$tf3
zwWI_ZV{qw~4zI(^$Wj|ulFoB=nH(GGTVd%Y=OK~kr7gQtUH*HL92JcLY+YY$50L5@
zNlpj-e2@2Vk~#sn5y_n=tOv@yb6hw>v4ggq!9vsUn_IsORKIYs_B!e7^e(BZ{z$Iv
z-C+dn$e_;B)T5zHcq{uh?hUteVbn_-ZDXfD6ZlQ=h_+oHzGB`^Tya=<%9p8;^G&Mx
z0^Tj^Px=>Yk_k+sJ%RLOdklH}bAFOo9pQ%cuOitOcy`<~N;ARCyPjr!y~-OtIH&Zz
zZbHvIfCvFp7C6m{4)p$3PTzWb0qfep9_9Kk?ryTKpbgB;Msg`%JJxJWF7~6GR%N|Q
z{ALHJW%lNb%NAsE?XL&C*jUw5+2|EEy!rkFWaf3mtM{yv_F;YKx#M$-A9Ia1=!(5)
zkixARW)C}u^aPa@o8V(D=a<A|QB&2&_+JMF`++1*FJD8yWVK=|#IuChbl7z}ehSCf
zkzTm3fO9=~V*>tZwOA8MKv`!=nOUv4eHHCjl90A+`$XWaQg+i)0I-2KyrB-1UvI@w
zj<~?fsuTl`W#f&;DaU~`>Ax11Tjn4q1uz$`nie07R}UKZF6KfjDw7^PFm@33WeUCC
ztG3n<SN3PQ|Id;-NciGtvXX``eBO~HWj9nNqAV92V!KBfaj@2;%z15h&Ft6m!&thU
zdU{pxP}c0V0L2Yn^v?AFg|SGpFQfrJjuJ^*R4McV9o1Hfto=!%H%iUl1Lu2`*E}E*
z5mu`gPqA4HD#!S(RT2aIn02O~R{XLo>EnIz;ma{4-A^~8I19}`gNARTsktPG!8dC1
zqe$sb4?v_W@fF8la9D2MX9XzS<)@+o8F{A+7x(Dubj<-RvU-jC6O6WSvaJu$Eh07t
zd~mgt4XWrtI+oaejCtECtQ55R(ofp6*d@NdNL5@1`p*N4X$Wy(>R+>2vh<wKv*?f=
zahIEaGjt;$A5|CsuYzD{TyC5Xu%c8N3d+glCRfpUi5AmX!v~psn_!BvpN#L=`rPU@
z)dDPxr?-F0%)X;9BswRk!;U~U){?O3w^@v39H7ZureoVJ#{k2-U#AygT||_Uy%e$q
zC!0XrtE-BH=NsK{PB8qYHkS%qth-f^fo<lFSKGO+`C>g7)*d$a4mLpYS2}Co#s8pm
z*YJ?L`|fyJbsM3C3b}^+edBZtgGnn1NAg?8l<=R5z8`o*eM+F{mxX#s8uAsXxopto
zN&(zW7EzO^_G;z3cB89TUFKjc-aGf3O!r~w5)O32p_RE^Jq{Z(V-8h)>;)#ZE|jAC
z=7;p%VV?&l^%rqt;-^?a7*f^<JO0Ysx$KUiPe*mL$4n~cQYZZ5P{-{19=jfNp7;Wf
zM|GzJru_d^@w={k6d?*m1RT7t(^7f1p{ZVn%d=}-mLRPUt}EMoJ^-Ww*<~>XugreG
zwsV%gNCgJWg~E#_5;vjO<(1DLBVcz~gGy$vYUu%#2@sZ5v-r)B9VM*7X3*&O6Ky!y
z1=hrSOe6xrJ@&22gEcD^=<?;`yw9OKC(!aGPRGK0q1Cd3vRLnW5_LO}2b=ZN2C)cB
z`iPot+!M7T@*+ZQzV^U=Q+^8-z}+H9<JRt2NxW|?lUO3pUxB2HD6$E&A)<6wys_|0
z#)!S;+~trf*CldfeaSR*^n-f?RLnop$<?_!jNj}L3)yw>f6XwnEYo`bE~$LG>Xs?7
zrK9F?xT_`&ENpQRutKp@Z*l7uJ5;q3ZnwOxD<5jDc`G?jn=->Hgu)~USLOiqikp@a
z@xs_ZY*4xc;#er<Ncpu&ZNZ&5ex(|rSIsGq(c_UNRl^Kj=i1ct_}6@=D^1QW5834m
z4=Sz)PCt5HiA%F0qdV2+v<TaL9uCZQQCZ9fF*Cp46EB*J+3t9Ameb5vRh8e)@Qprb
zr5I#0ivQJ+mFUz>3+Zwfx5zA$s*A#oow29L6P9y5EEol5Ffvv#tRMMx_vgm5yV$)=
zs1AZryaK31<2{!sZ*Y>RLwV@Qk5ucj_iYb)4-Pt?Hx^^r`MU);C{HT~wk$O6O-;=`
zv1s>}r6?F8v=?LR6`HozPCG=zH1s}`!>=(!Z^_b?L?Tde=Bh4NI{Da&o`$Wraak8}
zL>anInX{C*Ay6B*?fOOn`!VkM8|%d4T->|4d~jALs-*%mNPl6M>UMow*>u}Hzfc~%
zU|A^((6d=pWsaUPe8&b87i)+&HZ7ppaXS*rvUh`(Ok>^!&e+Cz=W(J%k59nyw~c+C
zsV@4lWr6g0G>~5P_Z;ZyXdZx>q{feB&1)jtEOe%7j?-KzLx2pS*f)G2|6eyWB+&ul
z)|8S1@VQ#l2{=Rteh_wN3T<&-XOY95Oa41vQUM4eJB-~soaFNzJ<S*_itIMc_o)pZ
zUI?i-&FqaEYr`@RgSr{cY-WB2*b{^c@8)zdg>EpYjXm^g99>Vz>*8|Ojp8?X@TvbB
zO)=p<uCF|}Buod5Es4J3g{L>HqDhpQekH>EKzqXYdCibedgA*7G8CJ;<}X6i-l5VL
zRcI>;<8xUipNI)&$cO!JF^DzWvfu~V5#s1d!pg95E6xu#-fFxs7o!9wVMLFJLc_aR
z)WI?}x1scC=ezYWI8J_7Q_Sjt?vv)RxHW<71Do<IQ5@bqo9w>k5=Vl`+fgB#buL#l
zqaK*j>uWsuX*yt5YYPfUsyh(`|5~-lam=urwwfXU!bQ)4vj#A`M>HXeLJ>2IVfIsQ
zn16w!;$zjOy@ZCFF;SA5ow8N-=ccZwao9{^0(Ulj>W(=R4-_|_AJ?JcSztJMEjMbk
z2!4yjSG<5r@24YoyiP<a{nwHgPMPLkSrqPIIgK_?tjWwb$NzYy?tWbS(>fl@ha2hA
zi`rwwcRG}dV}#rmT5dI%np-sA8}~zcEnK~JMEcovX^-wcOEtY$YOeV?@ij4`;n=*Q
zEbdT`>w7#6&~D0&f?Xbj8veNQz{^YvL9SbmnRtIWBn0fd0aNvi50i@<5SH+2`s23r
z^O9MUK})u$w4J8m6ILtQycvzc%<J(PTrCYK+;vKdA;YE^O+!M@iS$an9G>bu<J47-
z!Jk8A1Gbd7y+Se)Vv4*kV$Uo6E9Z%J`~w-i)Jvjh3;lr$*EuC@S#^HMzU$*X3@j&+
zMPJoUy5U%s0u<w1U-B}-V(s|wSXO2WxZC<pJGctYadgEemf5U;Dby8Ym}asSYaKNH
zIPF*z96#)sl5hknVx{Kz`?RyRzX<=9VclCZq%;>kL7bmW$IPCe9zc|APmT}}3P4<T
zwiCU5ezpyTXka#lPnTut9-RZf@tZzBJ1Da_S=ByY8T1?uhaA*QI{?jiet%`ZeG|YR
ze(eQ0Kc2p$zB=_wzlH5&k+*@~0RvED)DPFKAOdH{=KwQj5-T$C2nspTcR!;%+wup#
zf3Fati2)j@o^D327q&*Uf9^LUy;Pg<C+UC<a2?TO{!fS>|HEbZA1=%9F#6xt%>~iw
z&t-Ml2mjCDviyy9@%z^N|3I|z3c7>cyga2fqK>g6^&_i+`CZ1D#G~4(1mFn8@buvD
zZEP78${E)4gIQ!2W^H!4)8~Axb|6Od9MCAK)*JoG2FsWpyE&7Xx~g$vRy-xWN%XuQ
z4JB$Dk`64U<gPA0A2KzWfpTf{Ob-w~(xiwwaH{83W3A7jN*)p1=UU&5`wa;FnFn3G
z!0$Z3t+TnvD7V^eCU3gn!eO|hQ$6Lr8kS4xl6bC&|E!rNWV8O06?-UMYL_+NeV$QV
zl#>H-!~M1+b|~8h_)2HBOVt@E!Pdatp~f3D*9K0Dv@7@vplw$f*thAz%iJI5RIC|5
z2X9r!;{FB;{(ZSzbek-C>G+-sA^VNxw!VLL^;qQWaGd|xk(bk~#2f0)tpOKDg9XH-
z%LvqEj$(8I(@fL&O3Le%7)$ztYf{&+h-c4cpMVI@Clb05)j~qp4jo}TK0AR7=rVWP
zl8N4CshF||tm-@OOyaQ5rT_iA|7|%WF##uO&d38V&`2_iNMo>lQ8^iSS~yQ;`l1-n
zwF7#f-^=k*u`MOA3A*$-Dr0p4z4OM$C(dti8lLcdJf7(aa-RuX8Q?2Dq*!dEbDBL-
zP%wgpTZdy6Ymn!c+7lK;dCLj;W<<drr`*5H)p+C^z)8fpZYCtJv&-zBjSY(tV$<sQ
zDEs~+o{JX_g>v74kB<-XUTYMJ1g^xscpUJpf9|loQl4+nFCY+KMR(8UBoCe1<rHb?
z4Jb%dIK&Ka_nb`SdHAN|JRf^Cg86dQvs|FTQ~m*?G)HH4QZvKjOt;fLdyH{>572%E
zKBfv#&dCDtf1au>`-{55WR;t;Af?B#Jc|S;OQYQB_roOy)*c&57A-*`k*ZCs+4b?k
z;Fbtf?9D*MKz_H|5cP*ka(mxBb~)WyiyzlA8Haq<BlD9%<@UY8nw>j)G69RUl{Y|a
zmgEtpV-v^`+v0iMxaPB^SH8aC`3vYh(%Wl#z0fETVDAdxo?y=GB9g4){<@-nU+i0}
z7bSj&MGQ%>J#c-^&}nb(ke0e-!5!HJ)WI-oQc=SON153mMBiXF6AoBi6v@*Zhqd8B
z0x&F^OdFHK<Huzm`t%>D_0onYCfRK%^=o~&Oj`7vl^!TuMJMdjaxB%Lw@fPMJ@Og4
z(EAQiUJG=!^lwwlbwKR66WVo4ArI0SzArwl)m9-jY|CT_WNDrS!bdK~ZcHy3M<#dt
zQH2|+T4{vC^0!|@v+3B6C!_k=+!NnPlLsCoU9Kje5CQZT`dKwbVmfSv*+nNZ!)>F@
zr#!E&sh8(7b)j8%Zl7cke!*|r8|Kly%jiSm$!th>N9h$!DrJ{pZ~?T-i@-m+EM1~i
zB_HQo$5}oDp1wcogYyd<p;2MhXh_@xnV_Nj`aB!+gCO=6m+JdA3ZT2uz=djqB8Ki$
z4f^!kFqg2p7D{H;HUL|Qc2*xzDj49A7&#iZfy&fLg8m+C|B8bgUjZX$>Gl>fkR#h{
zZh3|CgDE5h(R`Gn6DV&Kcq;pV_?wX<P^?<H;{t|(8T@kOUkq!j8+NN|xIdC+yhbHG
zWiKfgW*9$;XwxQkDI)C-bD$1zA;FSaQ@W`a=z%LzY(PO4Teuh$g(ajEw(yG1?7D2+
zI19!0Ua4-rAsWp>VpLNvSeIH-7n+Y0lSKe3B`Z3cLB8*LJV`3EzP}iP^e*k2D+@Sl
z>ItrW{!W$PQQuDStneuIrc5alq`2s+vH=~K<qpSfR*CChdt&6)9AJX;l?gb=q-w?9
zCDg&;6Vz48hoQtu78;biH&-Tn(Wj2-CUXLDbM4{QXn?);6|&J~wt;CjEsyCw7vaCx
z+1PSwtB!lH*Qh8l*>Hb&H7rLGT6er-;V~3PNG($kBt{d9+z}72V~>T7|KubQS7uqB
z1W~Qe%y}pqbm9JW*8eR4UTpY3X^2KQZy5u;D7GZ`zE$f4!<T&S3xN-s3v>H!<Qjr*
z0dyeS4^lNdAeVCgoGT$r=w?(&2sOBQ&)*)f1Pb|x3k9(v_c-po%x;ee&96e_W;<_q
z=H2)RL{89XYrl-rQ8ZJ`%Kj6Lw{KY%Vg-m^vGdYCRA1eYIOG{yi*l3Bhf0v{F+Jd}
z25Ce{bY80yItVg#k^bKLH;UR{_CFQivLa3$(Oga)f|Y7O!nk3!y32$K6?XQl)rruh
zYf1iOO9E|Ntw1ud79m}BY}wo%#>%!LMgL$@S*mb2aNPiXVhZob)Sb8ipCBA7=)F>G
z77Mz#n=;L&D<rJ<hX-Ay0<$SXll;Tukw*g6)pwMN=xoAw7|FTs?1MW^!zWo6y+DHE
zZ*XLckscff;Li1oM=oi&kV~-jl4$yp>H>|EtfhSi#iTqD>6|>OsWhjMxJrn`8V$!9
zFG^S9DE?Xunq82p3T&Hkprd_j!h#4lHX0Eq$eAt{x}9#q0WC1~cCSA-XSp6OoS-d!
z5Q=qE@rG<#`$DK|{c9N5s4Pw5Y+A`n$Z57so~l#MS>fSxj{C0d<9vbYKIjhqJ67Ug
zg`9$-F=)o<sl&OT_AoAPN!dvGn_mVN-4*dv5!y~qNcjJG-TX<>E@t;K@r&>u`xrqq
z3c`0R)`+4tbEk-r#dgkO$PFjQlnGt$kT>$vgQKw)04k2Go<A?&v1)I<9D}HW<@(I}
z>R0)fK3l~a9(3i5>ijGRdH4CgG@SGu2iO|LA1%AgG#m7~QHy=q418vG1K|EW<rdfY
zlGSI($8_TvxyFP)R;+9u+htgz4uCwnKnvrc8?9IAxseij#V%=UANIE}B1*+!Jj0b|
zvaxTU;l^c&e=1(bTJRw*6i;>8)01UydX>dj8ua5Gw1=}xktQlulN(XXfvcrD5V?&p
z>y5GVs6F_MOyLnf;vyAx<-{$nR+lzY*nntZOwU1#l9A^Nv3?Xy>)=6B2&u@h#APF_
z0f^~_Dn_q`p8^kf9MC4yz>e8B#B9At=_>P|@MWEjT4^vqdP+0;&`4Y23sX^^Vo$3a
zJ8aqVk9W)%(qC^sfHR(wSFqm|mI&Ij5p&sKbAJK<MA8jWmN;XIBsHye)cX2Ce#k^~
z4OnKGd3Yi4wg;cPewHX=800dN+eiv?FOyP_2wpI|d1)IApgUO2?1obBgq5$|D=**%
zu9wo5n*m`e;J&|ROvu96p9e(Pe7)ySK@8VTwCYsvym29)D)@1tcuO^~-WR_OIDlP=
z@g)>*OeECuGu%;%0-IWcs^e~?ffS9Fk0==Q9iJ|?KJmEuE_s_M)R4=S_nvI0k8H%;
za=?cBW%DNiKx?MYi4WSl;?~v&qj|EK)zSNVws<WxqKXfl*_l__??`4H*+Jww+3+{&
zKe@<9%w~Rzt9@oLDlmqXY;cv?e--CIg7|Lo<0SUmg(}bFnjH9qYME{z0EAy#+Hvhv
zCm!8rTTm!Wcnqga&Svo?oL;juSpKrP$ti4m$gQ3p4$nzSJ=ye!8zG&gn}Vn!jO(ee
zFX=`<!w#%TkYBY~!NW>{X-cfLyfc27psv=7W2)LoJxoxi`BQe1m$#7E&z>-DaWWzl
zVk74<mHoP-$kJkLNyg^5kI{{zZPvvv6r51H5Fy?+wEtN^vvgBiiROF%u)PmkPixi2
z&qt^tm}W9~Ugo5n$T$uX3%uTPx8!cNb^$Aq=I}L{!;E;pFb#AZ+wR2Yh5a&&c~0@7
z(wQ>nzKf92yURlEjLpU1gKKhW@PWcA&Uk=Z7E2dF^wl(m=J!NjixpwC55#kgiu3Tw
zOjLrKl$2<q$MylIjMKsUf)m1bt;9pQauX34_de&JhiNM_Fk80ZEB?y&*f2Ac16RsA
z@wJ)<m_C^C5RWE!3gz~OabZGzAyS@NUx>bzJ5l{}G`ix&1FV9v5B!dqH>52oUPKfu
zvwzCj;RiP+js!CK3|pCXq62|@6hX}3-Y+JzAEzQBGwm}>6Yp-O0*iJW`|ek=-M&F7
z{#=RKUp7<&0hQ%?!7nbvVdDXTUzht!1dNoM%;-6Pf;8n%UgVi)J|$4_OzfPAHl{Uu
zc^Sg#ztG0aXGOxU`IL-rZEfKJoODvPP7Y^-He}ln&Cb$jboBsZ7wSg@GL~Ca0fssm
zIFJ6;=40)6jAuFY{OA!@l7U|ZH~5*dTR2u~UTi#wYH3#Yz+0B4xxKjBz=PFIa!781
zv~x`L9_ed}k70#kujuYX@5n2JyW}+p|3B=VXH=8hw)eLc8(;^esVGf)@2IFqM|$r?
zYUqTPh=_<ZrFRqrr1xGTARr(_I-!N$lSoT|kmP;h-g?g2`<(3^cZ~PT9p{T910i{`
z=2~;jHP@WK|NJ4g`UWbIg$$#=TR-)zCGk>{{=4ZU0?Y+YL_$eAR@CI=)4yvAGiJsE
zZCh6$K;~+sY6EE2%GbdgsS+nKkdYnDrT>g-`Vn-TJVpdsyI36xeKjI4wSG%R9%K)$
zzz8VNOf~TDE{3#~PI70`^jwqyGHn}s(A`$1b`pLBM)X(#`qgkSohsN>jT_7g#kS6W
zE@=CAnTU@{Kxfon?galOneoRF;=i3y|Lu(W^J(&5XVm|vw!Lo$M_=RsEMyRI$$j_W
z#gqGg=TFGX$dm>+iLcKVEDz|Kg6mGOupf{6LL>p{Bu=5aGr=7ricqM(A8j60+uspu
zen05H2guJ+!y5LD#~#jXI-h@9c3xH8ZV&Azv(8}rBFj0ZFVa~@n*ZR#OTCpzt^YwE
z<nLQC!+F{l1C0b{<A|Ffn7O`WXLWIazd-*<WaiP|`JwOM`)x9i2XS)hRp5SY1L$vc
zKk%qCoM$tfG<hD_k_*5XW|Xce&?qhayA}M;)(X%DwgY_^F|ftqOwf#?6-&(T$0}{&
zM9e@MXPvO<>FS`l;t1hkd&<8{%lv-UAd92NwW^#5Yw|w{z$3^FM$VV=W*<cqZBEDF
zoj2@Q>x%z!NAs7>>JA_j)5Z^OIShDrkIR~q-Yps*)_!5^Zw2JtHh;y>I<QuPI{k%X
zhv1nUvi{`?+*a4g`XV>APNXdnGf?TDTjw;jXjVgC$q+dA_qj+Q4>$lETsH-mP>3C$
zZy9y%y*n<Kzm!TJo`1t-eV40arml?DYsOE8u64%hY~<!=jfKr$JZ6atFhX>!o&jtD
znYfwRw~L?G=Hy>Qr=DK?T>f@Fc&q;9IctOw)~kqgj^O#{vdn+B+xJ0xavcC~AB&R}
zVdp(zlg@L`h_h?A%bT~OX1>=hH&q#HKZXSaqo5UjsWY~~$+)ve77R`x){5y#Utc3h
zc=%ND>T&-{=Pi<~^Hw@<RL#i?Oa&ZeGuvEw(eKC;u@B6reQLRmhJ86Kw@E5&Aj;R&
zN}UcgkCcm_X;t7#18!2Cwa#dZ)t$oKwlzjK`DtWyjIsXZTl~{86;P_Mxea_CLIrh!
zL6<Qs>e%yw<IbAli)cTX9It{_s9tU=VXMT@cIleogh^1WCEItXNc6W22X;*>zkudY
zoo*VS)}|>uZFyo@_%Ac-Pk!qOa06=|0-P<U*FDu|vwuHceih^E>i;Y^vssci*z3sF
z5l;?>@*Sc%xqS1X5jy?Z>+h>nezkuG2m;HhU)0V@<M6;4_MJoQK*DpN1UD3%gP-ve
zyQIJtJGSC~>6eZoV2O;^^@d}%u1tzvTVP4i3}42>zvhhfEN}A0oR6nBd=9^q<;fDy
z6vTA<?rk{5*rOlu!+)BHcf5cZIEhNB^$5uPMx4Ed(hANog9=?zxQupn^Syk$Qs?UP
z_$(*OrTMJqS4o<&`|=Vu3xD}_JIG{i-OZx<o3CwdiG_bC5l~2cWeN1AcIT=AF|C%U
zzJyHRx7nf9Ljc3VD!qa8^3h)z2fPmqVH%NMI{BO-6DFv!vC&!g!dE`Y$=mT?J0C*7
zVRw?&Z+S>&I`5$+3$#bYYD2npUAMChfpRjyEe|~yuuRke#3g)V&-w^oaJ=@P#^aAE
z@y&spwH?p(uRB6V;cj_|Js+yjsn{+n34lLFX!>$BXw%Ta>JQS^r}cQ1hIZl)TSiP-
z9`oaX6h+>~H|YT9MG1MIze}Kh-$ytAC#8E?RsWiBpuEd#?<;SKF4yH|R*5%G2X6ei
zRQRu+`wRK6PpfKA&o5p#WT?atmpkn4rePh!;It`02F+{?8z~R}b6)!Ux`RIk5{Ygp
zL#(3N%?L*@7<>Xpqb&AN<vVl1A^uv-ydc0$m`bla#6BR6Obfz3cpin*4gAI6-7&QQ
zY$g0Ke}?;T`O_H5ukZKaTDs{+Z{1GR5ck?k$;_{-8X*x-h$P-9y*mn4u;l%T2VG*n
zd{-Rsh1aK2me2iau3Wn_El&o^MGa&R{OVl+A2UhTmGE`TkozC}E-N{2Ew7TS^6TC2
zs3$<Q=tB2|F#c-20N*F=J+ObXiaCla|H5RzGyX^|_}u^X?}DSq%Vxe}Mex^yX8PX&
z{(brXcYy!cg#VW__~XD?awOYWQoX$-cqaYf(oWQ$w%UK$<PRM#1iWnpi(5+-5Yp#U
ze~TyKzqx8o#{TUsudLo=q&%;z(%II!t$ZbmF++Ec$%aq*T$BfI7VQnzMm?&os~K(u
zze5l6qC1!Q>EoUS=3#_Vf!>!Jjp$oD=3MQyagFv8S^-+V@9GEMM+1F?>r=zLpx8P2
zp>#&n{lc6$i+qQ2D?0fRvsXKYj`X;sD)Bw3{b;+UjIqQCojO!xjPWs87Ni=C0`W~P
zHcnW;l!N(eZ8RsU>rHV8&|~g%z9M<42r%>5Z6)sk-<2x+3RU06CC8<dRjh3fhKFm|
zW_``P&~^Zy(uGv+56i(xF0ECsdIfgz71l;RD2#texHzODy>!m8&>J*t15!>xK|zJk
z^a(Que{`XcMQ#ITX)U9qItm@KT#Ml+aZQEF?PQ|pflk4pSt;+irqMBD5QI|M6_baU
zOT~K4daFt_IpLDu<K3JlaZ+x`k*2gIxgNK4B)j%ys}bZe^+pOL7F@mYIL7|xb|Xk;
zZrybK=y~ii(<^#_wXpe}wZJf6n%j4#b)=3s<$n@se&g{XECvMxtaT9M;JJe%)pE4B
z^&>GJTdo8lmT4Oex3`lf+CcShPufb6tG^`vD?c#+HGiaPRZ7y9r>RgKt`S}?D-lhA
z(&st3O?C+FO*_GeFLWflbN7Ls$rn2L&P_~i$TZ07T0oSQ=aAPMM<t&qJBI8hHmNS3
zwKa)J+H|`5`|Iw3czZ~p=diL@LKW^!jB&m{9dPHWYXC$UV;>r`-&B%tQ+UUH>0E4@
zi~q!pUDip6VmWEtcR0Ni%+|kcERN2T8dnqtxkyDw<So_Aa`$h3Ko^G=a&NCbpsf(U
zK0BS7y5!-n>J7v6YbObf;-|z}6g*UwhEzT!DSCfq!G5YEdVqP-Rx4TBeCr>WSf@{F
zk|NHQc`=w|NS}}wOXM0K8*RMZLqtnqLOS9XAp@=vcGx8rq(Jrhj5ZYr4-|Iih?BTq
zgBjYMX3>Jac>F`TqQo1B)RIL!gPsH&#P4|ArR}41Bz+_^9V((DKKcJ9aG<&Kt<;(g
z$Zf*fL~i2)l%!1+ws<p5R8y4Sa=tEvQ&T>+7jmGW!OhIfyxWKO$j=mXwr;j_#rx-j
zh)=htZ%ojPHNiv^s^Tk$*k2dmMdO2!O{oV**7k_1{6z?gat|i`Vw0us7SRLcj|>0+
zhxe5@)P&`Xi)(oU_fj|C;#9gF1IrVe&fR%yt70yP&5!-<rZGne>_r8Tt;#3t3;s8A
zb!_Rv$;^oBDnJ`v<(JXREn^!I81L$tg4vT^{e&u4rmM(~)427uxopr2)(MctQei=k
zP}9~5BecH38B|!7)F=!bYZ13KP(~tFz<T0xMM}NUSRra}OwF!7=?OKc9%%!j83H~b
z7AF#lyAE8K6Y82QC)Wkij&4cr@A=z#oOfEC$_XbCIRwKjCwdogHtY8OW+!is8Q7u=
zbI~EWW9*`phM~!07mQ5sc_RLJ+^p@Cy)__>!c%#GP>$`JZPH*ajcqh;VA6rfB~G!$
zLA>lqQ#S}i6=6&?of&3hrxE#nBAw0~KCubW&>xb5tL{lWm~70!VGf@h?%Vf}nk+Vw
z4%H)_dj`Gr;{*i04;VP|C8qxYxvFAZwzI>_fykTN-I~_!Vud^?gz!qAlCcxW6RfIp
zy(7(|Dk%B^rN%%KJQfAbbnbF?7xJzt-*$F0;#I(!t#j%#lYo{Ahn4a6JqpkkwMDt<
zGgZfEima<P<DO+8nZ{%*&Q2NdDqqn9@x``A;`G}MzU9q2rJ;09lps1O(|O04>9Wfs
zCJse8;D(L`aij$wT(aM=xx8vt3MtATPjJ6ABo55`shpL-PyMo^6WO$3o9t`;ld4_B
zg5-*tJ-ZYv;!q)mIk$nsM|A(PwF}#pKTUEem(NEb3YG~FXzN;GEdJ|mUhU2e^V=!K
zwVm1HAZ6Z=5slV`cHF4<;IunZORs0_3c%G|_bB3)zG3CdzE~(PfkkRW+{Pw(blmbb
z3S0fe>zC9Rm+n_^=5nZA_RQP)Ex&L4{)=&YwCZTMr{gVyz>q&IDqngzd3>}t?Zdj<
zIBqsPFvJMTj#RuPQ=i!2)mZrQUJsO%yN~aGEnGK3cSyF&SEr0HIf@$frnYU5Uxo~b
z7Hk|U#S64yXkDaywll>EDy98vX|U7pCs@PN*xSd!=O})<Ob4?3LDhRBo5njc@fiz8
z@?j^dFJ2>!R$cPvkur4LDakSaB81crza2C{7=KPKJ^|WuV1=a`(VL^8Ej!iBCA)Wa
z=HDkY-<%oRqP}|ykJ+!OtLR<cY!$q%P7n#Fuwhz4@D<4zR(-zz+Aak(&Yq2t+N+^A
z6wolfs^jim)akzh04KDgWAn)E{A&l-fHIKNHMOT@v=u9@nAUrv_Y1u5h>GGRDW7!q
zlSU*hRV%3gXoUZEYR^_3sDLR57vyl)qnp(TYHnR%)?}WfE5))Y9o3be7aCe%&pI==
zR6U?X>vCnh?o2IMrHl}FOeLjI5en4PpWEIc*z8CN&p<-m5FdT=>b|WW$@r{vuF~QW
z!uXYUXseSn$3jg~@$lwLr{YjPnvmMy_KI?Bf>F}aax<`E-Z<Ve43z)FWFcww5DF(N
zRZY)Qg6~Gn8{uMD0$&HQNc|vedfr+&?oCav4EixU#^@x@i(X-?A^85BqAM(fPE*^w
zVh^{f++-86zBosJnIQ3?*0&Kt^Qa<1KXZo`v}P~%6L<FWs3Ls0yHX*?CSpKZTjpaI
zjDh$X+TAcI@I~0@m2}kvF7O)`W!GWOi2ZW-AxC=()V`AAYv$_R?q!>VTNRAd8CxP@
zr;zs(?FXTAwg-;$m9`z3@(hozDVP$kYXLPatIC7ylT=+;<dV5<syau;z0S}|q@eUE
zko5*X*Ruij@Nz|oOmCko06L02<ZNc>K@DBnv`4$0E06we!{yE0*Uh0qJldH|dWWhv
zdg|U8-kWJ%Tr0kWkX0{i)kIm&NlVysCi8-&PQN-agNF~XrB2*3f<}GOabV8x5So%x
z_tx@orfurwNJwosDHjN62hw?XHE~~19%<%IuWlp=pV%t&#AULay)^_0t=6k2%_Zx(
zSz>#(y~;Nu5K^81p5wz>mQ(Rc#<{KG!TW<Skgwt6)Gn%3T-~T&>?kNsq<RqZa@X5<
zLSWyBZ*e^aUtU{SVb9yyC^Y2zS`+n2Ngrdu2vT+T=3$hW*jeLQ@XgII!Aj^V`4=SJ
zb#N>05RZ!tZS=~TM3xd9n=pcv7e$(G;*ztA!bnn1(Cj@1<~-SYFSSpYiwi2CeXoET
zkHM4W17M(R{~rp-bY$Jy>$*KovZiDR2kadzJYTiw@vfSUXJ26T%nl;idod7UA`-hK
zR%iFY4Wj8JFevpz{<o4{madFaR#JG*QSKz5s%=lCH;EB&ZJ-UhXJ$et-X<(!7feyd
zA}_yTTlhk&Ws`l?ro;0%k3n3op1{7m(YF_P!&djKRn<ICbDfdpC3Wz0zwH{)v69dh
z+=G;5w`TtCD>+pLTq3`w3%m6X5@un=jgb|$A5f)axQ8-=8RK$aZ-cI4<huBq$Kz`%
zkw`3r&ZLUvM0L+Z(IkkAbIh>(L3ya`X)8u5?kSPuP$6Sx58rSaPWrE6VDZ@-kzz$j
z=q#|2!&UDIk?v%D`2$Sp*1>Aqam6jA_83>Fa8)drGP|Z)7+cG`vqs+H<Qw`ql6@<r
z`ZgND1)XDJkM@l1h-o)wFs25hYo!tPkp^BEg$9@fe%u-(R8?#3$Bq^WAAw^!A0yPv
z^?jx~Du}7($*|L(n%b)qGKS|I`>JGrCQyZWfV=sv_M)#^(`d;-O{V2B^Zl*7uFVGj
zRR1UXpU?8vud=jX*itmkq4vx>?7-cEXGDS(B9Ucn>#eX>;N+mQlM^#zt~}m4uqxb+
z(vEk`wRbd>^~sV6j@P<!NIzl+!PK<dj%aRMQhOZbcjR!JRO9)hyrj!dP81s#P~Sfp
z7(Wn2>w#c;Wuz+9i$-xWiWm6m8tuN&%E2oi{9!6zMjThm%i+bfoV-tP&H-7tM@{Jt
zJzrCvEaN+w&c%GeG$GuZ2uZ#iN}3h5#l-MeiBD#`4%!TJ_Y+X4>bAyZ(*xszC3qcS
zIAf)!FsI=Hg5dvn{I=gZ;aNgmBkhMzTiV{89ke=MMn(LU0IP^hhRWkhw<J&5n~Owy
z2`vx}k=px0HI2S&F;aa}E*r)*vyDodSBxFMm16JXaI>X1?MF;naOzvQi+k}PpT@6F
zUcaxBTCXf5uu4!+>d-4DeD!lIP*%SJ!j=3+#g0mRs`(aRl)_B(GgSLHLA>`T`gQa<
zkYZ5&U{_vw$4H@X4QSzqBwq^{)<JvSv(igjVdW3~LJ?}e?K7&ed%3ltEibq!h&rjg
z!-y&V2rCs&zQ!>8Y7tQBM)l#;r_mX)t7$5Ms#qJ_wcCq+b`_qq<t|L{RXWYWRKOM3
zFljTOg9uvyWOEk&{kV{n4(Y~rrb_{oRg1a;zmcUW>d9HLR|ushKZB!ZxSB#d&t5&B
zF`qsgr1vJSo@p&G0&s~s5<yBzBTRW1Is?L@ejf3?9jo=8B`yNtnCVsZtcBoT8K#`)
zk&u^4n{<%Sw)RAOxM(({y$T-<YrmCTeCl}}{t-v9x`f`@MNSnnTY{BskxZ{bkP-9*
zU3kDmKg3`nROS3p%lS~Za}!!d!W`zq!VPJgcVZqKt1MVozaKx$6jj%_NOdc{x=Yas
zYS_b!JUD0I@9#w0>$zB)W!ptSj1C_ko{mEox(!{#ecCt;edcT5otwr$)b-66@!d!$
z6)u3eW3o;)Gt*H?M_$1SM}*XSIhsN{&J=Al4NN?m*e&y{a)!w_$|OTNo(v;U%o)&}
z(H6|%zO@e&w%cG|!`9rNDXC-tlv#E~r?Bdh=y&SKoiB&k_a#$`PqnjIwI@hVM4)|V
z=m5?0SI9GY99iZ1{h4i*<XS%#cC5sKB|;CowK4L*xZrrXW&CGp`>Q`|{RX5ykA3zN
zl2`~(jlJo8wrlLSn8m74Ilt6n>Vv6qJ@EQ)=}QhH$W(D3Vt_#$)&5qTqT8jiM9t)e
zQ_3eFXK(=rH!lft($YMt?G_AFFcG{}AYJ}64`rDHoTGsb%k(~%;Y<V|0?IO>eN=^u
zUt=Q3{HcakcPOa5u-@sr{XG1+tdVwg#se@pOwrg8i^Y7L)>U%o$bu@spN04`Ej#(Z
zC|hl@Y1XbhUB-0iHN~e{NYKt!W$cdT33cfwVb8;K8*|4Ed^>l&LznmVWvj%CrW%z8
z@5~T=HeD1Ea~vjsHm%LdI(PH-8y|L@jiv#eULXPUd$1pp(i9Oa)t|OZFm53E_B=T4
zk5uG3%)MAF7ON*`0O2laZk%!{walpmhmU<Gs)%9O(LDr=2qiPQQygG}&kN=EU}z_G
zIy2L*>`Am)LusCrs_vUVh^WR`rTmnSeQgZX-1%s5d7h_zUJf4!PW4!VKV#L8lUW%|
zO^D{;kKxRD#suWrr;|p*uC!6jBLpI3*{S8?C^PajRr1A~_kyMWQut_|Fu>q;-ieX1
zMRo(ee#m#`#zFygn`V9J5o&I9{J2j|F?F{7)ldIK!(S^Oejn(4kIRb5U5RNG#Jc=0
zEjyvd^38d%7iFtWB|gS^E-ZGe-6_rnXCAU2-ROCy29$+x1ag|+*Jt`3iX@^ClF5Av
zPv>Tv!JZg^T0l?VKn2PvzT~xpSv|6U3Td6suSgCjF9;L^p>6c~LxiePRf6)4O^SbB
zw_n>C&dr4Ef=Bs1pTJz{8oOtkID#P8O@*;SIbDUzx(3GF2uQN!MT4~ZPT%*PYn!Nj
z3Uml|e0AczzG|v}Ih9b{i%`S(^49*U5w|Jr{U$|~xgw$CYBDYOxtW|jLZ!#F&(g;G
zgr$4d0eM2>7nMw0db4phgZBRKOyqIeNMHLrU-LXq?WN)^{Q}(+Qh=ZJRms53N+Io8
ze0hZSuQbs-=}45jT^_NRep=9~YO>cj(kC)1zIJVE%3K3qztq4}7yHD|A0x6h6}&x~
z9t)#+a1ilWyck2s#_Vw+b1qRAlTvRiU=D{2KaO<iRdK{iXg*W4d-fy$^)?uA!i-=Q
zWlpt&Hc!Wakr`26uqM8Q*`<0F=ra@WuPpd@tszayh*Pk?NK%zZ83@#jK1W=O%ASW&
zF?n)FcK~RWS-O5i622kn)e^cx;kQRa!IoOKq;k`|@nAJvfwwoq0&>*&Xxqe>E@n>u
zBtXw559VO2h1s+^bx6;EyR+OVR&!2isMm74Rn=a>z={O%Z<q{r_<pY6vA5he^K;ZL
zHovwwKRUGgaih9$i+W#G<=zm=yxv~0XXq8ey~@ZsAL*BM1v;)R?tMvm(1a=`)u>So
zL~z<F7E7K2%~1q}XC1C?L?&UO<FO@ve)-dLFBP+#cxI#Y$_f*_Lv3@33BbMxW5mh$
z5`7hvr+rAbE9|dB(#k=T#m6Jy#QNPAwJZruR>dsT-FVB%6ccBHF>?Oux)(_Kd$y(i
zii6uW7I%LPH!HC*mGxR^XDCuNTKxq=Y7t@!pW>X#FPh95pICF$?%FKn!xbr`G0Je?
zFT1b&m%U)QOv-@oUXgOc-6|Wmaa!>Ts9Jkc-M9Ty3HVwiV57l|u{Bn5bu5$R#K`c9
zo?tquYzy4X*7~h7W+)?N)$>hu&ByZwX{<aH<vIXjKgF|&NCyL|m130`C=XFz$4_q$
z@H$PE^`8$7yD@a-jyX(=!K;}l$6z#+vkccjLz4U%ppab5%+iOII-pW^uC-`iSj8!B
z3A3E{Ex>3X3)%-Yu{`|waHvzYVU$hiVs3k4UTQ%}$1dHo@>TvUr8`>%_q?B)b_-6V
z8fxsYYDt9NjVZsWjBeZ-Dc`8Bu@BoEX=*uA)u5!iL6;H@GO)2H5xTQL8J;&L0-`rT
zUwg||!kA1YThh=%CI-UmtCc4bj3{G_&b-wH7(R`6QpeXD?`rMkR^Z;qe_c}dEO$un
zsa93W{Ybf9t+|$)jESSM%;~<BP~GC;)oZ&#aPjt+mMrk)89V7tkPkYeKXmsA<;c2Z
zTE&*(>O!AZ749?)YKfOxMC}S=$?I`5S7qCnWk`xoOX5LJuf5B$`lYmGSGYXRShCNz
z=hGTSTy-N6uDT*+$Y`oQk;60=k5O(I8G*@lnhE=1R&9|a#yE4o5VVNaWhtCZX=f28
zvBPn@5xFe|TN2L|mqK9<vk&(jKb|Z9qjn-773jn-+tS#!_jG1ddi+>Ci><6G>~21F
z=_Yl!g<`%XrB2MkNmkIk+;8`;D{o{-^elMC*@g3P1?=2qQ_f#l&SUw!goiKk^X|2_
zWVti#@nl>&bdkMDYjRi7uX`_P7;Mbds>ZPFMg!qImT|F(&-iFsj<F;D8{uXHJ6BAe
zeE~Mp)-!zrW^-3B^gOQtBtgTH%kQ+aF-@ZoK1p!!yMYh1y~Mje3wF+G_<WY6VoaH&
zD0^Gw72ku48nzC-piZ_kpX?P_T8~NhFm1SuJCCFqkD&D4Z$92AoFWSOno7#rbk1U|
zN+6e6`m}=r)ARl+nT3FdaGi?2u7E-`vwy>>L*=YYYu!Wi0CXlclrqLq4C}aFeL(1u
z-7p^1<ZxERI}WVbew)?mM(9GptJoy*5ud4~s|9;F$H;sOk?2(6eeA8%0&wVR;MXW4
z&Wv{zTMdT2l}6c}3%%JB>B^3d=9Dar)!B8d*><evMwMcgYrZ#TfN;n~xDb{ge7WOO
zQ+(Iq_x2hA*7)r?&S0d`Za;gEO<m)Z(?Mva1;!|O6v^k0mcW$Gb>pM9A?5qSqMi2I
z>9{X^V-jGcIn2fJJ)^fh;;UJsqEp6&5{W-tt7#zl*70Tj%2DzqduT8?-?8fR;+wY%
z=Rxzo{YKiBzkgR#qMW76%DW7jTX51qOPf_<+uk35nt)s`;w4pl4bo5E@&p60goS>p
zELXvW;XK%5u@gMh=EVo19pUymI@WO^7&uU3y`Fhcmu|~}UZ1i1Qq4bCy!yHH4wf>v
zbwy+Cz|7BZC9`Mr(f~J2;BUvbl+Q*h+w@gunZ|whxr4-3&aHtu3WVN?sUc2=yKy_r
z!p-VydK`WR+}kU_`Ed+bf5!`&pKO{<ZKiww_VwUMP2e}zl8JzuYrOXSS`xR?{2VW%
z+vcW|UMjKCt-<T|?D<R_<C?(+gac_AD@WePa>d?rZBG%ELTjNIjie)1;}IgTU=T)H
zy@n>JMm@j?XK*{1vM9%)wHKN02U1xYo<I$vgiQD(G6)S1gbXB?AGZ(H#fPZS27ydi
z%-Ck89l?#8`frwRFeJ%~!rShU5={3UCov<aok4qNS=_KD?vp0UUH8eQ90zaJ_kKK6
z$4z_o6|u&7B@wq_&o$ODeaU+^R9@Z4&6iACU5$*;p;%^s|B#FGN^ZhJBG2(PQBHzb
zT9ry<@J%*ObB(ec!bFwQA>^?e!;e+#+c&Td$d!LY!Q`u2F$1ogi@N*61cg?AnWqlp
z@L8T&M|dg&z=X;WrcO$LYBYTHTt8A@G^r<5ylNmdME&LX^^JHJ4N9}k()I<jtfhk+
z-ixv3jeB+Zks~H<?I{f@?Q^lA3JTTC;a2QVk*TV%A-a|ttn=k>8hbWPE|&xD`ugVR
zai_S;WHJp<NFX}$+6sgVn~sU>>pj-LH6*H0DZppo=PTH)X{a(+e#T(8q!wNsJ<_91
zKD6YZx;ToWi>SkBm_BO7JhOKbC^8I=KDT26zr^pITT4I~7j+hC9I1Olysu>ZYA>%&
zY0}?vWt7o)V3Lk|sgLPgAQ!zW;ku)CW+A5fB6U+X;~LgLVrapC$b+O~?Dp-(7uSrN
z?BT$XQ}@I3t*T2oqb^eIE}0;+bHSV9w?#{3fwOGwH@w_^UjOJjU3h;-gAm;CFs5)1
z-{O7EYESA>w95t(h}Zmk3eh1In6}IgQK=Fqg5zwXrkm&I78-4FsByGsarI6L6VjcW
z5*Wvp<D?4A{OAC0JDJ`HTwV-KrOu6zRNhR6RuSs&3`noY)9grS!tF&<e=be|^5UG!
z8wx)`AB3ZcOowFdhJtZs+V4N~KthU6-4m<LWee^jwCv@)T%eet;E9*{zzrF<^(kDX
zV9iw9b@fU&cATCt+jW;dO`jkP)8EX|@(F*SJmFD#+iNL3>bQ)<Zx5r5j>a{etWtkr
z-(+&5i~SP6e#2yHF}uzyPU&@a8>Ft{=w9pM&V}!BtZic$2Ra`$#^z^HQg(5IQ{W!l
zBLOVM6PvUag}Chk&FJxk>$JrVPs(Kn<FH-h?0z4Rh8RfJpwX*MpP+XjC@iaMaJU4S
zLDRqeQMn+;Wgw^@BEQJ(;ajSfyI6?!i4-at-N=z}TD$c~-@|`kYa&k|G*AN#AFJvw
zYDOUqG$t<qgDx{t-^e=Kan8eXa$j-BIFHu3PpDgd@Qx?yZMLt@7-7<9yAfly)=}Mw
zS57A+&P%!3uQQ0fTk(1&2Y5l-^z9P+tDwm2)So>wKd*^S0M|sH6UtaZO`b7do&0<~
zh#Kxw1v}^&S_N_b(QvS@dF9d8YMa8fE`TR^YcYraW5(`j^!iwR)bWNJ)7c#PvQ~*%
z$2%U>tt7i9W^#UEec*ZUGWXyZmEKWOK^zAe$0PnE%F%2Sqk~|s6O?IH4RWBu=;(9#
zv5m)2zTY=^`+ZLfLEH%Ux^F6bb+NMWJvm9HPhG1vQnypPcQOd?X!Rm#YR!2pAHbC0
z{jN;)96r2tE#{@V<gMfwg6$EcR})83B^F3N+c#)7eG!lsvKB~M$A0r6W|*8~8*g`9
z7)4>KA1AODul8Zu3By$=%7Pp{nuw_sB@!s^+`17dOgMKuG*dwkWY3KioqI*+Uzd44
zM)c80;;T6I9=GdfAwmgFiX^}=LXKI6fd;T@;YNxO57i-+^&RyX!po-N`JL_cDns+q
zO<aQV0b0G97}Xfhanw-ocp42BziLC-mmPxh+4j((c4+d-nm`uTBk+t>5WnPl<TkiR
zVMF4f{qp2@i**1N^G<ia<Zu-<;+ZP<qj;l)0l4=Wckzrp5ztT|Z|s^`R3Yz(NUAna
zk}$diKKF{c$zB><2m2hMzsC-7^VnrCV8MKbwM|H$xOMu8m?5afq)tr>5k4!Ms|PD?
z-7woY)WMt5tH{OK?pe~a_fl7<O;%fxYOpYO*V>C&QPmI1fOzm$cXoxW4|98=mdB6H
zm*AoNFy%oUP@;$Hd}dh}#=e-MZJTyl=!1v{^&|2r{uAxxNWG(t49~F$=To^;<xeAq
zbU$=@d`~?;FWLS2?dF90$$RqRMV<n~pr)=7yQawZn;h0h47i!AR7{<*E{wW~?>}{K
zn;RfOLB5X-&#J^Ke1Z5*>{Ph#07xQenzt9@lu^W(httmTAgXPfrL#fEaG9_Dk^nZQ
zW1Gw6bs3MAV^-2q3r3lJ%I$pvve@zV%+(1rkX$B5kX)Bni!dRVWkbX&AcQPmkO+0n
zldhIna~SK?8sCf9j!$8?W{6JX@F`r$iw(zh$bbbop`2N`?L?0}kZ5BjaGxz#6+bH+
zSuLBX@>AYqG!Hlj6uQ>yhJBpeBZ^+L+ELX)B)tyus(`+w83<jq;3yCIWck~b7=f_o
z>-a8{CS}IUn$`<7(napNo??Z5%adItEYn%LYIa3$q^3vH;XN)j+<d9eBNuYEC!6sp
zdb^7{9wZ!x;`Lab#A6eK#~*3MkWLa-vvF6-+%!%r9j;$&Hb5BH7V078FgDHBdLOlw
zeRBF1f>+WIX#f0jh0@-wy?Qm0gTOfR7TxyojyUpNf$b3kC06>aq|$ysOAX3c0N&hi
z5DV0r8P#0lm6r(O!%;RU^rv(6j%;S#Am><K-8CybJoU<U0p6NpMpq)#!7>hNbw<#d
zKCYn|I_@A8dD{~vR4pi#u|$ll?d==7Av?Y+WvZ0ayg~PMpeyY8%Gmf+18@QRMX1_G
zX~tlq*f=J`T4XfVvDa-wO70m_0=S8LSrvsUw8RZBTD@6K0}^(Nj5HBoAoZLVZ%gH*
z3kB#R42{&$cAaZw&X>v>Jt0ym4I{T>2d3(yP#EFc=BNhNtH^A$h!M^v5BJ3}#cOu-
zGm<?DxF>(YP$?Wn4_fm~{c($Wt;CVMoGyDczCR4qJzqkcj55yHmDk?IE))%dCqy>#
z_`@ujkbZk{x6VMmq^}#S{-fary_jg$AA4`5SRMSKst8U~9)n#g)@7K`plV;if2<_c
zRDLxv-F(*pz=~#|Y44WJj9z6l>+MSJX$n7=eCe=o-IS=DrgultLpzq(sDixbNv-SG
zBb|c5#4_nxGaY3_b77mUf45S|1*Q?6beqU7baeXd!}4Xp&Ay6Pa;zOy56@V;03ukp
zH36$E{a^q(v_Io|$^I4bld_JsGMhP2dt&F!BtJj2WKbGfv59b8w=a7XV~KmiG;n93
zi#F7cx(D+>2=CBTcpg>#(&M$0l#mf;eX-QVu45{JiECwN77ww_eOz2+!>pUHj429(
zl#f0pr8yZsjvwE=+eRR{CcCg9L^XQ0z;MkbMr#_qu_e8S9mx=w7jQeb;h3c#coNzD
z-iJCWFZDTokq>vj#Y|B6QYG0Zc6Cwvrx1yf#Hg-S8jDR_Q91J6s!3#Z?a0WX>^d*y
zqBnL>5tY5&rwQJw0!`0x$t_>SG4T7C#JL!+nGc>Y4To8;0Kql3;j&4vg@FhCkAk(2
za{#{6Thdnt%?=1ueSPPy92u$|3%7mq#tP6?1Z1G@q2?GT?fvbrsQ38b7u3$>)CEqN
z&mM1Hi*Y=DtS!81xA1+QKzo1^&+OPMF%IY>!+1XCMZXRQowwX>U)6u>D%jS(pIShM
zC`q;`Jj{G>w(EicvtH6laEp|w_C3e6#9XyB``c?WT2S>$4c#)2HQUEjT&E9wb=}ep
zyF`V$PgR}R>@?XjNAu(ko8@`BX7tzPe)bVI(C`SMSI4qqG%$Nfz5c8CM>54`yW)yk
z!`HV|5}@5;=@qN|7CUoXmSqO1pFZIWU8OFS@jqx}lCMBoS3m73CRaV+)rh~Xn{9|!
zSf`FqyuD}=JWv&HIdv5`X(8%}Yg8l*or0;lBS;}H-dLvH#@X;W+o@j`nk__tHOEKO
z`-*qw7;lXku>X<hlrLi(K!vCj`^&eNOgutXrmQz=HenZ=SM`KHXW=}`aYg6SsU2*K
zd8}dzy)zT%r(#{9IR^}x=tgidPK6yKGFO^~NN0z1jDFNc4O%84*@f}-ck2ArNn;Z`
z<q0awDmQ*C!_ik{-^pA5DEbcZ-Dg?s%pQR=^A76dUSLD;MrkRNw6GCyl@D}qRqVa3
z&X$Dl<&b!)PM_<rLaNmnK~6jtx21m?b!BQe-b+`UmHMHcfXH5JU$6(Y4zo{Vt!x+5
zwn~wZo}7#Qhh56It7(hW(_2DUwqAqXEQVaw10;`h?HUhoe_UPWkjUW&+m|h-&0kHN
zI&zswwD^%~VU=)|CILXHeQHUbU>!M1ymaI@?Xl!ZlUcM*bhHNfHue752MlF}M8RGi
zP0&_+k`wOD=%P-fK@6$u6it)AkwHst6Tuu?wf5~@=|z>$H0%^88juXYg+x;fJjSg9
zrj);q@Ug4=x{d6>zu%DZIKZz!P`6U5KW}s}4ucF!br6d#ncp%~YFrc<9*MvMfqZZo
z(~yxW!B-AQO;r`%v@gLm3PA^WZ&#`dgLW8iYDsizqb$%NmVqyw*gOfhe0gFiSPG8H
z^omR9iL60`$FRo5FO<A6`i?T4#E1mK&Q=<jd||i6N6^O$m~)IUohN6efjjVq2y@;W
z9drXR7C%eF8BI)i@CzHi>zhgKK>=n{tkgcxP$o&l!wwdB=17D&CQ{8d61qQ-?h`(r
zPCBsJ1-j8p#@k^4SIHRVCAH@T!yAog{3EFOF%SM!=y&wQ&5OG@7%8=+60IzyeWn!z
z*-BQ=Az`awK}aIDdJaYcw9^Ls)ewnfO||wV(hN0}mV^OR)JC#ML_inK7(ujC3JGIt
z%x>=dc`W>!7XrX;FnsujFZppC`4M~l(_{W<%>KJ3&L4mFU+t_PBk@lI_^)I8Ul`W^
zJs4KSKbQ3yR7`(WK9!KJylR*HucrT52=)C%fHklJdmcuBZwAb)*nMo>gfbaN<oOCq
z8l8;!+$#}&GL|+75F``IRO#_iA4j%!s|^f1Lc~IL9E-bhE*h52e#IrdVV>+Vi>#2Y
z;;%B9y`j}Cyyt^De|882C!L=-F8?=k@hw>=G|rR?S@ChU`P;_MzWrn>Cb%*6<m-RY
z2{U@p3iRDUs%^bc7e@U9<V!|eK1|sGcQdCy<WZ^_T$uv;YwYuVKt@bnlnw}gS*f3w
z>VNTXXRnpm0$(`!@-XCdfaE~)1<E>FNTIiA8a0XAZ{=(VKV-QHnwE;nVdFjda5;+b
zY)<3y=Oc29&9;Cr15lXxZHXmCi6WljgV6CzOFb8?O`j1!ZEE^DOlWJa$l@%qvN=4N
zw)tg6;y=5zkHtX8+=5Q>Mk)g+?PM1BKy$CB&sb>zhG{qlREyu_s*{8ld{WhTm|&zM
zKLT4&=QQl^lx~az+CCTsT|FxLcYyLgwKEU*F0O{USgqMsz1(~nH(t)mRv|1}Pq}3p
z0}y-Iv-3s<0tYRAB-j7l)6kKVb$t4i)#qvbPn&RPK$Vyzd8}l>Cq&A(DGIsE-UZ&?
zhdA?g=kYdLYkH^2e{9P<svpCzbg^97k_25aBfPjNq-Yxc5g;xta1^|F%c%m${+<SE
z28NHm4g-L#<unY>Lvcfelz_OCKmj1`6h?JJ!2fUdf}<y%1D=}$06+q=!3*aF=c29*
zQKv-~ZQcn1x)E15>P^u2yI{O$rNv~|mLzd``{_rg697wT_~<*OeNiw$_{+VIO(c3P
zcfX5GJvXMv@OE>Km@Gg8E!n#;o#&mbRpI2Ffzy9CCXv?w)13Qi#2*X5Z;ZI&haL^N
z`bh*)jF(4KO}!Yg0WAXJH_%BSBAQR(v}o;VJ81UtOQ)BAdME47b>F_`?lHEQja<1<
zKr}X!Bl{TNzZ>_TBM=MZ+&IG~0a^lex?Pw3x>8O)xdeydxE}h&p4+;fO=gF{Z8`UP
z7K_&26M|mk2CecaSzj%v${H)!-CI;@39PS>1<qY_Hgo_fOY|^Id_Bj|VYJ%wtzyhc
zk~r|yI+Rn1X3GV<clv=|803opPvdvtoioP5mO6;9b$x#(@&EH~5x`1To(fT&c3UA%
zKkx`o1u9Yk_PCE<QJT5kz1ff^Ic;pIsr#jWXT-zo2vA^fokvX5C}KIcXXl&y)%6mn
zF?YQn-ItvW(a+|=IW<DQWiIf;Y5<#Udq%v#NPSBHXxVe-Sx-mCj@3yZseOavXT+Xo
za$+sC8SU$+Lys^5`Emk0@ayZdxAM2PZhS#2c&TSpOi`%(n-%@zv3EUyK81riH<$sl
z3{ZqYWmhLislB{Y;y3)z$U0&Ji3xtSv~8dAlf0A>l<Df7=1i#6IvzTi^uA|@g<8~S
z&@?8zAkw;c%w_3cz)Frb2%jmby)SHS{CdSL`_EaGNmIQeeLs!)?_O|{TfitKZhY_e
zT+HI-kcgGyL}Jt;EG>@EL%3qY#AxFe5(z(qQbNOb>gr}H189TanS`|z463D}toE0h
zBu7S=(&V%wjyaFG*dP?8W6Iys8&2>Xv_}BgBm>2AKZc@_TUv>XzPN?)=-yZSb$%k$
zHzjJo>6bb<NMVo|ftEo`MINDk!GFc|-#z7z{UGfv;EY*CZQ)hjf#uEy=iaI@Vmw59
z535t*AINQ6(?g8>>tOm+mS>G&Tshu)0PxnU+Vewz-nEAha^E==$rNXQti_jJJi#Yg
zpL*PQ;(2uc2kmE)MR_e$jG-CG8rf{Mh<MSHOz_LsRifWmH5*h@Uw2vts=p!UPPl6v
zr<?(hN!a^qTL2HA#wwVKyJabA$fEGr$j<`oe`EP?Yh>w&okhQDxfI|o7{U0RlvD@x
zY9hS^?t;}`$(~$rWdb-E-Fn85H=B}jI+qTyZLQ?9*^?Pas)A=TYI21I(44z@a;OY4
zBrU8*v@Y)y8i6v9HNpTo+lqJDaMd<J1@~3mlzjfK_iLJ+tf$abjtj#}!(a5hz79y4
z8yO-JqLX9GSc3TZ%3b;TvQ+qY|DYeyfBsHCLiBA)(&?$TI*W7XRO~O+Xb!U}cAkSs
zYF|@W-8r`(hG%QY?b7AvNgu4z?3V{?D9~zngv)JXDzGf=9p#_y>#@XC+-1{Bv=#Rl
z{70GPzcDg|9oY0>gYGiT%_;)#B?phc2iRPyt%cMD0N7})MN;i8t$Qh;#o0AEUb`u2
ze}pft-1d|CQX&Tyn|D~n+yI=^kwuFm<BM2Q#pJ3Majf<Qa#1lkArfmlK=aP!;o;^s
zfAGuC&-uY(w_}I6@x9I6LuHRtlT|T4iw=JtX#VlS0RUZfv3OLbs+iKhR@YFO$HPm8
z?q5a7exokuJYysWCS2!^Rvf`H?KSi*%-qm;pk=c8F+Mr3f+=!hBQ0K47`@>GqgK9@
zR}_h3ES1z!Ehx&NR&AXkddJDIlEhBXkQEViy#T%!KtP%;7T-_26uSAht($iYfPr#s
zqbI#QEH~pn5WUB>?X->R-o6e_51j;{MO9a&2Xe}};0!NR^KDJFfxDtuyS9pkc5cQr
zp9!D?UV{C4CAam`cOCoXk=@QC{#ffu@TR&XHCOr08DkZJp8GM^uM!d{>KpvIn7fKg
zTf+XP`RZB_up}?O8e8UiEn^zNF2KM4`0-LUZfIPP_a~=lyl1}OI>A4p@bgWV&1`zG
zy57_WxCaw{f-(ZXY<K?krdr~q4@QZJ9oDOU1kMY6^?FY=7@wbi{3^%2@Vh=lzb2#o
zwp$$af)@BXRn}I8*qi?xFHVmDLBr-+&t7kYD33r{wT_9MCAdyU54`{&uSzPHK4pU5
z(FgOhQ}ds^NQM)U)##^TfEv9cphmCdNmip@&UWISqgnFUb*{x<vFeZX6)8L12G^)#
z{sT0m4D_|S0F0evy$2uGitYJ3Im^b$QhL3=FkAsJRJ!aPj>^+$KPdg{vV9xvHx{+b
z6lTd*0vz3&^bM5Zu@c9NTgL;nT5R+I&3O-V>Dlj^^8>531qS8-t;>?8rC&TmKBs);
zQi{VwtFu1cYpusb*6xjsbpcOHgqpOWDoY8-^m89xPi@pgv`A0nr@p*!<NeB?wPZgw
zq<`{QrgXq&U-fSND%}M#U&v-$F<4zMj+L9a`&t9HT*mVyJ@OM}crKQ6^3#+LUR3VR
z94lHWK#_dMTy!Wb8B~wlyqvj4mr&}TL#0DcI8pvgw|M{IBpKx%YHK;L<1%V+@?mH9
zbCjy$Z-C6e)GQ$@FjV6oEA5Aq|Hn_($?l#Z<)YCm;EB9X=!_R6@*P~vhUc7S2!ki^
zf(h7ocDS3n$A#gb#IPeTjX(9cK?bMS-4fcUKBZR@m^C8nZI6=Ml{|gl=qgVlx?pex
zu$GmwKB2zuz8Fwx<1E0_7kw=AV%ZMoGc}0Rc%jnU(7!&$&!0&80xJ&=d6nM&+ZIJD
zH8u526W`eM%?UD6$VuqLEem=`>hN*)sCIxU#9;EBDfG=&Nj=|~F(}_5Vv!oZw4}0F
zOqc)!$sE7zKN;$zq)#!Q(4(`e$!Y?!s(XyPL(kOIRYv=?Jeg|KV^`R#B=s^KH0<m{
z|7N=DoFDCGw3hx3&IW%W0f6d!*L5gyE4>3siiaIo9l*#c@9{*uDs*3ir=0vhGeG{t
z-;oZ;h`@X*kvsE90@}++)r0YGLqW33eyuhQK)1bGhU-LjbotJ}_If}Hsl;(4@iGKZ
zmyaM3Wk`FfxVu(1L?GQmn@$RrIWPl0pRi^Ed_D$B^0mU}^WEal*iJgm`afuYKJj~l
z`oGyM{xL`XFwXy3J@CJL(?5^K|AL|XYdil}tp1nd4h$j?Iv;_nnu4!lvDihZN-!Ms
z^5HK#>OINC1n%Bf(&5Km<b;|=nVWX5lYoRqmpVXx2KzN`<3>7y->s^B`Lm(_VzoQ^
zfIG64svI^j1#mR1huCg!+{}u@^x|5lW~_8i$z36w@LFJQjeM05J7qNVpIyk0>_-V8
z1=aR!^m>4q=;S!{(!!&tU1`R~ldM^p)Ggh2{VqiOUC!e74W$kUc2^b`3+4}dv&77m
z7;5HpKLFT~ga@K*DL$@lbiGG2+?(C0{_<7+^l(oAMoiYF_&^aB-u=r>n%4KkPKp5D
z)@%W;EQadLuqOxqqQuoF7LCKazk080YGf#j*!uI2fG#@_ZUc%lIBK1D91-)&9Mmec
z)HKDO8F=wuQEQH#up}Ra16etNlah|j-Jw)g$)LJl@j2iMfUV1udToRg$c*AqPo-Ap
zx@sD195Lm^f;E}^w3Dz%k~SKT&s$q`WPH*6c$`l(?N5X8Ph0fwmXcHk?5^rIm1a~-
z!INjdZV0Hg(yuY!VMLf;9(1KIy6x*q(~B$Tqc=Xj!4@g0#r=1?KKU)_$YqT#<}@$Q
zlRE>b>>?VZ(=0_1wWbl0r@J7cuuxjFxJfJM(mqokDEQ}Y_#a*bTm}Y8-&D*!8o(`K
z_ihZfWrP){P`HIDq6^~25SFlPM<&DPIJxeTD`|1%Z&M~Dp9cr8q$fu&Tqq;LG;(ZC
zM=zZJ#oYg<3w#En;*>`>K=*U@MV<}gmtGU6w>iWfoEj)z_BMX}-p9|J&NoTOuC?^%
z$>huv7VLgSx?pft3}6fDw3)_c<~zfp78lUnBDZ`B{QoZD0z3=23i!M<)Sz@<z(O;d
z-kr~OzsU_fLHFW(k7jCCCd7^*WT?AiJ*miK8eRDp=U=32M@j(a$hdo2?KHFv;7Y%D
z^*l4<%OSntPQTjs0*(XLjr*(uXy7=p-g3Ii|9&DBb~^P!CTF-Gu*~xnP!lg){W{qW
z4w|}zJNwJ3_m{x89J^HP*8Z%i@s}9y5%aaPx56{Eg>UhG7t{l$i43K$i9fiGsW)EZ
z-E;Na)G3|5UroQW;3@KG;0~nI`@)Z?JGICUy=)?#@z0wC&c(9qE}hK}b`2lf*|_dK
z-Yq>}vFZ0V{LhL^f0@$mzzpo4>`gSF0TOgPRQ<*tfK%1ccxO4oEmCb`rskV<7p%AX
z&{M@&;lqZiR&IKQZ2#3?t$Z*iFp`nCFm;NDy|tqTUY?T3jLCiUFn*>a<<u=Q?kTf!
zOW*{LaUr8KgR~*Gv)lacf0)xhKPeywXiHmIfzOm*Y2Mi|9vvS)9V~Q+p>?3q^<=8U
zHU-F}xYJm@L*P_Arnl8DC^b5{ChV3RsO!NqV6wCt8wo1Md0Sz=mFb*(XCu&e{8u+c
zaBZ^xNFB?OC~>(XcNsV_<is>sN`3-*Nj?0}rHTj5tU%bb<~ym<j<sq6?Z|f)mzA|Y
z=FBeb*OXy=hf<++(eIajv6k+<y$6sQtv22tGZ#p>NRb$SXqAb^^<oj4r;L|Y=2w6G
z^moqVH_Kx{mq*LcV>~(%QgC_R7TLZV)~r`^DXjk--1Zl5@>4kPnZ?zV$rr)F!OqaW
z7>oJe18Yy9Do6!DaLyC-=w9=qworOcOzyLJM+!aqv2Xolp8qkugn=Zsl|{u>^bOwA
zk2;Si=aCG9cI4H{qQtV?;^AU-dG@{pBr>h=By-}i_nO%HT)5Hul)pWClb6Q-l4$bF
zRrOzF%pYd^?*RWEd;XUy^@rR2Us9zQ6-{YXaM+fq{`3J}zXEg(`qk6D(wl!9*n<tp
zTgDn@)t<}|Iz-(~@&}9MN&AB9&a=Hq^}2e2gAb5kSg?PXnzZx23KksyE<5MV7OcOx
z38l3c^Gs2je&1NY^}T`E`kUbn?RIRwA^A!~(H_e?IC(xvFYhpTQ%Y@eae1@EFVc2Q
zb`K_k&Rm7upA6(sUPZs-0s<t|Rrg^FL&fM345N`T1!}R;9g^-b3RG<^!tCDQR*>qx
zxr?CM=xF~zbFK*0;^guod$+!vY#hD!Z`QWlReX^Ts;2NRvXDl+R_)W%n9i}H=m)-&
z!+LF#88cG03;Q2Z>k*A&u7-5RHkHM;r6TE+xMDjG_p#!E7e0|*Q}5F7w$V;~n4S7b
z3H+`OjP-U?liYf!=A7bC@9skGEDqj<dtv`2bNG`_`g_dd3)?w+QZ>wf8q<I!K-^_P
z433VbAD<2UJh!%U1i)=af=lYTo}2CJk060y$YA7A%m&3%{LF!q!JIS0;d)M9|K)Ok
z&0{djor38&>dPs0B}IB!l4@ui2V8qLc;BWsX*>~lb*fV~broXBv_u+4nLS1#=m9)W
zNfQ;5{zLrxt0VKx3OkJ@jqr7k?6rm*<KQ(LTmB|t`)fud^&aHr30A^5Xs@NJi0Arv
zbBA7X<)OUFPoWf@${4YIbQX3?x5+%6P;&()&xGI3huBH)_+bVdQ?&|*{74=qOe<K6
zFIOEZd$Xw%?Qyd^8@p2%=pv&UpjpR#(Ie02Cg&k}t`0)Qd>8sw64HokMPlpqND0d2
zkhH-Cg3~9pkp?-(-SCE1Jmw`)^v?kim>e{xwFyec-<@Z2mhO8S3W)MhAoeEQeG{aJ
zuj@Ah@NS71r?~{bU6LsELjBIDp6$_1eCrKoGP_Swl9M=*qEzha#fZ&JOX5O;0419E
zvF>pI#`9r)e|o*j-Jz7HjRbr0T{$(+frq**L1tbOI0*&0aP`6&D@3d{69r9#;ueUL
zfSmNpge=C0?}Qy0fUxtx2CN`lv~JM8MUmC$UkArOXW0>VNGRTG=`EHzS)~hW7}()K
z9Q2F~u3xt{`b~|HYM#r(3h;w4ESyy&h#zm)?)X|zQ$aytmXsUxTps3lsC4n9SK(4=
zR|Xz3@e<h(I*G5eZf{)(e(_{}EV{n9Jc}i|AkrQ0GF%;AP@Y$5qFX-FaqbF7Hp9dt
zQhW8(bA06zSfn&vy*?ZQN$>qEU&G#z!v@o-JvD?;(iYZLAoWl6Jd-s*<H++?Mf!b=
z;}9&~pkXQ~30I$s%q)W81aUb;X^hFAC$0%u7p0iDTh%;lPh@ahCS@%Aoe=ct*y0R|
zbJ7C`LZV+N)ERT;NH0aHVA(4LB~vGv%AQ8xgPkik=jWI6&WgGc-n~;&-GB(#VybTN
zGn05>tC+b-;6jgct+lgbbvkmLZVY4HF;Cs$1dl7rp7&1xZiT2Bq}w#Fgkq-mndOiz
zoKy?bru($g!mS!*E>?JG)ymdy&yA%COHwHDu!Ikp`SM@e`ekSKO=Bzxio#GtYppkX
zew+P)pVWi1oK%U@YDSX>2#dk|U~}HC98SXzX0}WINw5T^aU(qgMJ^y8>nKc}rPzUm
zEl6q$kK4#Z&?zld55lGhd9;qf>nB!*5$-)Kx=fwex#J^<amf$mcBmzL&vP?ZdNmq$
z-6tsKYL$7J#4PGIoSw*N^?1ltyJ%4G*b9`lap%VnV@K9YkV~kWv?d%m^Zt3Cx=b+W
zR!Nn*4FbAOF9IAnR`W<5o3rs(d6%Dedu8206j!?E@`)_S{`gQPy7w8FtYC-7)F9SF
zG?C|@Jl=n?=UNrg6?`!gh2Don+`+2(5v>q)Pa~8poUz{fGk$SZem%0~eGB#8oq%@8
z==wEOtz0})c4E}9r7U|)lNbQHdCp%yJH0+9IoG-~k}bE6!s~gpe;X(`+AqJmyN42F
zzHj&<$2>PedhQjU;pU#RUUF#`u7TA!xX_vddRFgqmy5sQn@b#KfLAf`4vQYy9*->6
zr<C#aOG&LpC*$R22(z7ry7kK1feyn}<7LUp!5v>Ll<EAj7V5BA;?A1RkSR^G4J&K8
zp@?!xK55D$)e7}qpXnsdV!SVS)FbYgZfc=ou*)`N<0BpqUv|(9CxoL+rquHGK94I1
zPd&$FJ}hWC<Tx=_QI8%akGXs)QiBqkTOn|w7}@LUJ{iQs&<$&EfW5jPKagHyFZSwB
z;V0OR>~F@xqy~tWnS6SJMO9Lb2-ECv$hX%}<^oiC0p)Hi9&&c7$q1!8(K=4)t{Qzb
zt?A>koc1&aDVKUV;Y`^#v)!GMq=FM|pr=#raObZduHuvj`XcpKlF0~~fa%9z0bj=C
zO|$7SK7jJ3XB8GLGV|n{_?I-_iBvhult=tU_c|km4n4Zw{gMxtOS!Meivc)!bB8&Y
zUQ6947@nvSH7@LnE`hF$EO34h{D177cQ~Be`uEdB5(%klkVJ`IqW5$`5Z$OzhUhJN
zkBA_M-ie6Lj9$k~5JZnU7>wQqgTY`7?_=+?_ivx<b8_DIkN2P7b^giak}H{c)_U%>
z?sc#4{rQ$&{MNomYHl7j$8;8I-k^Hh>j;E5<>?5)*<N|+T*gBtAH*Iao@K$nNw-wR
z*uPig0x?A7zZ3TrO(OYjP#=7i`{saMDp-YLX-Kw_IIL;3={RhUcyIaovO(uW_XP17
zQ2ZE2yv0S@!;(?TS5iNuAe*HmKX;8j62_vP5jix5l`{)ijeSwYZp9HzHM_I8u#wlM
z<A~OJ*)W@WUteSBtmscggvq>P)v={OHiE?efoNTR_pM^7?8bn;ktY=Y&}m%!L#MHl
zLFj50Bx~4tIxBz1Me*ep&hvFVCF46^irAjdL56f?F^>(cyZlSgg7mNy?*gG_jcb+s
zuI(2*J}{Yvpxx>X(jD%|h&NY<u*evY50S6Ex)Q8PT%A0FOM6Z4l9F${6JLDQI=0kT
zZr)D31qK^v5-tlbEaQ&x6RmbbQ;+pIB+)ACibTZT#g9dV(Jy=4U-s!L;}s;KkCR9-
zO=ZzzWXGEzmn`bLhxFMr&c{sG?LMr84iZLoi{IjUN9|9~*o+4yUDN5p6i|&T;H*ax
ztv>1fTQr8fA{r9z$?T|n&}o}BUJb=>aM>{ZGH=2)Px{uMk*3PWtkeGFGQ*r!*M-|p
z<o3hfXvEIB6T}HWs@5+NL8PBs1qe^E^YZVk2TUtARs!am3TJ;945km-ZBcd8Bfl`F
zJ4s%;$tLVYA0E0|WMN)l!fjAEQ>{RxPt!z&wHm6VnRNM4WryyG!d4Rc3B51rcqHA#
zcyFu4LcBy3aFL`RiXv<l`5Slbl6X#;50SWDFD190Iw>o?UZX~-D$+5a+9}$reuu5C
zdY*=4b3y!4v`{*J*_s-ah;NLt&<+}>(%PuVVjbql-gtM&l88v~vEEKtK@me~4X0*C
zT5L~T$+Q%S@Wz`w4icx2sx%B;AtR+qZ`#ROxPol$p5Uc~N|DasEAxDZRs&iSA`~M;
zVh#I=Cf9YoVTWE@_8)rhc!q4uH7N}$EmtNX<@AP1Yh9+%nZkHe$H$1nZwAc{Kb^C`
zsvX0|ubZ#Z?9}jNVYeN2zIsswT+DWQ0g5x<f9<((iP-$M$k)yDI)q^}>e0A7)yilo
zH9%#d-!TVY=J0UymLxA7o?^G{O0pg+I}tMj@{Y-e2%2Xn_&mPJLxFER+$+4;`MK!W
zip<q5QFzYBs^ab4>u;#q=fo~h&<j)l=v_|EmJMBz0}w0=85*AKY-P9dM{xUDg;zjw
zei3C?A0QbUN2#;V%;<PE?c5S%e%z*73_BNk;c7vH1~9BF`xTgCH1mxzgxB5>|Hr~S
z-}CcOG#e_t-c72zeMaMHVp!v6V|7j2d?HI!+7+n?_8pVQJ;_8(TDdVOP#U2|JO+bl
zWb9-vu+*(HK_aq=)cn5AL64zjA!mWnzDq|omXAg6EHKTv>0)!@oW{%zW_T(<N3CeA
z!vzU<^&LXPidFzmVto`MXJsTkRd9&?rx?GL2;5Mb#?UUa*l$Ve4QS*hoaNl|(3ZB!
z<Pm7y#pX~v_)Mz0`*dU_#W*goF#zTs&6#!mGw*gMMd#^o1|e!N6DHHW&$2a@G^6m+
zeGA(<w{OUi)9~8<Qfn!!i>N^RoolW7uRPY_yYGB}J%d7%+${1^Y@!u8k`z=p#~XtY
z-=p3rI^;UB>Z9|9GdYMD`{|QpXcw2?D_zj3A*uVJzPquGdeDbz4`a3^?sUO&bc0rR
z?3NZE?!-?cvQ`b-_b_4;x&5KwP0JyLj1Qe&N3s?583C5_4%?O%J0|_qcMdd@o{d8H
z0y+zsdlqClY7*SMzl=vH;;QD+Ovn*OvL^eadfqhHj;WI)qT$3+?IBBA#P*xKR+NuS
zMcUM`dy$7P-8C<m+))gn9<!_208rwpl1qyQ3ASn6j=%u7DOTIimm_ziESu^ICWsdG
zoBz{@^N+%gB>!=}+qyB$&Xsg(1-E5nJ$?%pR8HR>Y28`4etUI=wj-~DbPCK~%_<zw
z+~T1>zCL>YgEYk)uA@u-(%gtawyzn*1X+Dv$Jr8a@Y{Hd_?of!))QACNv85KX(jAW
z7G<gE1!0`!G_qSKy!R^WKq|+#@Jj}@624lD%&NfP&pi(Jd4~=3r8bA=bq+fL^>qm|
z6I!1nuL2pvy|N@>#R85FLC4>aC!N0|Pd+n>ekdC&JYTD87@oKO@pHbH%I&WZhpw%g
z$UB3c*IpiCHSnk<_q=(jLGceXO0)c~&HHM31f<j9ouH4i#X$P92M^tQ=Vp?Z!(1O?
zXKKL^ucT1Th<u$>WSAy3i;7<ggJ8Yym_9hsPg;PwP-&Hv$c$my_OV`m{SBc7EnAV2
zjpMi36Eab~>aYnn@dV$&>^z9tOCVVLz*g~U-)4)%zN~0|H&b<<Si$FgKet|f$iCy5
zzma8mS5|3c$h0qiqJ#TQQz`m1M0|F8d6U7p_MLEFx{m^S<mYwf+OhHY8P=uvCF6|@
z<mdy#pqZ81nEjx<WGzl}18r_nzH?A><sPzeK#^sRBTh`*F!QIrf&S7pzmK!LkW$B}
z;C~sojklO=R-|k%-7mX3+dJ1Z9QI&~&UHIzM8jgEY_bRybXjEUfUYa_{-@-7uXcj*
z@joisTU*!`E>WExWPNa_phtPL^Y+ZAsOadB?Rz%4FAgV<i5>&<Ae#3Ckl(<rFByiL
z;zx+r3jxgX0sLbH0p2X|W-3RBrLeRG8lha)TA{nkF8M{9yf9fG5H%$hrN0*{yEY>)
zj13-|YRTsJK5{WWq=kim0)}FpK`|bq!)LzOiEj85F25{9_tmuR$C8pff5X54W$rOG
zT|&z46BB&=i|iZ@CTr%bUgk?@r$@}E0Yugu;=ou%oNTAOH|43X=2)i?yAw!Q>&OS+
zeBy+!*R>z&t6yvjENXKa`uG!VG?SM187iif_|H$Q{YcM_+;{zH0h(Mo7Ip1A?ZTe^
zh8l^RI7W?J6gm33yYWWl-INu3$K#rtU+)Nc8YTTMFT<$TXvGM%J8B%<lp@Z-5*^GN
zw4@l$rjBv>X6`NKb5xtRuHrl&O`ViC7y^1@*4nBbm)-h==Z!B-8wgt#SH2dVCFEPJ
z&wV;lCV|Z~x#sY)VRp{P$Sm>qnfW5ocIG|zisJ8~JIhGtPP#da1h<bk#W6lDQka9E
zE7rYKsJm6K4R|f7>AOAOcgWJts9%uU5P!~}oh2N#Z6~r|H^|vzDcC_PNY25zx-i?Q
zYr{A0Q@G}$g-|Ezn1+8}8}G4RYncX)Cam$}%(>2KCAPH1e7-gG=AEIQt0Sho{T1~!
z8!qF@OD&YWeZ7N@PwTCHJYn@8swbyE7Oni_Ja`apGgu#=d=xI(ZQXBd=i(7jn}C=l
zT2y%4{MorhQsa2-ah^|eM=Xr+amZI+4}w=dm)-b!;Ez)s3J9?~|1@5_jTXYz5j{Bd
z9j;rosrIZ3z8g=^-BT7R6q_{(;kt5<cy_B#2>Y<4{oB)8HRP-1?Z|lAMai{?Ey2dV
z3v<yrUW<~_N6ayt-_-SIt`JS`dL9@ZKFV!hytn7)CAMqfExxzXU~VIxxbk4I)qON#
zo#mcJCvcg`$F8Zu_^m{IU~1{G{L6P{D@FEarZ-bW$Zod7NeF9>0W2{WPP*J>Y#RAw
zW*k1j+x~Fy%#e+*-X)8Tg-3F~rQ0jhyf?MJuRE@n8b@8-vLoP-Lq?7fsU-HzXEH7t
zz$`r@yBN@d5hIxIl9Lq+K3o)E>d~LW9usNPx&z)T*$$CFY+Y#0itMbtnTI3l&(I=4
z&KOy(=8Hz|XWv}{&*d+nTjn#@z(q(m!b(nf8Op)nu9hxOkWOqKf6b95-V?VwJplBu
zn=>GDB;nj0)M7_O(L-;ecziCu_ws0ZLM8pr^>|6|;|cL4Psg9jrctG2tS%xKA)J8h
z(CsB>vd7Q0L4+u-vzb{YNSPX}b#%urfau<rq$o0J3LTj(P8eu>m9r*O##LXRk@oP7
z47@i$e6HqbPGMBF%{`=_9Nc!gG>MB57bHNMvGu`c-Em6ihN$Mv#olE1;PkrOb9pMe
zJK(GDt{&^Gogdt61|*uPv_n#_y8ByuKHHVreYIVQ)4Et(088&$vuP&iJb9`A+2N8w
zx66Y%Yq_k+50|<;7o3Nk9^Fu2EhMX49z#6FA)OMobIgenT(HUy0Y8jOEv^qW;OU<s
z21O(Cc4qQTwGbc)_WfAA5$%(h9z(t0ny{i=xh6UT##FpXkC6zZtYVeQz_av}JR?tk
zPEo-s`rSgN$1r^h%2mcW1?_`Ng5r@z22xvu9!Ebb`J>ihtl~^4(3{@9%h3Ol0hQyR
z8+bKG1xqFYlO2EMJ1V%Q{qq9zhia5_+nb&9Yx~y%>HFhf6gO_`BQfRd_}*>W2sfa)
z!G1$=JKty4pI5_zo1vtKohQ|LY-ZbljY6%z1}51x6PqJ{I}RS!+?42;S2#V$At1-)
zY<`*2;qna%3(Y#|eM(9PHfR}^PUMISo|-gQ#GX?Gvi)?Kx-9X2W#RRXAl3Sk`3I)5
zdcNA-eNmQrMes<eeHx7@_B|N#Tr;GJZ8A3CsZ91s<=Bz%X&pTzLLEnijE<89qw~=y
znRIi8{LVY-$l1v!33HEu{so(W#K7s6avz|Xu{CRAYlBWC=CdJ)4r}H_{m{UyMBB_}
z>8M9-g6k9?en&VaaRx}xmC(F8q~MmKqY;$~!eq&OW|x~MHpfM?Ig@}Ozt|`#H!vO%
zaz92L-_bgXy)+Y=4fOx}G{o3|i*A&937yq)af_f;6qG8~@EsLibNhLa+m6j9O4ab3
zE(dHdL~hTu67I<9N40B6SSSy^mq;7oJkRGPo-W0fx??0X)2`%26su5Pb}(meu)7PA
z8ERe`OZ9EPAiA4)?mBz}1mY-If62npAqTUHk68#MmAf&bJEZS%t-&=g=z4}tUVa^K
zhIT#MNcBAWdpH}N#`m{47a@AZ4S%y~cW7GnJ7;P{VY@63m@|)!lxlEi|BxjakqiIE
z7(=?h+I8w0Abci1LRsqvMwxP23B##^!>yBA-vZUTnM0pFZkH?eNW669vwKDY5f#!d
zL?4xN?ay<i+}q$6al5U3Ry!tLvSV)1D>;xfMSKKgl_wRieJCe>WF@HDxiiE!&4X3Z
zWvX0M##H`25d<B_zRPl&Rx6I;wMqL2E{2a%L%U=Y7d>2zsNj*~PUi-5v`krZ+jm}o
zCSEbokE&+U-NfI?I_iSybsDR$w#Qk^%{cI=xjoZKHTtstGK)XK<obN@U4!~p-|hRj
z=k`8tJ%9YE`P~y;a04|SeA%D}x6eyD#6qWa+wTiIS?B(TQ^`sABsmMcpz*s-yLlfk
z%@S3r-qG&ITOZbLL*||5?!l5tMCTu{@n^Yl=!knb-6Nv7np*1So=daWp$0VjC9}sO
zX5gk25VhT`CFGs&juqc@mJkan38c4sd<6FJ1%=upW<CsH@0ESx9kTTl1SPAP-6(0q
zJx2Z+#q#u8N8y_03W*Cc2;~S#H_#r#-LNB*Rs8%$mSc#OxfheIV1yl~-CC=lgmyn@
zd?Hi0LT4Ypcvx;ba{g~g8zqpmy}gUAahBp0h{`dAaths(953L)JFW{uE<U{qov!j<
zxJ1eLv6CUD@BmAE!ZzpVzG7#3_hhh@X~k>ValMv`I7VmS<~)3w!uJbP|8Fu`sjKEq
zV6r828R?*N&*B1wX3`FN-Kw&kRVEDVB%Up47uy2+k-mk884IUJ|4?UnC42?ICE>p2
z8o$)9b+~cr83X}oJ1AQ`YG@|32My3A;@fY~RFT)MWEd|&144VIxUvt`mL7Hy6-0dX
zpMt!*ryDSG)l1ZG@7eAxT1FZzuSvo@-y$RD-JjPn;*4@O6wuJuoXjc;x`vEhgc8j6
zBqYeR!^VJ&DY=s(bQwLgz=Y=Nf)Xuu)W`}OGgNH(6)9u_-K`DBu__T$jQ#io6XTYu
zE*DmjX)|1cv?9Q;*kXLE%35tKL66R?Tx{R{0SvFr@W#)>8+|;yUvjYSE{A`Jed8j1
z-3Kl)!dY1JxjLNIg$p&`u<5%1C9!DI&ZCXQxCM4oe(j6fk}Fj6<sLj3)&g<G{olmC
z(Qe!^3vMbqS?KDZsdC|41%R=r+YN))9=GZ(KCV{ENRFrbe)ZklD3lIp>m~5ztyl0c
zJ>0Rk*W`Vv_@cw>ZJ?b$+){u>){fHu<^uL1QDDPbu~Ve$?3#P?t@xz-;madj*=sTs
z>1INouZCk5iCpio;x~~iH~<u3@#6<=vSOzviTswhb%j*vwp%sTj=A!svOc-0@y{<F
zsvlkLHY_k2qSs@4q(b#-U|w8SE3{K}1{pbwjF_@epRe49KkhbJCMLA=IwMA(k5WdA
z&+oq<jVNkmsOc{K0q<zJU)X4++-YT`ZfHUfvEUl_Vy3mrCte3@Nam)Z_UA*f?0~_l
z5cKZSfi6XL>-mitg}H&T5q0k*gFNlDye0e(2v#MTv_kZ=qVH%q=5PB~+i`-tskUoH
z0bG?-&QvwlRcpl01$QXD;4&$x-obJ8sJV&iccg$LYZ79gy-EtTtjjK|Ji=PE>eGL8
zmh9={r!x#8Ekji;+c&S=UY{`1U=Nd<?B-IMnVgo^D=I>L%nCjd)%OHFeM_wGk9|((
z?pgLJ&N|h{;M%}F`llPZpLlgiNazC#+?Rs6_{@Bv2cIMefQ_9UKXzQeXdoHCM~S)P
z>>HP}h>^U?GF}Zhf#aAR+3LPJu)n%><g&|k-=tpgv%7L7xyjDg*@l@3FDbJH(+6x6
z7)rOO!_}7B6fzdy_i<s^j2H7<hFVsoCE#9(=&!>rS7HLs+loZA;Z5!U$!*BUsR+mC
zjoXo?GA(z?b<N!iWU~Fyu_f9w&N7~>!JgcD=>8pIa(TS1bkqltUZ0TEL0F0c3h95~
zT(VD8bs5ZZ?=n<PlGo3|MKC%w$;%7EW0crYmX5TBR)`nb&?#?AJU&-ZD)GP*b@;7f
zneFE-t_Cn<b>|V-BMYCIozIx^cQTH7C_ne4V`Jp}St$DO-kf^~`cq+2pu>sY(A_<n
z6z?>%lJ_zT{Nc}~*0T9$A5iHFFbP)FM;}R(-vo8Vm7nYTjy<o!0IJ;!azF7b&cY<G
zt1+O8kZ`|BWp~dze{id4fMWp08`!5`b`^~K@B$Zf>Grp7SAEUAEG{+N-H4`jXU%|I
zwIg#Hv(kne9Sh7ik$`KPiV~PskdLn8&N&ui-Y-dbb&P#2!}5Yv<lNn4qP;_Utd}k$
zSjd9^$?<#N?kQ*Ct8S{CTokq)th5<aKoROJWLD7KLP_TrWyT;<&X^PZW8AKcC|~om
zuRPY?`^#`d;DaoXd53%~=JUru%$?;5z;8BhM7G(lRv2IAP<DQS$u}=4?v%cV;tJoy
z8X*rRAKha$SIc>JK+!<W*g#d4aCam#uO&V|brd-Pncs%W;Z|OOl<Jd%vhjIR=**{M
zo}=4$+g7apcEkAaxZ?lARB8b-PeIFA8uSofW(P--3m^U9_N0y{1{2l=Q%9%iz=6Uj
z$?76NS1%1UkAy%Y(5ibG4PTU__pD@GLBav3gzb%CCT0FLW8pW;8?z_R?=if;Q0rzL
zrH)LG*JKwF#l5P4Y?7{WQhYY&Rvxw5xA%3~VmqkDh<)e6wA%O>CX==nmdBen4FB-r
zZ67twAP4-=;sx{RjrmP_op)bwZGW`alhsO8zWvg?H?>WQ#e;V%6+eI}wpe<;AnhTQ
zy<*t7XGJ@2LL|893&HWv*5OQ!3?j9Rp0}`;2#<^G%L5Y_ra7MvOAfQ*$$~=e2-PFF
zC+z_xQHQ#>L6gW?g|w4qFoIoSRtYM9ZFOOyJHRE=Q0)T!$^xTMUv7YE7%xz>&QYtp
z5x|$&lx;2Su5f-L^XY3gxXhI>vA>O~<|)q+(sha>9O6iXVc>{>J<7j1mJWFMZlI6m
zcztP(u#5nP000m4rymZG%>jS&U+@9#-{gP)LU#8I@MdQ@pZQ;F+@Eglej2;~Pu95q
zPEz;R`||(#Hvd1ooRUVrsp`o*6?~PN*3U;gL;kAi@bazom}C3Mxe?EKZ^kspS!%8$
z{M1~o4q!WcHR0p25Gjf8Z$cy?0d2t0toX_EkIg?Bn!zmL@(nDUL|dEvPLU2?L7-L9
z$lZ4VleIlvaKSia+yrsCI^*h3uhw5P+E;*SVHQh5lL&Y5xzD0-1K-~+eX0abo(E{g
z5QM8?V^zYlm|n2xP12XguCuizKn?gH0r2qRIsqPs>G_78-yPYa?K>>Hp0E}{tnG3D
z?v`Ez2g@cF&dt222jBH96#lUanx_4ghS~o$u!Z%3Ec2@Fr)9j<zx)(SW)1NNgfc;+
zdo0+-`1j9ZrgCsA-@m5=J#&n>Z&IZ-+d+zN0+LPzMCmP`7ruAi@>RUX{CRRG*IF<8
zD{G9uLC?F|V7|v47d#+UpBHH=V0fIeZ5+zI`g~d3=6#U{wmN}Tk6-9?*Ixr|Ad;yy
z9`jON0rboFuCMI>D1-ZIr^5klc~#t;`<<2)uwQQY6PiHA-YeXS$hL*K;IpJcmx^!*
z-uTy7KK0X-ZU@`hm7a(JWa`>dxJ3@h&H$A)0ArcmDS3B_mBO?}T*qRGO^=%-)9ZpF
zcLl@SYkv*HpF>sB2{<J8c)dyQTz`sgjBlR|UOGJ!d+}W0nR5{`-$LMwH*a#`IV&Z5
zb_+xJ(S~nhDO+V*VjJ^>^-N=`FBC+~n5Q!8!wa~sy|#BiM9JOp%uRPxl~3f*y!TR_
zgh}#H{zrf!piOTCjX&&ydIGmzox*MSbgNT{39|=m+g8$6Y_N2Z*YxViqqARr#r2pJ
zJFa<zm+hZv72My+(u*_Gdy~2EztO9~kYLZqV<2_-vcp^EoE;kC!Uez#xL$rS?i_iv
zi^{(rkx#monLgziIX4Lw3wV4T1(Ze%!^p*d>!sZ(jETPE>5~r5Vgo0<ul*Qsj`=e6
zTdFb}SA3@MWw5=ACY_rQ=G){p%6$@vPtQE#-GAm!dH3Ic@Hdn_Rs;zkd+fgey|WrB
z*(L={^nrE-d3wLo7D{2P9Wsh@?%|Lju*LULagHjQAxV2|2Vd>MWlb{j)UmO5`P4CR
zq@%R|ms6<$(5Rh<CV!2rpM%av4wyc~Y`IM219WPTauYq)N&}Qu1ueVCEIXyheieLr
zCfI%QaQR8l2R4n9!c<el+CDZ3X${<37*EsGgu!sZzLO4O@@affzf-uvNpVo*m*3e7
z%7IHu+fLMQC8iwm7SA6Pe}C4${3Zf0f}Z0a&@W@=OF#~2ALd|YxL&>tVqDe&-e@WJ
zGd}7ekJ}n=z<1sk()e(b-d86{{NTeCFIFqfL#lt%U?`4<#uYC7m6cF6Wl>X4pO!fi
z^1IzfPY3vu8L47X+E@FrCz@v{X}o~LU7Cd_B|)6COlZ94>o1qZ_dsj!)rHwyMY5aq
z6jY=_REZ?2f+Wg?7!wV?r|e8EK(C6Gzz?I{a*u}waprL$8Tm2Y+sGf>*TK|E5n5z(
zZ|yg;O+uo$P@O)~hqdoR2Vcg0U<q|UA0IR#c7u4%1l?pWW;s(;*E)al#TykDSD!e~
zxYaOgZfpd8`ayNI9h<|TXrZz2C#|W#0gkZ0Ync8TmoI?JcVnrQ_W-5C8~&Yv3A&d^
zqP&voa&i8d<Uq(pmJXH&XQ#jx_mLUisxc~*Csb9)=Reh|cP}pBcm3y2GT*pDrD3DT
zC_=If^uZG!JCzCB=h}VkkgIlgJ4ewhgP*H#C1%{VdJZdPiatN<X;e|zXKDvf7tEbJ
z=sZ{-od>KFaDL?gj}sKh{c9P2IbaOZ_q3xV`37M7iwg1c+k66Ta)>)QwI11TcM$<G
zV*_!|@B_-CxJOo_u?uZwQtBjrriqNw>4D6^)rSmor>P^owB#mifVU5HLjFn12kTXD
z1I0Ecyh)x{FL0=$g*jeRlBWWlx2?GfFCIyLQnL+c1}4C;<F~Yv14ICQLN35nxKU5-
zrG7d#{*%UE0zjXDNm(CIT{s1p3diM5!z-0~riTw2a5E&C7ay^cv&3|`T?E(<=I+7V
zJpz(l?c?gE4{72V^Lh@7&n0NL?MK#3#4xel`@t36mh=71gS#Su&+p)4=VAaaaor1(
z!?D}muPY#?3QrQV)};=-ShL=_fXVmqOdTn&>&*1=Y*&ONQ)BUM9*HCwV`$b3Tgx)9
zxc^1&`e#hLsU9D?23`}zQ&UOR1WljSNcd94cbTyJeLlG5shXW7Ui?|L{xg@dsJj}^
z48I$FyPQf=2W~czW+z-r05U5D0`TkQ55pmrZ@l0~*5nLrjNQE8{qF&%I7$P?0NYF#
zVLzrGzA~LrmLqJwUwYlTiFs?UU_W9Av4Gj1GODCR#l24|4Bm6O_IA^Xn<4WTq>5(%
zOoc@(?`-si=fC3@$^rCwvB_MiBxq*F`eMNYat*L^=_ACD`7Ka;=Zh7mL%)Lz>1*;U
z>u1dwJF>u<?LX8joPoxaC+weqW*vz1byV#B%+OhKXMykf1*etvUA4&SZrNXl%(MI6
zQFsijRz|na0SH-X$?tDV$)fWpez7VlYXgh$wKSMvK4!)*CS-+9?BR3ah#2jWCJco}
zoBXKW%>E-VYrLfPXO1iFm5d)L3}75#^Mj!en$MADO#cwRsw*bk!>5+`(#&OBay_fo
zwpVk1;ZE?G@QKcV!nLHnk=ZQhPET2*`kr!{#p3O;G>xK-$KL%H|FR<f{O$Y=fgag*
z-g~`0CJBJvubH*auDqYdn{dzDZF~(jmkHz}gZn}w0UP-*gQJtbQGAz`X~GXe7y;6~
z%RRS5sU*Y0y~DD6r7pGuE}@}T@U;c<rW~AHb;E%<P~cZ>%TU~Ukc_(WzT-!k`aXwB
zcE;+59*w`QFF)`5D{w%HGM=7k_&I1VV5)!LQphQwHzL;WO%dh;pyjpLx5v-vYQJ^)
z&<K8#6f1d-#reZy@U5-_Do%ekK<p6v41h8zX9zw4@Ce@=)`ejcS>LYS@E5sj7cS44
zQ##f+gp4QKxkeq>qWd_mcX6DHkDcNnKxkmBDf`uuT?kZtN|;@qPVT$$uB@&GHg)88
z(%l}2D{?1zh`l$CX3D<+ONiS(HV&`wUE`IfdD=K0&!-%6@8G&-w98vAD_O#=7_Luq
z_VrUfOAl|yoEA7cwQb2PUrpW`6dyR5Xe62%FAVy`Xze5|-o3pYG%dP})bzq3ryh0H
zhS@bm)|0$5EYlF*%ex@le&n-jp&7owJa+Ekk|N|6b9?es0T8!^!Kv2(**YWXm%_t5
z4&7^|>)`-V8KIJ>$jo~B`==BmW>XR$vpIK;G6y|IEpe{8l(@1OQ-RTAWG~o$hd-qd
z5)LGyGU>@PdykHqjR4of5uU6^Z63mIR}6~iTMfW+U-rXP^bf&plC1ST-K#MDwI6(X
z!e{qQ{Z-16AIB}tdW$V7o&yQTfTlBmg*;>VqrT=3kzcKl%E$U;wFDOL!W+j72UMtM
zE>Fj`_>*5anx0Yem8z#L@Ux0{Tu@1NnPbz_06XTb&I9`zVzeO$5Unb*e>QWz3_|nL
zQY59ROT|a<dm{RTe4n2l;4txemjn7S#Kp&v+|gq`2#R_tQ@Rdq>nWg;pyb=;RLm~<
z#pyxP>Nq3y@JPo`0!?D#F_0xARSoH!Cr{%VFjYcx?oX!{@C?Ld56d{A>BEfM_NMlf
z|3hD`pxf#lR1~XI$Ov}0-ygawOlqFq)coLJBmDVYKF+C%7@AjUJnTO7nw4si!R(0e
zGa^g#$_hV6>t80j#}F7IT>8vi{>DEX>%)}sWfvJn9QH~of+d9or`tEh_`&XG#5|x1
zcDQt;Fgye3H@(k^V4^%foPKey36)fMrJ%koKxL>?k>T>zdU4$Yw&*F-5&csB7=2bu
z9#JPrR0N8At42@|5lTdOU?oq?u@^QOdR)Eqi{{=*sw)7=VNvFHl0)_HB!}UDOLBnx
zm*n7g|GL#bB?$j!+HVB|OC$3K+CRD6e{Rr!{{cwaF8yjt|Knf$mrnV=j!s#5hwoyJ
zr>BwKQjZ0-?cAso?>$NVW&Bd~;_DuMi9d}f{>>XFevCf&Hvc8;T;UnX4*|lTKQkOR
z_zQhE;eDK18|lAdmf6%_s>07V4>;4W?E*+D218yVaeKokSNyezY?0Q#d3pc%xZ>lk
zf7E~r_bFW}?K4Y--=bqY99`jzJLJ4gs-o?Svelf7G(PIz3a!0g@%*RWSc$tpCcTjT
zIOyD$tKU0L0>0~x%yI`L;S&H7t(SCa?iT#K>@QaI;{f>z1-i-Skcn1I#H=%$&)Hgy
zYI2pR{4(vGeXo#T$VmeZz5@Pi`h2NBD|r4ny8O+LJE}*NOHLj}oyxSEQUJ5YMBC%m
zFEeN!j>Yt+aSa0(VwLs>gT1`$mOuW(7+nUAtt_Y7Zl6g@`nR-)w9#kV@xLyro^g=_
z_6VM?cks(@>c`rBakBh1$z|qh(ZB2?|Kh8pl>_U{T`6yIwA@Re?GNZZ1mx-cMqbgs
zdyuBRqvQ?*DsOp3O&uy;hQ{GAfT}q9+H!23FC{KTvsD<V=n17ccaNZ<IgnagpRlHn
zNi6TW`TxZy{WTH149q1<cbiJj{g-aym*R$Hc;kx_!?62qH!qh8KQpHEbM&fzIw$TG
zc40r^jKfNL{Dq~rze~1hYTssFG*Cwl*GP9?96f`w_MR|*z}=dmg9lph%uN;-OSh-0
zZ~gk2eU8Psh~c*~HB(BbA90k$cb3_#1ciu(8$9YdEzB_^1VGd)PO`1?5Vp%Rupr84
zSAA8#-%sz}iHU1^e6ndIERH+^@x)Y&Z(WV6;IBU}EfW~x1<`_*fm`-}*cK9>XosPy
z4~vt+m^+3xGE#DYn^~Wlq9DTlt&dr0`u`*B9lFig4xGk$A}p3R-T7pL?md)?LpD5d
z^DQ6iTQ5%`nVZe#Qx>_~argD5KDm1*!v6V9{o5D29}8?im}#o32_&EN0%NJ)Up~IO
zwY(5n$H;l|7C`4#f3U#pB}rFEZT8?+6~$Ek>qw5}0HCUNu2MU!f;!y+&*FtqPha2y
zY%PalJRRu6%lu-RcoMZ*!W3KTt`7^4ZRWvzgej`bM?it;y<qLIjkeQXaTg;Xjl}kw
z&SZUifpM^3mThm{f7t<KvXvLt93$@9zt*_ocMsdm=fyFI-(&C*KI>=t;AX6l*K~_J
zfMyAC;F8r6F=D~W>OFFn1)mhI0=@W+b1~(*K#+Q)lCRS#zq*nhG&h_oxt=Xa(WG3^
zszI`AdYhNmfZH(F>Z6j3hWUShTig!=Moht^3V;RV3)pbQ4h3@uMpFopg;U38f{1E7
zWYJl7&dbD|QUTa%`D~Gx84J&#41Lu|pra^8C~KLvfcQ!V3@C+zO&+}ijw`O*tuK)A
zg&%s2H1bmCz9zSgWUk`~mJ-oi+*$78;kn>}v{st`5IrBC0j8RFo^`Fjzpe{XSm$04
z4aO1xilF@q&s}{{bov?Pt!GhJ(TO~=0F`in^oyy<uHZ`FW}jG7Ke0IJWwyFy4qij>
z=fl{~Z%*AYiU4W$*jM-tU#;Xtt7wbaL@nDpA=4jDizNvZ>oH<kc$}gWz>?uf_wJ*8
z&BWwukJNPlPD)QR?PG<mh{lMyeW`KYwdcP|{(&cTQwO3kq8&Spx<U=$|CYow6%GOX
z-)!O1=&h7-Gq7!`stCqdYpq)b9O&n=xA2?T4BMBt(9~ayu%uUN>{<m;4+x8%<5d{{
z-VNeF2yXBk<#BBH=PmpXng5Rz=${|b{|xY^UA<*#+)DBkIO@joq`}xp(=H+msu;fa
z4swZp=BWFQUoTU(j2x;5rF=AJ31+7dlur!#twGwt{C9Q=<NR+x4)PswuWB!57{i*<
zFDe$lZ9>NgSS`boh{au~j2=&HI!)SI5$|~aV!8jyoiL=H?|lP?S9VbN;}_!z6cccR
z==v{fNtyP0Ym$YU!(uhT9omjt*?N>qYhE%dgHQTR6Sa28;}?qW#`pi~R0}-$Eq`Dk
zI`ckh*ulRc^o4x21JHY0b}LNs1=Eq5{H%)D7bDT4ODnl-N74G*PrRj)iZa4Zi(fF&
zmzh6?cMy~)l<|-9?kEd4g7}^fZUZ*V%Hb2HBwidokO)o!oJzz<SHR`=f0*rr<HPk;
zpOgNXFCy(tz+<5EiJ|Q;-bX1rzif5T=3a5K-+*T@cdhldn(?vkNb;T@kl~qS(;GK@
z8!*n)%k&@q_gBDXnne=#C>`<@IDt90ge`q+IZ4gi7ls9jHe+cOJzP-`(p6pYV=|xY
zY7ZSzoBMk|JZysoK=N=>XECMq|8<x8dxR7p^9Ef^7`BXOPJvp&0P2UDyocje+fqaX
z+1Kx*Y$C-2IN;!P+X`C}@Zzj_)r`-Wq2L^K;s+TS;qI4B*JA(51aZ^Jkfy8bm;Boz
z{ZBi+%l((Uo+pUwGDig88OQ<R=n&e@L)`1}WdIxt4maaBjt(~>eD(IRGQ=h2`gfav
zlYqd%Aszv>nF0I*w4gh6X$N&^A_SAy&Gh#N`sp`UFB|}F14_d>_-qEwcT*yWJ;l6!
zUx1U>Xb1cW=mQpHj+UfzS2~aRd^5PC^&puKM|dbe%j*LS6tKQfYhR)4$4_Gn`X^2Q
z!&Dtdq(9J#bluATpPu($Pr!eVL;q=K|7{R~*gE^K2k?)S{Pziu0-{i^G53Gnap?cz
z+5gv47t@Nr@};b;2G(cE<QVO~mHmSGbsFK;4y<Kqn=4W{IEAv->5Fkk1mKj%%?DT%
zJpaw2K=JPu1xYl8Ypu+~cUZq0kMC(@^V{&$*4i2v7sZ`55Hie~jEeQC684@?p3|Z+
z*wP6G^=mwMUgBv@;`Jv`<a1m%M6zlPKz5m-aiOUreWJBvcY!OFIf94nL{`a4_}HES
z8d-<k110E-?b>!(fg5s$iaUsvcu`g|-a%NlWzMpuxP`==Pq?+!SmIlJUf*O0;Zufk
z@VsXYnX`%2Oj-9UMG5Yf{w2z?1J)d~o|f>k(L8;GDkPHu-?Q;r111ZFkv7A^p`P5f
z4n6}O?^B_*BBtCsy7D=S9?EOefyn;r_((`M{n}j>oV2HR(UO)r-G<5NtQDxBCZsw@
zXgnYazMzfsR4PC&s$<=AR=3iix!VGu0L2NG&u=|_lV=LO5EXJcZ?R80?8-tAjFoPR
z^2J9<GPJK8um*?C6$I=HEAhdt8p8sq;&OxOvFHh?aD{>Er}0sAkm{J7un>H{Yx3M5
z%cnm#5UV4nN)^hlXdkG0dDS1nj!!~A>lpTU4FN6*#C8SnZ#epTc%?;(;P>($Dh7)(
zhMNkv>c5(DGX^blON^LQ_}gkQlCPx)ZN}A;Ef6Bgv{0dnjFZ+DH<7Jnq!L#c$(697
z1ZR<E%#0@E4`u0Bh49wHqm^-l9bHGg%$iXms|9co^s?IF(e0ztBqD1o%cs<xl9g}Y
z;JGwIxlsGj4;5N8PIK~N$x)pDa5ewM5~(?hH@D7Rp7cZOAL==p*C;sdDR`V=yIbjE
zZk{%x-#1Ey7Fg2?lrEz18uf&ETuE|{_yln;Do9=2Z9zVns;MfGtMGi}jn8`%z9U`a
z1})i`<X92)PS<)(u@=NTI3cLW@Xi|5z03o3M(Dh<Bsf6CN%JS5%aRe{#6z*&9TuF<
z*d<1etOuMarJ0KP`c;8N^eY|(;_ypV1>SlXaXa5s8_`W6mjb@*RCt_XZEb_zpaX@@
zX-k;J9R6l9{3&uh&6N>Xai(g|s&`a?4?T5aX6$oSrasbfbYr*DTXA%0yQ+cs=@5Sc
zcfx1{OB@p8t#meA&>qBUZD=CJ4Uvn(kWu|iGKul6ya>A-H`=@Z*m-Y0yMKA^{yI6`
zwP#2CwH$99zFF2oNhm7%rL{bB`v})P6ZHA!51mDI37IO%`(eIqx(mGLgjd`6*F+9k
zB7=~Ggye=EY;@D>Mxs6SyFj#ShW?L?t@u}EPBl)5ffnz@=Q|1kwgpXWOGL}V6Xi~b
z;dFxgqgd$RP!|A-$Xb<oTW}-TuWJX56E)+@G^C1nC=+W7E=pdnmP993)>7S&c1ZEk
zv7+SAw#05^3nlJ-QN9u2lkDE3+-ZZSsKJRiDvotQ-_8#{YTFY+`>yp~5W$8*vNyCV
zX=Ukg;%nb_7Fw+>vk}z17ev+TP|f=D_=MtVXBeEIu3{LC+@@f$K)=ziO2VoH#_the
z+PXL=yI3dv)tD4S@&we9dZAIQc#4=mgv-q)nA1aNHUvyA!@WTt-tHj0bj$7-_3ph`
zt>u<BK_VuW9rFuP@8CSJOc-(Ok~E(O7El3eZCFhundEO*a7kFvr38%NJLtv&T(;9p
z4A`xsk&8)a+>odtr=hNh8+ZQpC>klssb}RZp*Zn<XqUm!W84Oxq~7Z3CvF(sXKChq
zNN1@>&+T-nwYy{qL13_J+%mM7!+sTULJtxx?=D!4AnJvy4WH|act;pwh-N`EoHD-F
ze_}d|IZr-_(QmVKRrD8JDQ@G98ItT&66QUcn_xv;<XyE?J%8))gzIIW>zeB9HqI6S
zuMLz0Z<epU;Iu<%AL`!Exu@q%S7~4i$}qZW+9vsh(G^0!_HG2=rOY}Q9~8KX)f=)<
zEHeff)#UAr^K~-hy2z;OX6Hy}v~#a|-(0P8pf<k!xK#YZrtqabNxiuRNgJ!Q-SfzF
zO$}3d2x_T0>8xnnsDkfFv1BOot>V(W_S&3UBVMm0%}+~SdNe+xW^cDUt<E`D2=I1D
z`SSKzY8(x^3WaVl;Hc+oay0PoR<UY<-lLPz#e*$XmIW&W*oHUmc2uDPw0RiaqYEiW
zy}&d&=_6!tXuPp)wCcc`-sdAyf3`nJKzAIvEE?fre>Ar5?6tSLT*cRw(FsB2-#D+J
z9Ow)|Ju^Y+**S|14l230p+0b0!o!^|Awf$pWXXeV{=sb>%GK>!Ck>2LZfD7;XSldQ
zCdR9$u76L56}4FLs_%Oo^3b3a<dPpl^g5lB8fI7AY}E&WBAl_L7S)w4zK_Bnb9*@t
zTNrtQi4u0==&pkGkJixybI%p8;g<T916m?%l$fuoMwbF5wW(@vsDh!@#U2mG>ShI?
z-v5!gzElIIR&j1c3wnQ^F)Z{_D<>n@86sx2ZNKQrewwFS#Sm{3lL^l*^RtR9`^r3q
z4IZ6ZnSG03@w-_o(T4>-ppwIjqcfoMFh!p!4LyFAOPR19_15<g;n;&W_L|RMHV5p_
z4=%KwUiiXA;Af>H7YpBtf0jtl!GHdg|6;SFwLpVJY!tgdv5h$5I@lsi?lgU|)Nlxl
zm>+BfJxN&$LRHAf9jWtVa%k#CRAjqfa;}J``?2eco0=&o3QDs3L}P$RJ*&4rCHr~_
zPP?WSD3vbrV)1o$R<a9UXBI1I6%Kzbm9V*d>WLH(ViiyIwtZp+b!3l9!E+LfOt)dP
zqGb4jM(`DkSVaEVHFEEx6s;R8ZzIytO43sLMR$xUoHE*->8zIckh&H8Hf4j57LBf&
zaEx_wFSN=okbiZhf@^hY-$?^4m8+NEPGmv1pM~~1!xzSvyo&gAXDV{_;Ej|)wB~`3
zqOmXe{p77xT~>XzP{gG*(&LyEGcDUh&tlTgp{ljSM$PaAQE>%nPz~{faWkz|2r5F~
z=4ha`ic@6ukMb}%^R4%ex7>pCuWRddIB%Az1b6SAo+%&w%12b+;7PkuBqp{8uWCe9
zb<h`VcC1^xWWG1Q6@9DZlk7?ZX3{)?=jA=x_LlVL-@T?y%v2B9=X-Omad@kP6<;P_
zOE`DYl5M*mR?DGRX?|hcOUnEGjYfQWWX`t$#<n-QnV|)yBT=1AL2JmyWe(Eh$wv`P
zHBj$vo?tbLurzRynHzuo_>S-Ox3c%ZNm`n_uYyF%SYqLC?Rx#bHker{lR`G4eRQ|0
z+hLkwUu#zj-RL2X)gdTB^Sd@)K{{({B;JX{t5WB^ChGHsr;0>6(zMzffJ0#U^eg9z
zvIaj6Al8=92NjTO6W4XXYg#0?VIJL?9@uneSonfDlnSn-m9z{yzdDcM>+;x!hH@qs
zc~ZvcSC#At*Z;o2&Xw4RLpbK=y0`VrHTG4J!gD4Z5`DE$Fm6XUv7mPC0XS0!QTvq=
z+Ux1vQ@7_8o222vE&ni5=pZ?-oL8=>aT7l|SF~ap8lqGXQNOfX>8Ut6w_SBe{M3y<
zA;(hS+MkshZB?^FL20vK;KQ)Cj(%2=0*$<~l0TmHXm!EIsd^(eov!lFf)3lY%a7Tw
zZQ__HU%e}++r9e)k6bzsFVEN(hQU1q2&TkxUT_Dl9IL5e@l3~J0d+Bu!k~&O!FSqZ
zVn{gMcmgh~bBpha+qQ8>mV0G%3N%1(qWfT~34ghxJf^C+jyv4w=7@4{kWG{LlZ-m+
z#QFHH*iWnOSF=8;Hm}XkQ0q*z-6dAi54RY#XPu5O7cgLi&pNxIN}lf+E{ql|eVj2f
zOMlEw);s7iFbkSN_Jur-4cFF^h$W9h=Wh9Es2wHoVhpZYHl2*<PVC$~<vbyS@uE+!
z3Hm|9;#zuxtu~|hWoHtXm0^|h?`vQ;!x~dow~)TMmC})Ba(uW&>JZXhacuqO7*gt0
zD*h%4{uC-eS^;-8G>3Dfk!C@kjJPbrcC@zbNM{Pat5lEZD1k|J&AoKttg9>gs9B#E
z3!Z+RQTL0I@mY))*^{Hjda7RYN=%633rZ`EWuV($T{mB9tv+q7h7!6mTB_Q<jRyU>
z>H%Ri{aDn%AIMKy2DvD|8Uq$a-l+!{Byn<sOXPLb%CUwa)>{;f+F$2cVd!18PTAK<
zEQq&ac7hL?cIrRhd1P&~xtCizbq6)^G?qU6`yyN2y>l{D^2D3qySP+KcnbHG%Z6`e
zY9g3Cp<~R20!LfAR<E&PfW0gUU1I@NK>(YPup!Byy^?9IFlL@yW~s_0h@;agOBiFB
z)7QXZr@q<`iA^r3o;rxmElTd0%AZxu9e$P7<<akW!{UW&=*-ZdQkIgeh>kZRzrYt4
z^r_(C^+e@E+bwD6=Z8i3o^e=s&sg-i-SRijD@#EYV6G0Sp*q{Dn%^U#uuFJ`Lqw^H
z%?W}LFBnSpsN|qi+fxyC=SF!!cAO~00m7kzK=HOGUU9zQfGfdHWoN>j3h7hmTgR{<
z&RSyAk<vbjw)R2+Q!&4fTK9Q@^7NbC#W~wFwbH}Rj}Lioj}%7`1}hh=de6BGu5Gyy
zYSA|>y}<bMGJm9xmvisjdawGVO<018jRQ1R|LoLh*@G7{wOl>3>>UTu+fMKzADXni
znAXDP;ijNY-iuFB&b*r$p*YkV7A{t9s<YNn>3AO8D*eVy#UhXR==HXda%St<@-*$#
zul6oJiqZ?GJE0iU#3Gxtr0n;J82;MMp1k{5`<o*i%!WgH6y}FZ<w{e$LJR3{YyzVw
zw(c^1@x3z7NtA?ExVsSL5Y9^595|h<`r6Sv$HI0LGc<!L8vM9&@9|<SK5t?URIP-(
zt`H}601F^J(LB?0@W!Ly>tp>@^|ZXjcg^?$T0(rDACh?47omyV)^TB=ClUqDQz@t0
zaO)|{iS0-9XARXdHm+7y;e?>5CVe|pDjMvG_0j_(#K0UJP=r~?GU1T<!3qWIb`3JD
zJ#ZdxYTp(fHtxW~k~@*L^<(q(xY|~ZQ6I*cu}UaP)J704ZV>HaPqgun$;C>2z1681
zDj)v?<zgI<hc<aXN#6k)0_VN-pVSt(VA5I?QJ%{)sDWmmf1I@aO|D*kES5du*6nS9
zpb&Wy`#tADNa^}F4um!}lhzfJ&5zlelBUu${Nr~C7U*GBaXMb9Ub6W9yIP5dVG1AZ
z)??Mp#S~f%W2&{u%b0_nr7;GgaHi?cWLk{kajU+)h=vy~B?`2DSD%gqS}WSvUWMd)
zEm{kG(z>mA-{epZ<HJU#)G3pyQFGc8wf?FlGVh_P_j;QYe@#$oSbAYlaw~^I{<np)
zeg5>#I1Qv9x}t#<M~hL@UmcK`PyrV$S-o12mbAWkjvb-Qz2ybajcPQdv7T~Gdrd(@
zg6AoVo@?$fe1^DGrt~)wG*XFHL3ORk4njp+#L+$idP|ZPP3Y6>6&|!15{s~e`wnf1
z!#SR*Ap?RdpeS)@RZ@!Zg)Ck}4(D)AM;c8h2u>WeY4E}bZ)u`4_~RWgMLmNM>;r;t
zPf0o+M%S$s=)_(nH;C_c9)CoMR<~Yf@QQvgRIIF#lhmTsW2M@KL=WKuuA6t@Pb5;P
zcTJED@zwXUE<5lp|6sss(WOFf+;SaU+strvM2LOf&{zyn{IfbVed-Nc_Xnmcz>d)q
zZCFdS{faj2mEOAv{w;CU3{wY-_hxR1WJv2$O>foqt%EzyrSD5Ix^L#q537n{3jL+_
zn_n|KT(QdZRG}PL3c{2n&6|Pkb61QsM%sGM<C~1A%@8>hUia!Ky)V=hI?JGA@6Si8
zmpqCIEZ}glvM1Q;3EkS`DAfGnML(egSv}mYn?9jA-w)CtM<b*|d1-{sccsRAeeql+
zx(bGKm~g|oWRbk`SpSX=i!f|(QF807j*oUt=XV&hPi$KA8ft?$v}0gth9YKCP*R<W
zvl@#Kz*Iu%?8m%rqPj3CWe}JA6vn}-;F`_=wKl6C<L@5yeIbioQ!9gX2Na?LDO)Z<
zq|gEBx9jppbHzdB_dxp$#v1o4vt9C)jh5nwE5v+=gHlA2`j*@GcPjUgJA!ZfY8Y*=
znB}`L40;|F5}YM*_H30aYOI$hjy7$aS-u7nc91soNL_s;AkUm0;D_w7RFpW4BS%8q
zdw8ZmJBI~}6V($^2nez?Y2Gp(|A~9TDP|%eR5+I?Wv7p;*m!Ry!2_cVJFM)sLQFV7
zhz!P_X*ZNi3TzI;N`~uc4WljV4lC;z2M7!=3pHw=FONDIWO}X)2UQzpVXIurv$6Ru
zB6ZRj7`jkuuZG@buF|`w{EtdEK!Sh6*5i2?VYM~lYY$xkiRdvSK0-GY8uZEe43}QI
z(?poLNqOs}E`9gtz<o(C3?aF1d7$n@&(dK&gLy}xi<ChR7Al@*i)=sNR)cr1VOBnB
zZG03uKiI?!b7agOoLG?3zffhp;pd>0DMNILRu1AOeV^?M@9BK@pgO;Ow=DghVZGNA
zVNnqux7w5iTJH<O-ov9ykGtbJ>PK3Ib7aDMc{^ixNB2z=>(g$WxmhLsHR;lT5ERJY
z%<u}r>1TL^3pX{1(y=Z~*G$I=QIgl*JrAtVl93LJXOZ9EthSfwfk7z8n}9uVqAjJW
zGT?Aqx=34|Ps|Z-99BHiSB;d2SbkWrcRX#c_|HkN+DX6?;Zlpf=dB<Im4b^LNE`j%
z=S~e-ou4Ah(k)Tloxf#SXOo{IQ4sNhSW!4pGdd`>$cGi%!KYR2d)c^}-N5Q2D-4nD
zH3bf9mE#o)CG*HHt585jMv8g`-F}egOrc&z*qowpLg-LUeMDh_Jns7yap6C%KECb%
zlY*kN%uw<d{17FX;>M+yWA0PD6@NO2EOV<7sTUmO)z;@uGkH;UaLzsIUVhlqFIU@N
z(S%H2IDz~6O?5Ehn-Bpe%|ru{(J17P=3?Q4GH+7rE9EWcC}AXR^2-O|x<LQGX=2u_
zz?clFhE8Qy1Iegsn|q=dV>D?Z#_U?3@{+O)SlZ*+{)<wtCmzsty%$T4N+ZfW;VAi2
z@>oM2_0!s5A;?-J!ZycOtMWtZQv&wo&FyrGwx)of8~C!*+?OgNUC)}Mh)s<|QI`pI
z5QJ^%g^T`n74(r)*Lffoox7~`R}00~qq;)%%&>M(HByEO)+^S$Ee*t2YN%qz`#H#c
zaeGQ{u8q%zsd-Gy??)Y8mGGoEDt6360NbbNY=sC4?mMIWN?FUHJ+UXhI;&x2yF24G
zA0|!K>a=xf(^=>Y?*6XhWv>bUl}$;F35>1N_}a8bhl=gw_0({o(UIorN{6&?a{|Vi
zr>x7{X0(0BWc0A25MDDnCH1NUsB?`Om=Ol{(_9IAqn2FBYp|9I8R^IMGlercsMm`d
z#AP}|Z>Ze1p6~WJ#qtekUB&(wla$0PG2b@#!s?)pH^du}_d_oE&pXzXFMhY$<&;qU
z*e$N-S3vhzB=%!Fj7>$jykEvk0}x}*&!drG_lFCL-*1fe#GFj4QiDtOG$u`x(QDH`
zWS0;abtSo-j+N<9h|8f^pyKfUf~XEwCmq>W%K>K&&o9hW)Rp=BZyZIC`0N|W-cYHc
z@$)7lp^V4p8@RvnQhLs~t8pRYIe~9~PF`|S=<rFm@#Rm4s^5fC$%7bV=dX2R3hB}&
zdfqiHN##Pa8syu_kdJ+ycNOYr5ib)9tqg$pu?^@YB#(F|&%(T2br1KGc|uFpygAO7
zb;sN1QOoCh7T4@V-G6S>Ts+Hg=%5L|;{^i2f&EdK+CGag=t9KkD{)R`VfXHIU_U%W
zC3+fWIkC}W&Mx%oJVs5(Al>PE&NNCehQ^y)A<~1g3(htGC4zceyhnY}Ou6ML&hj#(
z14{%9Su11fnp)&+X;-r0Vbac+yJ-aqbE>HGd=ceM++q2k^_7eKqfLW8921VlX{JFp
z(;yR{`>a${uHAqTfo^-76jDbWU$5<Y)<H+&pqostG)Xh|WD>7|hMidvH^wP~-UW*<
zD1u;a*w<NB_37F8BG{!mAGB(XO3?i|mCQhVDh13?Ca6D4lqm<T*=}CWu@s7+l}$2?
zyKCXKm3J`r@sTws)wCbleB&9VbY9XbE;q*8fh8ut$;!aHllMkx`9;OTBDWEoncGOd
z$L#-M?>pn+?6$ts^%5d_3qlY??}S8@=q-9g@4Xu$$|TVeHF`vg9;25*xD!DTWQ;x$
zEqXT?!@J$*<UY@P&WW5a&zJW--}nvJ>}&6}SNX61T1%+Lh?;KnGm}>|j@r<VWYt(B
zCfdUyvNC1qS<g&7=IAySS{)*)W0?C!fF9g(H}a*PZ@qKjGbsl~d%6+#o+YSPoHBl8
zm*7U;`_#&`ul~9*LwFyS{fg`*jXN6_g&6GM`CaqXh5=sH+AFq+wOu?o$vO%K`@+`o
z7@dYbR+HpOByoeG@s`zQo!ce_!LoJ#sEhTQy1PRY5}`J$^xWlv?@3IMqK=BtJsZh-
zAlZmc%#dHu5EhG#o7fFHE;$g-BnrES3RXwO+MuAxIPdi{8SWxin9FL5)U4()Mc%}>
z%Bot5S7W_QY^->^jsr6Sg0_d*%B{S55oN2lbKL0r0%9fr#(@opU73_9K#nZ&8Qrey
zYDp0m<6UZw5w>-aC=i;fC`0Com$lHW;Z(zMK8-iFAPwAWc+fxUtB-+*%{y#dgcW;p
znZ;F)yTtegCNewzq|x~{pV&E{Rdt6Mf~+Is#e<J6k|QseFa%GC(r_nyNA?A|Zxw%j
zVHYrnGn3}cyIYvJcmBKe@Cc5v@JgU%OI6$b&t5flG=a~`jdUz{1*-!>KJP!cTBe-b
zEZ&$2;S@M1+@cYeJpP~_v`|KqiZUW^r0e+Bu~%8KprzpAZk5ML=!R%tvP4%)hl}hP
z_}$3Emy$SAy#&hp@PZ{BeOs9mK0C~20#I-EyxtgJfa%pEt)Lu?j@AHnVtewcTtk$(
zG^>Q4qD+AKeJ*@e#&NUjUIN}*x(usbVMh8*wZ+95stN|PLDj0qb6L%*t52;&{`g!E
zhv5$^%=bUAIY#$!mQQzz9WmERTjwn-2fft_d0SU_=oRpGsr0!vMcf;2Vxh7_KYh>O
z@j3D0Yuaex#MS*`V#7T{y*1;N83sXm<gJ$ZPs7N~OrMT5siLN<rP5G`2I#VH`j{!y
zNJ5w9L>G>k1@BCf*awh&3A~&yq`7GHv0fVe!_WIM1~D}6@cv?Dv3Idqme7PtjCUY{
z&GF~ZZr`$#v+<f!cOPF_KeDEr6&Y&(boAsQT&mIty=65Yk8`o&-JN-9tt80Sd3HvH
zNJ(2K_<g;{y@6ITZle23d%RC@00G@eyfPLNFg3WdeH%UF+fAWQeBibLp%PWlduYB;
zoXSb`AzUCUm$UeS>sRfnb~o<8O<q`&0b6oh*ZoS2LHKM9KZWCDv-BpJaH6B0OBFh9
z&|#;(?70!}H1y`XMPizI8Rn#QClRGJpQHnat>KLgqa)UQ#jE;4J1$4>9`<k=UVNWX
zYPJ@$ag^dGdIhv=@)(<CQ7Id9Qsc#x9r=9vQ2>AnoQlbV@sU0Ug9-HOaAdVSZ@0GH
z_a*<n#`gW9S-1yV6h7^WYdS?tvwOT@I%ib*M`W&vX)vwZ&@RJk`pM6FW`|^YWz7$&
zbA%c?i0je8EC}~z1qC4W#l3@NwI=~sb=K}r=1Twwz(&Zc+Don~25SZxOtI8$1*bDA
z3vP86-fVogXZK={U3`F4d4l?x?F&$BlgFf-Z@gxij$KmUS68wLKFhab3n#j_b0|#K
z^bFDkl9K~T9*$@Tf#nm;?x`X>{WvqdrnF1(1EgJ-R5o-NbmtB@u$BR{3MB8Qh&%c*
z35CjALGkV!h4(g6XIM%<hZZO5o*ziE?raz=d#Js_JrdlxV2@2TDKXdMwt>?p*YJqR
z)Yu0^W(X{$%o~m@N+*_lIC^2m<LI~lu0P8rvDJ{d6klj^j>lj-ueThah6DKCDfNay
zW^vp0yQCJy-olJyix^!gY+CaBa?*4z+Ah8M{@e{XN~YVa19|Yr-rilNrp(gYm+_t?
zi&+O}Hae4d!4oBPY4tQEpft!_WH`FRzpT<;SjeS%G1F{8<8HatPOok$I4L)JOhC*+
zy-4|$+KB-41RVW#3BI*_)1|*9rAC~WYo%#0deNOTfY)%|VPF?&21kdA9}^)m*)`jC
z8dr+q^VrogR`<!>j?u;by~smFfM57ix|pmP#CQcR*$t=u9YZ>qqobKQUBbBVs*!RU
zwmx4QYD+?pd{Sz2>rO@Y#)l`A%$PF;-=_MeRbhw${ax)8xVm}0?Y)B=eLM0TO0Q=F
ztEUWBWh*w<M$AUlF%v|T^CM<7+ikOscJceeG0uL_Py6qTQ{g|xi-I`4+M!RjYW!(y
z#toS~=qWOwTV@|Y;*1A8Nc2&Sqym}mh^R${P*)AnvNPQXTcx2$Ry!j9q9XrNXa^&W
zC4;e7OW6Z&OH-*rudU`e=*C!YJMpfJZ0AC?f~I&mg%MCn&!NQ)Ba(;1_}vJfU7xI?
z(Xo}9G^s$2Vg*fpeQ>clZHvas7k{7(yL~L19+ms;q~8l@4o+&0u_+$cHR~<)+qq?M
z=yX`!13Ob(Hm2HJ9F4x=RW$4lFcC>(M30^r(k(-G<zB{^6J&LHp}M3u;L8(KMaw*u
zSItLslSFDcXZhX4-m!)<EPZt40F|DjPSzlj&jgp}$R*0(EZ*B2>qKZc9q@S9<kf5z
z201mM*CJ7fl<KIQ$LKoEFAd0ogBmT+HbJLZ(4$6~yno`Xk}@E}F)uQIPv-m4&Irc~
z*de`9&2`p|7zj@mY3X&XymN{IX6CH>x_gd(nYKbPt9QSe_s{YlXn5Uhf6}V5o4i{Y
ze|<mi{fMJ8k9Etdlq{W$b+_q)P6=@#fvmac*qqBIWQBDi8)R^TIo&SIvTa>o?FcKC
zP@~e7bZE*zX(KVsHcy}R6s)(S7#luoFMZZqAja*X^VR1ntG7w|F$%onNk?(~0&867
zWLD6Fd=JUqa@9%W)G}U2S7DpWzDiml(z*l1F^EW2ZCM0~2nzORep&V7yIJWG{(<f_
z=3U>cQTHndAD0%A=|l<)m-NN7LPCAdo4_B~$z(Uu1L?K2q5hWLG{1-64@@|kFIt;z
zT|<}9^yOeDWVo7QY}!Q}E?%naK4%P7rzql^Q;XL{t{BdLt)bO-E%JN{TzJoSi?oS<
z9^jg)lu;So;7fQC!i&T(Nn$u4W>NdWiqu;6oI^D7%>c7L0KkQM2YQnoH4ugQ8whM_
zRq>Jw!H_uWeAU{jz?xeeYF`(dp#%%tY0LL&WLyr?-3c`DIR_Ar2CQOjxqFL2?Susl
zssU0f_4gp_n;$;z8_7PuVE&xdaT&*>8wb@C-@7+;iqDW0^T8$x_>rqYp3q#*JLV&a
z-gS|>?l&Y|4XN{2<Bq(d__x;0bx|()S&26#tOI$vcQ?0IE)1w|3tr{iv>a6l5<}R6
z1^^kDCtL4&&7Kr=MD4QgTd9x@rCL8S6p5wP5gzTeFNLGUV>WoBX`=lU*-H-vjWrJz
zI#^#(VWno<n%L1<ec<Fk^3Cs%RWeL)ruOSY{~*=STSmGz1_a0NXl-ONu<lu636{fu
z#!<^2*A>t(1EGpfen#^U`>gXuekHj&haH^`%N$=C=-#NVr43@*iX7?z_|aMt+@hTP
zcqAyjGoXC`UPSwj0ZWUg)uskUax0Y*ZiDb+KzJUPOnU{U6_IUOosCNlDPLmKR4yOm
zEYSJjwCJi#qN^`K(P+|bjYwar>$P8S&QmCgTBtMawr{|>xj?rm)ltGF1fQQ+3oJc0
z)InCapxpEt()ApxnziYti;souM35-G1|c{O6`GkE<;tKyjZJgBdv}KKpw@KLr6W&0
z7qQmNQH8-E4(1)I#m03TKin%{3i2qKE*|1F`m5`F0v_(01ibzIetgeWC<f9>Yb0$G
z{hYf8=|Ye+-&vB<puRFg-Vxg#_f2s#5(-r|PY?`)^=W+Z*BDVp{jp1TG1XMZrP6Q5
zZ*yUF5i<<C6cYYiGNnkV(o8Knxw8nCi}1Yh?!ivpYzx=nJH0BI5!ui0UJu+GfAco3
zUoKcL(A{wwix!T#f5xgI*C4S|x$ezYHQ(ASItySQO|08m9}4|&XDc?-otC9ij-1e_
z)#qJh2rMYey!I5<Bf1Ex^0NVWC}1+)_{pkS(v<81eVMe2L%lje>}_so^t{B4PU-ZE
z+;LrZ2ol%w(LMNUY>V~<+v4NvLAv*j2ZZ_8;O_IctquMVT&61L5X#yU@68!q%`$?=
zpxclOG<dp2mwB=<mC7^=sw~a-jp&h1H<QQp)KVC}BGhh%ri#F-J?N1m=d_z>Y!GNO
zJ8h%bg;(GRn{o0I^T14&$1d(GLw-kyz0BHPG{cATQrhOL2;Y@8oAi`mq|>%b22n;$
z!>adost#tS7JE?#fc2XC1AJYsM=mhkwVOF?FMVdDEsEBHbTMA=Vsu&FN|JGw(4>nV
zJd-Ezl~oUl%`uq5_Aj#ILt3Cvowk>a(qs=}$ILfL209klhX{<+7{>|kjp+pj85l9<
zbkCP;byq!^^(&LX23PO6ZQG4QKLiiY(=cAtAZv#{?+(v3PoVIKzw{)6jbzZC?puWF
zZ1B`AXWKyO(qNwGjP5=pQKLg`x~##T&Dy;AZpe_9%OFlDwC<jh=jd_(o!!NReyJu&
zQGV=Qs|_z<Vg_9Yhmyf&m73UyrH|+*Fq{TjYQ|Z$(Dj_)w=vOc9b<g}!&pX{2eycR
z#D64FqsUmsEfx5R!7UI~;%-J|@@c0^TX?*BRX^n;uyHeRq-0a&*AXSuu3z8i?os{9
z(q7<xm8E%aZMn#UO&+8EGFs^b9&C+mbNQ0DQGs1Kh`E>f3o-MF8Q`8Rt_I!?DDLpg
zEw`$k3?<&rWC?J|<RMSadb_wbLBeO|0M5r_h4CS9$YUMEoMf6any(}Lu}%byX&|dV
zshx0i#CzP>lF<+w(NKUv7|t)zc+?ep6EtY_Vds21Y8Cn%m4DJA-^smx*|g7i)OUP@
zvW-7RqmC&iwof>(Kh}-`nKt$agKRnSn(Avg-0ar-bTWmy?WAK?oA41}y}BTd@+FQJ
z)PqMo^)Y|l*1uxsfBr!T{}9k<3oEL7(!_NlrbvSK<jV$Iu)9WkU;?%10R|O(4B5KP
z767JRAJeV;IS_jrWfqJDUl00n$-G(NwNci&Gh$D({Lh`A|M{Cv(h__Wq<7qS{@o`(
z5z(I}{_9C9iQqqMU!|FT{&afb-=12Hi~Hv5e@HaFeP#Y<X7T5-{PPk|UPJaK2%f6>
z?Eks1+0WPbpRX!Q`a$g9J>#FhM<envlk&~~u-fvD8}a}Aj$f_yzuWnr6|bIb=WwJf
zudy&qcEvh`+CM<7CiHh39D)UcwcIhHS%kaIll+86$#oj0tYbmy+?OoR5UpW{<ix^=
zexl3&eA<6WgoctVX&za8^k0dgQ-0{Wa6z*x>@fY85Buw>vajQSG_hT${k<x<fctlw
zF815C0>Nhk7DM^I@U?$@)30QY^zW<)kDn~kQyw3p4DM6nE645J3zurAn)-30htXE$
z2O0s%8^Q`JrV&Dh_@QH4#zr7CTZB}wo${nVKN39$R>|_}g2`~K?3z27v{)lC_KmzZ
zuR_R+M85>PGqZ0R-%L-eS8I`3fzzU$S{6s;9PJp`rlT&oC1BGTV@_#Y_2-L^5#YXY
zba@+Yf`9)BbN?b+<@4({%yHAhMfwwwPxzE+<P4}~4c6Y7@v0n5wh*rY)Q<!)^c!8}
z$_Ex5+Apy_bwPY8NR+UB89l9Pd(-PJ#=M?JNeezB-;A%kH0M@PI%QF3;LI&P?EIsQ
zvxtAB;CL2PeL*D*=u&<o7(=9_cMQ&V=NIts5xpJ{-`&(m)t}mO_s>1HxN!!s9^AQp
zc(!#E&uKaIxbE-~`qYR1acDR-=f?27e(g@pLNFexq|alKJ?rT7dbMu`;9^Kd+6jNs
zc@3e&d;Qtge@fdKlC?HvV|ON(mWL;R_Poz3qnvQZKyxEW1$Wm+oOdk0JJaDD0OT`N
z(A%F6>BSDfL{wB3qmqz?4Oi6s4^8VF0h<F2xx86Cv)vvW&ZI2S^epdA17-YfZ@ZJ7
zE1Sa?JQsIe?MEFCRy!`mc>lJbJpgRf$a$DN9aMIWpXl`;=hzV#WKb}<VR#z4eP={;
z26p#l!eYjMAc_1Zl9)z1F%sSSZCBEGMkVtzNs^vvefc{MwJlCbowuz6aNDr0ovxf^
z>u-jqS8ajQ4Y&dp#!@3sul$-)+5}BW(%dxDXW|^4PLbghQ4HN6yIl<90!UJ)oNV(c
zisa9aTDLBf-tm+6zy{tE-=l8kjc(q$&M3J6G128`>qR!x;%G&*V_uXOY)T!{Nt$`H
z{Kfb9cUBG*(#*3nJ>5K<8-Ge30@!{pdY*3c&=x1J-q3Y`qD4vvN*#ZzGcsY|jI}dO
zENBS?&BFA%uVR;6hit<>&S2hX-AXX6yI&*I5}hdajQcpAZs+bG>u)vmJPTM-;M@Uq
zY!&_F46?^y(>6RUZ6I0!vt8b2eKyJNMP7d$Znr_wP!HyX*_j{I>Y>@E%l6~ecuKHq
zo7#?#3uQ5@(k0JRJXaap5RnHZAj+JYQWi@%xKn-SmrC((dsn~&$ba~ixv@gHRqYe5
zRI46#32JrfM@MB^3vs#8f#(SzD(5-cbETLQX!7rq|4wtb1MSH!Vx?Z!zS5}q)MBbp
zOD>nXj3H^43pcrHEvdFKjW>&2ENFGTLfZPkm`;`&$NXwXvY5BE;TEKXCc&?5J|g=!
zhN4vo-0Ac`1Q%F;cTt&SzwH4)Ehac-`^9hc5fDRHvXiynQWgJ+OaFV}`kPu00+(qz
zi$#j{w~~aL9(I!VyC1LilW%#-ZHO@g{P(?iMUtNg?kW4t&J0eDY%n+el)w4=M<LTd
zQpAqL2IPNl0sp(be>?a8ZttI0=6_jww<X0#8XdzFEH*GOeg54^E9b0_`%Y9kOp)}w
z0f$>-zFffDI=n?YpZ##_Lnfhf`~Cn`WQ?{st}ydD;YI%`_XQdnv)bhBW$%ioy7Ceg
zm_A`h<TxV@fFQVf!#1Rfze{mC6%4r{zDd#>IZ1CwCpJ$em^y{J21rAQjM^KkO#YG8
z{TCgsrUGtb)trh;?bTN@98EvUoJ)csSBoMH<$geyd=TgOj7V;uzmQqjDk|xH`FpZ6
z;Lb3=;Cx>Oz)csL>+hddF3qUH4im?XdgI*m35Rd4N;#u}gJ%zc@H!Vt&mRQp?Gy%7
zD80TRa5P!q%Crc%UtsYsi}*`hZ~{+HCm%MoK#)r!(C3YQ{Vte(QkOH*{UA<3_95z=
zoo=jwZ;1zEM7#MMM%wc_z4Cd>;x-OII%04JMfEdpGhAD~WI3V+j)N&j!yhg{>=?=x
z#(7r*WEdZa78}DX3^#H(sw(|=7pe3iy*vBd+l5}_3<4gzzJsZ+Swr%p<z$pTZOAJ%
zxS=Scr+=-af6~b(YGn=atSX_frR}O<Y}qK8)RLgR(YXuP&&9WPOt_ci{JmZy&dPt$
z-e#b5sQb&fYm9&LAV!O8T#~qb^UJ7DJ0F3Pr%Xvx%jaaGG}Mw|sa@-%P-5p>WgGo9
zK4m@Z21D}`RmMs*a(;D&uPOoXHZF!o5oG9+QD7;?g3u5aZD0PS11+fubU3?sMMO0#
z-`>^cJNgAr_4!}vGC!alAd_;49|@6V3jvI~m%52}N2eh9MIVrDOt(SeVR3sgI?nZv
zlBWvu7ImD8m4fBc(2Xx~7?s(uKlUbf*Ee*D=qGZY(WE<UQwL)BjdtH|x!nrmr#IPJ
zoGyW>)$Uz*{*YDI==!X`c!nJw7|pQ!>;5XfG{7dQTQEewxx<7Zb+1{lwTsvbU8%x<
z@483jEbJH2*jcd9!*uo>*TqzQeXgWh>b228tnmG%;J{<Cr#1Te5_Z#}jQyTQJ1KOB
zufka3>^asVDc6(~u7VPWs1i)IVRdq1b_T*^+~0V?`0Fh*p@YvIU-4Y<3&*B<1n+HP
zZJuV`_G^5<0_8JIU^n1jTvgp!sQq=+^R4g%RY#-<mC;;Com%8M>fDEYY@|$PBZ=%b
zTnF)&n!-0kWOULT_2HqZ-_st-L7j25#)}H2HbxSq$IiNlS6xtAm%6FCAxY(_Ij;jj
zGv|ss{Y7Vck`8YWkR$Tm(ErkawQhj>L3d2IFjaQJzSuZU@^O=aX-qco@d=QZMi5V{
zR35iZUbti)P1m^#2V`oUfCVU{u8NnV=U1s%ha71IZ_bSr9KVKaUqpuKo;asdT%a!g
z6k*#+<C3Os+ECAYTVCQK%^UB(?&H7wPyi4kcTR!4EF-+njB-4}gTS3upbvS8^qG=Q
zzFUv$B?w2fuH64djrTeEn|*j~c^YkO6X3_J$~tz8@Cz|txhbKuw6Xi;L20j*^ooeN
zf8=UVT{KUlfYBrNXNM)GoOV%zjgkb&=_|^6fz|u_H8}RrU;8M_y0WBJ<>SQOd?C9S
zSM4f(dGs|w8YQM#$s<>oeb(5T%XJEZxqvHD>m{T4E4ZX@Ir(r=&AEk-x0iH%E8KV<
zhI;3tUu;YBW6NA+?3#llirqJ7#}@h7;Rb~<MGQiYwNrIP^!4NQrdi%~0qNs8@%9gF
zRJH`_q)2RXbd)|UUWa$P-YUwB3)7Q!sR=U@V*dwp|1U~TO&w_3?YaB0B4j5l)cx0=
z<g^#sJNxBly5CK{5s%N~|1&%sWwYCwSW!dv4=c8-owNx0wmVTLes>em;Kw*hOZ?7X
zB6Qs%HQ*V&gTIV{?$yG5@urLmGY7~uxvA1euC&tklcPpljS)V@=EfAndY$#oSu+gS
z7eqOhPvi$lmFI(~7?g|CK(<sg{E<>7zK0X}ucYnUK1e=Dwul8cv-C=b85e#bqU=21
zwMBG}wWqkRzKe^CkxvFS!smXj8qc!Wz_Idvm;VYYg>XbWUlha!xu9J9{7Qr->}-8d
zowUPD(v~vjt0({l)NE?1?mM~mM=Vky7a8<?%1{O98x_X=@YTBpq;3Eo;BBj;dd}wO
z9l&G%%Vt)hx<IXIXNX}Z?=unQu#&_u5+D~+M8;aA$C#qXikspj9|qM<z+}>hhD^ak
zXxTN`Eh8;9qDzv}jy3m{O;)1*81qq*opobSR%zq-V307AnSfX3$;;o3VGXHs%ZpK~
z3qIx#l-c$y6DWJqT(*)vS?RE$be=W3(_P#yV#e*(9l_FsxI6cGXy(Hac5{iwabhFu
z#uD3t;?lqL*B>H*nrpl|bfk$dSkCZ~gxQ9Kae89>ZR#^N{}}gPuf;+<*6tkE+tHo)
zH*yxQq=jn$i!tJJD`5!R@aTQHW~&7iEL<nQH2OTb4}l61+`nJ)n`POpvT#%9DdSM}
zwM|Eur#3Ju3P~vH@GEQVx;FT2q3~{lAB7$*qU<>7q|ocX^yBF=fcxIB`i$7==KA8@
zw}-F1wV3lnU&KkiIIQ}9*8R3knm(gPx9xVhO!$t`sG&S?2r^s038#x(2P@8@4HptF
zRMXU#xZBo)oN{v5Y+sXUe{Fev)Mr00h@tGdPv!gA&N%+kb=W46^F8gBxjH%3URn%m
z$1$Iw3j6+IAffg^lNyY>Uy$f)3o$|MktbpNS8f01iE1ApSicg_$E{$X=N-Ru@q0QE
zUjoG-k0coT(OJce6U0G7RS!P26-*`H;gXa!-Iw*)ZMW=%`j};Qc~awqwBxes-k`BT
zR%$3zHQY@Ee5Bqk3!(N%{dl4S8Rbxp;?z{sl4*G8)jQN)?$K^5AH>3Rr9)lJuFtE)
z$@^)?G1;}GgyYWZI>uQ+CRO|DNe8UPXq1F9f1pe5sFOXCOmp_Q5%yp<wd$8(<hmsQ
z7BfHVWFE<;R<hS@RcwR8*8O$w^_(nP--XbRaz)<0!SN*Rj@)V7>@SV%b5L1Qq!V=}
z5@f#l=YXsD<(2dg_2lo=(j{-5HKTO&B`|3bx53Om_wuDCg9rIG!H@^XiWm>m6@lQ4
z2bHOx6`23n$yolYDD_{Y0E}4&2G~hK-A}S7nVIsufhhyCMDwycL1jy<jO~5Kr>1%j
zDA}(%jzm;Je6oz**re?)t9%>5XGLNfmz1bjh_W4FSJa;aL!5a15vldvG(+BEUh10h
z-ET&(<~3r>RbSyxj}~}5>uVa-lR4xtV!R<<4iK*wX2N!&QHK-UkYRkg>dXycA9iwv
zB2UAA)L8yYSg!%B&-W{03?Y_&>9HAsJ`I%7u0f64+pgyI(9hBtvEdYC1KtC9SKOUc
zz1K{H+Z=Vn@5h&d)Kl=|bjhHm?!>!d4DM3QuAJxK>VtWj0Qdtck$)KYvNJ=NE7l{R
zAsI`Gm3iEmUW~=3Y#l1(QF=E7hN$UE3Lt=&XG^4vudHGddr42hc{5KKu<_|bgY-HW
ztZFl-GJpCBd*Tj1CWcKRPRfN-GOwo^q=!c>2j<3*Ju9+fYw{UfM~+D90CLgWA@_H3
z065Z9tO7EaY;C4>=@UBQQ_~1*^vlWF5$?|e`@Yq8Im)yOxEyuNjRQQ(W(I=<iti&@
zf+&+bqPK3_bm+CiTb|_qqwwKhEV#NRFhe(b7jMMgD15%@*Zx&u{wVt$O;<kaPE`u`
z(z+PKyOAohU6%Ed3zuZtEHyLN7e82s#JtouS;<vp>xKyRy2yLxC09Mto_?ffkmJ$v
z$S%oq%vM5);~HM4Y9%+QR&cF_+H+J#6)VhZM5@>D>&k$v=%z|F+f>Td=k#i4Y2=ar
zW=WYr=r8fN%xbWSm6=D=bb(uo%!Ek8-s^>7o1!IHW~ce)kHWRM!*ui93l!ik-%lPk
zeETAyG$~>KI2rz3dT2oHSUmkhj8t)$*2d%&Cw5v(>If(iSCONjidQt3*xqV7a@!6S
zJ~b^#`f3R|;<->jI`E~>6fTm=D)DQ7KSm#Hn(zFaADSCtD@w;BDf&6ovklVF^R9`k
zi(@>_5%a*%$!gR(nmIwKBTYZ+X8%@GpM6fS+&L?x2aRR1y9+*7(yH?L%L@<(#zc*L
zZSAqT#ndHnNSy39`GZu=E1t{au}whbr%JB;i{tR~2>Wzjzm)W({#(ZK@TBu9*W!9@
z3)X2H9ej*I-8;rEnH@K*&zlA9TXD634n1a5pf!+(IqgY4v(`R%FynZ;K*p(|82j^y
zzeH6+XfB@QBEJrg&Z*LKwu7cWhs?+YR1oIoA!t2BhsA;~Z{B|$Cv^<k62<HucbgsY
zAFP$P9D%PtX%y7In=HV_`NmO*$otn;=N~Wn3V76_l)qgSu&wq0L@f;0WclUF|A+kr
z6+i#uw_pB8h#^qN_U2!4|ARk%%=FyjU$oM{C{!ld*H?jqVn`+Q%fRd(?+&oZ?{vR*
zasTm$Z|{QC)m4T6tSitPQJnv7=czmJ|LS(OmR<Bu&hEGU+{_!$DE%#FG?;UG_;RfE
zZ_rkz3%9S>yzj@~=9!<0c6?!RaNOsD)89<u+(-F@abfrFSed|H^npMf(LCiuc)KTW
zul#K!a-lb<76Kk$o|?0w^f0g|>zh|KJ0tY8gwH#5a5EtG5_%UyZr4dM;%Fpo($+&T
zNSkc8AlmP43HZ>Ws?H=V^&u`cu&+IK!n<MM)6nRT!YGT<+hcos01o4?*H1T@FNaO9
zH8PwAH~XfZxHTT8>Yh3a^0Sq$l6?sdKh!a*KW40RC`^Ub9iL}*iK<1J_(Wd#cs4;{
z`Wp8T?KOqdZg*=oK-!6=&d11HR^*DM8<d}II2a`Mi51CCOquV+%GZfkGb#IWPP@L(
zfVBpWl<vddAi7LV3M9oLr)6{21yB6JkCK^394BP?AB!{@t}=8HQv+y7^Jhi)C9mBA
zKMDqZY>NYO3<0m+)%jQ<!iO_j+PXKnzP^EQCdu*orIUPuZw>*5v_WL|$3`-$Kn$6?
zSi+F1FWn?twdkhVN~2)<CY7`IHsQhWK_!>Z3Yn->h@I%oAQw^i#*bU4XvB~LHjwP8
zn%hc=&ZjP0Eo<8-arbb<`dJr*PD%TPfbKA4vgERUo8(T9f2n!To@2iW;Dmue^dAza
z7UC@bdx9UM4+aU6qZMqq1I;1^%y)Q_ca=s(TZlq0-^=Y8>B~1|>xixnt}oKp?a)NK
zCC>#rB(sQTd4`{!`cT&Z<{M9K@dk0>{<Y?hYUpct4@(FYm#wRyOMR@L-1>V+xbfQ3
zg?igpM5AF-NT%^j_WX+7MoOi<JUK<{92S>=ag#<zL5@>ggg=!{E8qb<*ZwYgVRWrs
zwfHqx&f_~Z*FG^c1im=RHIIxWefHY&(l`my#%k;eCJ+vA4y<m_#JYK7u1eL$N=#!w
zvQ)Yz@vlAg6EhKF19Bpp-1+-gE{zcCXSv8}UbPZ@qIvg)XG)rh?#d_el@=LzchC9j
z2<tl9hGK0V@;UWc6&ziOZ<fV>ens^q3yV|b1();z_=@k_q6{H(y1u^LcsWu2V?>ky
zRtdyO1fBGEN3z~K?U52Zt8#9e1}%u<*E-r@w{#0CD4ZGQS0;QOVIU+jwT4IRLvs-w
z6KN{CGGo8?tp2uboM!<QsKX5}cPf_EQ<KfLA4Kx%R8}NdfG(1`bIs*4CqRq8eEzJl
zwU`~J+MnwUl7PDT?{_C4pKLTi6O$g$izT*^H+i}NcRS*ASt#HFBG=%7&JD=C#G{}q
ztIV0ZU5*Mjp;S=H_L<0fA8Sm=<|)k+p^;BM*>pgK7po&iFFvIj;MeHwOJ4e1D-T{Y
z<`^`Nt<#~00!Zmp%l-O3FxmG%^^tJ#6~54-Qv{{M>Tv9i8#|UdEDMzk{esV1nWwQU
z(#9fAmduh$XmXn7{0ALGysnkw44IL_^@S01R`y(?WfwHS5qo2;;^uGG^SHGaXfSWJ
z<uf~YRqdEGJxGt!#6ZY_z#g^xMV%UkZgShl-Q=(C$e;RF-@bx}s6j4eDIVk0&QHPG
z@FhYSvG6G07OY(aWqA@*w`oRWZP05tw$1ddK3!OMwoU8C>E`EM8F2U;9@U^yWYKRf
z(?lzXwnXz*4T7vmr1Q}_h~VTsaNwgh!J{tX`<Fd=<t%PwXj{GuonpKjZyfW8#`DSP
zXPyWa%&9%%YIY90RH?~iwJ&j14lkQxvU&0@p_TL~e7gX9{mvT>W<afsx;y^ROu*yu
zw5!;e2Km$M3us&H0c=^%%Cg^ua~T+@YxNjimtoF$lgx^%4`cM3nOM}qAM#udJKH+K
zbAMu{rzk@3ks?@RIu1M6mwLvC#@!9i;H9IgwYF(hhn>fUB2ycyJsX7nj8aoD6043=
zkLNGCoTbr;8m1zK&fbp7z4{3PGig`>g%8lhzP-9w=A?T{p*-#2R?!_2qG~V7RAB4V
zhr<?lPSN>i&-Lkn5ai3>NRznVj<M+AyUa(swJp&{M{6Jk`SEAeL3wo8&D-L5aSwC}
z<vIib0*~V~3dA6KD=rONSx4Iisy@|>AsKjt&VB78UcnXEUI^7He@bO#|5qem@&Wg$
z`TTEGe?}&BcWa3g&G*_Fk6zFoyR=}h9s!<Y%+V1V6^!bdKOt(`9=9CM^5z^L9W0d-
z1Rr(C99?z_7Sn!ntxIq4q0PB~t5o9=KHba-xda&^_o@{7GnEve)9$!l9jB+eWz_(~
zQ0ex!2NzDfEK!o$P+zEja`YE~ZK_mj$k|SWq1DBpZL<%0HL$-qrb56OyYZ3;cUk*2
zV_9EZs}jpGq(2&+v$eq~h#vV6N*CFEdze1qbkTMIp;HN-wa2**);|TOz?jHN-jRp4
zZ6x~ie>4LB=!j?Qa}IhLur%&5Cp1YVx2MO({6&!cH(?F1J{7>g352v(-~!oPZ?0?*
z0gdBCfwQvCY%GP{@%?z!IA)d*L2|l*NdVuSKsNHYmEq#Rmk%7aTI*O>icFOw%i9^<
z4C->w)A??#bHK4n8ykr~{RRKLZA>h{l6jtf5Py5j|Eux9f3QjatI?`&+c|jm7h6GV
zR5F}hQcwOjEr~-)fiqn5y>g2OgfUy|^1`^cu*ZOiXu@DRR(OIrn|V@lH&D)>g%5`Q
z=G7hnG3kwDA*Tu(+j2W&b>sNOlFjh}w_vYJsAv~)f$KWU_SWVU&NlrUho8l1|5oPD
zp8M%DTnLy1&S|A<hPt%m`-;p@FGgMD*pUc5-x0}|M@!dFRh<`be`c%nxL@eW)#FA+
zwyuje$x4h%O@`^^vz%BEwx{lUh5hGGzdUr=z*b&X>#AHH_-3?6RvI?&X9p4<2x`9D
zQ&Ob{PS|h~E*$x+!08aTf8!B+yKrL5T?aBBCF7u)!;FdZKt3Gm!<-agi^`iy=y2Uy
zykSp8{+l-=6;%b6a4=m2&VVP_j+oHhZ22u8?o5aU!0*K(48B0?WRJxI7oB2H@@mlv
zEC&#S(I8%91+)~<uDX!O6(4GA=#t4CMtd@4<17wftUi>C9uU4XwHr9{NIGfKYR+c9
z*8Ih`sLau4Q9aTUcNw$jT5RrbyG#?G<T6RUaZIk-Ha{(|7=$Z6xturkyl!4l$IUy#
zXxpYn9{q+x=N6HpahP+}KFDLK90=n(lxzvvp|1_tgCL^d3RKdX`DNwOA-}>PPt>Sw
z*iPrikoX6+L)5_53O<H)!Gj^f#NSI${a%e00jHlU>0g}7a9Iqb&W_?RkgV)2!vPgk
zN|;19H#@5G-L)3}HCwIfS;uI;E@U^%yKzdM2q8CcrcazYmUr#>IgzFGY74aP*#u*U
zh4HefS~V9(mD2)RaDgy@H8s*w&!TV<<g&L^IlA6Nc`L~?=CIl6@e&Pk5e1ZFKAE(V
zPUr_-$&~9R1ZCjJw18|>o_gv0<70O*cNM6T5HxFJA4RCuW$juWpgNjN(DDfTo7gYB
zJT%(-f%N0e#aAZ{oGV~vvt`4-<EZ^4Rz%|pmbb~XYP>|jXnEpfyZpEhZ`BbozA=wg
z^tJG1OuELl(7<1hH3B5SvW$hh7#>NUM3;r&eLc5lnR<18=}^NYft%Agfh00HOW6Az
zu9UC|>Xo=*h$+vF!DGz|_4tZv=Qa!BZ=0?Zsk-W4|5!083H$7x*4|+|o3^>GiijDG
z`HglVz5%315z^610K7(4!V0?Wr<yzEeeUK7?`wIP^~Wu)L_7@>i4*OZ7(k(=O?X#O
zc#P$nZc%fQ`jIA!fZY3L>g9(XaWo0@m@$TjEJDeDon=4|!y_DFhk>u(puBJczv_;l
zc8=E*b`{kt4fCV-IZ={-v~d6;_573H7_<=W6E55ib>JJUi>Xvpa@&o<7Xu(iFc+?Q
zX=*HamP%PGWX1#0#SjWeGyFg54wNnSF>l&vB<kxI!bIw|uCJ_L*H5xS<nFdvmB>UN
zy32JMD)h^$l<f3&6e(;p69vs6cW*cg;N=8<CTZY$wt1)Ay8Tq6{Y~s7nOra;{h>mQ
zGxrLP*1^=lU{%6LrkO3$^0vsXrEWSA4M6_=1CW2mb{i>7ovp4AtUHd))mXq}exrTp
z<Un*!x)@X6+{*ES%;@8FyG2Z&hPiG!en-?r1J30dsOqKKd2_4FNx;#ZEY~%(B7uAV
z)ou9~5BGHj)}znqqq=_+DA>=hesrN{ogY07NY%3m%8ti?KAMcni4DTlH`1jr5V{3l
zU+}kENE7spTNyNQ?#Yts^%Q9Gtq!b1be|*IbYKb}^0qSA6*c{hYjY;#+DRn*Q4=?p
zLWZY+Yq{h{KU2%Dn)Q+|)1zij^$`sVj88jstV<~gcHVJ!>wVuk#ICP5EpR;-UEOGa
z5n4ukW`8V)cIXcy2ICY}-lyi0lxKF)C=2=8|0YH%-~{qqB!IqvnK<Ee<XrA0c)|$p
zR`B#o9U4QL8%E_~ufrr&(bw$I{4<X(hmN^6Z=)-)C&-;<LfnE$1mLu(s+`x&`nn4J
zU~zRs$HlGjW?DHa!uVF|S1B6-+}e2?^ZHg5+zisrAxGqmfZs8HCxK<!Ra<>*buQ=I
zJu*duqvoeq4{ZUZM8M&D6$-kyC^g|)F+Mlq^$9U++oE*s^2>6~S8S*Pg(ht)dE>SD
z9!lnx%^ok&?rj^!i3cMKbGmy}p-a5GmHkh{PaO3o5~#7UEgY{x=ocdJ^O9WwqAMz*
zX879Un6!*vEaAmhg?j(GSf~<bbQS$7gUcpDigTs0IC_*>?}ycfZK<mVdGwd%BJFzb
zF`w9r%&+5kJXhP>zq78E_7VS%s=Na{<F8AF)lw$~pHn=B3M_c>gtfRitOzNF81ATn
zW+SOgO{Vz|3>!I6WqH|l*A@kae6KC4hz%vl?T2((zfoGkCrtY@Jv=)EfP>KHDoPl;
z;pN4TvmA!8Z1fyM?1zJ1OwP5}TKgODV%r<{;`r>S*d~Iln5+hpp~bnx-DNEwr#qpN
zA0eXo-1jifk}}2TZrDBLm{4F#Fv$`bJq_gqv$%pT(sZ_en>s#RJC2SyI6lI(yt#Kg
zhB^{Hz_fr_5+GLFDGxT;+v06Ggz1(agI~gBK!PdU>10I3WD!=?=V&nNsA{2X_cu-?
zI8gg5dm#CxZQ+n6;`Npg#EI)r<APw!O6@v`1l_jLV5$aYE>wB<q%cox^q4nzzxzi^
z3kViLl^;lP-5E3MO?dkhh7cV7U75#;hxHI#p6|v#1?DtR=)Ymcf0JUT%gO)uImW~b
z{!=helor0${Uvf`tkHOQmA^qVFLd<j8Bn?AV4RgWT6y_Yot<`qZE)JO99&E~M;DnL
zJ4>p_l8z!?Tx+knNeuYacYU%GS3mfPek@ay5UZ0i!ynEaqQIob_}qByk+20@X&R~v
z{+wnI-HNg0bf463w%+ZRITdtsl?Cz7`R@|j-X{p7+vD%Alw$~k!h)P1VArQ{1q6zB
zFjEH;PNMbBE<Va5X|m5+b2qz2ytc(#q*Ye$&6m*@obp1gTUP<mX>#jWPyq!O&E!))
z$zkajO<8SSC_L%saVyzf?6#K4r15K?6ure84~QMMtdYY4MA^n+cJQ2DEFU3sYYnpy
zo@Fdz({Uxn$RbSmm&^;G%ru|?m!f|@D%vDVrXUt$)3V}<_9Zu@e)(sH>jRTAe*|b?
znPaN=W1T&dVOi~=7Q_;^Jvi`Ozfr>Rb~n7+4mS^E0-#f6@H%shGZll&b^Rc8=#urC
zz|3j6ppKJpj9Va^(G8TG$st0j&b=?$Y#m^jAh`!)RRGmnmYi(dGVi2I3v2H5+4Uq(
zuHJbF_>P~Ivje#alY{_6+3hM@y|eU=_W(uoX~3<hH#jVdEM{ysUTz}J8}o#tSiWz%
zEwZq$Pi+==D(yGI0P`izR_P#7N8YbR2j9w^s%QORrHZo)$@JV^&ZDIG6d<=6I167D
z3bP^jRVZGbU;*h}^tv{g75m^9c-^)JgdIjBbuk3YZ%Aw$3EZ%Um0~ol1ZhuMt>g``
zSazX|OO?tGT>}^ZG`@{FtSP&o!fQMiqj~d>ilX4;$^m>p_RnOLcRRKiOWt8GJa8Q}
zc(WW4>Bn9p(I01})=My#t?3^{hEg1>xE_$~*FGT68znvzTh+6rF;=Lf<Tn_UAiB%5
zh3piUt-$sbsMy?%k-`|@ZY_Pgc3;0eMVl3L5*RNWE*P%XMG3VCYW5^6O(bj=GX{P2
zGAi`s8UCv+{=bPfTirk{6J3Yoj}OEb^GUM%$~qz){%Afx+DzlDQ7}3pM<(nz9_b#>
zQ7G}N1Y3&tA8+1l=I#g32266fH|?Fh+e^*L^0m!wMlaqrVadw%j*%V9l=!EQ+@m}h
zgvEN_Vim_GBA1(D<Vh*_!{i@~m)S-Xyw7}~cx|HK1Xi84dP3oq$+cDEjfhohbbD>-
z+$DEE{)Lj`vE{RZN;r<!$LVJ#MmY{alv{#EAK450bMFi~s|A;yawc>q^dwF7*j@^}
zZRxvhgr&7pUILBxHspWEjR@jaL_!Dq&&OaW1FT!@=KyoE-5nnH<(RDbZV@jb7-WGD
zVMVA-CV$jWfX3bo{)*)*wXYcS5FiRKAy?Q>4b#vQkC79!Q+&fA%TL|c^-i_n*x<oS
zo79}#?8uCadyPvSAoAY;eT~}Ucqsz!-Oh*;d%N+KlU|))eT_5W-QQWvY~I;c2jdtT
zB{78Pb=A|-Z~xbA;C+-G3cP*hG<oWiu$|_CwA=^i;Fy|f`F3`2|K-ssRq1DBn<Srb
zrp7=X+4upwcT{KGHPFLl-@573r{&_SX=-(h#O-_-tgnFI7a19yoi8dPo?MccHB%h|
zS<jZ<q1%R3{%ia#!Sm7rF_=81!VjD>GL1|3ggTCP3P{PH?>LM(ST<t0VhY}-YV3Xk
zeA1N}tsiDBT&6)c3}_bR!#&&@-A2+*adTVUPB`-D!ygltg-QJ|vG_IL*+{iL-^6Fx
ztR!Km56b!{X-hfW@3**ZZfb46fv!}mDo&kWQdG3?%_@FOR;(9il*ta`?sI=o;3x^G
z&SF`KB;WOgMd`;(g6v+~{+PWNSfBmlR-7_#?4X8Xpjt<x?(iz6@6e593vjdveMY|X
zuQaaLdGb^6r085S+uq7Rvn&aG=Is+)M5139x#j-|G;Nqnf;?(>G?lt9r@X%<&8puf
z_teh(+@n%mD)rk!*&l{Zz!*VpA=4nc`bT}Xc<(&z-m0;iRoD*h*D#)9`a;M-#j4nQ
zrNLRNkZtp=M|I3Ctg0~e1C7He`)qq<#UsxhQUV@N`P=4EhI<4Uk*F}ixZ#fzn<yJj
z!O!AV+p<!@QF-sw@?KgpwyOImGW^kE6#Oi6*Tm6rP&i;pn@98tp5&G7dJqWBiRC`X
z>X6VIEz2Tlok@Q3+(_80$#B^`?}dEcGb*R5r6BGD)^34`4{c2G&&5)l_2H8PFO(Ab
zl)YXejPz*LKjg5P7eenN(meOyI?Ap(dLCWBor30#e;dPl8cf!ALd4te#ST*Kzx^&J
z9LC2m^zGh(hVMr4mYY}@Kh}@Tc<+_b()BAh`(aYXmYwNUS{?Imjy}XtEqTaPN~+IL
zWr*x6v+7>bULuo%yQUO63k1JlG!kZK^nL16OFn7I6`xBhWEPgEsJNM|TWciU#dP?Y
zjQ}*P7mo3*&*bc)s2TB+xhCC79dCAt6NT_9s|6D`q;v@j#WRcM4ft1c7gZZ_zix8g
zFH|&SwyC>96|i%y@xg=e8#Q>Rof|u#fo)#6zF|O|?IB~@%%VTVig+sZ&Luqg-qw9z
z(oL}xee)HYp%syOoP)}|hu69{J>Bi17j4wICEu-X-i3pfF?YCKwcw1Pr&)*vn2aOh
zfKp8kNj*lJ8^+nJvqV|Ac6jy`qGTgav0WFQ1MEGWw&NxrQF?B6{4#pN9WQE{;iI!Z
zl6cL<Fj7@L>B+O3-IaHV*~AoJk{V@%ceE&GCX$uqX~#36i67(!{9+PQ-hMqO6M23S
z>J9n)0MjuLD<6gRj1ha4*f+vt>@D8@Rr|E_4F{-;S`0hK7eZe5C0L1Rkj2ruZ*Tvo
z0bZiDZ+!wI-c-Pz*n?os)N<5yFG`r%g6LNFW|i}#OAWVr&4Q&toUvXmDoZE$0RnBh
z=LxUU8E|j?@iz2s#r|R#X4X|_yKmnrXDDlSfdQ<n=N{jv$GU*nSk|Kc+~}C+jgkUo
z3*%EZs80b%-^l%)EgD;atZm$ha`?HhKv$NDb;PK{td39&j#Zfq#g5C}MxYTZD)+Wl
zk?JZc$5m}($ej|Eug#5pH*s{t7Zul;YVK>SIn-7awmXuhl{@dbHr{r(Ej~-9B9jDq
zC+?49JWZIJswlordG~TZtM1Wy0HuA*avEMTYzhit0_1PfWy>~eDGqe5-UZziB0lW3
z0wzmV`0NvU=4VEZwFy1;3A<@|+lmc-qb(n;K7G&x?H?p}(ed&#ql@0{a=AG>!e0~Q
zm13v>$s0@l8e{Ip0CJlM6?94PQ$zIA9{rQ_2@gS=JiPl;eGMczCXcb3<%VQda$rr?
zy!?g7MZHGuynZ5hBS6Il6hn2xE9rkN^sVGzj)&hPa(hwo5XHO~{pttEsgi!hbBu#)
z4{+JS43j{!FX|Qa)b(0P^#*wnWA1I<g?R&|i_h9>KGOdPY{K99DxX65cE-2fT*NHw
zP+2K*%hj#qgGPR+UCT55C)D9k*!<wkak<!Q&9`hrz1wT~Au;r5i)qZg4?(3JWJb?9
z;9&xKcW=Lr#)0j}z`OV1xw{U|Th6EE6<dFzQW!E@l+@KQDP{jJ^&}+v)e0ila2!ET
z0HUP&XWnoyT_-x<Fs{@`bA)XHGoPm6`9~n-7_;6PYqv(dy8352&qk1)TK?&|WS^(S
zEqI(<+lfy0a>6V}ORYfL&96XrekUSuY+3KYY(6DVeCroM%fS=dQk3n;;$-&g3lu_r
z0{m{^eZ}gYvm3UcT19>m$t8IS4G4IiF4@F5M6O_G3W<^#Uu#mjIymxPU(0RIqbXNq
z`{7C>VtRQTj0U5W_+gWwdfg&OG=i_IV%uV*213cu-TTb4Gqs~pB+(`hG!v`jGni#5
zsW&fsqh)w@{!z^pz4@RzDCt-#q~^4)CLvP5GA~n)Pwn!4X{H6)1TQ8w$m4Y9N{li`
z_p~|~SXQBbL1+MqZf}f}RccyPobOS4#F2Bmgp!OZR)7&7+~AotbP{%CcUwiC2@DD%
z%#G?041DXSl<SC!&0|!_>?wxM7{};eqcO24?EGf4XX?lB(Hu7LSY>v%X4v&ZoKDV}
zu^Sm3MtsAGr+5&uDY7hnzQTuD$JmyB?>~9g4OkSQIrO7WCY~~4{~UkXmKD4|n+%&S
zIoxjnxYatqk?LL3PKek>)h!FX!3Tp`!V`#~3%gu=fHY}?%+8Xsr+GMHMfIqK#j}e2
z8sA9~8Ir)p9`@ubmVxWC)Mdr?UjqY@@*#lJAan25qP!Iqz_Mg!J|2&`w1mrmQLs4x
zJVT>uH}`)JWdUFO#04eHW}UEyL+DdG`laAZd{-6EX|E;8b99=m!Q4swe=T0%GVcQV
z6wJ)!9?Ltp>?YrFO|o6SPf9u8Wl*J%NY%9q*!bKp(xK5G{p#rdK>siimb0k0S8uS>
zs-MTM>b)o$hnyDdfZ#J01fNndhRpBuLwG4W<*_H-DAFXnm*ybrj=|;H-ygDsfJ9t(
zdfK3e;J(X@ApJ`JzHgp;Y~^1wYW`gaLJla9esb}492XSMDTP1lE6Nt7R+D}0Aw%dx
zrp?Z$-SD%A^1nNQ*9~AzUR*|GqCp|7VVire+y2;4|LU=34yvv2vnA1$t$U}in=<o3
zurQdepX1+k?!-~fuNG|E2*qZTg4P@R(+ox!9>O(=V$7>cc@dp{;(@r&cj?fci>K(#
zGa;$~85d5hWDGffQc4yF-CsD5U8u#u;G`2nGx0$>DtwDSAO>GqO!KttuOtqLEa&;U
zKc4pPf8WgEQ1B8AFX(@hLpU*=>vSh<)^={%-}aaRuqg>J_W`oMO~!yzY4td%_9Cuy
zj5@_W|NWy7DG+fkpB-U7?e+f-()Qg3CSB|^?A9sq-cLMt7dUA!9LrM*Qh)v>?teG;
zL~{Px+##kff3bQ^OJ*l$+q{$eqwRmhUH{z?wY~&^3f)MU<kBklMbWGBjNQyH06UPL
zjuH7cGROe}E=tldjId(|WJHy-X<r*2WesldT=a}_H;q}l-=FjR+{jktW__X*Z}Ii_
z{OGLk={vm}ZvwOt@}+bKZ5#M)&J-*8X*)by=)T!oB@<{!V~Ln`+9}=^9iV{Cy6(m_
z<;fl&IMTg-fWcc#!ZEGJe7pB!K4_9eCWcR-(lDE`3^frEzqCtSpf?COR?R`QhVk;~
zVpGMDrFR%1(|TJwQF!^_83V2+$i%qqyNO7<Zx&l;I=_u2f0oLnm3B;jl&0@y*!9s#
zu*S)|sNE`UdMx?ZR_kF4xJsBE?<x~qPu>{zsDU7I@%mdeZQVVY4r_A7{%P2yb?0g5
zHw1}=%1I@CdHa|hnbnGh(&#3bcQ2?Zge%jc9<agL#8GDovg+odbRS#RD)oa-`aRU|
z2)Ku?uXI03C_SDXI|zBF>6IMGSKRXzWQp!#gPKw<LWHHreb!)hearX$jr#rjs$Fq`
z!jXR~VU0bfL}i7AHt+bbgn8E)`M(>h560Cmpt_^v3+k9-{0*{AKED=@RRu!|`{FsK
z9Lh_A;e1@q{G(Nj&4FA>ZwQ;i4UTfQuGc>o*|SGQpXW@GRW`)4EX8Q$GnNjqLI#h?
zx*D=pR%~zN7~q|B`oV0wQsBGX2I}{PqepH3Yc5g5l-3lV@F{d#Q3kNs=@bH~XLz2g
z9tfPP_#~FQ3qhiBd6w5nybBV^y>}n`@Y+PN`R}$ZGl31|HSGyHf|oQYtu5t}DRO;=
z(OIb+SSD>QG>!1Te0hnN-@Iz|?v9nee^wbgh~C;d`UcsaabB>?7Y`j<U-j40w9>ga
z>s+bP!_(Vw)7ZP8-su#Lv<yVh%BRL~@}(?5SpS4Dcaq-?Ycgi(RCba{WhobHNETkE
z{ak@(nbgE-RAkL(Vo?C*<7Le0D<^F)^eDgmS{0>7rho|)FjD6**5QndE1Zebv+Cql
z`r2}IrHl9d?K+4E32eN)=!yH={fSSr8W~>3zjh3Mnk3Zii=%5`Nb0S%CKi;uK}A@o
z_dys*vzjiHoFTuAu~b%~Y2m(jt$ShW?LA==i+Mz(tI$|s<0GZ4`)643%A3mUs7paS
z&9~ytf!7wLAY42{)>g;aovK2%BOUH{D*@f1jc2uxZa6k;+owc-N*0g<7<@NpN!pP2
zD}J_uH2rH^W4Bd_LBKDeP@N~Hx8q`}!CdI?`WI$eK;i6c9s7lyXX3doJtyDwZfH8?
zXZf5e_dCyAa#tS2!@HZz7qTfMt}fjho%4IUqEjThpDt|IoUYJ!knNh6@&06lX;d3s
zPjY3e;Z&S-Xx0?w0&Hj3i|qLA5*K-<QjEscxHNsMg|LN1*&gKJte;$*m4PlfTYayL
zCp*1*(oTJm%M~xX&tnFIZ0@DPz53kkLyhSZ(>6%Y<xKL%Z#n3E7-sg3#uOw_H*4wM
z(6wI%R^MI&O@K4&vkt+%&q$c5+I{g3@o0-QtxS_KZ?uLAx*+?hE;db{wNp>&6=Sn&
zecb2J{gI&s7^9U`FeKUR=xxB|nyHj<ncn<v=pFHwbSxQA)ffSLnE`L~HHq@+Go2r{
zQy}>Skz*8RRYRpHnFsE`v_XX@TgTRy`ei~R(8^Vg8VtT9%r%SWyXWnf#*2ER;zQI7
zNm(Wb6a02AiH>gZ^GtQuQkd7Wp1IZYvdWnsaX&84QCdyFe1e2a4)mV2kX)}ySKi-&
z*95^Oblg%VYb}uWib(_#DrM80XWQOj<ftYb@|oj1z3Aa0Y|Ksg=-dHhic%KI295UG
zvfZzluNpj{;i<D_B+Hc_kmq64?%noLj67xdzB3U?(&^(yPalrA{0JSQm?Kazx?jun
zpo|ss0@7rswK4;-Bebfra@@~Zg;FHq+DobrXnYbkPbgQywaT03xDy|t@%$WXd~Z47
zSS}{3CrQRYY<xR=YqB?oW-7M6@cvuYz+-Bn#Lq>~t4!56(=4AD-9>(qe1EI>jux$a
z{<ZER;d!JTSCfe$?OSDAmc|nGB`dgj>L@piD6uX#J7yo!NWKbf=Szp6`jRA-&xaMS
zlA~nOV^;|>Fv~}=Q`R+QV|4@CYwqqQKC1#9)Da!~5lYVghrPE9i$ZJLhTRqd5`ut|
z1}y?2oeGE!HHdU~cQ>K}D%}ktDJk6{2nYj=bc09?T|*B8?;72E-}|}U^1R3Q_j~_&
zs0YlfxYiYCWK?o==y^xDujuc(ES{w7xn6y4Ydzd<n(_2^7x|kD$lZdCS+~>QKRCqR
zQ(4e)RSo*IT4R>#GdDwj^M$j!inihIM#=X|M1o;VdF-*Jh`g;XVZF={Q=C;a?(%1R
zVbw$053L(~$Qw?jhIhGP1kn*#Wg)=OR3TF+huUq?&#G3iz3E#u8Qsmu_Q6L|@3vWy
zC^o@w_1bFP*`&E;&|rpIG1csJU`yKla;5Iw!S{jBwB_k=j}%R1qD8Vo2F?aq{UKvi
zm!Qj2xdA$XMMq`Fksa(Pdr0(PoUfe3r_h=V9JW;(o<x6$(gedH`k3*RT}5b}IVjDg
zuhC)q1!_Ti_3v6;i&rLyW0&L+SAN{Fvv+e=Swa#en5Z0QXFa@Qn&J7|1!~0Ht>iQQ
zY*%7g1~}BXjkl-@J$kTdN}wm<8LX2n(ceucUbXo`hm1w2MAoHF4xcTo+SzeP*|Jd6
z6ZL-aiuWqE%~OL|xh8)p7KG_072o786gJMm3anVuZcr~0|B^$RrLXSwF>!?$ukPrz
zQr&Bso9ezdgtKPQ%ob$1<yYbgfsOa~b8EX3q8EI_6n(!v7@^!h(6~Xt+<w;)@HpzB
z^De15Pw2md;a>0Bg>(msDH1Ju#$TBKK4eVqqNFe|hj5wAI*C$v6JPK&^0W0?%!`|G
z_it**46#UxQl-4L8iZ8RPKpyr#O1q2maBQ>t%S=>d9$(=DwH+MBv-6+3}}o~$euWG
zo&DV!y#r*cmiEo_=X-5F{cJ#UbaKAhvf)xK*5_ZzfVROoafH!Y5lXrzb}7eDf>^L9
zOtoQ}nFga-8UFnT`YgVV%t3UU2elgc=^%;9ZxDw9fZT()om4X6xffznVrx~_4^ss8
zMwrhR35Pi6m1>I6Ja1>aKvI#2MMqC{_Y%Is`--PpH`J*NJ~Vwf^6)0nV#$+@z_w%Y
z4OF`OriATy#7-3Q#LQJS*_5UjhSVU-WZfN@p`vCWPBx#Y)y{cU>@eP06-w}0x?qpz
zPV`L}D?z{OGmpG^ko0^g(HJmFIu5Sx$6wD<%p9k1a=B&tTlg?<DX5z;^p^_aYl^(>
zY`*OKJ@B%zgGx%#IIH5L#r@4GGSI2k^zW;?Ej6DW#V<^@!{+o^C8Y$06b~+1(p}DZ
zI8ZGPWz#Uq8SA_=@j1Hd&D{*5WfO+kWFBK`YWQAu^~Bb_i#N4x-czvZ&Ag6T9yyNe
zX%fFd%)IE;rEs?+aXk!Kdr-_Z>CKnNRR>j2D>i!xxps7^PvB|ocS$GHcOhYPnwiaB
zB8AeW>}#8F`#-Yrs;h@I-)eApH*^z;wZNzqDF&9zc)QqzJnix=zfKKEJyKjQ%>RAj
z-UfoK-OBxRZ(AROc3<7<&$0zgkZM;J-mf_RYOc3Mo<ID8Fo@3ORfye}e)N2C@Xvm>
zk|Gu(p9XSCzu2Ya`%pEEY=^aPE=tcQ0!P0L+viOqi$XZd=lg}R_Zu?x5C<NvQ5Gt9
zh|jw2=zWlv7aD&l{ep=+Z^099Vlnj=EVS#TnsLdTd-!XO{p#AQGMUwnpE`!RNhm<?
zJYpSbSl8-|(TA~imGjpsK~HkZIo8+73)vXBl@;$={62yG0#F6KG{NdR<h&3uhLQCe
z5-C>7z1L<dnnrQ{rnwPs35pC|%fF=3<}<*~O|U(F8lH1wy<UMF4x~u)SV+UW?F-P7
zGV8i&DmEqr{*JG+A8;yg;5uAAf0jc^wJXQiK=j7gt5PMIzFLlF>EuwN*cvo@Kx!V>
z*aU%;l)hn1$idcK(}T(er5Z}-shv~ssqZuZ?QHxDDFXv&qifxDcH7}#8-ad@?rGF%
zG;=c+Wl$FnP~}tzc{7SkFi;tLsU`!>30leGIb{^<Z1FAhvBhH8_d$%!P_H}$_D5P8
zK55H*F7aAS^V1#?L`=}A9qCFkUX-*bSzTeogU8cE0&(t52BrxITr{|E`Wpo+@k$aQ
z7OHs`1MlBAPBiiD@M<R;o4!fqWZX51Cx)T({EGTVKI6oIW7#fm7$P;@tT;60vqnR4
zx1{8gov`DUdBATAosR?{FZW~=Xq~(;4|DD$nCQwkzK2#7t_(Y-t&Wtqd;1Nh34gb+
z;_0*w$oFkO$U*j&vobQg)uvaMjeJ`>cuc1z5YY=v6XqNDRmBZA?<o1`k<v3-+DuV=
zp3kKa9;bGnc;hLsy6ggm{+8w*ACE)Q58FK6B!Ri8uhdGZF(im{JF044oz1zJ1-jn1
zLz^D;ig^;DuQQVKXn?ucpf#!VXm0HL0S}F~h(?2YPHb`EhYvQ1QLH6~=1N#tcPNcS
z5-dJ;c1yqxR*X4M5kJnB0o%weiANRjqp4qmY3j3yypxG;;}yY$T@Vl@su;FnN*EwV
z`nSfd_8xPwMzk$SX+tjfAcv=*+_18NRX^VgA~?C?799FTbZ&#z#;&GelZN^`y+X@0
z?+1nSkOK|ExIwTN8vuH1S1>S|VLUNhOZ14xqb><6Ny)Em)SCWg4(I1hOVU9#60MP|
zd^J}Um*?#(JLVdT6<_2`na3;B7(e`YyhS89^7av^FxM`<l+R#|qw}+a5m@qHuNh}k
zPeL3%JDyAuaN<6LnJy5F&s{2$`E8Ln`~(y>x48wV>K>%af60copBpU!7)TH42K}3n
zgl4K8MkMkmv`1W!?`rk5UaB`l1fCg1f<w+?VP5Nrm{F`Fp^*%ZSvH)X-dX`lT{cCb
ziF{2Z=A?QmOJj_JkwPi-CnpP74zF659hmOZOf`7KDNr-vI&{XUEHR)0bGQ4I@0yIG
zIfn-?8TT2e7teN!3HuU>t}nB&luy>t*PMqts<6I~%vUMpU@WspI-m8HLvdMJYO|a~
zGn~$Ea!NXPLIJyPyJ_{|Ii4;Xt~-#Z@fs;Y_ZZ|*!st3|M><mJ_hIu-;ruZDtA9-v
z)VDV(2OrWCu+wm>%+rthuY^;<C?bUtrwrsEQzBEeAse|~hSbSqYvC-~b|s~)as%^w
z#hUWi^R`L%)-#^L_irHWbEeiqsQ9hJuQlfsu7nGtAue-@E>B@OiZkyXrG;Ua)9r;#
zYt}wS8fFg?G#TU~XJaU&y8CqJ>p8F`lgNCzdOL(nL(Pmoeb~|H9Ra?6$rBZib>lTi
zavgF_YsjWysf8~r=;FinT))`wH5q;vG_;x!^n3Aa=4+a*$L}(PzZr_Nycc>uwy}>F
zhFL$MAtV(NEbtDLA_%JBec;p{>}w=R({1hYHT`=h!gTHhj*P(_uFu@-KZX<}<ovVr
z?Xfhkp5pVJ!)>#w*9a6X(~4%0w3Bkmcl8W>ais`{cjSyDQBSoiWkF>KFcdYt0B%lK
zhZ60QR}c$U#H2Fmy1OsBfa$q>2+YB)59LHJ9-FIIc6Fcc#r<MWp35O6C|yw2+*O8D
ze^F?34ODLDdttk9_P1r%J5~^ws%gvYOV2KfHBI-v9GUBOT5B5<kLej+{L)Gg<UhiE
z5!Pl7(!*&@NSVLOKv;Le0N1VZ>uTk84_yTg{AXr7`KN`ipR_ArJpsdzf6h1TW{t~Q
z^s>|S48t-E-<#D5_u??7ne$;Q=70Ho*-E5S4BJ}U`lE$X`B`}$55{aKj=J@(b3{db
z`gR3tTi{tN9<H%{Z8PA=je|!$n@rWv3DVy?+Qz~84e%u+-H*R(se)-2dHc)6pNL)j
zqaTP}s{P*~cH2%x?0(et`DDo}Qj^TW!@=i3u5-n2cwLZ}{I~0g2@wLs7!YqsN%@fJ
zzT9;`k)vsXDy!q&G3)6Npfa-nD5vN>N58PKT@2xKVf}b3rXlbcwOrW1dUQZ@vj4ag
zJtzI<Eu*^3%Oq?{|3=VSYax^bDx4Anq`~@vZl@FN0qqMz@rXxe4#8D#eDJaxgPqxC
z#V}SO>BPbXYBaNasOti!ety9D0t|3N<5F_^j{;zx5%kqWx}L4N>Rg%Cr2p<3exc!S
zugISdAR)%fLyr(hbOD~FDpzC{cW&!%q%?a)d9I&1bFvK)f2i<RBRm2_v3g_L3pq=2
zA)K&drdiQMX?)!1cl-U<tNTtCoMnElvPU{Jf6go%(gCZ6(hp26gpC^S{XU5O_{r}c
zfC}KlL%=Nq$4r-3`UOMDy1x!rGI8P)&C}(8{xcK)-##LsqKaWU!;+J>rwm{I`k+v-
z4Rdc~vZw!U(Et7q_(0ggj?uO4G>qh*JVC*GV4WDaQ~iFkCI9>qypfnvV3z8X9`0YS
z;>Ksp2xa&cIsX50y1<wCCI>1~|8VD1nsa~skpH*1nEm*Bak~rti8H1uaIX3|Vd#*i
zx$~^%eDPWH#ENf!ot}Sg<9`N(a$qJViT64_8=}M1Saj`B1>c9W>0tF;=DDHa&Y!ah
z@)fN_fBluE(g+~im+@T2XEh$#XOhRW)`8Bpt>)ZOIFBJQx`kvrO}2Db^awq+TltW9
zwe^&^WOD<YxO1NbR(Aga8dFmeV1ULZKY_+$@CT~6Xd6#%Y%Bl(F^0%V%p!I!Z43J@
zANi753*ZIN?FE&*r>Z7PLv`GnP+EG}i}Tm<`0Mijbqc{5|J!rLi78Z=S2#MWb(JSI
zg2Mbxt;HJAxAUWG+Wz+m_MADM*1<Seo_&<=mkoBY2%;a56J}AmnbY5l5t_lE0X;<;
z+(PQYpJv<x81CQyzQ#YmxyOIL7Aipaq=~UD?2)N|O<Tg(j>|<D=1sCYq2c$QIyqB4
zR7nFFYoFwUi1m!9cjeZ{{c0*%<Q)bU*6R^xI+_)~XhyHruqXOH4Sy?~;+B<}+VJli
z`12CuW2)5+rmsFxK*XWt?FGor3+bL0zM3^O!3GC0Kmg^7f@-C?$TVMYCsa-My-Bb<
zb`*W`#=*zERJzne2vJsF`_QeoP7GDTg-V(c0Iy;cPm4P43zv6Kd4_e0mH@9K*vV%p
zpNxl3b~PV<O+9HAo4L(L)5}MWzkVBbHG@jQ^!t;{#o3yBm1shVfGt{|>>3_NysYb5
zweh8M$?{}5r^xi4PYwgo=6?K27H9u1s%6f)RUbv|g`eEZ2=!!X=Xmr;H*#%ArzhfB
z%G9|%ZySn9&AkZO(xxsHRTPz3T_@X={Wo0!!Qbx`An#&;CcD>r8%BYL3<Bs)i8sKl
zmnA>aO8L$P+p01-`~W8Rw*mkXqD^l6WO#Sr@EL&zk;I#VzCJu{=XmiqU1Cd4)Jjmt
z_9HNSL%==kI@<M6DbSe6x0LR?C4}>cww6kqFHOok8V2y1x1Mj4>~}PA=O`1b!xD$q
z3nE7OA(!VsF=A#lDenaba>jpH)p_21Ezgi&e#*s7_5}-55<8C&`m)%(Tk>@0)jmKq
zSx~ZP@1JRq?U|h8RVmK#2E#a)bO7S9oWq~`FFbPE;T7BH-Gl`qp($tidL#1MHy}w~
zql2AIqMM9+{<y3vvD7^*<oT<$M;zXU)5(x8wB_DFk}&F`LC#L`q0-Fe=kBVWvXAA^
zo!di2hU;4_fdQ%Gui!hGa^a0|gQ}F-JhY1am}8(O#c8KDSQ9*G!^Tfe-UBJi8M8~c
z+5m*SBWn2SyZ@?ho@us@HNkWnI>3-vNyZ(tRD_3nFaYGY)fn`L-RLw2y>F70KTpyT
z0ZL>kNA$j>0G_+_SscS58S-Nl{p1GOmjo>gviou>W^}8{PuYz|b;v`R#xj95rMDJ;
z@@IsmB`E*)a(km8igBA<5s9#rLbE&-4t(68W<JPRh%*Y$LXo^S=#+i9MA-l~ViO)l
z&5E5)BCa<bG-t?pv0}Ydk$4b2+9$TJs_5^CiV>uSV+kBiOR>J;xHJ_FOPy`vH>Wu=
zabD1ze@U5y(!GYyFa?u3ub7OmT9Cj=Wf21!wU1(S-tH`ad`;5!Ou-QGE(zLnD<Z(V
zhR#(_N+}4QGT5bW*DcszI}U%?LwTCHQ==A!f!MLCV~!gbEp(kt^FBIQnNU?tLLXe1
z7J0^YdFqfpou-9`kZJmcUKvIllDvtN_f+A>p0E8VfVOC=w<*oKJ&7Ech=s@F1!z~z
zxdPlKi@&281r#FI6?0{lpMZK(`rHNQ5w6#x&eOK0#ket?9XogPL+=rku^6khCU_H6
z4fwsCcU=_JSW^znblqXc9+-vuhbG>{MRYYa>i@tCM<wxRS=N>JZhWD&D1Axin(2A{
zu8hNTy6VA_kEd}PeP%#%$v0WmQ_^wvz>srGs+Tq>gW!ZFI%W$9RQs!3%b=*=Wp>tC
z#ls+l?_%}hJHx!EJg6q;BN%aE$k~vhtAnaFLka8b`$Z7b_@y=&+rU*Cb7V_yi^Ltj
zyZn0rBpjp8MeI*RSPHonb_Aux=oOn72OcR|t6B;=QspN*&65O&f0bF|*V?<b=$P^$
z`aZUI*I9|QGvltjg9C2{sq$A(%k5U4f!sP}G+42rF}qmY>w1vNM(Pg~@T%;V+@U_h
zP{mqzIAa){efS|gPfEZcnSQ_yU(HVpaQk~<|9x^G!h~$Itg{&Gk5fSbHmL%{Sm7yy
zmTXo!P0|KE7MVIV(^MxvLKobif-M=D2U1-MR8V1+l7wRglQQS)-Si~E{Ch<om3+CG
zEqd!=N;j7LmrGy^c2Xqq#izo3jRA^k%OdOeGuC7k4cjxK{6Ion`chHLD*yaN(9FFt
z3*^bISkut-WE!z|xrkMxvm&6+EQG?%@IJRvH073IX{?&Gl?)W6__y6ID`sfll0Zb9
zd1_Uak#zayhX<T&K}5og0ma0Ir}1C}HNgXvB~Ss?H|T3@H&_gOx=)L)7m&6LnGv-F
z9zs&fNa^T!fcLe}rtJ8(E4DEIZRzsGmY1w;T*_`GaR6FcUxVN0n*^8~?csb7!-S{-
zt6oX^K1=RAlW=U;otPo@QHvY9r_sVUEHH^~mx4%^4>wR?hRtZ!b$+=~>?G|e)yA@y
zab1gb?y=}Tc(?{r(&m>dz^089IwT$#x~lQ46O^z(<-5L57(k+Yt(=7Yavkq9UfudE
zC@}5CS9=w0@1>fxW1N~PbWtRtq;bgh(&z3EGYfHAzt8(G5&lhu7<=+A4(j%5ZAj~(
z`oTAe>gl!U;2(WO0Pel;5XtPZ!g5@T+Ue`<70KV&b+r5tvV;s{{b0vkXmoE1$e>LQ
zsrJy%j|jb>Qyfe{OlHL@I<93^8Q#|rlFqpibs@kAwn&Q@nsG>}!8@mtvm)4qY|lO=
zR_+2hHjM1kaLtcKpzojP-lp5_y)+2po7$ym#7<R_GN>+jH(C-&)X-}dy6}tqdfp;W
zyFd?+mDRV;jbb-J3?dVe@$@}tqXCm^^E^KeiPx^d(Y94Am-e<<ZzDv}S*Fv1Y&*Hm
zBbUeyb^-<$zTP`;J-Dz|WIc-Fukqursl7s3^YZvKF3B(`{0z@=)+9dv(Y+hO7)m`6
zB`U!Hdhw)IT$mDoOn(HRSFGw_@Vte*U+*RO0ywX_gRquw(ty}?U*qEB#gmYPU;%p?
z>OqwV<E!-TWhs1<oL_sqh;IRnrb^=~@Ai}mDNlulGt9f@b!(qvf>b{;<9t(CKOmkc
zCbP1J4K^<M!WLhZT8ZYjxF=`l=$`h8fA;i~^MJWj(T$a-9J5@_L<xUnN(GO%H4~fj
z3|}ssl6ZC(B2|;WQmmv*JT$GDB(-G_GWkRG@riD}*I>16Z{bMzJwt?M*7t*tX7%Q)
zM-dh)ZM5T8yOz?U?8wO?%oy8=L{glueRm75zWC@L>Ggl-S3fm4iAkR{Q#Z?TVTFp8
zT2VV+i&n{$6~$?GYhvum4cR0VL&yv(Zl@i-i4gqiO}RG7_2C85CQvtWSJNdhrXh})
zK8lBWeNutmQp<Ca#X#}k64bkSttCg2Z;=lrha!@PY7bmGEvkYU2UfDr0~9Ov!^_H8
z^89-<mV>I?nbg&Q8cyy0=ms4g)8%!^vvfcrqL^C-(e;NuBgRv9cz6GS2wqxxo5uAg
zi?2`)3I1rs8WSxcTKr8Mp)`B8RTu`3dyr1<pC@^aHEPVAl_I#XLazd1VwQqfu}|fZ
z{e3IM$N2WwC)8I7P7vNF)|}sdc(qdP{|1qp--uz6|CTuZR~rf+z4Em042-&&6h*bs
zCol?TG>MvQojS$Ey{s|!-Q4^nPNC{=l>QVUYdJ&k|4D>Q&ontd^HcZvU@;vGtm+co
zqSEr}@>jv&wZ%tq4~S^pDkw!EyL={(5{iXUr$MU03AzR9e_7nKS@fZ=NUhxCWcOH+
zQJkU-9<@Ybd~ZL<%xC=+DYM3il&KULMOeivl)8F1MnwfT$ugW0bU--d0}n(*0tXd6
zVN*;1ZSB`s4{Zl~+WdsQhknzs-H{j^Zs&-@TKI`Xrgi^jciSBj%V1NSom0g)|MH#`
z|Mu#9xFmUsq8MK)Hq5yU1H}y&XAtt|hn{jnzEy!4oZwI#&sr8!=qovD8iiioiFV5$
z`el7dB0{GM5d5%){nmdTW3wS+{$Xh5OtajjxqYJ&Pcpx~qye<#Iq_zLV?Tn2_Y!6j
zM1@X!xE}lm6HNX?>s0N@OWZ!|Km5|-5>*}pi|8f~Lxk+}g=~Z@;?y-(0rpFVcUdV;
zfgAq)V*S*iIQ7T<*`4@*D%t;kR>|Jl1}e#a6X@}3|7>h!u^GJr4e2L<G~LaxcWW<(
z>bl6D(fvaG?ji;Uj@Y5T<j#?!B>%Bbq++(z7Cy$x{}zyQ!2MH*DxO&TC$rvqM}40P
zkHPbSM~|jSt$WejxtCOqj-xBzc0HJMp6S%gA90em39V6;nAOw!tQ@Ew#KX^Xkt?RW
zH|}2doiP~A@i>ZaEr{DW--_s<-%A3z(C~&<1tG`cx)sg&vAFu^d|_`r-L~6a69Qq&
zddLHn_3;u=*o<LQHlqcEUmR-DY^{<_?BTvxE5cXuvewGzB0s#ptgmV1SoX}pYpoi+
zT7dhj+>9)ygzh)qxW3nb5$Te%*ebPAwt7jEnqpo<<7I(tAJE)!M6B)t2h!PxO9z%N
z(dPwtybiH`B6)Rp|AFLvQ?Tbqe#0DNcZ7V*G*#bOuy`C}-93{gIM+%5?=C<(PZh5P
z(|9HO4i`)WY#%GmO>182YiyRsx1HWtG#@P2&0JibEMJYRibQ+Z%nr5G&!=^^!?A&>
zFYgh$Cfnb!PWbaE%~Tp|lb(ZTwIKlI7Mh}J;X@-S)#FQM2tuT~)8MZU#kVSegBOg6
z^Xiyc(V~Q2%RtjR*bU}y*d1%2nBd}@!+>$ca*%O&&(JR!A)fdxJK=9sF#jaRJ{HG}
z(90`jv=)brW5}HQQlA@&UvN+AptAejVpc@}^?cMe_W|tzOKmSkE=Kp7Y(0&&5rbx>
z%Jp;#?|3)T2dZYqqm!P;zNsJWfh~lpNG2-lBx#T76~E}+vCg?oEwUYW8@KGPr_ov9
zcr(ys4wt6q7}u}#E{ye6)1vvln)OG(h`9v9YthSF1m!Fqg*wvNozEa%yI-g~G8DXd
z(tx}AVtQ~Sg*HmHdD*PDr+Snr{<~(y`q^LKfom8MpDW3JKQs+O#W1RSoy@%Hl^EH*
zxy79YL8&{J0ZCmbsPEV{@cm!FV~hU(1|GBZ>5(V#1Q3AH_q6Vo4dRophF?QW3OvR<
z9!m~*x7nndk%jxe>tpa)eA(!q>l^wMxui>d^yGy@3QjjL8LLs{ihBCo;6swB^{6xW
zFQ|=jpd>ez;VC&5YovBKl)|it8u=dDQbWDySOh;9ev>N!Rnl?LRs%3DgU3qNZ6S-t
znu5h{S~N;9nHRU6VVj||Q&$qk5$bFempcY~ejJD_lZ#FhUUfr(gTK5MSuCL4*-^4b
zd6<k!|HgjRv$z&D{UqAEUGSZhh;J;43i&L);>%IGzShp-3DC%>yqhn#85tUA2*hLq
zluPLAW1@H#J(D7<t$j_oQym~Fo$|s-JdaYYPdZ)QoeFB)pB`y$JK&R_<9#_sP=cJD
z_w?un9C+i@ko{%Y4UYu+*l<b46sebzt2T<&GOFuiz;;dzhQ-r&dHCjhnngXZ+xF4(
z5u0oXa94ycH|Mx|C)8SzC^KS1D7oEJ*a*H^xd#vQ{rr|s42M>&1t@lZ*=<3LZ*~@E
z0^ERQkpY(W(Em8(#*_^u!>8@Olg$Cf!|Cem+D2OkZMI;U8zr-fC$NgBp@TeW&t*#&
zfiC(;mc_n=D7m7*!6F&Yk#n7jFuXjMPF{jg2jPNjl>vNfqq)cRuRL^<9`4`EPe(4b
zM5jm;vZiQ~W^o!Q){QWHoYS43!EU^M77*T~W5QHPS{aw*>21mf&?vc8|F5;x%o_B@
zqq!@dUW#X&+1;;<df+TCLN$@{$^!lgQ(eYQ$^YH?^U1=P{cg{1s|IGHy=)H>Hs3Y)
z7wcie&mv4NR;g%tq^i?>dY*RuMKI-?2dX!8M!P!C1=3!#;gY)Ipv<xuq1wR!z}4k}
zgJGSnwmhv;{T5qi?0b!jm@)@p1H_Zb3{RUv6d`TvB70=7Eb1>U4|ww(GUYeCL?wnC
zx)(k=3sw5YxIU%2s#z<%qR+i|%`Xr?i?ssWHjXJr6e`yIS8bHUP|)4OmWeK~Vqn*f
zsRxqIE$hh9Xr3p7RN7`WJ(ZX1a5S|C8eppDfO18>EYPh`UWWRzDi70Qr-{Rc@^CIH
zm<-axW#0je&~;#7MHuSZ$gZZBb-*FL$9yEd`OTO}m%_Vjvc6lnY(cYojSRWW-YkN0
zHERC=rp!|t!t7RjPBf;kWY(Vf?nNQ@<&BW5%515MmNf^wI4J5e@~N5kla7f8aT&2%
zb&L?|d_n(sT`#p(=FI+{k=0QZ=i@sx`76~bR*WU+@5}4^JK4^B-kNt(_BwZpKH6#`
z!(1m=DrM)J@9?$h@A=afUv;Ol&LejL)``jA+LIXXvz5528xjey=?%G9<f%{bkipY-
z4r`{-0{16NmQ7vLttwS2PukWpHr+kairRa9m+RRykhCh*!gs0)yk9T5_dA`i^3E2F
z6@p2>I(`#;ks=mHecd4f6YjH2KGs-yXMG|6<=iJGgH>PbilZ)MV)rEE@qQ9&{SLfs
zUc(y4=PkO@VyuNd&s6-UyPYJgmQtZvsR5b)bY!vIozNTpZLUsBKcKUid8AG$id;L*
zF+rHv$0F`<ZRmx`(8?cT4C#E4Up=TYW2AbxIQDnxI+c}2>M1)G+=OeA%lJ}~H=Emw
z)jRjSY_3#?xl&DK<y>f&Tz3a;0MaT%R}yMk%Ij`Cq>v-ZI6RD02?xZHz%-J{dC4wm
z>ST%hR{uq>*Zzj(LUYD29=dxO;V&55`GE6exb{T`cM;iWN`bN2n_Cyt+WoR{E`D4*
zvi_PdP$Ny#ul>1up@+qv07A&AK9{#~m`rWzq~*(wlh{>{&q-tcE(kHl(#e54;#ou1
z4$nyv16e`;&f)=aQh9q_nk0L{h8HjS^0rp_l9t?ReHHSU9$^}Vaz6L~T-!gdZ{Dm*
z(MnMypeo=eXe}fg=+4qi!J1<osK{PFrV^P4JH+36;2tr&Y&@W}G**x&;#f5>AUn+`
zB(-LNI@C_dkNzbDLsdcI!319;rdD5nHv7=pN;PP+IY{x35Xz^AHtE~MUmZUMqm=hO
z3cj&}ia)jFsKo22Z-2ypWkwU&!+Y+2($v&f9gsCrjp{Ty@UKQK1n4K`J)l=0!ik<(
z@Jte1v8qc{;BFU;Wv!O*lGbO8*ytdAAOh^M3J{?8UF^_lvkT-o2tvBV3=hs_5LhDi
zUdmR&OT)@}tQcHxRNtx%D~}gWOq|*aH$S$WjInK4L+pjlxodIPK8s{m#i=B@fMrAw
z`F?Nypn1O=ZFdqb^7syu<vqS0O>N)e7mS9FrDNh^ogI$|U55&9B8M9G&voR_H&`?-
z9|_{68fbmfLkiY#7Y{kN_ga=L3-Se!*)c+<@bA$?LFzSw3t?brs8L-`22TzDsH(Yo
z)xl%)NVT4zYn{sUtFGe5HI)A*+QxR0ruoPzb{rOd(Jdyz{UO3D4P~T>o>(}Zs1F!N
z#B@<NDbmiwHc%IruZx<d))Vs)Fl*D8TUVmd?mIV~CysN{jGL25Q1@`0?<z{?txnxv
z-p<nVmO|7NIK9O$UEY<#GWkV@x3L66K_u-vD!o{>|Itafe9n*yOf0^q@UzZ55ne?V
zY-2xAy*($ABILm|<zO11^6|D(-3?U041~A}tI3>Z9REB%tsE)yqOU4GUCC!z&?tv^
z>qiO9qi8co%JZ)F6HHinZ-3p<UHqVbXyZXG!K4z+>}n$7ZY1J%!#!phIx1`W;I^qT
zsp$1GV)sk&EOAkSmr{g|v?>vXiMVI~=zFf7%Y{8G{_-Ib1+{8VlMbcBTODsHwp~0o
z>7RQf58+Dme5tyhEvX+jr-j39JtZS1+V{*--ZHb?|9RXwwnPRRBtd0G@(D9NNjW4&
zH7@0Anw+9Va-Y4MN1Z`#T%KC>UHhb|+7PW0_oNV<t1~j;p}jkdQCEZt`-I_ztF{kr
zA1f*gT<Ah{r_7<`+}2|O24C^+(q7wMbBn9>PXxZJi!i^8d`t#$`jV&prdNfjcSWtY
zvM_<D3m-P~e4+p6-A$w7L=6sjiqhRB7k<Pia?U93eAIEB$5+h?ZNtzJ?}k#GHTxN-
zi@I|#)rWH>%${GYo@M;Jc0Jd?)>fC7{}LDlF~im@;pQyi`Y#Me-$}&zr}cNIt+xnQ
zH1l>n*CM`*KoQ+VAp2^{d3;8_gdU9|)ckNm`+{z&+o##a5yQ)wp6z#qh*YB)_8zz_
z`zV;dJK$(Ylq(ame5At~iWfB-9Taz0xmbbjRtcv<f!$+YI@!T3D0QZU7zyNdZVahp
z&h0L%OYK7MvcpR6Lms46s(c||4UF&bI16%**|5QV^EFC>^U^f4wTHYPy07MPM^v5E
zs<8@isEaba8ix;_6-f?yd^6P|Bd*k(OXxghh+VM<gnK+p0J;=+!mm)GsBT4#OwAd-
zS3FRU6N6B#8h<vgRfIeke!%2;@^oiZOOYhAz{yT5+wGWEH#{Vw+M=CLD>jC)md0q8
zW+!z&Ii}8fJ_b3a><wF+T291WwIR6^!eRMdbgpouM|Mt7#lNjQfTSy&@3?l!1M=R*
zG@Dc1$8z_i#QJKlw^UR<u8K~BoNacg2>rhZ{5HPFXvTlXzLYKnWf5NJV1q<lzK_oE
zTqE9<O6g8A%{vs|-8Jw<2PiyzLQTfdV4~#~8sn*QZ?(I(`P<RG=qCO#f;2naWzVxk
zb|u^%R%hen+P8XTkx0*~aktDDU*+e54}>?tiqEaG6cUG9>I|G~^~Jfl$xJYkIcjYe
zU?1dNYb3B(H-~me3S2?oo=NoH7s!7S#u~tpPfGOR3ny-Zc(fp}%k@|iQ8ig;US&B`
zQn0saDdNh=n`_3tIL#>Ms#V|LYJhZTj~FMy4LXpQn90z*H62_H{AY$OGE$!mL^ti;
zA2NGLs9%3HIJUuGJl?L?x6|1+NEvZ4=lny&kkh7nX!U4&ka-f)cuq)fd}|3ceMJ4S
zm|PM0D0ZM!O^ey05ba4dDT^$<Ak{ozpUl~u_gWe9GRuy-e`ZTi4RS}g8{|DFUB!OQ
zCL`G`OJd7LPt8{0<eC*s|J_D@-q;6R(p>rN4+I}`xZQ}+cDqIDvEad?Hm`foSEb+4
z1U0a}OQp)e;L75TbWJj3)bs2Xz8p-cznt-yn`-~Y(NXeL#ZK`y)AvlQ(y0g%MmM=6
zzNy=YgS=Zn6v<qzuRfYCS50^3ncD=;&A1zFO$vo$vc>iui|?!K3wnD?Z?$}JtxxQ*
zV>cna_IkoOURhU7PFIb~U;@hkCD0-jE&SS%_WG3AA=8fU1IgmZR@EJLNe7R<w_1;+
zNC&u2)R($*q9b2jx#h1)^*I(x<E=LQcF>xc@Ss7C0y=A9w3{*)9Oa3rZ%2?ZmHOQw
z1MJ)>+&mTX+`(fj+Y>G4M%Wkw?55#M<INoJgO`G3NFDXo{bP#phM}b=nyUb$ns!e+
z*?Nqy!{Ty#1Boy+#$63D#Z|KeFV+9?cK4*OSEI{hxqt1+$;yL=n>I@(OH6*tQ^AY>
z@Bu5S2k$pAzj22auc9iAmeeLnW8pBt3Af#^yg)&!1InPxJ3gQA**i>q@n*+7RvChr
zB$f@iEp(JvKo`;9A8RD}gUa9!s0`1_rUwFO<!vhqKe2o$oA5MCbK)SVFByOu`8?0q
z=;qYna7-RyRrnY?^)g^hV6|qtiAZcBpmkPvWzH(*kyIw17k(7{WOTX;az?LSRFp`<
zRaxr~j5MsaSt{dmjzza5q;|p6+7=0PEccKXP39vvJKe9Ujdb#cS(5%di6P7~G1eu=
zWl4n+k<=LlPFq6BaP_T5Hzy(4LfG7i)~ki37juMVmbPZ-Bs>o$m)`7nLDf+Adc>!K
z^{E;wkrU{PF`LO)ZD<<GyS>gUKfokuF1gn)B14P^)Haw-i~)F7hvF%IUDjkDkhR{A
zosFRW&S_Izd+|^cmF}+yMcjv(NmC>Was~s*A+v!{w?krULmSl1twuAnKV!{GS~>Lb
z4RYo<p?9pjg&YKWMk$k1@6DPQO)Pu*RKMoa%-_*7h?$Ek6;kKFT@v|)<x<5VKM)zg
zmBI>)2ikbE5z|4)t;W{Ov;<|J4_}+U8Na^jkn?fIBf|Hq3`UPWzYKMM%tgzPfk~>I
zP*P3R&=`*nS#&X4#+>9DkUN_D)^4|9L9LOy^A(y|q&d|9o}MQ0^wji{<*zho!|Kij
zc0r8+s(>z*z5bITH>TRVhtFcvK|+(XQDb$|u3>WV7jwXD2mt)kKk1^3crYJRP-10B
zlR1xyM;okeXPJ8+)^R+{>-Q+H7Mt^HI!ZlqNcn3L8ezzZzY*n8yfv}2ue^e*ofML~
zJ5@%b<AU#c#>XOi7FN+C7BzBisfo^sWA9aa^XdUtgRZ0RxyyAcp__(IlDo_rlX_k$
z@rs$Te$Hxa_el)qVf)f|cspO%L;<#8G``D|b4*fFBeXt2C9T0ZX`MNZd0v{=+Pge3
zoQf_Q!tR(v?3-GP?=75Q-dgKNF*JoH0YQghrWVK5(Re%)egqLjl#U8}IhMj^mzeMJ
zT2+oqTd{JR7z<m^V0}+BFYeg$dGRT0aH_QT^9ovy-aylP<Ay!AU<*=bXm4G!LL@HP
zS5E#DM_R&^@6eR}@^Sy1lCpp=n;cuj7wBPG!_di&aWnO=HS=vyGds-pJ}D+B)(ZCS
zibZ!s9i*VyX~v&;m)2zHe}5RaEF(;x!omf#ngqL{C5Do%A|q>mEVVKysZF}?Lf{s6
z+Qka?u->#-2woMSj(Cu%*R;@Ahoo~-v(_eKExPZ$k?2>?F?1xF{hfWLQ@HYE%d&h@
zPS<#gB!oVJl%=G^OrZsqJ$vVwbcLo<@~CXgMGEObh#D77kMLZyZ2S2uONsHSBr)m7
z9YX_ika=MWmJ}u9l-yFq<s)T2olo2p+xn>)(!&<~B1oG)nPD{S@d}q4Zb(l73AG!&
zdY7o9uha(ci8T;h7CbW<ofeFS<~1NuyE%IgiZbZ*Rp9%A!#imAq1CLuI6S(Ho00r6
z-`kT|<Lq-5(6UtM53qcY?5^Fbv1$l*PvHKwOaWAkIc%BC)XocAQKI1~j%>GJLclBj
zK=ljR>ab<htCg%G<2qRsS?(EjwZghejt2$#R?fCeiIR%gOM>q5eFmmMCYR{mw2XTw
z;bq9K84nK%R)(D?u|h~?<y{UjjE+CpS{-A_D|1rOBbzL#rwhqtP}F)$KupjbR1Q}P
zs5&nFm<Oq?v$%n<RAJq}*AQaVED)wMR(g__@hS7uyRLIKt9v{VP?q%^w=cDCVOv{l
z0kU-)rd!`XS}K097|2iZr8G}I34-pFp^7}x(<Qq(b@_61I7Oh#)mnGpZ3a~}w*s2v
zR1Ex!zdj=p!`5a{)NXn^v<jYS$9t&fyUlCSt)u(39ZB?TO}Xt;j?i}veb2Rs?D5&&
zzP-~G&2>lF?eFMU)hi+sGXv(HNq%zS$m~7SUF*d6C}W{N7r7u6<gQ+;qrb?fY$Rd;
z5PcRRSw#}ezJY!sYHK&KA)WPr?83=XG?QV0@sX=Hk?Q>f8U_p6w(s=0lYA|MDuDbI
za~@IA4%0mxxPegL2@MaG^Stm%>1Fibx!y*|C4(0ffZGBw!wZxx*f26oO*)Xjk2XkI
zPxIs^km_HKbY%}8Pn(<|Rel6?9s|xJGV9s}8=>oTF}b;(zyWf|Y+Lvq?$zz)7-&jU
z%vJuw=N@JW9+D?xwAV_R&kWVz-SJalvwUcd{3un__ieYCwqMyMnfB%<nB=)QEVT}J
zpQWER^2mBTYUl8ZQ0EFcR8+3cdd9wR#Vy}fc>WLg>^NJFyh7==Mwt4RTh&tdil$bl
zX!;%Pie)o~A-I!^h^M~19S!;VC~iemH`u}SaH^29hRqDpgc3>57O8vP=l&q+4Bi)9
z(3G7di>|$>c+K!=mmT*Gc>iVL-(GkPZXL??d)ZCJvfeL8dYjV@EzGrWP7Gqx=$q>e
z4*zH#8V@0B77xrt{(H#LXpfN!k}W}ZwvN`jvs`kIe6T{t5+<1KUJ0d68rqCf6}>&A
zG17d%AFN#z^x4tH7?S)}ja!|Goxo}vHFHgJp%yzAUhpT?#wA+abgF9|3y1=L{UX#z
zp-j#%#q3bZpQPFnO8E@MIu5mFNqaZ!O1m8<m?(MHpbzm3G|CAZI1xtZ^xj@xe<Jl`
zlX}fPw=KxJGMm!*Z(gsKOJ*O=x#lg2_ExBJWxT*LcGRGPsB9v)Q{9(JXN7>LrfQaU
zZVs;}6v2!)^QbL+MKH%C3j5mlR8(S?I)1_6!PI-UsKc<WM1Q17tgc%S!^2R5h>xlW
zeN(Rd(fQlN8-ZFObuin3!dbPvUH(a&d|Hpux+mRH<7IU&LYY2Y-(xzeN8i9LkxR%G
z&pwm!9;BQ64hvslgN5ze{-Wi3JI-1Ua{zDGaLqE}+e8x_9=#6J?+aLS@q#sgJ^ON=
zLUga$O4Q$Ryg_-#K4z7`OM24VqT#%W+X;)uDrEhsqL#ba3N*X<uF%1<3D_rfudrWl
z&Vw5u$F(IF)b-(9xtAysna|$4?Xz;+L<G3sc|iUISoe8fQ#!P%Kie^w0FbRSHX#M-
z&MM~^Zm^#?98{L%$2>Bp>comrFJ5LW2r)egM}3;{fW-I6>xC`JED9}6qhV3^`+-bZ
zn`(Q;Y^n+Qp^Aw)b>Ou!GF0UD>?NdOs6@x~>eiu9->O!F=A||VrI@Vi>ruIKQM>k|
z72EYiV_zje=bx$czH_|4oD!;&{uY09%UdPT1bh4Zp(mMU60$+2u-B_o^l5wA(2*-I
zz7mP2Om4Vzvr$y{2UC4@_~WhPY2@4Gdos3VK(KTop+nqS1lm+oW$x}JlzB6<c<+W|
z8S%QyVLcP^_aOd)Y&YP>U4R#o-7q5Qp;{3D(O^K?2ssM{$_VTcOwTyfr4qeIcv1Je
zodm0Z1a~_$O-HRDN9SlACjfSJV%aE4u66xW?rh`o!q0Tg;rePdx_ZrK^cRtoM4*S&
z@d5tsI0h%3pxLi^z$bG158djn<Cq}GPZ2lyUVqKzVyxo03?YtN=0cTsqBQJZZu^Xy
zSP*2S=xLW2CJ<i=NDY50wZf_WYUO_YOD&orK51$NVcMZiLGkd3Y~r<{%EuW5s!9`k
z5~(%JtA^1J-?G8(FV4KMgwSQCtF^LIRI3(Wn+n;ppSo5jERK@@<j$#W7*#?4u=aCx
z$IHfQ*45E@Zy0`%ws$~~(#2HL=%ie^iQKgVm7d9kLsu2&ks4cGCtfJRKs*2OkhAI~
z!&)(ro5`%Dqe+HL=1^_X2x!?vNLE9@bgt<-BC0}S$gtCKTiANS{j<w>t`=KP5|k?i
zYvh5fFSEqJJa7F#`QCa+pPj@7^tdBxEYQ<|;fn(M+p;qFQ18lSg&mBuR8fGWyE%V!
z%4uum7l?xk{n?<|hy5Gg$9pFd&1k@D((chcS+(}2K%+6%c|G1IheH@vQ;fFP$Xj6Z
zeW<(-{JAxTTY>i5I{2Xu2odxmG-1t5<SdHhNsM>wUE_Ov4u?AWt5}Ap)$+6-7$~30
z2h|$wmGa`MbIEBW(lKq<6zQLwgQ&mC1v5mGRENNS#pVzEz`7_*x%jJ7|7iuzlk;Cz
z-~-wJ7e?SVlxJUBYa5w&L*4tqB=KOp^rzIT%?p5GP9yBdp-YvuQK**w4gTX#<hIdE
z5Bal@orp0lBk^{I40tPanL|5iV^i|-9Hgt}6NVBqa)}mD5YnT>!wW$%J_;KtiE};o
z?{prYEP$=s;+*ecOpa@e36L=1q@PMFJ_*nUD3?@pr}X6?be-hajd|pfmy$x1bKHf(
zOt~)q_p9-9;ar3P76)!z5VT!&2`FG156C6MEGQU2eV!csKz?W0gZ$&lxWB-Mjx4SQ
ziQiC$;21L-Rq2w4!W2Km=DzjKz>VthFfM@5hd1z2q;oxzH2pXA?2~NRe7CL|4PE;s
zar==8f4h!B$}~fGW{Js6w0z+_`56x}VUYc@ubixho#PLu5H*a@Q*FuT#AiPLy7lKT
zC1!)W{zf*@O2it2bJ+@I#ZK<5r+G2plDx;KyA6I7uc{BN&OxZFjJpdno5^ZT`|@^l
zVUJ^(eKEu9;D3j;G=2cX*u>GmMYdmB7r%UrZx~z5U<W;i-&4Z>Bx4cYurUMcpT(_z
z_`jK6VLrAz=m_3Ux;Akt%;)D(OpM0_ysp^eQxuv0Lg@r6fc<;IAW`w}+wwoob{0LD
z#hTsEJe8mF^XK^7#$dI3-}K!5_oMe8S`v`T`+v*(<4F9yyjVmFzA%Z~oTT+^Vr+v6
zf2z;na|Rka4|C01PH}ffcm@bipL!VGG0r*Xip3PJs<^Q?{D<wO*X%xS0T4B8)wo!H
zvc2*m?(In~#$jMAaH$N<JzlyRVTE-L>rf%*G{hoPGDD4D-taL797D*xsg3#^;2YUn
zj&s(C1Z8~xwB3bc04r4~e=rChAMcFp`)rRAymRJV_!ROL&NcN@bxzFJ`0KXdtCC28
z4!D<Fa`Kd)@3ThN;$yyWKj-je^a{VXZxH#iR^S?zq7~N6#@9zGfq^nL{lMH=;PG__
zb?vTS%IJSC$}XTv6+7Eu<!RpVJfk_cXupaT%sGq^nrpD~jp_2F9KW}FJ5;Hc7x$6t
zYe`R=WCgvqRv3{ufDJKfSVt&ps$O_s`o4oju)j*%!q`Qm#;fmL0(-}Np8@puU)%?Q
z0n2+Jj!lCEvC}9YlV)H{mqhQR{ZNeq7VonjQg>3XD)y=vzwVB3EX^FNuY;atBv8KT
z%vZMFWJ4<P!*)4*USL`nuXwyHrd(>?@Mho^Q)F3bJMYSG;_%NP$^;Z^1?NUQar9w|
zEZ6*`H(&Z*aS~y<>us04$pZ}PGS$S^RQFO3=PJi=fhrwaPn0hGC%+6ysz->W?AzTD
zJM*_UtJS)L4Ae~;2zdI=5AUS}NZq_kxoAlwT7}ypQ`U@96`R;lBr>dXEk1>-(O3fL
zR<65Qjf;PjuH!T@qG|3>3#Ux-?(FZMzxczq(XdoOT5vctIk$OQztYvwL*La+$jp!I
z8G>Z*#r(j)Tfz>NjDy3~yquoBl$TkL4aI+a!T%AC{_{6Zj9{b1G-TFg-~EIegw<og
z1D%Zv=43E7fvm-eota%Dg&Oa6I2t^l2U_L-3_rhw@OKwMs3j-lvL!zYXpq1P^!*f~
z!ckEOT*~o#tYT3ELP|U9c7qtL>i<y1P<g<p#ns1KU$}9rd6yLzQPiViZE+7-2KPO7
z+*dGsK_;OzC-?^L*uy7?Mh!$3&153_fG`^oW6CEg%N|_qnwd;>Yi->3D^FBQ{`1X#
zjmjOM0`GWrbToS*Q}<=b^7wn^k|N;a*E;Rzc=ifc`!;Lar*K8|vX=BYQj8$T9p_m9
z?b<Yab8)IEW=_|6GLltBzVE9<mvq|@Z%sFw`F$a|Jw1bu;ojsAs$$de-Y2d26-J5P
zoC$s0>EXbdI3*#JP*SE%N-$Z++gbI@GdVLgI)HF!84yPdE?<}_@Jej9<f}xpUsneZ
zUNftKumd7#z%kfyva}qyBJl6;>CYACeF&DBIFVCRwh1rgR;u6N*vI|ON?r>&lh}*5
zc6Zsm#v7ul-adH@&^Tho2kR*9riv#|V-C*kEaK<eAnP@~aAaQG%+0k<^d%Wd-qIH@
ze{znhhh36fRF%x^5kb9H^tR9kyDe6wTj^-w@mc!^Gq+{BcAbtD=wx%>DJ13^j2k~5
zIw`gd&aDj;d(?h_cBwG@YDQS!)vI3Egv%FMjJ;w1`%C`ESzHW``E>;GlRFllIj~_c
z+sjr{mZXu4I5+!Q2JYaBU8OFhnw$l4kbnyo?)gsGl!a{YgR9(~gymPLY4*z{Qz1MM
z2c6Aalx`I{glPC6v~UK9KWJE(@2gM}sq%{RI4F}S##vAla`atRPC<HVnF!<A2S(pe
zvyOYGX7t{XINDyK4(34;+3jgWy%r;zDU@`Q5X4ii(c|JVgPgu;p?aClV4VWwh3bB4
z+!PsgzaFLk{7qsp$QYR5llBYl=^T%1*;{+<D1po)t5U&jSGki)LciDkWMJATnn9w)
zo%Ax@JIvxyuNrOMy;`{91Jee$|4qA3Z+;4d$<#DVdiC9V#H<JmF%fe_x6w3Gu<w_f
zLdJ6>i{_NWL%%e$k1I0na}*@rBhY6tz9%trC!2#fTv$Z>ET?OPRppbjOo*Zm=BP7m
zGpd)?q~Q|_o5TqJ+>dgNx9yTMe1a~d0p@^4{L7|{Wab?dJ4H~m!l<2TzQgsx5j&ao
zy6?#H57EtXyv+Z62>$a$f22J=FF~$J89DW7`N|izwlM8*dOmq@Y`o-B1j`%TUi&_+
zo?ga}VDv>(v__KvPVZcUbv?dyjMN*J3k+LruYGxz;(QeIOV^d|M)l&R*!iRa?4dzi
zYKuPY&5*mISb&z>aecMMW7s%Dnp^@RdK30X@UXDy13e_WWL}E_Q+&x>#)t1xy|XbN
z-=>`FA}b^%P`KJOf?kxjd*#AwOiD|BVW_*Aek7%|SDyP-c!M&f#|Ho3N#no#;TtW8
z39@?e4#jdh3e&U=lx;V(MQ=L@vnmF}a>WadA7dOQ9Gs)Y->}3*C@t)3^fwGI=zFdi
zM<d=)rXe#AIe?q53tceIfWdeBs8<XUumKitpqm7d40}a``!I4?UcCLO(SY3`9<@VL
zg2q7PzTM*h^p}u4!0&Tn{$bTw@s#(L_h$#w_+fd0B0AHH(}=w}(pE(^J0v07eFqL6
z;K`xJXGBhqA)GlzKO#>_xc|aLXVrkw;WWSS#!n!b#uvW8|1qqQlQAsUCcK=~{mc{&
z8`&Vs$U-*P>Q!|!z<4gQIstQ2sol<Kg*Pm)zV<9OGjgC4(kn?EBmqn&&>KY=ujk#f
zKE1T9)C;)9G$24cW+#6$gEusMd$Vts&dDtXI6Xd>w)&8?Dq+{;&Jgu-KI3VVKeOS}
z@Qi@&`v@a5zQD<6vayebP9vhM0GNy+{2P8n=7Xn(!8IC?04@qIoP>&IR6@p%E4@_C
z=jb^;aePA?ci}?LE4QHtXHsgFdkkss9$R2%w0KsN1;xjFQbh`0-zm|FOIa6*c-=p*
z{S=n&)`rM^fBqTEM(M#OR1YrAo2#wVo#}j?yo4^eHzUYzI`!)otwdqOX^%!Qrb=VX
ze8{jwV&X?u7_F|MwPv`9czHxlpITNz#N4%E$0S13w6|gZGEx+|GiLBKWks34`>0qD
z#E*fPxet~cZqt2s2f=eXJ!(Gh4fx*sJ77oaszhlnYJ2014N;F=yh%hjnpx#AMayYh
zZV}htT&1mAciSnM4#mP!$hq6;-4=Z~;zWoV7U7;hvh9<D>Q|FOKW%BD7V`D~szv_m
zn*O-KE^k4ch1x0wF>xXxAz#sISD|09c;uUu%?qQRkqA>qj+iV)r=M+W>;7(Aqb=e~
zgI<{`0|pk$1*m6^EO*K&j-<bH1!xz|`M7D<nA7BW^58)~=Y&|0E`8{I!`Ucjc#!hx
z`*{V^Y8T+_5^HLrSFWh`X{LZy<Ej9>dLTM)q@WFJyhfBH_A_#VvmfYYvb5MY9@v@u
z{%P>Z0@=vcRpWtJQQ&RyqPOl+5OOSI4mjEF9<j{6m7yJ=|C{}mR8s041oPku;e1Vq
zLbVGbe)w9H0$&TtTmD1>cr`SnX!jqE7Lmy?fox%UyH1CL6p1t!?04_)0W=~0a+^;$
z5;@_h@`Z#By*#d*t3o6I2MkBxaheH<$!*uXoe^OpNU>et-HldRU|Ka<@9Qtgd*8Wv
zSql1Z%l%hklo*bA5W1r4mB?Nz;9OrFZ@@Q(yuN`)6!=5f%BddE_dF}x@4_RTK2orf
z9>#2Mve1aDJZA*DR*Hz3fs22<Uh4M+9y_m&a3BH4RiZRKtpMcDzJEpan1OGp`|XIq
zArFoN3tVvvu^-EwE7?~Qn3B@RF1@mksEFfA9<>gCqBv`Q)vZGdE8;}kQq+u>Z_x5R
znN`UQGe49Awpwfbm|Id*lZKutKS_IL8NX-uwDX_*8hjn%xF^kDa7)*zahs^=)RIse
zHf3I`Z+GV3T`!>4gLUK$b+{}WxuCh@%^+UoV;!uy?qm2xO>6-uTB*))@id~U%$ZLi
z0WC{x?OJWu*t69>(F!a$Tz|J}fAfdq+}rM8neKA2Rir-A(Hl~G$ek+AOoXVNtS9Rw
zZ9K2e9N3E0V!jwQAM0r^(+oxcC)o9CK+>gj-4NZ%!f5+zJMS=tsm?|6I5i78L`2vA
zbj47v2d#S)xr}tSXN8+b+Vj?cLyNwHG0)c~b;nL?{<;y*%r^90A13bv3ykr9z~9~w
zZ(>}GeLtXM^d<?|0;pJyyjN5-jLvPjnr~1#9XR}Z6<ScDM_?@ddi%_6K41i#fAml}
zSwgK!P6)-o6Bkl<>*G%gR*VtGAuz(Ysn2*D-Lt=?`wqxiAJ?k^99SBy3?~lZs_rom
z*-4ubY#mbU(6E`=%otOmm<cW%0Cc@wV~lev!vEaexzcbQ4{DN{tUn_AYt$|owvERB
zf|2@1)Y!<w=sxxS)O{j6p7K6XzB*&=jT&262hGTakYf~Z{dSy&HymxjlwM<6lfX6g
z2+_oS4E!;y2aYoZP8OlwqYlcbE5n72Kno>B6CO=<ok|ezBc)-sP6KDK#BVB(A9tv+
zj}W8#WPkM>pMu{sf%m?c)lma_SABnm=7jeU1wM}FofPk5WJ((P<o{OkX>2Ifm2#pF
z_xEw;XLzK?wD1hx;~}xJX$PQyP`CM0^U3u2&mJRoS9R(?R_e6uA-wVZUoAzl2}&ri
zurLujMY8&5sBi}dW8{8i^OfPM2g~$ea%za^#Q&Gy@;}zk6_`dFU+~GI{lSSVc=5<J
zxi_60_mqnP{z>*Rc*7j#C85}XK&J^qiG!qJd>eHcUwvo!rRo1azcX;202v?QR4TRw
z^VeFpOU=4Of^nWA=W{nLa!h}jsr^?)nEij)d&{t>yX}8iP(VRKK)O^K>CQnBkZzD1
zlx~TkLqI^Kq`MoWyFmm5q+{rC=piJBVTk|N6W;gvo%?vs>*spjaLqM*XJ+rU)?Vwg
zK5Om0fjw_|9CEw=`jvk<*z`ug&+vlK?*6xnjRCt+O#sg0F^vBAdd0v0j+ir$Dp~lV
zlS%yLul|c8|L3`GzvBu1p$zx+pT=`>i|aq1eD_Nfl7_&u5IO7LU0d>xhktwnP+L0k
zj`7*=T=L%s?cW4I*X`(u|K;SUq@U!*5mCpF-=VO72oC}<wi66R)c<Aq05;sg`;)3z
zXL_^pyJYnrad8_cwiYR<i~fg+Eni#gUwKdpHg!kR##u!(u8sG<u&oXcYr!I)Yp5>4
zc|K_88>DI5$Ymb|e~M|(Sqrzn*YR;t%9wxdF^P5xj}pNxK*8s@*Z6%8gy};F8T@d`
zhN}gHQ<2|3s*A~P(7m~Ve)}JPI@n0*2-e~_Zv;pF@#gPdH4xGfbjQ)}rZ#rS<OllS
zRbSGWNt9_#%8y8)z!z~YTfAG|({hqO>~ah37J=lA-~ACXL_=3ocH0{&-$=R<;W8pC
zaNCqF0l)c*e1~TB&^m4#y1lJ_K0VnG!{}DBnUp4Gu)fi~J#jTiB`(5(rtxM}a<;5>
zp(_vjVToHi=EmxNpue3(i$(C(#l-OT35#f4N>P?yk_`z2!3D!Pw@_G*9L`HQu~B*Q
zBMah35mvq0Cf4t%WF&OAGimWmK8!VkdmS}<p3YbH-W8$jnKlz%`XjxlX_%AtnV$}<
zIF0p`5&m^P|0=y>s?~C6_tW^L<#p4@xyQztFF!xjy)AWtcA*7fb1Y(ZB0|u5Rcjbi
zw_#yX+UFCM;W6johMH$?0^uxb#J0VwZwJ}!xxt}0Cu#u~Sa)rgLT+s&4{=^N=#&Tw
zv4d~whxZ-VSdC}I54)ClHD9E=cyY$IMo%^LmiA~NlJ1|B%78v=G<gh`)Z3>H$Alt|
z)6Q>&&q<7*#6btW`FA3vEZp{4j@YTsTZ4{HsLJC={A@N?Tdk@Q0fuLqmu`6NvcL4Q
z8FIs)`7#m9b5zn;wEecgo6@TW=rX#J@{CWM-Cj$n_wLJYiZLsWc<8+(x34l?7`9%Q
zXX=!c<WsJ6(kgMTBb)1Ax2({{;0)^;PU4p_w@hoVlUmy*g>N4=KEEPJeIH((@;NX<
zC8Isx*^)w=NKiCgKo$dDGbj|<Y&5X<1VY*$N1@*;Il38{w2so7DA|T-%!FDtOmVLF
zK$p%D$~?`@1+t}sao#&T#m5Vj<aN3)MjNMg`CiDHUCzxbq{$WzKqk&1S>qdNY#aHz
z4b7kc+_yL|F+s0OJEX|kci;DOmMALLO~paf!zKA~kMj2>m-B@)Wg;ynmq|^gC=aK(
zjB^?!@3}y}>!l;omJ_<WDQ>jjm31P%_X^iTP%j+1tZZ~NTbeS94cRCf!Vo!lFEX+W
z9L|3=QEBUGn|6}gER(UQ{{lU6%2{P&;nM2~P7cSuTj+rE?O&@*(hIQkS<11`l^89!
zOKrDu!phB}kI4G;nVJ=PgV)b*Q|WY|x@4&|x%Ivd_;R9tpv<_jMGFKzm);b}25H{6
zd!rvFIF8>Ag0HfuGCdlzJRpo@qJa9gE2p!}H5yEd!7o&R>N(E|ca@j!b9xIZyA2r5
zhAMAp0J&}O_DN&u+}>Qm>rEnE8ynW7K+80CGuv8v#iME8RO^HX7q?CirfjxpQa|y+
z`E^T-G7Am4J_zQUn#}Pf^tIZ3MhvNlF~V1qmIuKtpKSNjCKy}~j}!5f=OiTZs^Swp
z`BKFx_h2sVhr^{&k0o+-5=vYTeOxLcoWhH73nTM?NFL$BoT!C;3}2tMI6JkUd)uuK
ztXyUp>3r`{AO#Ms1Q%d~v5rxDy5>Rq-E$HlAB@Ph7f83XlLx&lhQsHN7Jn$}uY(_?
zEoNM`j;x<N{Q7kH)F(H&Hdvt38)2uodk#CC0j^6{T7p4bIZYRtCOme>Rrn(ZPLtw%
z*7>}rguDiA+UyO6W5yB3L*BD(@gYYGIafjudt^Ef<UDFgzrkquYTA=;pS7xH(yLS1
z`|;IWs?;C8D}qxJII?Nu4NU`qYA17DN<0UL&V0{{_@wZKzNVeXrG?Yrse3|{XeULP
zbDOZ!MOxEzi=rL0MOuOHxHh$0-t8<j9?>KMGaWSH@?G3v;S265i%Gs`SP=<&Tp!NA
znCn`wGCdd9IOUA~GUNT2{bVhYebMaBO*TcJurkrqzUtWu!5!MZmp!DeUw8*F4yN<_
z1RqQ}<6Mm(rj%qpR0-R04PBK&UmLEGgj<wh<;<6`*Hv-uk5`Y17ou|;ogUgwvz+eP
zjSsiR3yvQnXE?$WP^*m<tnF@2;tS$(#36(r+PX;f<kY-F-zog*uRh0$Df4l*(K`Ir
z(1;R<>5fv4N}0$DSv)YQf%v|GaI<Ca!ey2Kc@Ffx!+2{qyu9Am0J!R8fqJst;hKuI
zMJ5pSxw}Ota>mb7#PcfFU~uKKNLvYTcI6YvC5R~39xd4uJ4L*682(IWb?XP^APlI7
zgTbOfs8?2}xRG!TBNpFgNC{Mo36VdUXfvcSfH*GmHV_|2O=Y<E>xndbsm#<PNVGy{
z?Zpu`iwkX}J3EaA(!=}reg&I|hk(M=rW*@u->hhu7vT@t;Fd~AX!@$poHyCw-4%4r
zQ4vcKaG&EFZoJ(hgVy@2XO)BcEuqI<3pdBpkCPjR>_5J6odqI~7MeXjZA)at<@J*J
zJr9s=^R_|SQuL!zm{s$0Cv;q6%p4LryM%rK?hWowT9}1#R9cpQzw@ryxcQd0!}<c%
zf_rMOQMur@FN?m82{O}+iM1Km4Zq&;eWVOpigjzRoRB=aaB#KCO6v<wW?N_4xbvj1
z3k4}$&Z=5Tbf~pTuQRfEvH=UJN{4P#msgA{McE^h-e{1b3L`T0^?GH4uI!KzsfgEN
zqm%teL>H>dJUq|HZ(uR9**mS+Ifs~P?p#=NI)o7+T~~>DWN-C~w;*2WKF#{hm8Q;X
zZWRvH_*9Q*yMu|-DD6GLVOLSG;Qm4K5)Q|nV{=qI?PMk`9{6bfQ;K!S`jO^>>)!1U
ziLE+HiJywV%snmOdokR3lb_mhdcEC$S9I>|dCAFqwMYF{^@&#}ws49Kf6vCVUkJcI
z=QhDRCt_EQS(y&h+iGqyGgR%GxkHMPBM16z7nTYXMcmiKuaK8FzP>2S@fqn~jx4;Z
z5NaGghK9eUL_GI>d4?~HlC7!moE~mh<=DnC5b)hJdp?45lHnwzUd6L0k7TQ?cwu6R
z16I3stEVkW54O|mNj+p9xAs1GKPMA6igU>ogXWwG4cZeX7Wc8aoKWn3F}iTgVDY5I
zKu3PKcLeL8VwstkH>cX;X;-7Tt-Pv@?HkQ1Pqphc>!}fN<|~s*Y$_uo9mKTg=SdN#
z>n7ES>!x8*ogwyFM^`^fhGKbMgk^bqP*Nb?rHEE74YgPZHpl2{+w){=?tLw(Q$H}G
z@#UoD9-SMaAjQK8nqf|}RedhND0u03Vq1T|&LdK1QTxa%YeC#z^z$~XX)9#cCOrkB
zAuf;d5c%fish?qKY6u#~U&<&;O)1@IYppNT8$E?Lw&Y0-H4h*HLJo_X{v6kZa)G!W
zGO?~VbgPG!WThbHgt7hkN_s*y+c*LGZ7M0_vpV0c)NEhOllRTolH3N9PiDX8lDKsi
z*3``BbcggCqZK%B8hg)NZDte_!k7Io3RxG9H5Oa9+W1uRLj_=B-6wjDZ2}qk7B`D{
z>-zvfquw_76@Pt0i_G^s^kkU2lYmWU;4@aPESmNy=ZvUOt5Y(LEqfG=15El!RP~_6
zd2POq+5!<`l)b%M5o<*y8$e>ZC$bKYE!x0Kmy-ENf{>o`sMqa<q*Ds)-fx3CowN;(
ziczn5sJ$Jp=N8^pNjVu?ofjDv)<A{t2azD$V;o7+o!|M!wyslKF7PE6NVOJ#M!eAB
z5a-RS1{eFLbkyl$_Nyw2(v4z_k&~8YZ%+5S8LS}RKXC6zBOtRhB4_`$+w}aNSUhC8
z?VPk9Bx()o5v*yJ`MaGRWi`)qucP1IFuL3mxfG;!fMzs3Di<@lbX?)FAd1LS?g<>^
z6ZGrzo}x_Yn_ti?Bwl$#f!-(MG{aaC-`%lB+hcvqE6lewu(|F7zY%h%a#)NKD^h#t
zR(&}5S*EKmZPnEqDPfgSMmn&J*40rALTin20MEbUv*{ibN-@+2mB5jTh}T4Ul;jIv
zQBsegD{~DsLpq@eC_wbnI<fw8!^f|{=L3AaWfFI`iqrB-n2@)&Ef3`I4yXHEPF|Pe
zgtUT^hn~ZZ`u8G*sy}>f7Q8QLGatc1ImT^N&@bKOfk%DaR!CMmKiqZKIgi|)qCEfX
znGT|$#KUPa<CKS$DLe-%sbk_aNlPjKnJx5<)S1#7hmN$(!wiAOVg7wCc>a(W^|p9x
zno3&j{NA(_q5x+jAKvJ<&yI(n@b2(%J2k4X&Vx2CmCSxe{4)o+f$jq&6?rPvPrxGg
z-UZ-tWP@5L%Bs@9w>ohl=ntt*TzPQ=xckrRn?9gFK2|YfqMnwJNE#rt$}oBtdD?$h
zXuDa7ck~RCRBeW!OSgn=DKi#?E!p^Cn<25x9wm1|C)sPdR~|Hg)h{-qxc4BE99+V_
zvTSoQDh5jP{#>|17SpCUixpg0OUv%%To;o@9~X+}>?cYM_OHC!I`3r)-SoE=jkCvP
zf*x3v_HJc@I5wOS$7BiL8o6bXEd4qpG&>Scu_nGdJ$aCeogDVPNga{Gn&*-r_BPk*
zqPS!uw!}4=BV+LR=|#O(PLTID9d@24b&(D2CZu!ia&)43{78N;k{;IaoRu)U@XHei
z`l9CvKIXJnkYd35Zm2?ml>m7?vJo7E8eb6;-cp$(|1q>bmq>Nm8_>HwV?P>E;~fb-
zHrgBzUo->l7#-nN+b0jj3=&#<hNY>DPr);w09K{-#~!k|NUw6(XJ=jX5c9T8yT{Y?
z`N77*f>&o3l211zHSky3H<AV{goT+grx5fMFDX^2y_m`FPRt;~BlL%OByS0h%lXPa
zkBn-vglr<_WVv_88U1!b@oE$^XfcCLd3$rOsqLQ%r*2GYJ>mL5`W85{H5Z(b19By%
zu1*`U8#j~*q2bHJ2{S_y#;>X$IY%|Bw7#ikuGoB$F@*0)X)29<p1oI};L7mkLbAzn
zS7qwZcJ{|)|GO|&H|)7G)_NG*Zusfec~fhh(|~}r=N|R<lgw@*c++a6n|OvEu465O
zopR>Ki%}t?@}4l=guG4~x!~whO$=5Ba^>Rgeu2JOEZmu?7v<XpC9cI~8b46(H&w-9
z5`%gc-u>Wib7~I@$Ys;=`IY77!ZIHMAv=0$JJT50raW`pH|Wd^$s5|oNpXy$cHZ0w
z4n>Wxi8XGj%nAQZAqJ-f{k^9%MvKZh2=^jJ%0(QX#$HjlY#Ovh>QhSa(dr<CX@3iT
zrn!K_;ky)g)$rQBI^7Gg_?@7<vo{qHzmK7i;1h~k=-z!s`N!Hw!zOq)#=;ry_F&m;
znyZ`MbO5|VV;`sjpSl!LC3t$#7uj^FLCFanEvSMyD^WV0)1p4##Mi>?6v}`93E?#Z
zUs5ynclDN-3rct57k*viE>~ac7uEe0)0v^9Dwp*oQIM{=Ek`H!!tKJaTf?4QAGEhw
zu%9M<LaZByD|?!<`astF##mlt4A=H+eMw4kf*qpkO|({j8Zy(=70HSZoI99oa#>%t
zlM|0~wV!3$Qlvf(NXJWLFR@Lvy9jV@&QQ68KvP?L;XQ&{wk*iQYIAa4b2~F%wdf+-
zGb5m1@XFO!pQ<L?OsGg;!bni5JYkk;o3d5L60*ajHkh%kycYR-QaQ%PtJ8HQrJ^k0
z>eH0kgquY<&cYIHctcA1>gLsRdGNH0DYFCnVo0M;8uq!FC-q2RfwLK@p?Juv_&q>j
z<jmsvgU&fTlC7D1=5wg=6S3Oe$U6;XN=rSfO(2HQim7UG+kyqJmVhC?CeryuSZ#*x
zPzFCc_z17k-g-C&0HN$YdZ3DG+~Xn;N7}-IPOH0vn!tW7^yuZ)+@N`p>wyuM+k%XQ
zK<ftCAE-wHKs{q2x|#Uh=)s`9Bq9^jesE!UfxZUu2l)rr(b&OUSe&*S2<wu(uJX^}
z+)@=izSIfy?>+gh2+V^=niA)Td1Kf5FySsjPfNEf6@$MKY~z2<s2Y7VSDsWQln-)E
z>`%LEcG^N3+Uhx3|Jnp(fCD!$jugqI8~FC}TZ4Sm8*a*I*VpPj+YP~2w25hP=h%X)
zI91N{TTb|b=Jham@zR=or`9A>ZZ(?IX!{9PAVP1|R-&20;mFnSTS0nUVU0nkk;Mhv
zhu}rBm)(>R0(*Co_gdpvkL(-7^}~gVlGhWC7`Z*jL}A|Ly@?CYB8&h5_waYT)rAMX
zg%NCQsj51=6JYK|ndbzyP+d71_U5=<{w80;*N%P@_4ZyeSP0or4r&;rxTbk1U20LQ
zshv}Aq_=<u-Z;8_<szbjCS7vXkoc}GyeRN0G4a#VqZgEOExo*g+Sfnboo}M=3n1JZ
zFHB?<bhQ-JA66Rm?&6Di`xyw=gNIwa9MpKyPN2@nS)q%TdT@yud&B8gU42c&FGr`U
z^F}hZ=@r$Il)pDJ)LV{X(#|0VE}Zgo5yyxNBj?kqb4V0Wz@JO$cXz+8%s@7t%0b<q
z@}#^%+9U=DHf0PQRDI&>li71dlLD{Kl@){88m%i?#B>XIwZamR#u>#lKTuLQxeB^#
zJm0^}Kqh9%ViS&ELyzdrSmM@XF}S}R;P}#|`G5~~eFN&i*~aW3(GVZ6-QF!%?_HFM
zeHL&1fjZKr9N$_(U(B_M!Z+NtIYouDL@qY&>xG`p-g>`+N}jy(u5<a|B0SyxdNlRm
z3(BRLgljd<ZM>T9mXCVpN7}{wstV#P1_o~#rz2lWF-6W{-uChXnI|}scK3<5i_<9B
zm_+!He9b(AgSvs3yaf|rSpcIoHG^gc_-s25E=Ma!v4l%EA#|QT0`avtUQ?&S6DK|^
zw<>m>yS$W1G3?Gkf~`<D55Ho0N;@#;=TF9?SQM$Pk+!Bp->jE<CfY#jlX}-P={2wm
zaic)5tWd9(KHdR4(0uDUq{^P+o5ogk)v1@Kn}l-uO7ZRNf$MdbaV9A?{?vuC4SSi1
zRSEvn+yhUEC=Z8$rRjp*AYs~HoFZ@wz%Ae|gk-qOqh-GjBH*jfu@X*B3Aj(+H|1X4
z+~>$3G?~<;|Bz)Gk&p$`P`g%i$(MkydEA928k7uQ>HBJ3sZFACs_j^)_LHBm>-z+9
zon5amm1r!?$~R$$6cI-up!yCmOEx)sJr~ao@8A2j79n5k|Kh1rBAb71tk%at#`>aF
zyN2$Wz=;BS2U?yah`~v2Q`*5;GbnqRai1s!g9Toaau`WAlx{|gHM`m?;C(by#UL2c
zNCSRZUZbKPv6vi)-Y=uMW?qnGabGnujl+mkFJj!Ds#~@;Wq5gp#)6d>(>wk|6@!mB
zzj6$`p}4m3+4U0SX@h1wyA}YVD-e7hs^R9a>a1C3=cHqxZFBK}<!1f4ZJIdy9XxhC
zr^+M+o!w~zHpn+~3M@*cDKoVETK$NnM-zs!A?}8jZhm}~ue~FxQC<1q?yYnDOA)j2
zxz$9H;Vk9-P|qA@(Q~q4Tm-@*)Z;LnXFRmR)Fxw5_Vg#`5(5sjTY5xXzMa2+V7>G+
z(BV%+nwNW&LBsobPmY<N1g*L5CylWcUV5FIOYEhu&BUKiWn}u13`I;iw=e0_SFd@B
zBb*m=4zy$KdFJuTe43hJmgK)wn^^=v5T!Mt{RVWk%(n+bjiSg?hPl=#zUkf_%dq@w
zAulF}?Y-)Va_2nE?}uW+RbnyT$I`Me1wptE_7K(USAHHEEZM6&T>RCucg1&YF-~d9
z_nx=LYRzC)>X<Y1M`TuoOvq_3FKWU=SxpZPvUmnnJV=juv}Y=Dmx@8-m|$@6_#I)2
zV%R~_6?2~WS4!w5hjVq@2(PLSa$T%LPK6D~?(0lg#L7Coi&2N_IE=@E61G*QmT;|N
zboyFoqn)&=@ekRVV>hY_5-e0~3+c2sp8SwIIJoMK9GzKB(iW{{lDHBM9`(ZWCsp@D
zbzLSSy7P{uS{m_kp0#+?vH4qggy+LIGs|&s_wWZ+Xtyi!5xqa`F1BAqm2!|Pak&3r
zF4tga;z*Y=TqIQ{?YWmuS+=J_dbFzBv>h4hu{D=yaKdCWemrB;+i>dDl8kr?-a80H
zbbaS9FM+^@{RTaXYt0u2ln!Z?aF@pQ&nC7s;3lXkTK>$cYgebnpXt(Pp#;Oyjjq9F
zfH}rGvGOq){pC5|ypaMZO{!O8npo)4Ny4dn0WKr^fqcU8_-cI-o1QN{Xf$-wO}=Eg
zpLD=fgi;h+kdyta#8m+ORLoo9Zbr^AXMaX(y4UcW8qG&s2UF9E5}IaOUO0Y0k+LZ;
zxSeq>kCA$J>3J*>1D;H^RmCoML~p{ba`a4pZ1>l;qagb!rMnEuBGs3(KO(2PNuBwX
z;VZ<{FDxV`naHt7kIu%6dmc-ZP!|um@Wz_bws;Vz67Faa9~a3#_YUh)ee9V|RdsF|
z<s*lKXQvatAx9G!d0U~x)jC{tW?sgb{W~;Q&|FC4Nde%V3F$=0Vol##S4QAnHK}e~
z6|Q+*1P<&)>SYKl`mk~MLq0)Sa2Cynv+(wDLM5OgUnY+VdZe2hKq-S7BU>Ej8i6@K
zMu7OG<fk5Jdth4**Mo~2m3n1yBF>`D)nNR?GfnRq+o!}PjkxU>$Du!p=DK8h5v3qj
zwhzemG^+9qn)dp48<hhm-kCqMr;(b5=3^@tUPr<|$YoN%3%X><r^u3wTy+WV$<@s(
zG=-isjpZz9UaRG8an**`HoWJom9U~n6Y%yUvUqyicRidJ9B)x`W(<xm*s5^auv_(|
z*-MmeAHXD;#AcSaUXAZA1Axg?9$_kOT(HRf=K|X{<^tPvUec}p$$KZB?70zBAfLqZ
zAZ<O?yD~P8aTEn2G#S2Y69ox2vG;jT+D1xyRGUR6)`avCqxKT5H@bwDGc(1EtaOe+
z6tuZlNvFv#V*RCuA8Ob0rFDyMu&&jVxax7<$HJ`vJd>YcMKg$MgsS2F2h<~9-}v^(
zQ_)g0nx?+IOW`TFCfY`4h7?x1_O4T}yS-2|h<Y%l8bAp>ZQ*@teh-uDhEHd|@Grus
zVMc}G>5HkV2gw`m3%OTBnK4yjWiL^u>6s3fj=P2vM#GExWKA=>&Kr_PdpoVhG==&Z
zQl(O5e<VVx43c#6aRlukIe&T|)3M9%JGYS?xci^><mnS{nyo8szbjOH;1+XCTq?0N
z0M)z*8JO+oj}Kglsm!+}Nf|x?1*PXEf;ak!ioVl_2Y6bCg-PK*{y0BOLirMFPanCq
z4SmjG$GNyVK+E42L34|hsIyc$7?VjkqPO70%DLQZ?u^SGI!7qj99-+<kW;_S>$}&M
z8c_|Yf4r`NF*GlO7HmZDL5U^ZpuGk}p@SJ}<>QISPiiGGRgYCGnkrbkJh;2&lRD?a
z7O7&ES8tHF>N=^s5EOmO-&}!q?TT9VeZ-f6Xrc?>B>cCKiU_>xCSw4X<?VJIXdy!C
zW?saZePTTtaWpFU@DbqUMH)Cobn$yV?137~+>pkb?J^JtV-Y|fj?;pB04lex;>4?^
z>2Gev<RoXCe|V)yPRVn@qqzB%L2E(zVbNT9T`!^><QOzL;V0S%9=`N+h)V0-gF2t@
z``SU(I+1uwIQiuxwJNeSe4)QQjjBF?(Pm9kUt^;q6(1BsOW4Q_%mppAJVyp_`WW{J
z?k|p*v81em68V+N{ql)VeZzOZPn<T^X|u@%xrW)(BRVG@DZQ$D+i5Ps%(<X3qax*z
z-R~>}oQP|kx3K6P0li+4*CBpq?Njua#gv;xZY2IegKbN!JHESU!kkoWp_5qKJ4wzh
zem(DK-GQ%>>Vi0KGxNRW_c)-jaL3uZdB<d-NJVrD#wvT_w}i)Zz6-_ujITxu4jpY+
zI<%I<g!AQw7tO9`L8%Mf{vY!gDh={d0WH9T#@f(G;hW3lIHk~6UV;er>3P~&bJ(`C
zTu<Yw1nalYZeh?O!kRAekon<MNT{r*eM1Y#@LSBl)r&c|mQ#a>zMx7$1JdEsrnag5
zg9sPS32GIGh<f)y=URJplReLLK<4#7gf|UN%Rmbk^)aJ0761v;oF3Ee)o`XSb&w1>
zGg57T4n?4zI6UPD{zKf1l62T`m>9<0q^B4D#kjMfost;d&zAD(h@*xSX2L*UUzuiu
z`?QMviZe*n%-;kQvD&f;`8o;OoU$C&u}Ps;pUrFbT=%n*_sit>uZ}fT+B082+Fw-~
z2#426ZFu*hdtSnjrNq523Tp{Di#d4F>{hdQMx@{hE12%MOs#Jfp1huMPcpqdJH%<q
zwJ>dH%o}%{B}<mEq`}GcnvPV>G?O*za9#kr`*SIk99V;>(Pl2AtVdVmw(L=nZk=y<
z7`VQl=dAGL2e)^Wr8~Y|exHr^icJ<xi*`v^S~{LLN08iLjfzcuf6aO^b#uW}H`zwL
zpFBDhP`-T+nW~z+%qo+(s<=HMS&S&eC}(R9iF`?5383(1C=1qOEKfY)O{*iuh?Du(
zu72k@To(@cB;}+4m+mbP&5IIXB>hR~mc#Tn#1|{~f<$1#Un>C`-QZKoPNHZUQwri3
z&nNYp#nQP6FEgb@itA3~)}$9s>s&b0`Fed}&8su9url&;cKP`qNu=-3Br?(?la%^)
zSOO<TC(V6Q=SrlmFbyYrQPC$wfZ@J*Oo%oEp7U#J?u#239u?Ta#@F0JktWSP#ppe!
zgwN2Wb!v&ALPhFNFpIoy>)En%#hXR%Nv)FxDlWfmdXpi{tc%aVV-*WQ*)-6EdpWUI
zm=GYOOAl0b13Fv2k;_Ty>3a2Bm5b|KJXVl?Vqop!3(~4cdGK)OBP<kM74s%Lm#TOO
zV!)Nb!*>3{#3`xjbCSwn4)(S_rF__g-rSSSaA2jlboP0RT$*Hg;)ZSaBhfz0d;%NY
zcvV9qKh+{A+k?bGC(Fqb*K2t`>Qr^bSBs`M{9IeJ?wP~2T_~L#fMGu+C`UThMa;Ky
z2sMI4q-~}f0#RM<RoHu1#L_BW<!ni$68pjw7zEnwr%hgI)`i(=>zl$8ZI9AwU$<-o
zH>1Ycf~KxcKAZU&DCz)7e<o-seb=>3VE^DaKEjQ2I(*}!Y@^qpbA>(6O$T0;vc>V{
zBS+p6A9y62g`kKUn-Act!afap?#;C{`*4zx)gCxD`&#1ufmdw+IMhUvfB6Xe7QZFz
z(k3+BJw?k-5X8<wL=%m~H%AdU%WgBEtGA~b0LSXjlccE^Y-cEQ*YfFt26mL1Z8j~u
zj-Voe0nK|O(F$mBu5Q<aKCE*kHF*{S@)md^t0G@d9^IeL5*PtbP}I+R3t;J6kw4XZ
z@bRRrSbV=R+IR1MtqrzhpYqIuo&@Y~su|7TmK_`M5dG#g9<v}Dg@H2INuK~m{)j$)
zjTM(NX?;uylCLfXhxjfP4$+Z2!sP-zZ4i?LBTjc-st2hMFvbY?>4Sfkk&sPlOpdJ_
z=Zz*Gh~HTSs>tifHMA;CC9Vda9=h4p7|BKeb-@MNy|+{~6WdqM%Rs5(O#200biK?%
zLU*24`rxmhLi*um2hKWP<;I?5jllXzWJM@ZAsbf?uUvjsp<u77fI<lA<sCyk&>a5~
z;LR@TBD^`trW9Zn@u9Uk0xCs_Hm&QymFwQN6ogaRdf$rId0Q*frj{R-NVEQ!xTnL4
zwRnl^Ip4nh63*#<<BmQ1*q`8$_8Up!sV_4)VF}h6yw%(()HU^LYt+tXbivD@M1&_v
zpzVgHTtI@)B-6p*jBHcseVb~RLqCGsLx%zrc7m=aD%{ECTUZ3tW>>a%g?f_SoNJy|
zyR{QbCwS=c;Z@-UKrUaEmFERhVrpn&hEEUN8ZIo}kQ_5Qo@d)LaiaA!-=Yicid4y?
zJlL?`ANfZ6GHCAgX%U~Z_UpE8+V6G+RXL9F;H%q5R`3-&W8xMGtl<-ERP>n3DEz7J
z4K;P;XA8B0`;>oELFuYVnJHAc&EAf?Kf-x3BDC%JQ}|Rlj(8hrR=vIjRF!}L>(sm%
zSw(buH8t&L&9y4mc8?A@ps1Xt@7F7xEH{pxU%80=UFHU##1np&{zy6E?KE3^6_U3)
zTaAVD_weD%KS8OLpbCIT-Im9#)q$jdQ*PG(dafuR?69a`c%xzc8h51KBQn1eAddwk
z_(?HB9{uVmqB1nj6u5DEebj!v;kJ5xiSQ#AJs#j}KLcH#K*5*Sms<rH>epAujSPL<
z)$;bMXj;FE%8Kyz>#Jrhl#<HTN(gOodcVhQD(wz71t;!=3Eu?Lj>Gvf`mZmsIw$`q
z%m0U0z%jahSI7cVvEC0a&-R-4onXKamex@F?FhfC{r2m+L*&sg=<?_q*hqeMjhb_4
z&%3(prS&758}5nycrR~~?==tlCBd|~cz&R&W_>b{m(s$rNdMqt|KqCy7NG2GHALC!
zJBZGT>g$rZIjy+%Dt+)06xBTQgP)Dt^_Nfo<u-ox;ryd`?f>X!o%EIq$9qYA|K1Y+
zyO=A8Nml5*<-wC4JI>F@|M=s7`o{z@P)uPY3wbo+<v;pVA__MTG5!qekMj6`5}Y&e
zxiu<_IPO*>wEJ%l55<T+9JVYnbbS5qA2k6uY9~dXvT#Wv{}n|Ec9|qz*(&#$fpof9
z#_T^87JeDYpIgv=LXYL=z#^6X$QRi003*2CVrE}!S?=QUu_jD-_3mr-|1LMQ7=SML
zg!4Z<__s%xfQ(7#W$wNI^?7u)7dQVT;r~1Of0>r@t=rEWKR<u;zdnB}y8`n+sN~<w
zBo(lZ?{A}I{@3SkKYNM$+rj>6kV5x>#=bj`!vELj3Eq9C_|<apUk3CV=*aj$Bt!A!
z|JwV%&G7GEL`M+B|1U!Q(>VX{_?Djmro$A*7w`+h{{E8yytVlshauVV9xy9qGOPdI
z%lLOm{ERd=(52B+itb_to_RG16HHc?!A;#MldR4Cmo!DPs+~lP{Zh|HZ=?GVEVpfS
zJs!dOoeeH)V%&ZvJelOBbUAd3YP0h}-~iSP<YlGT$AJ>9;<d@iJTVt1?p>bVCVSFg
zExY(Z8;(SVySG2AH}@(xhYV=m(5NtCheimNeVgVK1-obwP3|wHv~a@_sahu-i5df5
z`8Ab5Tcu3rTaMY1ZQ(!l1^$(0e*l*KlKNQNm={-&fEVpS5uU?_)2Q@R_=3*Nx@p~E
z?U7{cBg6XolFUq#-sFrPW&NZjS7N@&29?xzl1sM&6d#iwU5wYOsR$yz7Z=GuH|T#m
z_c*|*9Lh7bEp_1uJR10}a(D^uixcV9MW!CqDmsyp_szZRbpmGI+vT))!6H(WS)^Z;
zA_T_fn^vT|eGD(O)!yZh&U;fvpB7T=Dm8nDm9k&ft+aOQ&c?&vSxC7OkZ(c-V6C*}
z^$%ved7U6@tYl`72NHt9_{#gvb<GX2vcFcA&7p##wwA3#>^ABb65K>;i*nns2;T*W
z2PkTspkFp^y;9d^@mP<PIoGJ~hV%uGp+{=`&X4-L0xqfM2xeP=zD=}~fboPmC#Yoy
zQ3Y*-B4ZhR9kg{4>;+IEydG0!^;DwNwvHyfO?&>qI-W^=BK*DQ-l*$q4@SqwBXS~Y
z*#-CmVG_q`#t&^Ek)Wkk=MmxiE<`f3ii{YX#CT;-iGH(~0Ku38K=uWB>%D35`F`(|
z{UOVPXgtZ=_~e{g#sS<E(srjy4xYRmA_0=}l5v|aJ*pT9-rWkg5qs%dboitZIV<jc
zSN@`~qi(G>MZgN<KdkS+TUUn>uwJ~_B6c*5nN%W!nTczo&J48iEm~p|g0f<}wsTTG
zF{ec&^?*w{wyjy;%C}C<Sj<OtyguFGyV337hM=qWeFl3@LTeCI$7S*RNkIV9Ez0Sx
zT)1PqhdZOXBS08ZE!sy4p6-W@E5plmPA%vH{jbtuf6OS>W`HHWDhJ(B)adnWufI(*
zt;h>i-9YYofP)2KOVWn5t@hoH`M!$mQnV8?duH}KS&?>>3#G9YX8HyB)ZDfE<a{is
z+^K_y%};fl*7~a^y|siWW(6Rkkn6WL1&conJO$H^0=y<@RVG{9+(G9H)>j5I;s(LP
z^cpj~wRk693r=Iv0x=uwYk^lScDz`2Lt4YgxyG}X%%LjkBwf?%tf_yHBY$PcsvLle
zW6LE)Z*~A5UXlTwB3Vj^9;dX(XHmO4DdD5WH<A72u#t7P`F8^Rx$>0;n)askjdi~E
zWUo!Od$)`E5*hIr8*U3Yg@b)5Z&uEiyYd&_tRupBoFuT@YF}8TLhAWC$_%>5$)F=G
zuUqH1<Jop`ifi){lIKg~)^c_wN2{|s5mmodLmvW}j9f>UjMTS@={zhl79$O&u%1H(
zk+|r1p{J%+BpKa83kMn^9%6UDXZd~HQ3CX5mE9vegy9Ot&BEVbe5XbAVSDgLX_nY<
zg2PM3=<j<HizFCS6Xe<Tx(1UGq#ddd#Wb7b$V)1_FC+rB(UEvOr0!2J?E;u*BWprQ
zT0HIwR+S_p0z#c;Z2MIx{9Y8kdazYK*~_f2Jc%)P*|z8Hqy2<AuT$5TAiTSY6Sr<_
zYR>3Wvu{l^ExY$+N8w%uTa?+F`-G1pd>Q!)<Te|{YNJ?Tu7#Pc!V8B+$UwjU*16sA
zSO2-p=)?)8-*Z3c*Pr8x&6k?)uj4ui@kvS9S`i2s@T!fDlQvJ-y)atSWkw}`^=waQ
zy}ESDr2D`HlW%&fu6dPHEcW3tH7SB`5N28`Y^ss`!lB8bTV;qhwXZ;$k+{1lTxuv`
zK}64RrW7@4abyi2YF-rCETeUekVcsJrL#p9thv)<u-?1@AN)8t%4*3JmYPi;8BW^!
ze?#oQSlPnQeuPraQrhRnXX}Pn@^j^`l-b2$U7<8C2L`b5<7O<RCHB?V8e}xC<mNYN
zvzzX60ZdM7#usqkD2JY6X|)^u>OC`8<blkOeMBisx`J_!g!Edzs)vwqGKfabC8z9l
z%`o-#X3xu4(-RsFCA38tIr%8BvPbZmF^YV2Tf^RJp~c;o4H=GG*%7|Ws;|%%pv$=V
zxOQ2|lLR&+(I2CvRny;BDGuyxAjXtdi|!=}hy4zo_$vc3b}KfaCz6%RQ{OPX6Njvb
z$UT~TWN%CDe(zUr^4Vj7K>T}QJV2tZs6fwalq`_Zb(cEHJ~AQrM(kN)`22A7BX(>{
z;q6a?O=s)A=}Eos=eIt-ENOgGFq^U`mE_ZJo}jj-We-o-+;VCggMXdaxbbCMNJ?^g
zrDY&N3VLbj2|C?vBxIQlFBoN?KFeL`D!moScwck;yY6Dc&D3|l1vVdv0I(!Is_$P4
z9{#dtV^O?o;<&w9CUZ(8<<(q{oRyHa!?SP;4!cE?RwH5h5Zb88Xwo=T@Pye)Ev|v=
zS>Eg8YyP;G+*ma)-0B6flI5jJSNm59;;$_yAq5PcO^KXcA{1>=-a`-OU{!ipryQxD
z%21;hzB^E72J{;0VYCdKlp=$-XihN@T{^=O(fF9(MLD!v)`0b>6NPm(6Oer<s)|UI
z_aru0tZ`%m?(Q>vM&75-?)CgKDoLPfu1>d|v}|Zvv9*IpqvL%E+lv}r-4L^9(T7h_
z4YukcbD`2Ut>RyZV{6iu2J&Shy|}^r=L1=F=o=>nmDG@3m?koNfQ##~j!cQGN$S5C
z@V`ZhWpyA9B_!8OzA(0xpL=O|YWgTc2dSWPxb=hru|KaeFK!@jRfW$fX==z;+kYo&
z_shrWeArc_S<;cF?hAX`(lW2vBgkC`A{+4eOa3*gSi<SPE<1H)8_{;vCocJl%G(wP
zfl6^5P46O-rm)Y^|0rPp6%Nfz2QcSJi%=7r|3Ph*ZTPHEOZm_}pcj}KDMYM6{=Q7a
zVP<bH#k*4MxFW=ERpPP3J+NR(l4(*2(s`Q0)w4FMh1!ghD+-eOzB@LJ;aoTLF*_`8
z^_5zkejlk<|LN|;2K@PABmYE#Z;ioxt4~=C6=}gA>HA-;{nSsukeEav8&e0B-Y-_O
z(Vl7RI3X+8Xm-q5NoVM=A;&;|+Jv9R6-Ug9mp(Jkl(D=&xkD~cr8HwIkYB^wO7VPr
zC~@79fp%cZa9qJ`2xwOdzVYcpkBV<w#70{Dt^%m)$cJ(GzAWNhV^Y?)^a1oQHA~&2
zMvrt`o`JwL%O_bHHz@wtwDK3=)RP^k)RY%&Kp;Rxh}XU!Wk$+DOHUb5m9%X}>QeH4
zelQrTlQ*7Ny^}Z4N+c!}3LP60#M&yol-8ylUo4pNLq%cACa;fz-I6@Q=CsgM^Z9iV
zP22s!gyJXq!nH_|bhp_$&daYuXDjJ!A$J;z+p~pl{ubRV$Nt3bYcrzFZ6!*`gdnoR
z?02>sPTZ>gOtbaE6<w$a6dGvP{xM4~V-Jo@(T<G@<Lfh-MYHDU1BpDkWSQdlBeLNl
zg^veV+zdBasd|OK>GUr85~!_vM4h`48&5cbC`zUG=?8o#^@H=(pDpHSRkLEZSc?%T
zKl>}Q`t_cBIDj-;dUW@X5&<~Lferk0J?Y!S$5`^ggs1s3GNFCBzU1-!+|5G9kD)Qe
zuCcq>hndAPo)@TSy22r^(*7`S*4rICMkuOvc;cdnHTXO#ZIdINP0GX1<n9sNJIMLB
zV!7cD1&V6@@Z|k*vQpBpD!-xxhF3Ko6E3p?Ri6$Ws2dfl>$zX*8zH9rS_~2}`xK}8
zPn8^+_w!9k12XkopBSPvCMm`^97&EKiVi+a=VOsOgxkxFJgGj#2m`yuPr}r{{rP3c
z&#XdZ<MNhFY1K2aeY5tZfhPKUy_N^xX{-Ix`+mI3p%_Zn0)6Y`je$(JF9;%?zDUG_
z^~{X9^i)hsecPxIbufF;b*v{vNY=rAqQnLx=aYb2L#AyJn`wGNK3lTp{LOx4w}vPC
zJA~`q?w3CJt?y~!@%NwovUELseU$;)`FX{s8PyeM`^ER`3n<v{<Qh?s;VXZM+Q{&;
z?>+_I>5Bwiy_oI+_5v>yU*<Di|LDS3Qdtwb<%HfGqR^P=Fb>N2WOi+xE%t&KAXW6<
zY<#d$o0a;d`+r+F{t`GB03Fu4xmfv%tPQo-Jbwn9!sv#)LhWB>Tmz(8srS{zk;?T2
zu+JHEb$xX@=TPK#eb7tWb6U;KVEW98A2&7ZO<u>|6Z`5X%-a)vCpL2YueQFtyiI4!
z+2P#1_~Fs-;{hH}ZtCwWY#f=vw$0}uGwAOc68k*pLKhg?XzG;pE{x>RUnsWPkmT-N
ze{FOz9lZlbo?nIUzlw_;2LMtOP8ZjaVDm5i#;MuSM|bU0%Y*OYBp9=zOU?x}=e=eF
z23E@SUo=DY6i5T5n4NKN@u0_?7{!}Py)>lz+4YdlhR1D%{aYi;tOWdJ_?FN;e@1k`
zg%P|RdlunLAes66%?7s3@4ZGQu#GtT*n(rTuLwIVp$e?h?*;n%p0La6Z-u?i#k@-G
z_k>b!499ipIy3w(f4+fM@RQ|Q%dOO5TehP>`7>fH4f8&@TAeJz!;FyR1tu~$FNE{k
zi7XcaUqKa@5&HZ1@GE9)JOZ?d{KoL;e<XS$Sb^u&kc~pW)#)!izm@=olR9j`L-_lN
z|MS29|M359!T(v^{~wXQdpU-H2Kimg1B8on<{}NeNjbPas>qz=Oev2@gstG_Y43a5
zaJnDzx4xqg>NKvhRMn?c+!C-7U%xM9&Q|}lmA~?lndLthBgA}D=i$dYLL-4vm<jk}
zeKhNPPdLi8i*#QYQX6+2zkrJOc(SEH4Y(A@2#5#WBGX*)6N+x+8@K9}Q9BqURf1_C
z30Gt|IlKHyow9P0y2lqCwWZFlugsI{yI*vY?X6AN=xj?sGw?+{8Wa_Gp;qTDLWTK`
zp!rYudcRpm{?MQG26!qWh78iunRMs29K=^NA(W%aey6Qppr9tMJndPlC8@|1MCFxq
zYSp;*dObCUQrhhNNp3rkgwt}FwvR5wL?Ci0M~@mW4!r#xc99hQJ09#YKU#J#rdUnB
z?X769uY^un9y}ay+{JN5|J@>8Rs=A#MJ(T{GTm28)w<54_9^+Y3E`psjj(c9c*m;V
zBM(s*L3tB}zaZ?)a6KsxQI`^k%PO+&0uMBnTR9U+@pMNr7v41NtKG&e5f53m`F!$w
zNlLp+?IZ>spUm>a;~!9HJ+VdH?;g~gikYLwmX^q)4Ap`oV2Vs{U;ZZON^Sr;by5C?
zv3<w=3A0W##|M+8&)fZ4T>UTNIdSCbN~9U#JLXwF?K_cTQ;=P+>BvVa<9!0nPe5VA
z^`u=h)!53T)yne<-P+g4R})ma0!KYp9*p^CEeB&bH}nR8!{LO*2*`#c<fuZcnplC8
z7w3mzca361kGz*Z{BmS}feEO9BqUbK+PM@PZ9nD|;QxYE7D#=*`$8aATK$<$BEbOl
zC$Z&Mp^gPekl`yDUgD>4^2gu5p`GU=ev*D0H%h)95_(R(kMpM24-cACPN#vLa|R^|
zMhExsuzekR=~$`b`;K+=h~-YOfzM;+-P$C^8LNq-Bja+7a&K2MiQi~976%~vvA4qC
zT*-O0YWNDHbrtMgs?1a7s6Cb^KQ^CmS)II7NGPrqCt#G;7ljElU=vx0&-yM<7m*gY
z%%pka!c<omC`}k+H7Jz!QN;nfd)b7tJ!3|!?nfrEAlrvF*{YtPJQspLJEwn1+5MqE
zw{+ShZ7oJ>pmJLmbx!W=Z&ayFL?#>(LODm24SZZ;?&l%wU49T_XzOUmcOJj|9_+Ac
zNPF)1!RPEy>Gr~w@Asa8?}X}}Kh{lKV;vC-E7<>*2mVPbZ{mOmuB}Kl(b%zWv_8tT
z3kwZ5J;?I3u@h>J*_49Gf$9&>avfqk&HONV$TpYc?qm#VqL6ty=r13QPgE}Mvj<>l
zCcQo8pYZVYT1?0qJabbUwky|nOf8}v4`1Nhqgmw<JRRw+!)<1(73!ZV+G0@L^}<x@
zmned?d@UP^Gia=`<p<x72(D9FP+kD7%oYiXB`hj!v|O|-beUZ(p7ta+hXlGt!v>&X
z3y$xH&7|)<7&jn3sVvMuZoD+*jjhl5aqU3MaPkh)X>Tw<GHkdz3+dg@o?EEnjyFq1
zDsVoijY4foYs8gRyBF=$rTnQY{!eoFr^NyXRb^LDc|NE>oiZ#%j)u3;&bl}}h9aL6
zSF+XKv;AQtJ&9|}VIjsi&-{~9WHsQ!Hnto~;#%&Rh@8~2;!<ky_u@`4P*k0`-yZHi
zfx~0T6Je4DaEgZSJ>-5;irt-9L9M>+u?F{9%w~Ej;mE@|!B0VxapxZM2j5XlJ_b>W
zvWs;C76_$mrs2&}<Vzxq4+g7`)&fe-5cT$i7eXwk7~Buzq6HQKv+^$?nS&dz#Uobp
zm$S%D#?Kz(pkCbnlKt7@;!W%KjTP0!r7uy;+eVgziDv1k*(Z$Ft2!jZRD!U2Lm?~)
z`->;pU%+$7(u`dj-tcra){))uFdjLqbV81he~RN5;Q7Ob)_zLp=}!q+-}Z4w^msbk
zk@+ctDI=t}-u2F9zX=q1ylC#NC2Dj-YLXjLW+icYbo}|Ft_(=~`kBuW+~aTDWHPvM
zfVb7-(;-gzzTFO~>1XEcm9ws=+3XjaiGSlJ6JYB4Nd66YHTF{$+@Zrj%g0kbRuxM1
zivrmxDCW(6s^t|7L3%W1>#l1vPE;$vXe+6G-P&R9LJ)S_5@UAnrmw1b9hXX^RFic3
zdt!8YZ22mi8jketUSuD)U3&V#K_EuBX&5}EX7%;yCk!qAyWjd1hoC40zt(UPP8M+M
zj-IYCn+~jAm$z5goVi+M^hhdc$*8}VOWnTajNWV#9x)Cs`<<gJH~d*%X+!tqzDgq_
z$|g2tehpnKwZ+l!n+7u=O`9%-7pNNl$$Z|w!;0#+H!V@xO1O!k_LdwV)Wa{FIQObJ
z6J;EdWqqW4GnA~d1Jvx<`g3nV@9-MlwK!yvw;_OZ{K0)<Xy3=saoMo*a4S00a;z9!
z<!DbT_oc<kQk-Iy{615$Qr@3mm>KDAmAkGnKvQ*Y+p^)R66t%IHOhQfjR$j>L03aY
zaQ~>&qtTax!Eodo9Hx+}mLqg#RgzAt54vqu#Ltz!R&5uS;58cf?E5D!{=n*N)T5?7
zXU6Q$IG%E48U)WaY%k*B`JFF~ZhS;0k;ICX3~A<Y6oWt$I66PZ_@kOB)R>jeM~yF1
ze^<jSSNSP8!3_)H?<*;8NJqQ&;-^F;V4zI2Nq#HcCRTV_{7Z(SiXqFmx%K!|w!$F3
zoQ2)jxWEI-tA|TrTxvJuT_5SEy}FxSacn1%*p+6LD9b4t*!F-EX6AWhcw&z_Gp+CW
z9Cg<s<NKR8mao-{!p{SDo!X8evA4KaQI?LWEDhf!7tP0Qk*sTp$(H+%A&Rk1Pwh@O
z{4(r4S`>M5Hf<hyaFl+D-J$Qlb+WgoY}gG}J&bJ?to_8Yzi0{+E>AVgCK_<y2}Q<9
zsO;x__g}~4FuzDN`uNqi-0bZE%7H^ev$0MAIP)M#!04!PRyv{=JTnTT$<%ijCuf&1
z4Ty-C1C{-;dFL<O)U%(9kYq^5__(gACX$p(o#_XC&V4h!=a<tX=I1e&3sEXlTc2>x
zF@gQ8TvD?6l(4)9Hy9+$A0dneBPMjzBo*9%JyC19&lFrRob&w+I$~H}XV%1cz7OA&
zET53MBosFs(($BDI;T2b_#1<p)iOv<S97S~+mZNk!KRbeHRaL-NnqAI3jJ~>a+^yH
z40aj?QzCaPxRSq~xHCV2RF;aFKT>lA!*)oaTbfL)MvN@G8Z*OVZEuf~nk6TxNloAO
znJFIfQqBM$i8T_eI=DCP4+bQ`Kbzk^98V>m;5MruK%_VdsnUI0T&<s{?=%^ikC*y8
z*HkY1({gyBOoC$<1xukJ6}*$Dm1GD1Ac@svZeHq0+nIv~?MGXaL)<B6XEb`8sCVD$
z*VaW90hiFC>{z>A;aOHTDVF2$#0Bg1#q~WXTN`_ILs{Y2g&Q0U;q!ikOqHtZH7mv2
zu}dyyHc?X}(4)F|5Iy|#RXU3Pxm-JEG>S7p+~P<#Kq%HGZt@`uEXHTgF2FMGN5i*T
z%Hwex;3i&bIheJjwGwCpU0w6dWRMb<d?;Lm+Aq}WoS?uuFPAa2P&3(6S!n>LlsenS
z;I~=ySAgUBoV@AZp{f`Mamw)J+$v(Bd$vob0}vLKXxoVHnykgTL6}mn`8GyIBDyl(
zG?P~LqZD>Jq?^dx0Gij@g?fHwZqp2|CpUP=Y+m3+B3kxC9CgBJZI~}j+kH^c`}48t
zjIf;N6^f^+%pLUom^=XFNo_xWENA)TFpS#_cl72DZJqoZJeL+&4fS1bVsq(VRNI2;
zN;2JG^}Fr>JKdp6e5)X!P~w|8p_U$DoKNtJ*xAhA^3>D-2pi+(8l1cHC8hR!Wy(w?
zn~-$NCN9CN0uHqiwnn^W$?KD7xe;aRhWz%z^^jj5Qh0Q)7&w(yC2nE)bacDFKpfor
zqwdx2dS(NCL^_K!=KztBz>r9F^spMeyn$!FjHIGqPT}OXdt-vT2T<Bq8H>>Koe7MI
z7JH=Yja}s)4tl1mrnxiLd!E;-2YL5frr#g?XMOA8CBZvEo0Gjlm2v$Y<2@P)Oa=~h
za6S*eEX_7RVGBEveoI*TdMQTqK59_0>f7YS*4p!Ah&8iAjwXrYO(I>dJQ>z@eN!uP
z&X~dT&8E3h&E7Am=ibzP%{||_5@w1lGb<Doc^0*ZUlPWxk+)7(2{4#>XNR#i7xWs7
zhuN>TlKOl^%AXgZ6C2r1*|>j0+p`dFP#q@FFri?@-#t2G6Ls)<qa7{F=*AN|<!|&|
z0RuHJv16;hD)ig5&>5JU2-7;cE4m4?;;Zz{!bneWpV<s%%4}})S4_1+oCp%yT-3-N
z4Y{oE%SnTm^AEpvC=YC@1>Ydo5J)PFeK&4{$mSjwD_e!33ApwS)GBUMq+WPa56>kx
zWqwnhL3Xcs2OnNBde;S+xn-Nk3hryHb!9Jy@4{kOFY-S41r>Q#^>$yrLls%*SJJF)
z(Yl|)pz?=>Ox+?xl6<K?(VJ$@qU~`v#j2G32D#9GGZ&$E0M5mFx&BZ9y=x}TQNvfX
z{bQ$D+i{1v$VdOm^l#7hzDI`788jlfd!nDRx|?$;L9>6H>*<~6dyt9<^XhM}Oq_#B
zyZIuong+g^%$H%m;VJEFf@)z1+-30Gu6MFNf`~aN%&mC6e<fRY<W*GmxH_hwmn$Ls
zfmh#;%kW!S%)q`$4iQ&+!5Ka#HFM_n$GVzry{`@U!WvRluKTO${e>UyFOrQlzEGCl
zdMQo=Tuj5j;PH$Rp7)@^iMhI&IaUed$)b98Z;+_nUx2cI!n1##zZAfWR?Bi-bz9Ju
zH@tZ4Ch5)l?%6&mH$__r@8{!+TBIoongV=0-a&vGD{59PV_TraZoQ|#yhVlOUH;yW
zOBnkGce+Lb9Sq-5`({a7Mwd7B_#B?@+%nJ)uO_KJJ!S6sK<!n2-@@a#wJ#ugJlmOm
z*k$V(_y1$>t)rq|ySH&g8U>^qRJudDrKG!4Vd#(!2>}IZg&B}Wx>34Aq+{sr?nb14
zpE*9~Jax{TcdhrI-}=7a|5!7_%;&Cs?|toSUz@4jNl=xT60*3$z`Uxd5=&QI9xL0O
zFVrJVF_qajA>28#<=x<|5eFK=6!LAII=uI|!NRAF<g1?Bg}9e&3P9q+%lbJa@14hO
zqS{yNrp<TvFC!)3ja()m6=KK{xvyoy7qgyj0`6vdElv-0N;9K>;b3i6{z+jg?nNG1
zS=haHCqrFI=}A^bET_TvCl#tVh@+lS8d`zMNOyJGZGH{U>DlQ6U(qi+Ln;@N5G7S{
zR8<2&e(G`j7Q<p&^pVi?XgAv+h_xz)tSTWmtA4Jb3#HOh;(43}heec{l<&&o5XPtK
zXqlcxLh>JNJ$NffMnt6==j*v95P8>R&51YsF)}?$WR6#PDFt7B!;xz*HoiQKG>VoH
zel1EI00brBqSVl+(b18|fl-2fde8n0rTP6e1=!`!dO^2<l(A#H1qx9~CGwl36hNiP
zR3{x{3rjnYUW^-WT6MiGTz*t2A81Bv1G>zvnsp!kswJ+%QkPbIooD^PDvpQ^YSI|F
zX~%E4ylPZerMVds=AuQ*_T@>a#6f^cihTM)ki(pnHVZIj@F5yzssUlvxAzI^{tD2k
z<Dn12*6hzYD|Ij%F4&h{!B8n8vE@^r1~$~*Jo~wu_fI0`8v~c(&b!S{y07(na?|5h
zK6V+pz5;EXt0uMN*o#`<|0n?uF!u)o=au<=3c5#P*z3vtvr<;s?~8UfUL8BBJ)#_Q
zr&PgZ7Nc0s2jNx3+h-1hu~QqhToF^+#Eju%xVi<YiDg1hYgL+*j{?(1ydmbRXbJ`;
z{K92Y+(Yrb;}07OA_AWTysrDnk0%`19iVa*bmAllT6I&)inHyRdJFA|cD0#>auO9#
ziL-HO9_)zBI4_GWL#ODY>NZZhXidJG4{p+UYIrP6;W+Zu$p@fmB2$h-0&HvhIetHg
ze-=QAQM0QgN?qQb&)**3Uf<qaHidHn602di$Hsowqqp;^zCh31eL(rN2C@OXLL++f
z)AR)?EKO1HBQfQw6-)G~Fyt7!6K#irb@k;Q{^~#@t<9vq{nKag;*eiYRB!%^E!--q
zb-&ep-Y1Uq7T^f80{NAO+hgD-svuC{hc{Di0ioB9+j&_3r_+7l0a_<~d9vSz(-&p?
z$2|Ok2OMEL9#pAhJwvzFQXfn>370<(ZW;=(T~ADKHok>m<f@?uwqyzI^e#^*pm0`y
zlBXpM?X-ME*-j_oR{KwVnm=)P|6%jqz>0Qy?%t(C(2qCHeG?;ob7>7~Y+kXam7p8X
z{y(C*UOWP<hUl8V5s;GV@?w)O{ajzFYf%kv;eK1p=5xR=ak_EtMSV@f9^Hl^PT!D#
zBk<1>y1#tr-x0$TYovDh$r8HNR!Wu?P*dFXjjs8~vS)?-JO97WI;;a+r|udk`?6s8
z8^Z7<lmt9)QRv&BF|7(n+HkPb-&cVTmTT`QTkrncVg4GcE*daat>G?{e?zB!|F-`E
z+x?eepBH*v9R6qf{=Z*Kf}u_p+{yQm|MDyU?T!C^e0b~dKW6ruiBWCM1c*ARPK6<T
z#NpwOs6G&yG?X#I8$7U2a$%xMa_{FU6->@v#iLmgb*{GVnT)SLn??V$=FVP?SHLhQ
z+zFyxcvqn+VmzY^=q;F*Q}pJo3dd|MC{eJM-8H=zkHg^>ZncsC?|d{*!YsfK_1-%V
zH_DoUGy~SNYSq;B_l@MnRGr_QIOfOp<gn|V9%ZX*Ya6{nCl0sHaDtmlcq0ZY{%6Jp
zGOvjYiDf8;c+)jAdRbEZmL=5_O!yn)*OU;1+Gx#~^9hBR1<2qtqaUv)gXh`8R410?
zidoT+ZNByJ!+YZ2Nv^2R%O^>}#nsm3%NVAl{y^5FSW-DL>=i45wExZQt*mYq^&QaD
zPy`v<9MuRWuTP3&r2s`hMbMS+bu1r|6jI=<I*^ozg-b8Hi^vFMq+f(ky%EDgq#qm(
zlug5E!28sx2jcK-e63yJ4y!LDfB?#w;SuWqQ;QSLuk7Nv7Fe&D48GM+p$BY!7!U^o
zmRl>xxA$JdMu-^po6>o<HZp0ovA$#>Vf(;)Kx8wl{y9^Lw8s@Mq|^tTW2hXY#0!7t
zDCq%sK}?E>Kvc6QT48Z^z6y>pYQ6p45?iIRJKzDkGip_`?hU&ac%gm=d?At_O8`E}
z-n)(sc#g|m8Q{9(3&@O@K>NpDE<$3n&5obXGtF5W2m&x|j~z{&Z_g-O<%&;i@X8-C
z+CHAAEb)swQmM_WiwW-8;fr?WQQvisGwQnUzTDq80wm#_vlmY>I(A<+YIc2)0!Kcw
zR<5b5H7{_~1V9XcaLXO_*|A}f+t8SGO~xU^N>sq0%IHkttj@3LXH)Nd;^DsJ%*?IT
zdS>6sO#`zZc6CZ_TEnb1+VN*V7j4y_p3|Et;|rm2<HL}lzPAI6aPlKm2erT&dm0}5
zv}ZiHCs?d?&QV;fVe)=kfmD?$gyDVL_BWU+E|=c)&&pOT9;jj~d+NORjN^yzZ9;S9
z{f4boq|X}`(CR*3$TS#t3lN4mjc$1vM)f$%n^e{g1*U|qa{vIiruKG0`^?W^H-J>T
z%|j$kWcIRFRU;%PtXu3$Ev9A%%5u#onMKO3!|8LWz;&_F({8^e0InA@p~gp3m4u~3
zJWgW4^t%iEr2lq{{O7gR3@Adsd-sX}AvK5a<;1<Q_R8p}eokDE#0AZ947Odn&~a30
z&w3VgTMp&n&+WTN$}affoHt+Ib8$*$82E&j>bcYjZAbossBzT%1&1T5L>SiwMT;$M
zXNyX_5@t^`W@{@BPVcpB&B~wJ4#{Xo$_S&_Cky*+otz|V&`9PDlXSqP=mX>ufM^gJ
zfzxqfU_!$r@fd8IQ+50rBJ=rr+&p1^A*JxFbUt`~5|45$aX^1^4VMw@0?0_yl}27r
zT<`Zh3XrH=qB9}tUm1SPh>3$aK2>Nd0!(-RYgZ8Aov#<RMiH<FwP~vJo!}>!Ey?yB
zC5_+CVCgvii5Gj{$>-V|U{<<PP)m3w)?C-_Khpls8T>sW`E|_rEC9Hm-_y-_bV9lm
zAj66~tr~fUu^shcc%wE2m94XTn6XT5v8Ve+qxb7X29~*D9dY2EZ~~>UCpNdA07ew2
zKmN2p;s6Zk^?wBAA|~huT|3e#N|_qS@d=Q3V3QqHltr8@?!>H^s@iAi;)JkvWW8=$
zxk$RBM|QTVKX;71-LqCR;3-N{tS`}YwP>~%zjJLt;*@dO)aO&}1E$+OH|2Uj_BTFT
zGXsFCIfa%<r#b_Kn6ln-%ZS4vJOdo_1<S>%n$&`H%8PNyy%UV!CXz<axW>?3+VZN;
zMkF55_LY6r9r6-)<Yuk_rKF0;A%7tjq6aycpdSp0@1!8wHATkhIX#Y94T?UPLFTSA
zJd_i|=NF|(<p9ytWp*!xg6k}m<ildhVSs{dfGRUTBUTxyGKh=pFFng&Z#3(|O6drO
ze@>xreB3sWi~4G?KAcqkcB-q2ZIV{Yi5s|3FMU9&Oq~OXU52_pVs_A2+Z#US<=x&>
z_l*DHFO-G5P%f!VxXkH+HUFG;<@tlbAJv7@XWKn{$Q!kked9%WD++_cTuHOUoaB>e
zBZA#-Lge$JrvgRf4KaEUZxZ8RT(}ky(I^bK=1M@>#Or9N;VX8I4=C2J=M@_6kN||&
zV|iU(OLU5f{(X??Y`}BM4$X{9GCg_|^bh<y!p@8_T;77{b$V=JgBu^P($rfrQ{mrt
z6#y48Pq7`XM0>%T69ovAvYuM?n6X?|9D_Lt<Sm$cW?VJL;-_W8oTV-VSrhlpKt88g
zlsx8SrZ}AtWG2%opBRI5Ivx1q!M23O5Ew#AK6VHaA-E5|OQgbB>prVzWxbf6b~C-r
zd7MP&v#|~llutOAft`TKJNY{^^<-ioH6^M*?F-v>0o!#hB9rI>H;T^vdASd`ZRunK
zdo~^p5i4sx4isuEbg9GepCb}RjNmw}`4NJ4f3>g9HctEK@P)hHGP~`7a`CZ0T_Us~
zBf_TMKz`SonU1~KX`r#Nr19iQ0cdMnYwc|9n_}W+jnu)=V5~<KAw}cI4b_SZ1EUG+
zGnVe)Bc(a);Gy060RgzzfgJ2Qpuz29-$ws*PoaJM{NVlW)idPbfWEmt4H${!Oa(I9
z;X=tfEbh6PQkzr}#S7WUn|*)cV6bYs(Q~l{5MuSReY>_8-ES+5o9Kv4V!x5dU*+og
z#4f3Tslx^UzHQ_ul)Rh1K4SO_-+&J|fmP}f9hh_`j8f^LdLDOa1H})>krKj7`r-xZ
z`wljAuKh|P<1{k|lzU>aDFKbfcVqiTF0Ze|3B-LK)|IFeYfoAV7#Zhr+v%0~7_Y~Q
zoQ^p}T+Z9m{8-9843^SKv7pgL@^=FK7#yL`^gY92vKeqojGE(N2a^`Ji+u|9{_1sv
z-S@!mkwYB2gUXsU4(Mnp4W64Rb(qxd5?>?=H+V8fU@V8Tm^1s=BH3s@QSUc<sXLd~
zf4%P!0!VSZqD@VI&MGnX3Fri1&|Bq;B^{>BnZc|aS0+9UZ*H0k0RMPZQ;|221qa}3
zOj^vVkk&)#D8f07isgAX>9#H68#Y_K26=~BYMnWk8A;`h$Fu>mYXu40Y8InrzvUyg
z9-A<HTr#!on=1R$pD36X(9+1IE>7LVXeuzFCoTHw&lo8zc&?T|7wi$jX=6T@KUA6I
zO*tDSof)L5SG>43`jK^)0l>dIgrJ#zUC0{dXromgF#_2b7xiRSUtM0?H&FQx6Km(G
z{d%UBBLwCjmxQJV6K3Rd&UFq)ZC(sx^|wXS!Z-fQph0KG>T$GZ{5NES_uyc`Vhb~f
z$gfXNMQ<<tZmMDJZ{i%i{{o2Vfdj<AZo^3Ww78UzIu6~QMrBnknUlpKxJ$u+{)>hB
z<Ntz%3Ja$P1pQ|NXZovZ>=lb&gST?rEnQII`Z{;+@&bNowPPkeY-0Q+P=6<(dVl>z
zLS6Z$B8_n_M%Mkv{Jjkvgc<ntdMDtXH#$c!`3a1*c@xbR<og*x3Hf}#0OI*HrY`=z
zvP0Sl5&XyTj{(X#R#&paF@M88Mjn0wTp4OoIdaZOsekt>{?q69gL4Y|fwcL5@J{#n
z)7|0C{2hdK7y-AYkA4{jm-OqJ)Pt|R)I`4h3aa)~LDIr0&PETy|EYBGXOEE<3<I-X
zscrlwyC4?wuUHJO79cnccjh{P%HvhOJp+9BbMyPVe1b54%3hB6@4ojRzxs*{_<ZDY
zzb5=!<M)H=Uj|!(oow)3I4rV%#cuxh@!_rS|Crh5!}X6)K)FYp*_czxA2Y~tAD$`w
zbx8cZfMYRoytILd1aLy*-vs#^i0lZ|KUSnvYkt}UK)yPPhd>z1b(gIWDAhBfEC!)_
zbt8*cc$nK}*Q_g(nQ#|j77dM8olcF6SF~|o=?+}P*G4W<$fCU8)C#)n|KUCDYaZKc
zo{(CQ>$hq&RX<+u=A<a`Drwi_dOdQJA9B*;)u>Ku2i<QKmZkiCga3Yx{>_4v0j_8v
zFeJY8e;_!64|5iJSsRj#f8M33Y`N=rr)xA{=cOw?Vx9p($>`!GDe*fN+a|r@4WRg2
zTHDa4vYWd6ob1$@ns+}qIJIHm8xJitIx@rZ=~}N_Bc`ZHG5j*N-<4SXejv28GpvFz
zc?SOh`shRf8CxXjFhU^RQL`T>g@^uFjeO<{015aT^e(Gl#}^*k?VZ`gOHx=D8R3Br
zi5ue*H;yU-<?1oKKRQ4TnPAG1TfKsw>e#_*D>0vhdkU$8+S=V+xj!74fSY+S#fSlt
zDZ9ls(V0hBanbmpS3d-vrSSI!;-Dd@=Vxsc{O563^p`6);&rE?td+_0Q;-c$DcbuL
zjX;fZVSsvc^T*w*Myj6ogw&3YRPW2-z5ha%Sj-=rMJRSyiprIe%Pc~et;QnZnJSsy
zx!!FpLK+g2_%m*{ds$tIx_eKSBBMIKtAeObKeg}T{yeW6wyqCzKX%#cYQ;+t=y$wJ
zP9v`tQJb2tdq^no!{rkg=c*BkeJ!z|iK>#muBmV=jtodOI+}wa-cQY@Cl!W)1R-cs
zJY59K;;0ZMgGf&9!F+v~%+D;whOV_TL@76EPIRt3jo6bxxpReLEb<^6Ohx_~DP4ui
zsF#t+lU?d~92uOSz4K4VdkT*}1u|2x!lN<)r72<nT^Qy4Q~x^%n1~vaF_+!UIGDu}
zxE5^e0F%O;P1RGn(Y!Pq=mTYneK-B3m~8;{Q&#-9hYaXW9KaH}8njzn0(7%;MK{%m
z<iUs;$wMZ58Xq1<bjZhg7KWnXQ$(zJY3}!x(W?)N8)8aS*J9lr!sAtH_nz#+Pb!eX
zSXRrE&LBkWPE-K<Ldw!edzKc|d=NohBRjNix3`{;8hOSY-A3nJ^Qn~S0njq!i)`c5
zKAmEwvUeUuHpCJdY3<A+R+?%<GEA!(0orqv9N1ay3h%wowMagw7qDPT|Jeol$7_6O
zz-0wA;oUHM{N>}O302@o6+!)%cyr&J$mE1!TOe|4H7)suLtK0OA2`{|T-0<!6FRK8
zNk{5++w7@*R-in+xXy81E2bOUF`nx|i7}r&p^X|60&}|IWv=k*-c|z8PHNH4a(ZNU
zL@22JG-%w#r{+_tvu&#syNu@-S=UPJ)!Nt5xj-HGON*a8{R?V3LjeD>@vS;%t>=6U
z^Ao9f-Job{MFz%s=g93a4*1ul2Ve@nVD?K=-QTGWwYIlx)ica%#vYI7Nf*OW#}0Gf
zg;ndY2UAL_tuvttu|H^?kvn$m5XT`@4MJ_j_pSp-qba!@b7%6p>n~M{^$bh49nW`3
zd$qK^2GkFQvZI(vx2%0eKP9S*XkbkZ*i7)DuhC=h4E7)ti4cw?O!+)0D^>U&Ch>9c
zbq!j<EFR=!Qdl@>{eAsw=Ux|jJ)XF4z04Axln*-n2(*yal8;_y?8A3jbb)o!!L@jF
z;OX_~IBib4Wn4}qHitfMaRG@~!;sC^9^m4Ww9rRYN%^y^?U7s07#&Dzx6m(Rh4GO}
zKJE7IiXj<RUmmDkz9<Y(kqdmQvC!|bToe`Rc@o96W$C_MfZQibnIAV_GiWpM{VvsR
z0Dq7}^f%F(`?Pv0vZ}fXee3Kd_9r~Ow&_Urwtd8sZpIlX21NBvnZ#4VGwsl+E<;DF
zjKv*Y3{D%8PwtuGPP%aKE1<dx(4SaZUhzdOGy^?<8@)U2=39b3Q+_)IGZsJv)Q`&p
z!NesAq>LFoq!wF{K8ZriZe4++vKjfQ@Wp(b1Y)r5YC#;UIbV!&7(2P-Q%Re$(sLJK
zR>A#Ih#|YGYGwG|nD%9b9}Y|Ik%8lvffXfly`vAaRk_uQJs&NzT#i^Yks#Eo{wFws
zvajSlj5A5b<j@t1+vL;LepDnIugHU~R;yTxQe-BX5Ouv+)899B>BZuc6SJKirO!_r
znWT(Ik+gW`8NDS=7|NO~rRk6Mn>LT#YA;wNS$2Up_Jy~wLe0gljP2Uy=LBrB?9Yp5
z!u&P}&$CCn4n@9FB1RR`=#xv2D66#)4@Pe9iHn#A7)gi4odoT8#LszaYO^v{y+~>W
zJm!<;59>>X_tKq0M#$Zr`YgkHuG%X(_*QKCI3<2Cx$s?5pX-42t;&rlpoWCYLk-42
zVY{@g<4l}`Csd-4?b3?>>yt82{>TMuIG8BJ=xa`&Se5Tn%?o)fMo;hVD-l+#r_maf
zv4^f#WZg&%_z)87;lpU>K7V3a0(#MdVn%ctTTzdG^OUcuVshG6u>ww?;V=4Km?yoH
z#FxJgAbQS>$1NUK=&T$dl3d;|nJY3ba{!zN##oFx9U{MpLhrU)Dc(c+3`S1Lgj#a#
z9S&jVKICoscxh0S;X<V>T$7&>%y|j!`<CAAIU_QH>AUG<VCA5m8tAA;Ue$;4!=<q?
zKYLNq*BGDvkuSUU<c0k$^ZQ)s?DqsLxzwb&rLVofREL9to*5vUhxnLo<Wk>30pMt7
z&K4%5<5i@NHsXZR$;gqW)CW-Jf;_Ci6=qYFa@vm4lZ%gi<tr9^HRV`*>bg4J?U3ta
zeku;pq5k?p6@IwEAD<{N`hEu`<Hh&1PRUFUKih2y;7-ammUhS$mq!yicA-uuV8=Hq
z?sb=@nxQPcoFR=*xDaKB#5q=ZIwax1s^f{`T3-K@eut~m8+KT|<2hTxW>NLbm^8E$
zZ4`CQ`YCvJoc&YghVAZo*+n4)ak^{RRL8GJ1!hf|RUv2w(>@QNuud)-2XYy6+9_a+
z-uI6Mt`um8*J%1jgm02Co~z!qAmj$vNUx!H;hUol0w8Fa;A%d7_#SBng7H;+Rsn^P
z)SqGD``V6uBys<q6DYd!_)?E_-iJ(^SFfaM^xJ&`{JZpC+39Rv$;Am^L6*n6h5|*h
zGiqcS(Tr%7G4$DH(NQTefTyQv+jBW3r#58qBsIgyWPh&n?vlz8N&d`)h!R_R!2VS1
z2--ch=y008Qp(XJ9!$7(+Sq&_08bMoV2yK~>Vxg$)C)_%GgeC|Z)5U*p+EkOA&7DD
zV_oso&qkl}S~<TC(D3!Kt}#!Ba5slnS5imL6eu-aq=Q&aV*>mr<-2Gvkw)n`v$%q+
z_`u{r!;GY?YU5r&PuqHKw6YYTAYwMUw5RUdWOW+XsrGaaLkhMtocTS*>F(<_?0btO
z@F&y|Mz^eB-%b74tdibM+?7UK`a@1p!xvC%q|dvra79{^8k{APZv5Jx?t&;5kPr<{
zl&M%u4wIU+XOjEuF}r<U&4>gA`DkLEyhpL5apqig*b&SE(Q|;uL#77<<-VoGDT1dm
zzkKgknUkzY`4%lA`vbC+MtIp+C8!3~DX+CwO_$kj|LKKuTc8-5;PzzM7M>Bib2kn!
z;MF6UMO=gfJR!>;0dAqhr<w%~>88u<(07?l3h@L>ipNjF0o-$4?nJ|F8L?ecB#2Ab
z7=r6Mb1%9XMH4ey96fTjwS&DtRx>F2bG`CVV(t!;>>XIQq8A~_nSKCO&mIu!c`-1t
zvFq4<l$k9L)o}@cHZHRY!>47}lK>~ps854yzzbnbQR{m6QuQ@Zf_6W2O9Q}Ls=X}@
z5HgKY6Db=mKJ6|4Ceu57r50<EAa|mZl21O?<OqpcG#J;uj^94GFT5Pd$l<I@_d#J6
zN~p^72qKls=s3VG>+m?0GWyOJcL%wlCvB^Nl}A5MsEsrDz|jj3%!(t$DADH{pDh4V
zq=0v}FD<dLq?{q9!1I66z5TOn!hkg34Dxs-y{1LTj;4R?`vxF>c+2?H9@09RZ&*tR
zitq?@T+SD0-i8M`Q0Lz~bO$bdjH3C5jmpYJyLTRp0BG3DU&vO_C9o&%)lR-IQiU#k
z7|^{$Dgjx^4}EqRl-su+*U|B%UPCh^dBw9_a~*Lq3~1BP$X3x1#90^Cy@_WAnFQ#8
zjL)Rlax_<+X1H5N;l(C*5qE&Q>}%ChXBqy0oTWyjDrn0?H`i`a{f4B+wLHpzFZ?4j
z0R+W0JdLMbbo8qT#1Zl}x%C405TBJ1|9;GoGH{Zz`0Ikv^Q#q*AbC{aYqfT*>*r%D
zZlu{f@dnyS1#u^nK`l)Cnam-fn%V{w;4Vf}In+}c^cALV)YUp88c^g|Wi~6yGyT6g
zUjPU^^p4RkB?$<Y7+85#C(joZQj~>=q@buTNcPRHnag+~IJ1;#g`!ffV$8*EFbKAX
zxR5O@Z>!~z5qr1Mm}5Ppd(ZKqx!6z{iD7T63HB&RGt$BVXytd`@h1;?C6AYW@}$|%
z8(Q)mE#ms<H3g9KP)GXhZMxITST3%c4~QW^zrIoi0k#-BhJLcF8l|zzZcdrlS!)*^
zeYV8op3=Q?;ikbfezZT0nE!DaH&lQ<g6U{=0Y=pL5wYG-KY=Xl(Sl%&``Vb~!xBhI
z1qR`IZJ!TlO)CD}xDZdZ%a0_>@2CiPt5F={@=DyVLvzdhXnR|wAmiG#UEVb+pWE1N
zKZ=0uhT{^MS6U$Vd+B$j?B0=;Db`!L*AXNvnE~ImoU%|Ve{P>;J+4*;8G51ZkbW84
zpbv&01d{0ix}5&MbUBUBe$(YFx&3op&eKacx}0#Kynn3ug31Cwn{%AdJI;>8Z#|fG
zpI;TY2Gj(4&gT90Z?6Do*-nJsb?xt|b^nG@{I&gi40FaY;BUBpzWculjsLx&|KCz*
z{O4YP_tzU-U|S`z5B;-`@4v#nfAXIIg!bPv`xjf74!ExWUy&e9ifT4z3~ZsgNwHUu
znC{dNq~-HvY?pw_tkp}u<c10p9p#;rp=gwpU<d^p%_nia{OgmBEw*q9+#E+<Yqhse
z`fO*m#cAH%-X4j&&2_qAIeAvdML4>;GGN`XMO|sWHW1!C`#2dMw|^|OO)diQ)$2Xn
zTja!FSe*@vYpDLpEC79kRP~WJM=^yf`%Z%Yr@)(L_|B_G5wL3YWAUO@j{887J#RM9
zA6tS-&Tbn3FTVA%s-`LK^7Nm)RgYg+-&~Jp#SPM=#zu@b=si~MVJzz#c};65D=@>x
zXX7emp7(F9C;!CzsHcTFO~baS$2uM3oLvzP)DFRPA{)B~tRw9l#3<i9cLs$}NRN>~
z$zCH++@^a<m6uuD%L^HyobjLT$>!HCgW5uHl_Cg^O6Pk-u6%XFzYS|UNi7)Q)4-Sc
zG<pYPCA>^91~j}&y>*|L(`-d}l={X_=AooZ>en+a-)W(zXy;hxH;koLM`Lu3AumfU
zS@hjsCfY8HYCREUC;%g-g#)^mL+O<Hy(4yD@ivTSo+%+WI^_K+KsOgvf9EsOFdlyR
znyL$hu%LW<Q#i0iaqN(8KSOyT=SF)TkGy|H_cHUwX=eG5Fx)0tc^e1oC2YazbgerN
zg_633QsqR+m9hFxH39j{Q*Un=#V!yi2ddtg{H@6^_fwz`196^KYKUYWQg6$j9O6Hc
z8O_8n!b?z0_Xj0ylll`mqrwNEpn48FkW#JxaI%3{WV7n;!k1{Hw^Kf|L3D~MwO{<d
z8pw#d7&oFFI-MrN*NEby1D3eoiifx-9yPa=RjP%)0Q#)apDW%x$X~1j!Duom`!2oe
zc#wll?9rx&!c+KE@Bu&I+b%?9P6p&mo(#8$A?NMqwWd8#znnX*WsJ)RPz`tW(o!=z
z|0XWVI~<;|r)O9Dx|&(YFCi>_va1#3Hit6|)UeO426mU52tu>nDjN4GR)(A!sF!P^
zHSJl7SL7V%DAMdikHhME_e)E8)Z1JYofA{>3IvNM#TCabI+i(Wes1?&avBKUBtI`Z
zRV}vAyEp1QZ!4YOPtq77cMcYQ&2z+G%Rkrf@r7o_6$M;d`TGU{z1l@ee}k-!9WV}z
z!ufLmO?kxTkMaBZM8>4@C*J4gjNXfBse|TMnj$lgiPaCyUGSbdaYV^^uFz;{kNPvW
z=(eo+S!t6zyS%RdR1n|eizH6d0dx%t!0NuLJPxDk%yBz-UM-@KR=_lxy<7iOQu`6P
zc=N~Y%iP`SZ&bK3J#MUo$w&$K{K(53MR)!7>OA^26!U(N>G^~QI1kb7QiueJ>jCv~
zmTGr$^Kt)fP+*ukQPyO72@1ghPaaz)b@AiPs4A;n?-&n2Z0qVnm2sIrJ?6zG(&wj<
z7pOc?(o}n(@Ea%}f9EE@kk~z@HmdB<+T@lbQ(%veLW#$-jTAMa<B*!8x$Qwi$y8SK
zlsq%=RQJ`U+w#$cW<`I!SXsVlLhTB)fGo<Zf5weRS!!8jGTw+_iEx8MXubYUKK(0m
zpl+LM=ySC`cKKU)_ghjfU>E2F980pNeJg`(H)A*E4Iyo4F1*86$R}nEan~YO{jvT0
z-LzlBeDlTLN1Zd%XSB(4YWelDl^(cf3>znQQw7%+xH3&IWiq;w4o4by%`oOa|1RPz
zAGY^4XOF^uHz2t*uGGkZNf$y>gEl?ezfT@pDkm^K>oa0+knLNM+Q-A96S;oKz)TD@
zHs*%HYyp<^U`m%NcIcU{H!XS=E%Uz!(f^5~x(;IodG<49STlWj{lV5Yi15?bkpiXg
zxTENh-U)#@YKlf~N#6}q=OJjacOR0k!U}6uo)CEQSj5hx+IOHKq%h-6@=w3<b~TB2
z>fCyrVRP-r3I^2royZer>+BoKY5|sfuQBgADO^Ltxhlk%2|gdyaU*q@br@kIno$a+
z%VpP7i)&00<)`Hsf7dzfdP(#ym`^tqL~hAfobH<F$XgQO;x|)_6?SM#x!R?XT+k<^
zn^afB3n`OR5;8l8m2&?(v-uvlpvWGk%AaXdHEmj>_hJ(RWIT$u%Zf{eBG0H@8}=@0
zqM5=jp4R2abhUl?nRqTgXzCWARDeU-o=Q6AKOU6PjN9PKhDwuI(SkwEj%4obNCEjs
zY4O?Ee#Z#=1H%(V9Cmd#Ud1tJUNpmU7DKK%Q%$}yi^JgFn8m=??B!C|v#}tcc2_?8
zr%T;ob!~#3;O3Bije@LdHXeSxEB6MEJj5=F9~1uBuZE3cJhk9V&4g~g(M)j7u9QR$
z(NK3p$Vy0BT~t!qA)}tE_<}!nJLGeWqi$w;-zq?NHg8qYkPcSf<%(0-o2vRqIr!Xu
zF3~wZ{J|alaaCgEm+EP%hZBI%i=l72Rw^$(lP#cznVS~C?@+I$NLQ<uDwS+4QY-+-
zj~X^8h(tWF>sS^s$t~=W-7KQgmoL7G)ULFkMB)KjmtMa5IV2v@$Nv!SDAF(hdt9rM
zrRa_j<EleI!@yJ;)l-pKCRAN#X{^Ty>3!&V)-L6ra6;5UNuXwc_}q@w7*U*WlbRv>
zrXl9XEU7G+&9V!l+y#%fKBsR^@&E}JlC=x>kK*=Mp}R}=!Zu!L8C`~q1xjmZk9+8g
z2HaTBG{35jkuQkBbD!?`tHX5u@hl=l+?h=<?`-}|uUT`)qSX8vwi8E@yYMB|SL>eo
zX57iCw)VXm?+NmRfbHbWH?60h(aWOOO4~HywCCjln|C8imU}ryb-k44gC73LN&A<J
z6%RntzHNz7(XoT8YEGzdbvxp96ee}kQ~A4x(m5Z_^p}AgG-T9u(G1SiA-<lN?GI^q
z*;yh1;oE?>DB0V7A06n3a?%~DDffbix)a?e3m|cZldCq;R#^#{<IZ(VHAbm!+OEDM
zdx<NIuKZ2UMM)Lph(>!yj#o)nJumpPPT-2Q{ZRp%Lt}!Dt<%*Z0YXp}r;j6a?h5`K
zZg%*hP}OZ5ddP`hsN1278I2*+Lc1mw>gllURJc<1)vOcH**Ttq5L1ycZ@my%k_|1B
z{d74gl}C#rp|0psB{F?lGFLl0lepLBCd>yZi#gS$pmJqg{`@z5&0rWMhP~fl^*dtw
zc#J_*)iDOKLd3`Wj{#+QR!TkdyMV&zsu*%R(3EL#DW*4Q)82I+3e)BsYW<$fZfLBf
z%}J!tTF9X1*Kmh)7>ZTRQ$O@<li{S7jXKra{IMqFd4PQth6+hz)5oOZ^*DWbyGu_o
zvt6~>5~%qyqd`^t<!dhTPR&LUt%$HneM)ZDk*?1YEFfrHzJ^R9)RE!qVBc%}pznl#
zI7@$ab2Qrk<ipj9exYSnLg2RM^v_klqQbyuj=nCg)3>wjz{7s%=3E-PZi^Rs#zc2L
z)2R`$KJ@7j^yI9DKEnNob_zt{hwYryEmvGBjdYhM*eKM9U5?WaX)VTP&>4#8^AwWs
z@bDfu{VM?yBmM&?zL+}i-k9-RgUqYmYcduQqKnA}OY7e3%STSHN<{>TqCibsvt#6i
zQJ6tS1+sls02sKGsj@|kV+t@!g<sHDB=N&#XYp~tyfxcr#F0$?Uzv>w&Ta9F6H107
z(VtDS9lv-ej=OhZg~?hST1F;msDvU4^yRf>oL9GaBP{4v{(&&#43M3{vk0~l2t7Q?
zqWYAR-j=?QnN7aABILe3Y<H&7G?tA@)v8I0>#U-;H();&JncAcr|3S_ef2m|^?Aj*
zg@9ZNZg#JtYf1Ovznrc=IeR&P7HYQ@l(J!8O$=1vA!5zm4dk@|`A+bw1C*V0%fpwQ
zz3Ds!XF1s6oF83Rz4J{|EZ%{ng36Tp0;J`}^9Xy(2&b!2OBfs|LIY!J>lsMOeVR{o
z3*48p>cQaTqv@l-=;ETpU2`8D<Hp2$kYS@bhauv3Ls{Q@p~3dGQU&lI?;1u)ZE}`?
zUQjLArSEI9KexIQh;DQc$$(~(%Z<l&FLZqFMpt3fBiycH%fi(SRrEmov`dGgbN>TS
z;&)m@P1QC%GS3#JCP&M2oZL(NoYtn~R`VJoK$`I$k+q`7s{@Zs!zLjrnhn!Qp{Lac
zkCdz`MC!H|08WOG{8*s7@_u6%;WjI9I1B3r+WZHv@TKJ6K?|4GB?yz#72(^?M)dn5
z*=sj`H)pq3H`hSV8a7i=zw=eX+x4cKi-OxG(d!fSt$ESgE9Zj4YoOiD(Q=e1LFFL;
zdsSICZFY%X9Y_qT^J4)7Nk$lh1tZ?!RLSG6gr+~O%<fad{m;#Ni)ySx7_yn=fDk^4
zcpN;=jz8DKpMWr^7e};d8@u<}tb5HNP&~VT1hl)k6a}P2{q)bTfG#^X=eOrjzpLBp
z-Ku$@?+)-l;ky>5a-HvotV#HOYq+{#3(%9C5+6KM4NNwOg1U9yzYq6fyW?L8+|T9s
zE8eil@*l>XPyn%4gM*W6wi7qSkO`e-X+{q*HEFU%u!EhvjuoTeL)O1bfc{436Kg`O
z<ZM#8OBZ-`HrhQi+%>BZbWMWT@HfSrY1+UOomdNO+=p2tF=Hg!?FMF`>%#cvXJh!g
zQ5dkaS#-GKziOf`7=P8U`XrNIy!$ho_Qz`jY_MpHoATthTFnJ)gypQA@t7l~Ujeu8
zEi>2FA=yi<YGn8(k{HH?Mvm#k#ulSuVh2x_5sIbxvAxS@EChoA7G<>FlX&i9A>1Wp
z9WMCeKpg>Si&-gzGVu8=|1=kPz%PFr`U`aGzfQsb;)DM^{r`&({>kq7y+skAgcjdz
z!v4M~hg7|UhjTO%EiyIqaKPw(sL~2z;aUxfea;Y+LS^t>0zw^1&HYr<wRMBOAADr~
z5*Xj19rB(N<QGd*r{(MAher7q*AMIZv;NwOY{1xyJ}JrLV^zKF4HOz`KX2J6zt6WG
z@tBurF?<~z{m5ILJ~u+4t$Z=taXP;4Io6<*mFknUtdI(1pB-OKX6;5+5ae=vi5MB!
z8y;~juPiL_LnvOKmQw%n0w;~AA(lPPUaJ`<*f|lwQuNO=^q+sd>ITeE($UV~nWV{?
zW+i`Ak+<*~T@fi13e^8Ct{LH34p$d(2_9;!ooifpBJ`O4ypfiEAzD?*TfWzHVGB95
zJmyC?Bkk(De8F7y+ABPjWx6AW>L8*dhH#>v?dlF4f?9$i2=7gF$gKkR8u9XUZ(P}5
zUlDw+fQeG_LEiMEVsDI<?SDz_5OcjU44&#=eP$OsMeEAfCqA~}8nwnh@t%c#dnChm
zY+!f&bL*KCu2lL6CgWkyiBzMebQG-ZpXJZ}m53iR1NUA4VrZ))lnmENEB0R8K;s7A
zCa6ynb2<{uvoDf{mq0fmOzK~hN|XBjCaUoU><%~<sTmDcJNzw1X595RpUQC!ai14f
zUDj_l?%^uMF2_FIk+km86;-Nmr(<`$MwmG0NCYT3g(l`7+EFXnFHzP)I&wmvgJ)xe
zq!}Qz<JJ%><JNegVA5Ua`jJ@PW1-`DEDI<jABY@<&3^q%OV_zSsm<D>E?7T4_$-ui
z<5-9b*&-s&=+1zieWBhe)qfeje{OL;UYP%9Ck?d|im5on-95~iIaOr0Yn`~f=B!AZ
z;rbNd2=NK^hM|#=cyceEe%4xmQ{&Bez4J1Xtcu_JnAQGJUehb4&jKxUC)^B=wlSA^
zGXruIZ*X?rvPkqplb81&l+2Yy>#rnkM|e`Uc?$GEgO0Lx&H|zKrBX6@q)IwE!0YQ$
zBqkTJ@ZV5hS<6QT+AnEm2l81^wExgUDp!-4?x14`>zI<_c9Z6H!fh+j0G~{LXVB<R
zOB%N^eDa{ZD9$kdzLxdC&3SSuj5C?$?m(~Z>Wka^{;&7gE1-NJluM4}Su^Afqi6;s
z;(3MM*Ux+TDCL2`RSxKgNm<xYW>pVG#(ovI14EZ$v}kC2%GE>|Jyx&d!N*(USEuE?
zt-R4IQ=3+lms3S-^K$pTT};`*y?uX=j<THppkyzx`n}Kd+4nMp^r*Jbw+je^NVh0T
z1AXnYiDhOhrd-Zm>3ZBe<$VNb?DqESzpRb7ZmRQEAx*73wzbyYz64m<EaUQ=DFt6v
z!WutmJ7rbjVhvQLo|9(4pib}Szo1TV|Na;)AyMOl?VV1oMuIHKNnu$H{_kvGxx5R|
zPY{jY(fGK{ugH7!0*ncfo<MW+%uv4)VGQd+wz7BUBE>1UB->q0sojxmew8%a<vZ18
zWbb@<^^nedQe({*eI^MzUNNdedp9OE24wc}hK1Hr>jnjg<(x=kk=}CGv|jh?h{lB#
ztGHi10J^dM_jUA#YoY>_;i1bT`m6cVr?ud{T}aODUNy*79FC4?Y;V@%$7y(Q98??V
zD^0qkT@cMmi1JO6^bO&0uA4+-{HUfYmHaEMFaCy8kf1NVqHJr{Yo*5GDzY(sH$jH7
z$pm(&ap!jHgyJ8RcgZha`Fs-7*3MU)_H^VJGPm0RX=tTlJnMBcZuLxlPZ<0dW=W*e
ze{n6_Z5C$}e{8Dck7<vNAf0_Y_r&dOnl;cY&H*wS_iY#)=ekW_Y!R~@E9jaGtT_|a
zb4Mo{<j22KB-w8>i6|6F2m~b*QMKxNVGrpa&z#M35NVGnFLQAvZEsoVv(vRfXFu0R
z0j-8BpoUcD)0gdiKa-1?N&Z?eXkiqvJV#q`ckZ+y7_onU2mY=}o#RF7(;ui>?nJFe
zS5@PJ{W}nwJ5^uU)K1|LhTykVm6dv^2(rl|$*!6-#%CTVCY&t0*Hn53JabyV@R4MD
z_qg1eykx}`REb}eQ9PSKppib5NL1!&D-tZOkx})+9M^8SJ}ncvXM-1whg>qUr{nZ(
z{L;h+kk>4o-(Lm@?%+5nByBLFsb}J0*F{pNo=vL_o23kr0tC^)qv4QeHRkkbbesH8
zT$-^>2qSqOX4ZH#MZG%MOS(sB*|3D3-SUj3mpg{ZbEW9qOi^iU@+QxZl<Qf=C$iQ&
zKqHi@50Bm%J+dWj=s4Msx643Vc)D?J{-VVF!n@F6=oKJvOs&35i(R(svuu53uT2O?
zCjX!o$kBMt9?#znUQUvfX6dK<)m=WVM0?5Aha!>5qfkbg#YnXJ12yq{_cD*?o#<Lw
zni=o#*(KrNk73hNMbHO{Sx_a!&QT3g8)4N^VrGx8sX@U!kbbXS-5slC&0&{q`?NAz
zQ#U&C;M??hL#vurg^a1=GfkB)=_NkAqVN3&eRY;^gQ7*c_&I9`*h1uvONyN4E)su2
z%Us+ZI2?<hNi%dZW(Kq@QGvVkkiwXquMem4?hmN!eix_r6@*4_Mv|m6US}bwEy?Iu
zvsm>PK-;+=f<6*Qe7i$xYN8U&O{0DE9K-A|g-agy%7fu@UAIv~?HEliHU6lvhcr1L
zgE!qkv~0UQaeHObFbPDf+jQX_ZgI{}#Fmkk`*ZQ3*?8VVvN#}s@iDz0>&)Y;jS=Sd
z*QQjg8P>|j_01bulQXKxiSU`AyeaxoE^?1PJjktOsE~J}nHqcLVrHsfNX)bEgz=q*
z_Ge!7W$Qj(!xOKr(?Yy?f;9+`Nk71dsNvX=JXt-Zn$)v$0Z3PUx3&ameGHI_Z`Bz_
zoI0!SHlfeDA{(esJ4HOGlkr=VY?s2kfhvIB!$^Rc<^(cb;$({7A<zpcFj&J38)B}I
zE<g|sjTQ5>dL&GwFe?b!elF}D8uM<%Qs#ke{YWWDNTf~I9LK_WKmjbZHalzhLAMQT
zCyl|=1rZ9Brw^&757w}W9HDQxFDZ*mA9EJM=VcmVoZCGX;pH~}j{lX$z@U#fhzVax
zv)Z?;y~SCzr*OICo^wr3_c=qIgZU!KaRL;y;V5*|9qIIkmHU&F=>(9ld&$)1SRzNo
zFp2$O8t>DiXxoXP4ty{$e{tXk9908`qMGMe0RF9N{#IlEiYgSCG%Ae1&Gn$Ko_2ib
zLWBBe0V)cUj0&We#+cX;)r~mPIzmLV?&s<s44+5{=;oBY+_;O{^;ut{{X;fWRmO37
zTJ%n~%gb}6xlEjBOPXTNc)@7r-Yng%$d^ur(dt=+<tmI4ox$C`%*)%=UzBRYxTg>I
zy0BCeo?HVwtM&ar`mk{AZcBRc!Wpe2e{thc<pws1u8c+fkY_ugTrMM{P|AHsdY8q>
zP`3uYaDh_WS0z#T^`~E$44c|FQ8~AFj0q0CFM`kGdv~~EA;!FVrunnBYvdiv4oypz
z@MPj11I`RUnOQ+}JKB~15zNTms_~e<IBO6oBaiZNM%5r|U4gGP>FEXgQt5Lk(oosW
zh?S=h&t>&XCz6=DA9gDinS2w?<zG{8PZ}=yd5}o(qYQhj(_CrdR-cS3N>IH)7o!ga
zy%Lp+W3j$gf<z3CrGNgel%z|KOHXhaWxwK6o1he^6h+<0y`5snEAgJ7^JA^XtlLP}
z+K^O;Gi%TATG>xXiuZbExbhF*NlDje1)8WJt`Hm-N!_Q+OLJTK1eBB@GDdVaLHrKn
z>l2k;XeGh6cHg=)D;0?87$eaHOfc>$;OpKK77ORZy%`cJ^l!w-1z(Hn;tjhC^hnGH
zt2Oy$NAu5uONsnCz0-w9bsZ#BA*Cw*e4BkQ)o)8D>9?Zv-c3E7A7E=Rkev_Z`H|={
ze?g{BrK)XOwWqO<rO>Upne{fh!m_*g1GsIF%Uv>Fc;v%;gX$yvj?1aGj}E(QO{#)Z
zQ{!c+-&=I!7m@)1QKv{dE`RaC522-o;c=H5A)iMz55kG>XRB!d4VmwQdS11aJi(ug
zRchnd%!zwTeZ+JzUqJOHx2J@iil&P_%Sh0kaw%H5m~FQ1u#SRi_pd84UVTF_`^9xP
zMEi74thQE9wGJrU4vLWQ$(VW}di_8Wfc{<f>-+k9f@eQ7R8t^)eZ!GU-94m=_dOHR
z7E&huef=qe>=8OGHS216ob6E0(OcwJ-lP88CcXIFYBM=clL(-x4^-Iw+m3qNED}4J
z%MZ*2kAXuS17>`)^5mX|g3iZbHqP)UH761PqwY678%VRtTx2PELT4>IS6E6>n`&(A
zZ{@w7kgnw3rI824mw9qcLMW!PB7-UW-`spD&6xr08>%)~Aj`7b3-oWhKShpZLhlej
z?!7BNe*!f&g5JTt=3y8eadf{Ns;AI6`nh7E|GuXgFLq+Eu(g*wBrDHF)fid7gmR5j
z5Z?|jmRELfzxqlYub#`R0Q5n&`==za=F(+X{)+0+%w&^ge7we;)_1Kt^sdy(u(e?f
z`Jo2p?>#tPt;UqeFg<m$@XAh>j=)bESwE~JqqBpvFrl!>aj9@{JrYUbE&|iJN3H@D
zBkJnWOMBFCmBa|jlLz1TE{M$-4;le7h}G{|2+^BjknQsbD}a`J&JIqGe#}Z}tY%JY
z#XWZdHSC;$x;sSbYP4qs+35rAnQ)~;0nunNaOU^^UzA=m(;5Ay1Q28Hw@NJgsNs8*
z6sh@KnE1#__~1!~Z97L|l0JUi`WV+p+o~5PfCj@WQAl6#SLK=^R;jZ>{aXW@oF$^O
zGNCs`rbWx#w^JQ{LY{D>&cw2SC><h6c0hu3qU<cQJm1e|#?Asn-SORNt_&ft$kEK?
z{xj9Y+Aw839&noW?3pt&B|*&z`(gC2lm<J9^8mp%61+&Y^+j8cUie+g`MZ@E=!AKf
zC1DyE96z|n31zE_o%(THzqdsFN&<;d$UBB@@jx!nsT_wPN?94FU2X&`b|ZjuFY!5E
zuc|k(vskoWeF_V0zk$Zs3t_5t={bv+3DKu{DEr|nw69G@Zg(?;cGH`wS{-BEma$~b
z!NsLkV7FBbvgOj}`Rqd-z7Wo#GG12#=JDl2eO6aE%6|aJ3Z(w0^FSs=h~*KB8iKwb
z-k}q8`5G5(8TL;^GEhCXbpvuCnY7AIEdP}Y!J%6u`qxy*>B1D{E>Z^dv9^gwO|17J
zx;n#Se7*%FdMQ&DbPdL>%I-UkamxJ5-1*(n8fVVsKTS3)UT4fzr4?PWMXBm$<u80T
zyQ$ntqVmY{{PI>mBeOn&_pFL$GR_UFDyTUxmp8vxu|91?Sm!GR@37gm@}Bv*EvKVc
zyB5X%ew#9x8FLlxWPUH1@(U9cUEP$vKr+S_jWSPxhcd2b9sU9M+qADHIweRw@D=zf
z1dRP=b8FcW`&3?y`FG4`7r^OW+ROwiy@n|AwN~I0^&HWhYc%faCX?j^sQl>h){%V0
z;(o1wr14!GTRZx}S6LL%+y~PZ>gOp+)R@B?fE<IgLy<;EYf5+=8&Zo9J|P3TlG8-h
z4G#p-9@xLSG^Ph1L=YM>p*+k!SxB1Xo?n(hPL%OwY)Hg0tQsa0mYk}Oo+249XBB2F
z(26eX4q=}>L`;=Bbk1lC`$WkRGU--v)YrQTv|P|S{!%zm$NLTxE!o(8^$bamxa@ge
zW1F}QZVeaG0{P2grEjV<E%82~sgyUh90@^_mB`vh6GMCQcplo|yS-3vNWHznSdUWR
zDyHyFtas91OPV(q!192j3f%XKSkg*0g($g+K-6JzKC;+yeChXo3{QXQw=h?2VZT&I
zm5%SMbrKonfClwqbGVjn>c1AoPgy`Z-icYb8y3{yNsp;iYPoP9lekea_+|K<`Bpbk
z`zNM%8pQQZ&vO-2bXjfGJ~Vu9LJ_TJ*_{9spyT*72YFC0o`WW25s-S%T!y^Wkh?B*
z9g*V;cUNlZJ(RY+SdXK|p}7uo$0gHLLHU!y4`lYwKO>b9E6SJJX+FZcp7Tg{v8w6v
zGR9sQIZ4kxj(qAHCy@rHn|nWuOU;#}5wxPxjBzwkVDe$;4l;iI0=YU)vr2)C5i(v$
z!*!Vs-95`u<%+u$IV$XDBUs)lKAf>AN6LU`Z@owyVx~vD^pB2N9j(oKBi;#IA3PGX
zFS~D$#GiE0`W3~q2v1C({0Q&Kehf<vRc|ZL>&u~t=)_JCH-2=VYAy_*!9;sF*Rghr
zFJuwA-{K+@T(&-Rs^Oy?yt}#D)ZM+CY0K38HP`kD2s&btJnnJh$|uv{7T!TF6xXd#
zv|iU+x^f<$M1ZW4U!nJ@v*+BK-14gbQZewaqxGbcW-&YKz1wxaTPWos&~ojTGx8+P
z*!R%yX1k>6;`VY_Sv2eB8fem1g>wPCveH56$85U{sFd1|`VPnV{ag&r&T*nZKqb>`
zW|I2Yhp=F`LdlQ4mP>0u_BUCaVS-=zqc{JT`J+FISO1BX{pVj)fY8aiia&AL{}Vy|
z?IZvHYw7;i>-Vn%_?LvhiM$CAnl<d4U7V@4UvE+WT>=Z3!+s@T_m?HAA;YC%{qy(8
zV6y(p)y|r5Fw1{ghlL#&_pFWqB=&zcm}W=V=OYER|3-M^_tpR3$A`BL|6^u9hwit!
z^n2Hr0O>l17uzemIUa*(Z?r{&$3nz92woowVBd+617YWurK4>XLZX!b(G$|7kLPEr
z_db)%D!rc`bH|DcI&Z)$u$mF>q&YUWd8RNo!&QMA<@M#<SM{#VFwYCNY%vlx)czw8
zp?p+A_*`v1d|37al)Yi0WFpvvia@Go*NgDl0O$(o&;{^^`4_eta8Lt_S=aQPtF*Ll
zoJ;0R9f0zAqvkG1VR(`K>S0K8qfya4_)^A6Utpw2Ax{@!yaOKd?cMHY<NnR&TXrtI
z^y;O_Jw=*&U`zqU7*sPvk`mMLXh6bm=d5(RX*}j9V*%4NGp!K;7$am!52z+~NzA{F
zYwL8~w*uG!a6;Avd>C#SN_SfrR2-oCUW)%DJiEu+AYPqC$JJV}se)<Hbd&_;k%~<7
ztU$5zXsM~g7~`E)PukWUaUeszY=Q?-+-S^Kh>Am_=?>tGZtF2hv8d4k@xA7`nHlx4
zM1lX~u7IHNQSI90iL{{Zx=2F_4bt-ni_?!dY&pCws!<Gs&b7`m&}8)c7M!GU<$O0(
zjtDVq^O=Qd{d<c%{cnL5+F_57+pNZ|{)S+17f@lq8*Ax81G?&PAZOS%#oBkL%!nE5
z2Wy6;bR%Mw^u0ZN`~eq62V2CFPxU0NiP}2MebWfieTDINTF!g`{jKd0ts=RS$<>QT
z88fSmomHhLcY?Pmw5{pC)F#Mje*GAv=uCpJPRH(*$Tp7~;RN(8vDVF}hN7ga^gA38
zKZKXkA20^C-Gw0UNg<>e5Ya_}bq9+(!bZ*qG#Q|5eL#i)P=Yy*ac0d3vc0U1Cz;BB
z=<-6q&l-J_Jz{!K0JJ>H1|f6Dw|Ch_WvUtKi|`4L)FxdCla*FUHuj2SsTQz5ql(Kr
zA786KA|Z`m>mMb1V3(MnP*nD%p<6yD$Z{)~H`0t{9NWs#a@bdcPp@P<pg6HVYTu%@
zqT==Jtbo#md2O(@C=;WF)sxgfR9xcOdbazLlhi0(moGpWe<!N=2F8I(QXLwwLPbm*
z)?Sn@&Vvq`A4zG9eS0<F=KByaRzn*9ZQ^1(2C_IQMA79wDUv)mqN+@RW<TznQ@)@;
zi`Ma=qs^dF%595e?uz^C*)(r?L+#MG#G!yZrS?b*eOf2p&T?`Y<osQ&kvKM_j%HX>
z^qZUF**j5Q%@%c<GYI3Mi{pV<vWZak>rOu{zN8#j$?6^3$L?k6s4>ajmpH`%?hc`4
z+12{=@CnU;HDZQI=q^$t@tg%w1r92%(%n)zgz@|k4qED4c}DFpT>mO&a+;Z~&S+q3
zEC1q?JuL%~gRY7a@3>->HDg)%g=N3ma;>P5%JXCsFq9EBYorG&{p+W*ArsR5D-4E^
zKsloNG>l+zOso05i$hO6?na0=bFYBe;x@__*<NElSyV#KbgeGfDNGo(5iP(_gXeQx
z79QcuWY;)5y3GmCeJu`iQ~?)r@^N=|IG_&9XF5>@oB@%3bRS0i15UM10e8E*H4q=z
zgY-W=ZY@}GvZ*>x-8F2XJvR5MjyRx|HwPMK4rGoBtOJ@2+Kg5(%?8yANjlOqTwS24
zz<84}fi;HcHHh-0G+I-ZHaS;wx;cH+Lfwky;c#tyVTEHM*J^l@&gyy*Od=J?tG>k9
zn)d<mr*zQaZ<$|$7{B5RDFc!{71^m-?8Kq&A+x+8IO!g@%-u`47Grt15g<XtNcbxG
z9u)u}Qa_a^`q4j_M&pW;Z?TI1iIi@9Xs?b8hUZ`)Zi)q`#w3EhA_IMC$DT1YDc52}
z%Jft1U7x2&EDB?r&F^hhT0UoI<@&uuotr2bRgNiH+~FsaxL9v_7=Iks#!q_k8Pg)w
zsTk<=_Ei4y!_$@z9N&mejw+<zyon2WjE>Gx^3KG7pu^`pwyF4qQGIhD-m(V+Tf9_t
z5&nwF|Hs~YhDDWaU89PE3KCjTK%z>{g5-=Mk~2sK$r&YQ0R<&W&J;Q49IA*)h9YB;
zb1E_vp`fU{>C>lAzh7&g_vgL$`Tp>1sy3UoSD16IvBn&;yo-M~aHkR)XLitdD$!)}
zlqYE1W>vT!8UJd_nOr->?3`ZVID-CD)N&j$ADay3722x|Id`YLxwDdLGKqo<nH5e}
zz2W}H16{yfegMvNvElP~Zx-~Zn!h;WHiEQ7_2s!JgztCQTre$_zeo^D!XQx3psS;|
zW+RPH_rpGxy#0z{Yi?F`$B0>G398FVzJg>(Dt`GdnN>3|Gm~ZopxMw8@pwMnz&xrt
z^-J66+WgDHrJA#A@t)lb4j;yVQx!*ia!kILq0TemRpDKLD1;?8=c@VBYKQ`a>VA>|
zp$5|rTS2FiRUtDDn5XKV&PCqdjiare%_8t~VZCcQJN0Wb6O)zJh;qYujg)uqnE%OM
zerT~G0QR_CeFuEuL+EH9i3Dt$3xLT9Q2OCB6Q2F48AfU>BndMnJ(+pjN6Jjqlcf5&
z9AS<kx&m(QePJ5X+i2Ho*D7<RUW%z=9(r<2InIIhuz}K4*2V=ULsA@@@jWyvHz@jy
zQoEeETYL9Hjm5=B^MPVjr4><j?m`dH6HN6Sq3y{JyM|PqX7K&PLss~GWL7#<)|ws-
z?BF@-!@@e9QywTRxo%+Qz7!K+RD{2^WY&+i6*IZb*e9DM(pz(|{=_6WQ|<MCVQA$7
zby<2g24>(pZmNqNUuUw2O{wiF^A#`r<w$oWIw#8-ZK11)PGK-9;hohK@UzKLi&|89
z&b+S<EHkLrI!BL$PNhZa{Bo%6879(OpS<Ul35S$&W|yQ2s$fA|jg0XkQKyg{6v@Uy
zV0%6$ww?CknLYVGg%a0%XRoBJrt;H`nnVfhGkTP_5W8&(r%TS07)V-==l5bBEFTY9
zz5z;$Gsrz$EY5uzEncw+#{SGfy;?3XwxQ&;5jY~2qG814C;4i1U7+6xDBP46!!|d{
zxctv`rLXxq1FO60aA~WO0C3_uUNHw8j~YF3ALP&Ov9w%?%}T^}lyHmPoa}J$Okq1H
zW)m2^Qi_$R(e5Tv=y_tZ?48QTNZK_DzeYO(&Z}UAQ86zyZ}+OGu@yHRWj5qyOY%ZW
zwT{1^ZRGF`vu4DEJn8-7;Q8p~zc(vC4Y2ZniTH`e@54Rf4u<RZ!p7F*eEYBH-G;yI
zE>3c<w#1%6>LL9oFn^agTlH@UON8co7A>2m3HaQzhh47qu~IWQq#eTb14J}1PrWgl
zGtthZRTC3d$goBDRhfD!c(Hcjd4WnND`_b<FCfV7ctg#UZ)no}<dwT(dZ7&O<bRQd
z`T)e5w?tR(p#Ta(b3`7$#Prly3_u6x$Yyjtuy=b5`$k$2@OAwe{*o)v8`8#!+2`c^
z6$yAfGTqU``H@`t$J`u{vfGwQHV=>O*tu@j3U+00taUWiV<)o%>a)#Z>Xajg69bKx
z2zaVtV%+w{lUmzFXC9UIN5vjv7yCeI`x>*r`ciOVgBC!=Y5UQ(TDfVsXM$aG;7y@z
zL%EXAJQX3KO&;oJ`fH}v)qZq9^$O)lc@v<f0u(3`P{9rZ7ywu|NWRVG{7z^0&w6hM
zh|`h?fei?YAxu-tWB`vKDmYrnNVeMLft|cYm^YwJn{%v+qmjQ~P)>wZ8{g}H>U&>_
zG@&J_$9v-z;c<D|gJLo%&zGi`MGz~e(S_DnIPGyUU)t!j@fz&h<+(ojNoILGzy~jP
z1czDSIzPq7SL3Pxin2X#0g5dxM_u032-yVzJB7;YPD;6|1~Z*|k5$Lji=WxE{})>Z
zXs54KmtO0j#Q7bDBzf>Us#*|QfyrWNd=xLs+%tH01@i13%}8x`+xxqK`R1YbiE2nT
z0X-^xHrA;S?3t6;b`0<jK6Qo|m*?po<?i3!1m%tQ%cMM;X!e^Sxf+Dpl3k`!RLMkn
zimT)31pC)s;`SAj7Lu3O%`91b5@Vu=l};20b=Phgn^cnLe~1+$e4{a@4tZw({GXc+
zzfzEKf{J7++;MFs@z9+3tU}D9XWY#ET8dq-Czx;h^?S9LPxB^jHeC4au-pTx`_08C
z>Nc3S^5sxojX;$t;j#75eZ`pkRh5`@=S5dd;nZ%Vrm5YebHUQ#SUl*QAY?es+qj;5
zPDAf7rF02P#?&d>>@7ChCwWr>GYp(pogC`J`DT0RmKOI^#KXb2BkKOo?6Ln#qpxyV
zoCX9kS$`vD14Q5BZe_`iw>~?QrQZkuN+CHV^Nj?}bvS6g^0%h*7fmoW;yZ&-5~vgw
zuj{Z8e<ziZx)w+@U!k8Pga17a52;FGKl1kb7|y-h9Z~qSiCtPKFuiG>#7P6+7!Jn%
zYW8y~8e)}7x7sadKnHlEWX!AjoK~MXaKl7m!<~G}iRMl7_me214~sLU55?&BS(=zV
zQ_rBG{5CLLzs#RnoIl|iy?Ouz%-Q`N1vEPa3J>YO3e)#K`;I;Xlo&SAy9y$xXygf0
z1U((J|6jBjB!Ox~Iz8V#lXiR=Gu7f-*FSr${G<BrHK2|i`r<Hr#+RJZsfajWx9Oaf
zrvlJu&}~9rdZ5<;Qn_7W1p0qPB~Np?VsrLmrRT}Zm*Di6BW$nzHw9kbk*h2b$F;E3
zE1qDff&pht>pW1WeKp-K=LU&RA59dF#LJj?B%r|y*Jca(#}p0G`FX&vkR>PM{H}#j
zb^pf|KA(K|U`~U{q4!FIcS<+9@}JEUfoO|3u=~WJ#`~Rf&a3-JIi%#Bo5K$O>`tSu
z<eal|f(L&8?>}&W^dWJAAPAA<KPz)k4e9|F@i?IBckt7m-gjU57%p`-_6o-hwrkSt
z6H9_{#pB}C`RBd)wd?vovmgFmS*67SSi|(*X;Q5xhq9kV_=*{_YyTPbTLTIz^qlq4
zJpC_3`+qyoFh<~hrL%h8e_Wq`k~QpwuZ}mNIvn@@u?PPIALjF}#xVvI{14pGKOYWs
z+y8C;KaIoxUwS_>>cNjLNA|D2mtJR7jZx(I<W~@24<`4>5$EoKFWoGxC}GB5C!o}9
zq#qU%<oh42{BKvHxB!r0Y4Fax^FKf&4{01ZG;j&XhWr-{i88Y>;>7-8cuB6HxSP~_
z)4F<kLB6yzfBCq#nyXXGp`O>z4XjmfJu({mxCQEiTkg5~##upMavc8BClyv=w2gS?
zL_VIsB8yllYcJ~U8H$C>Rp>^=5G`EeJ3QwkRm{7ksx5-AN&EAqX@8Yvle|5eif*||
zR4?<Di@Kk>^)L9c?Y=9xq*Qnk^BIXpUBvlWP1P=t(fcLrhp=!&dRMpX?()Kcv>$PF
z1hd|8#oVnqXk~g7(`Rf3Yz|r7FGW$unE-Lfc6q<;9P;=yPYgd`*KYK+U+K0+ZxL%_
z>HcKo*qSFnbUI}cRB3qt$fBiFFB-v$a*kHPYh(=$AigCZBjHzE;&-BMY-$Bj9za}%
zU?}#)Mx0OpILNrnXRMz(J6?+`K-L|(4rZITNhAn)fApQeTK4&m>6w9*aYmM&p}^O-
z+-b^UI_Y{t(bmm8pmu}Li`O@<V`V0tEHcVwXnYLZ=>t@8+t*WpoX6;n)Kd~tOJRkJ
zts9JkCKbp2+ObCM*8(}+)SEptJtLT^VYA3=qf<TGjMveVVl;Ya0O#v50Y};CXOx4Z
zcqZQ(r%<^6##1-@Y}}+INsr)%C~MU<@D~O}tL9iK#}ap&Ci`TuJYT(Lg?v}}lsObh
zQ6}#-ld7+A?D6b)$0}&O&fvV<k%?tQcJ7PxpNm}`X<mUcP&}_nBE?qvVjjZn(vFBG
z(S~oLNy?;CXEwoG4`n;8?h}XlrJ%PjW*L)SPD<Kjc~#}%+{a?B>mT2rG-c$R<-Px!
zzfe;BJ9JX<#COr=SiesqTQdR@B+9@@@*70{E<kT5HpyBfo{HTh={cvqCn3CMDQF^D
z8^K#IRTfluqoC><MS_kDV^e_B<ZjZYIb7Ln-|rSHb&wc|+sSLCv{)@&8Md-{liy5{
zN}9c_le14zsTnztN_Y7b7^)sn8!pXUOL+F$0en=URJ@YIU>mrm*{>Zqk!$f&Tdo%c
zY*R`tY82iTEznKb2wT)6Uw?^HNnT8YMz8bD)C-71=O8#dQW_6Q(FvC}JME!W5wf&O
zjKNPs79QxmkIO>X3%XYic?-l9BONbugYJnG7K-Vxw&A?eQ~-w_CnjicKq#Bsh|tSd
zWO`mw=<7Dug3U-_Ee23`HA8=}k$j>9wf(dc3GQ1?xm)RPVu0cZ^hXAS((8O$_j9NF
z<WnP~)nlMqN@8-HW;7G>u+XNTI+;E9D|Rcy!KdQsiLix*>^TI*81n#6-g&e%ZK>dH
zi<b$vuf}`}K_TX>UgwJ9CRUnFh9hAnX}!0$7eg3OqE)2MoH|$mrm$8Bg1CbE@S7la
z>1X3orOW^=k%*#Yqoe}^fD@S9eY~H4<V26xp#<Nh4bso2-?(3@`M?_y`$&ndjH;cL
z!b8`6Mv+8w@uuQKUo8fm2O$RxV6#!VcKG2&5jf1fA*$5Sg3IkB;Jp($!^qFEmNja?
zTl4j=GCk@&eG$#AM|nh)k7P$OJ>l<8FDaQcq2=us8`;3Z(Bg~cC(WA7*#as@c9&@R
zv)W55+-y^pVJutnlK9$T?@WXhvR?YYs6I7sK04@H<UuQz&8hyBq#I+%=TQ#qywGV)
zPi0M0%Hrto@5CM)42~~8Jw2moVO}k2bjrtGpDC0TyR?qSs4mE5*hqRklh(XB&bMfc
z+2r|j@7$O!JnW|fVb2TL4Lq~{7(7Nm!0Zo1{hrsl7w4F_w*~9Q(nN$p3Mkn@^JL^O
zDL=jVkr+|VVQ$XR<D7R>y1CY1WOn3Ii7JKf)`WD4Bc~B%ro(8*k0+CmQ16@pHlf^(
zC(2^C;xG?+^1vOha_SwpBwtMB(5k?htxFGv^B*T77mC}j0Cm2?7b>J#pl#(1>ZFSM
z`9<~_GY;wwrr=IUz4V+<H%evKjZjW+!Aon8tXIyx+slx1U~*!j#N}DIu>5XJd$*uJ
zSMzdR-{H5q9e;(5aNF4_A90cUWbAlPl%z3U7ucmNOy%{B0BHr78C$8;1=b6304V`i
zM)nI~>=DchpfRn48Wm~f?(bHc1-!%k0g=C{`%EOxvYE9YcC&<T1Z9*+-nbO`j_??=
zj~Whi+IaFg|4CO*RTG#hdHS5qsd-A!pso8k#2HUI^<6)xkW1ePE}V;W^|7>S=!nis
zAdx<Zw>k!ou2mx^C#MO?tv!6kQ)>HOWbe2Wj)0SpmX9>xYYqtb1IfSn(yKtsp8jf(
zX!@PppAcLao-<O4{dU4OIry6U#i1@h^zv(o>}k#l^m)yr$Ns~(*gC_gejR_yWNDjO
zrTg5Zsc(3*AVvyoX#bnnz3FRtB@6xf_dS}uUQ87-c?l7gRvx{Rh$6LFPVn;rJG6y*
zPR;v=O$@$Er0fmMv;MYeL}si$9cQfKTy;vtc(<irqiR9*RFQ${{9c~}?2vxbc*Q}=
zB%q$&i}sUM!EzIQuj}9?(zec__@nQm-C5O%BAAfpk^dUlnm0ca_2FyewR^!O_;YjL
z#ApgLTJiu5R{;s)+gzTMaq)~jU4T&SUFdIWxS8%DYPu}$-ua$H>ZOvchhrBy*m^|U
z7+Q%Xx!>HF!awDkRrPV295$ShVX1^I)5gi?&Y+%ny@^v3lT{0*xqzsBRdcmwFC{8a
zRUd-ex)GREv4%ju?U87Z?-?KJg!+;7=o=N5ntU;Ld!xUj;NVg%YkcYP6?whfox8nl
z&De4O^imbNrL%0_dp`1Bc)CdPL4(F#lhVaW#t>(vwX8GLtk>`z@lV6TTURtIgHfHX
zY|%)VsMXjL%*!R4p&b7S`8~<`iVq>v#9)ypL|8XmNy$wnaI~~_)hL&SSuJ`^D|3>V
z;KhkO%;W_(KM)Zr(-E&!PRi2bKHBp)XI_Oo|Is1PZ19v#fPA)NnhEb!`BXICU<TFA
z>TDX9%41TbccvaePz@E3o4a+gu^UJKro*1e3(}0>u|^z@^PJs)^p`EyXK~zt7?)P!
z$qbz06Si}9H%>%xnQX3kr}WEb2{BCS_y9$%2dT@uLKZYJ1481;b>C0F9A|)<<?}dg
z^f3{I^BiPMYV!w+53fq&Fe+`xg_tmLgW7L*4Nb8VykdK1GQeJTI1D+}f2irnNHL+m
z%Z6H;FyD{V%0)h6!QnsRR*70kO-X{>+|I)tsh|=?>sgnlBIZ*vMme=sNzhz1RDUE`
zc<c`Dc;|bM2@W=d+yDWQ*p*^_plW=5r@*4cBf;EPIB4M!(5LRD@1%`<Zx|q~6>uiE
z4!7$HCZ$s~&@pqxv$b^Z;wi_kMs(2pG&<cmP%D}09LNOj!s{{a7f5>Z+a|Po%q&Jb
z|CGsFZ#C5mcL$1fxN0fneMT(kG6LU{h^)mDqiyMb?ird|L@ER-1PPD<disA4CR-M+
zsE1%a4Qqz4vv*}46|(l1#T0L-G#K7*3^Y)wJC4J~s^f~@gvo|KFnG)3cN#wH9Oz=N
z8t*G=qw3RRJ5Cf2gtXq7j_8Wdl@DLqz-~c`jMXBg=xm`JWqIZfqgA%bq{Off*Xh&|
z#vTq;S^_SH7vG${^(*qLBhJ@XQ*|1<0~WKP;Vvuw)u!0?d)zyzp+onzt5a((SEIdW
zU1Ph))BSW8sR(`idk90G#b!5ngP&JeiBH9!_z{Ho63@O$AtH!O(IJ`;ne_XDq1P6=
zvaMnC;d9asAQ^5>;#S2W-c8%g@HALmD;v=uH?Hk0<Zku+&MVC?&um{5`y1DL!0i(n
z!@<ry7>S;1<8Ubl)*oGA6<r~(4C|@?mFRIYo8FIlTOE&A$+{#;S|}VtmKF1rQCJ$2
zrVlmayyRdER`q4rztN-U$5soBWUogDP14Et(y3Ue8rRoaLs9ihx4e=E%^HeJ4Yf?D
z@v!>yb55aK{T}e@DD1M3ig%ir-#0bYuv58O{lypSAl6uw1G@?%4h0+Ts%P*~A6H}j
zH3)}fr5OuQR`e?ps<C_7&HTD>&EarkS@x%47XOusf{NZFI~Iai#r@v-k8`Ubgj^M5
z#v;XVo2CM}6>Swl>76JDGM6}NXob5~&4W@-3@1T>U)^@H8jIOHEzf5&DtF`V&Dq?<
zYHOSVKA*}Vbd>{eJQl;Trkz6pl*F<C;o)jc4se2A*3^7Pex0LNOX0Z*8HFW}bMnPc
zh!4sIFUcll2Do)&;^lqtwT=zVsGt}(rt>t2RLae|8K&-MwBIVnA41I(#WN95ZE94I
zdTXWjGjiGGf=UVAu;~4Wty<wgM3_d5D3tRlZ$ne4#E4OV-M8Ke#l(EEPqNG?Is103
zIv3qJGip0++Ma)>rZ6OMurI-RljK-=<=BdcYaA|@>Rll*aSsd1@kS5xdF$mvomE|e
z#~l`}XRk&X+}Ma?T^nG{Ice%#vaGapE}{KRNGom@9ud5<r1H=teP91rl{UJ<EV_wX
zS?pyET-;`sE+SBwm{R#n2f;58tEuTu6MR=vj#Bf}8ae8+ic)D$nEjBVtU^#{@Y4R_
zY~1Yq`n(WLO&BxLiP?rCel<lkV(TRLluOS?IIejd27UZ<0LcFKmCsD?<KlmqSN_|U
zO*FAEg3`;6e@tnqJVD`E2VEA=H|(ii+hJGD+tSi+9Wgb2h_vTULvWL__t#iGa&<&Z
zDr52#p3Di44j8cO#bRQbCp=r+0R(dd8p~zJ-MO&=`E}=_FivB$uDE25TW>b9?_J;|
za%*h|I3guCviXnZgI$d$bB32oOfBM`Pzb3=9CFi5JP>=9ui))d*0szLi?8JT*h|iw
z1b2(`T7G$BgLiJBHNBnMVsMW^5&eAoSBZAE>xN2`#qWuMsszsM!fvZgQ9St{;s6ai
zwFr(@i*CMz`Iw%tczk+YI}_4fu8CG&3dI~sAPGj#BLog4<J$GSI?2)Kp?^ba>GWEd
zy$eV905rZ?Co7UP%a(8IUd1~0x_41>lQ~yO>ZOd6IzLzD{^Z~+=a?o@wgY9;rMi$t
zF_s`<@so%#5*vJeBudlcniy?~P7a^QhYJqfVfwL}<36S?%joE5jS(lXYhrXKX59w(
z^%Mx}7bcpeZ7tkri`7lj5}~=|-@&*4^M|MxFhrY4?_Pm!UWCx(C_h-0m*2UYO*fi8
zM3;xC3<^W2SW1F=#^eV@V48(OHbyJ#RZ>!Z%kGTvYf-ROb}wa(cUl={PgPig<s+3k
zRav{8qXw!BNsNtN`@ksTgzT>5t$cDgc;h<^<#8O#@;4_wF$&W(*N4m4s$qHmz+=9w
zs+sJt1#ehHWT&;#HHT*FRo#2VIQCU1kBh51pL<~wSyK`khO^epLCiFH(Puhv2ZP9(
zd#JEcqpGz)$N@Jgw4F-p36bK%=CHckkrq)8GI#jt8CR5R$#+d2hhYtZMu2piYYYuM
zUTax*UppUi&#rUZTyjJ7m2t8Z;1%vGu@ve3+OT)^eH=Oda#oqG4SRM(O99~T4%Oxa
z1%irB$B@|APr0@0F1jLx$}(IX`8#oII-)_?)J^nwubyF1e~**J5DMLGPnibMEEU2@
zxW~9fvzWVj&v(PtO)@(A?CF2vvaVrBUY(?@tBBrubmt|F?Om8$&=eE$MKi;-wC_0|
zdKMz^>CH#<o~BncSM*NIXU<P*9IGHpN-ZW*Q!9k{pK2WEW#spdGA$Wn^OnPJNT#H<
zoW9VRWJuZ+IWtCxlc}vl=z99Qc<A#qgw=HCnFRx<2Y{eiVPW1hOf~4OvW{N!h}sI&
z#|bMtFC>ZrsKDY54SJM4!-#e7R?O#A3kxC<2RUCEDHx`ZLtw1a+6-wmt{b@Y6})9|
z=G8V~@fv;QD_Wpe=bo<p;8ww=ZTJ+7(VaNWR{xmNO?NY)ax(hx^{O0@LX~w{$-Wsi
z>wTaj-SZ3(wwBkQ;`F8SzmL0T?Wpgx&wHh;PwhhkU5=cv{&GVIR}5m<4D=)>mZWyL
zZr>f7pCZfl#=xu%6TGg|Bu<6RyDw~$?_(x2ea(#)gK^BGL^YxZ`~A5&R})Y$F?xr_
z4Zd+Z`)d(@DMtLkb#Z62_o|U+qUw}Uk=Gh;o#j>Ny6S%?3DXNtt#zxNYyKuC(Aw2r
zBoK$_H9$zRGDl@sK&FMGM`1xd(7dG`wIjJbaGug+|J#<1v`AN@YJ*BWHns;QZuXH*
zof+-9?yr-jWTDX+aVvLjJ&dbjkMU!`Pc`>xCIdPpJ0rxTcZ*h}drzH=*kD50C+uJc
zWj)^w#Afaw*i<bx%JBIy^#kgA!d8d3HcMe3mDaD>u%N1d$vKcvV3x<<;~pRuO7;c7
z2s8FCchieo6c@M9?^IS+w2l;HU*$&UjsaW8oh0NIxR5Q$081sv4$!49K@OLt>~qA_
zx7wLB#^~IO(>Vl${>{RAus9I>AG)8j-PbhpFAG7}uqlk$tGoMXMaoHfVNV5fDC#Gj
zyVcoF+omP<eyXFhbWG`~z_4_<;Jdr!p_%8$vJj_VL6<_Fodj=mInX{54lV7-+!X5)
z9V5r)W~e-o;5dduZ`3P7gS#j9A(^*gJ|>~1)Kf{_>||{+AXuM(tilQ6TC3WpUWKMJ
zCArIPBxYhkelD-<s_$}0k$`w_bdDJ9>69_L8T&L7{}$H3TCJ=UlU*2;quASL#Asy9
zbvP*&u%=SM3QjAN9ef9a>yJ!0JV<jTg=h@UJ{5$9CAj3V8aIb4Nbi0oG+C1JJ3gX%
z#^O3!u%!!ZFIrsp5I=VFvwmJmunIW!$bLXc2MQKdmVZp5RP#;pAPJD;TWx<58I1sr
z&CMMItzxZX<IF8r?kr|1XJfU2v@okjfn)PkSFlduTN1A3yGA@Qx}SMIS#i&y7ING)
zyE`lH;?KBjek@^+#SdmLYHQ|+#2p=4^bgSu%SzMv+$(cx!&N6=%z<04j6E4J|F~rL
zQ6FWvyK_;As#}R~o@?|)+~mh5)#gSmOffyVlZxQR60c#ObF~$|;qit3^R{~e-5te5
zgn5vTEI&pae^_<yt*?T@F~-SX^a3(O!>teHCme(`#jB1bN!Gf!8M_HhPP-^H@|B#L
z3AyaQIVBVoQj3<pPoBIEWY000DetMNcF>>Nxb4}F8Xq7FO)|ese9|R#LfY{=6O}4F
zI8}aA+OPVyd^@I*Zw`in$(=}3#O$undUxYdjPFl}Jc=H+a`$;CoQqdUf!{xX_&I)>
z1<d6@K=~5#;I(i<zSGcDUtdh&l@Qz~<NJ1bERTjn!1+Fpp4$#tu~l+5B)F4i$Z4ud
zg{pdxCg{B+q3W4p-qNRiDqhApZ!?|4Nkdq>!)V{8nvvTyvT4*X{aRobIZ^5nV4+uI
z7;wu-J1O5VbR4pIMg~HDL>xKP`SM4SIy?$my)jX#*SD);f|<x;$y<5sbaX8sV~g|*
z9wI`Wprj1a6B$ILB<6q3%mzsqvb^WoyP>Q+M-={k$xQc61FrlqR)qE4!j{xP>Ls;%
zMdrli>Xxhf8w{)?Y65TCSWE}Citn+lipn*UcfuL!=MeMc?I;Sw92EN=CKi_uE8#3#
z_OYZ^oO{4C1jTZNyg{bB*M0@onLeY#Yqdf3cYC%sGfgyxDu=$UM5(5i^;tO+_3|-r
z9m&rU(ul!?zC50-3*M=+8yQ2vn&{r)xR19iuBG;vz9$MGJ8#YGuFULrD21UC+&}a-
z?tuc|gyX?1ekva5I}7k&hZ`BvUr7F@2+9h%q)2UO(k~I8>w1ovo_7}w3&EM}5G{c0
zMInbe@|=K8udl}RtlCBQigf$_tuK+1S>bA}EcKyN8S@WS7)TKH=4|#)EZgHF(<)qA
zuYdAl=GC9-3kvV*169|W5T#I>*4w_Fo5k;{S9J5A^a5*r`b{rN;GO<Eu_;j%7hQg;
zzLj{mt{JCXszOwwW~7(VA(hiHDC#%f25+NCZkqNC08h`y@62|UH5%DjVhcAUiI**V
zds(&Y)&P{8SeZ<`CG(t?Cp9n5HKEt0`z=sF>JbK4<}32j+*7A_OyMUdV)Gx$r{#?c
zImiS*`HGpCxILO<<K7I^zZ!^L1dNgRJI?zMeSOvAv;ulUyY)?!98BiYG!ZN*B?MA^
z{U*6z8e$q(Tq^4N6u+Os{1PUG1zubWR?BH{ZI}|wwH}updseao4T9&TE$7EH>d}^G
zRK2+<QVmF=Kh0gNU)#E5PONP&=`4V)oc!F(R{%>RSJ2~VCcnk?Oqn2A=^Y6|YGG|!
z-X%1IBI=6-$)n=CVwx_rIK9vEa9h`~R_v4~YPM9CG?l$BqKz%{Y+p@<FbKZMUeq6D
zMXGpNm`Ub29V(mk4X}E0<7QX(M91iv^DWEf__odu6K|D!)KyKLvTTNpIjM3}H&4qB
zb^%_hTW?Qom54EoHEy9>Knt4nJfd-{vacHf*Q85eRppD&W+{xQ#O-oN<@-1uFi+ZM
zhTNNYK=S4&QdnDU{o6TX_YcKpmEwUeEKcJ}kNi<hM(rOh(6ndDr51+YLoc{e09?ts
z5CiJROQ>>|xm-6Uc(=&&B&SR^@^$cecFcPXI*(SiZnzf#v!%BlCduGvr8vHLc@M?&
z$cV(Fn7B{$M4^%1!U+|Hcg;YHC#>G+5NLrxDDG8inja&=v%ZV}=0u$q<`TpC=7>WN
z45hh%q``j9JrK?h(-+Zd8ERlWR6QzEZ8fHBPlNQ#4>_OY_Jhga3)Q^oNe=oM>>#=e
zzz!QI!lBmoKN%%^+@2>AAVPIgTej7zr`=zHBW_JSZCoXEd)@xcKlmisJh_(1#FSdF
zT-wmhwY<ATpn|*AONf5rk!(7v7~BQ9DS0Q)rbmaIt@Qm72w8p;P5eat$HETaQ4kTM
zc^l4gmoZ_GjCNIBs!PhU=GzAOiv2aAr~}`33*Q|`QvKv+sJtaGx54o|xGB1G<DyW-
z?31&C{^QE+?=xg^#=5sBNg*r+*CTb<G@jThKL9W0lsXq1`z>?8AXxrXq~Xn%!eADg
z;T3o39x6<$y1cs@<IWiq!%Ukt?dRVI4hJPM6W&Cg@T{(liL&kH`dP!H%NouI0pw;p
zAhx*QYUDJv+XJ1Ad4qJjpJc;QCTCW|nB33Gb@#ze29jBVXno9~X9i`lVv$UVaL*_P
z0qJv^1Ko}4go2MSw>4*yX1~boDipd2%)3`%to>ZBNL~dvb{a|Mai2;5P%BlVVDn>{
zZ58D^Bama?&Lap={na}YIEznh1g%y$89NDY_H5xsaCnQ#7T071OPF9tS7f?gXZ-~F
z{5v5=g|BAu#wKQ?G0#+nvzo<qE`9DXOfAQ;nS4F=pv~Q;KR7Wi6JwXv(b4GFaX#xg
zxvhs8yh+Ly2CqX|F`<!*qI_r)#Uoi|v3Dj`46dm$aYYtRs7Fg7AlZB>(0VSan?RW>
z%W>Y{<V%XI+cP*WtYDxH>2<2ZA+qbgrZi^tcJzT6T#C(1{h@1YMKL4M@TK=ViJgX&
zb->P8IUg}I+^t~QQr-6;d@%VNSTCmOcHmkZcqaxp2QxT>LmkP{s4$erCr9?h2#^Zi
zuENvoId8R9QMR;au0GZ%Zzi>X^2OOB{?&OzpY1GOErk`cF5XX*p60V|Vr_<hI!B+)
zp$`R605PUHBn7<^r+)!L1G#yZ=*y!Kg?t}?Oam>(LQUxVbcc&vzWLDsaA{@=P&sty
zy>@&#g%!cS06GI22AsIPr>@s;ue4gP1>3)U3ZF@KTlrcQB3-W>N4F~D@-wyy-jh9m
z3q-ceuSUeDez)Ca&MOW+38VzF0{;nuJ_PtfwFU6(W;BpBh?+yMiJ<q<C$)3lGN^N)
zLF}oZP=?1(r3)?QjsMaTplUQ4qtQ;kP5zj=eROq}El^cms}NmqMDQmo<KN_u-@_AG
z;B>l-^?yVvzLgJuba@dV(hF#Gdr#Mm)L@FjC4PF*G2{I1A{#%m5iMxDU9|2}*Fm!(
zdc8hV%5=fBO-h@XPF_p)pnpfU?F*-XmN`w5H5DdaD9m8o_h!;`L?T@!C#OLc+E9^B
zK13<^zR+Dt;s8Sf!*x3~bWsWanC^^jaY-zzZ$h=M(`GU}xnR6O&z%zE=J;;}FEu6m
z`EK4Opc4IX?K%c<@#DU4(nu70kQcQ!17z0gE{$wqI(2<~tyy|CU08$EA9wwEJ8&V&
zbzLmlQa<d-zaMe+S>;Vz`S#XUrMj&+N2}A5TMNd@p393~yi-n_nLZ?8wB(yQfrVJh
zZxgxl-Cz9up$2Hon@Yz%c%gs!%2$$U5N9p$R(p%o!UXkR#E&Yrown@~WqONK<KgD^
zL-tAPy!$2DiWJ)gT=rM5^4CUQ^9^L7`g~BfHnIMfFI@95IyDUKT_UXOR4!w%6tVnU
zcf{!<N<xv24+vkl<>8Ff{pIdIo=4I6fvU$y|9XeQpN%t6^L>6T;v*@R|I~~fqQY{H
za&o`8(q14r__Q=dO{|-L4f*4<uuzqgf#CnyE}+vNQB!>$PU{|g@V7?)J|cg8jTT{?
z+ZkJjTN^-~!k;|pe>65t48xBeH}S6S<G&2dzXtiQkNo|UtxDjXgrTWT_y6|Q|Ln&9
z+uT1o{{O4J3san5eNIM3ChL<j`)#uEPHuwHt4>hBdOE3d=LVmz^x=!pU(AtzPlRJl
zQ34Z?*={;Qh)A_7Kw27oGGwxzi-+p9cN|W+zmZDzsdqttXBEEc_%JBpSR^%!!LiK8
z?Kx2aNvi(-^h}6zw;Cz0NT}m*e)Y{)C%yb99wIsv4|Ye8w$(N@lsIF>_lpV(Q?^E9
zsx?i*YKA~cbL0ASW3ekWQ>EiLlE3|OhB~uReXcm?8}#SDiPRS_9h7JDgc%a7oJ!>K
zR_t_2k7*$FgEBY3yd^Izd2F8BdpqA)C_rF`h~osVeLpvWIlW5vZ6^?@_Nb6gGrA0#
zvi2c-FL38@sIeQ-xIq1kui$GN&@5ONU29TB6QV6pVFiB$dCs{3L&A+={Etwm|JJ_5
zC%`(7P8baDzZs_g@$FV7d1?)}m2+lgrWcZ|i50hV`eXPfp1zbaC|~s8w=<ae`xLOY
zuhdvbMN50+EX`P4&O*$wL>=kfHiHZJPKJ;$-yKI;M%H5fA1pN>ES;S1ApVIF?{K7#
zkQd(Z06tNG(x#=^tEho)<{u+Xb-f510@E6aLF9Rqo>99~h2w1P%;hj1@1I8OZx@5F
z0mJ@EK3Kk()t;<mhqZ0_!FzY_H6(ZPHpl0CVK2(*dlrMPwZEJ5WLD=l7r_-E@7cT`
zDUkW)uyQ}`xjhu4lBLk}dbG2E$Ard);ysFZYQABr&TZH<WQ@Nt1(Vi&ZDB?(hP$%U
zx)HT7!lIMg8dc~SleH|Igp&!@R`$&=aUPbYkK(fk3~m&w3l;QKnfd{O9&K(Y2*I;F
zubN-LG_e0mGw7Rh=XS<(n^#9>dTD$2(Um=z?bz2~ab196PRh4dbd_wpG4<nE5P}bC
z%gCTdm4a}DY??ir*2JQXU*jf&$eHiN70DS8YSnq2TW3E!kF)C#E2U=N=Wm)(gKuqD
zRlGjwUuiq%^4YhkrEKdpp4O1+E8c?hf(KNc&fYxA$}dbIK*p8kXp<FFUMngUsmG6~
z9+yH$RL}Ak%{D!~^Y7*KKWz5Z7@X4q)7Zx$r}LbeU@9`_<gq8CT*gs*E<R-X_SC}4
zA*v*>LO~^`RE~&PqyG(Y2R-SF)yqw=uHrKWm45RDRATc$&6L8Sjv0<Pedc9VYICxB
zAX2A-=#B1n*3=wWfKsF~a(=$ydJ7WCnGhv6E*0ZpFtx3*;cxV}ru^Br{e%QBEmpzn
zWB$K=wu2sKGk+dN69(}`$BE&sv@+km0TZQ~nKUU=zh>e&)Q1}LZs48fDl{F%$v(02
zW}dS3xzSjh!apNj1a9jaFVP*|>wp_e1p));<xx-ZOHY<&3(UU;iR#*?zDf4(_5^sV
z-YK*qh58d3MW`cp$%Xer!UEkZMpK85GRM8^K1c#=gd(F&Z>237xo|+g%S}4cZ?U=?
z_Fg-BI(ZdbxxKtS0RmmFC~Y`}#V*h>87wq>4qd2fQd61O9Fdp9K(URS!(mZ0Y5`gb
zaq15kjx49PC%!3~aq>_$X0A?RI5;&}2LIAFmO%k;doJjK^v1`CO6!m!Zno{$tt1-2
zkGl3sI4eSku|`PY#OOKo2)bgkMv&`>t$-KXKKUD#&>g#%==Z~Kc%qGM7@;ug5AS(l
z$4}pz?q1jvDr@oyaySQvrh7zIX_|e`Kln;sXX1M~0bOFMYLE1z@4n<#Xsg^Gf&|eh
z)y#OSrD~?xRN6pdYe(=^hRqb(YIq2=XF&zxVNZV@0sP1TJU_QnHDnFLf_RCYxl63C
zV?qEwFxxO1SRCbP9dhx6MDg6<vK~=g6qEc&paxBA(({iM>>rdnqr=6Y1Y^*DD$H7l
zkT6V}zC)=H*KfrG*3`1e4lB1b;=zEnRrt{-A*`mh**0}WJQH_ztEEH=sz&gmwx%5m
zGcQee8C7$&^!P06U1Bbo?Y{r^=ZyRN#S{_2OITAmP^5&tNIqhY-}K;|U(YtyWoNaD
zxMN)hzs-RC(rG3^gzru!nDGwVx0<!H3$EH+Xn&{pSj@4XjoT)`@T5wQW9#D(oS)c3
zH!;M%w$PvMmkr={S;&A~W}UF<tKp!R*~(jdE(dMbJ9?-3$j1eIG?vEY;U2t|!oF|6
zr%Tw>wv9ZP*avL=lL&~<BvEPmyO^jaovN0(Xf9dHzAU-BwFmryY}RZKBSlEm!?fz(
z4;2~3AS+kjq`dl@h5d6_6iYu)NkdY#Jm@jH6%cEjL>BXljOXenr;O7p_lN)!CC;kH
zaqo*YG)m++=M5eW*i)|pCNYBw?$<tlGA$?0v*BZh_E|tP-BjgY*w$<cFSd6Uh_5YZ
zV2ykS35rSUKFOxuQWg>%#v^j6R8$gHdA_-`_7#e)Mjo(qdrO>ZX24QQioV`#mT0Hn
z5>hZNkM4c$c(B#mIHa!k$pgVJ`_#jt%s!M|dgW4;G&S?rhT>)oGhn?;4ElF-TlyO>
z6cC*lM31Xd1(PTZc3+$lDr9^ls>fh7-1*^sn#jWPwWh&9I~92zmy~;Ca<HvQ|E1L!
zZzmv%OOH9OIOsAL|GOpjP*av++?$n{AF-0(3!O^rUL2F7_SIHR&W`r<PVc4kqI5>w
zQDvCJmeeo;>FV=Z^9oymnW{d;HU2wAD<IO&1x8Xbc+;K2E%$0$ABtmZQb2Iw@008I
zPtst(8tzY}giL)Ar6!EDPIS08^~C%QM%tvtJC9V^!E`i(XO|i&!(6PH0ID}E<B<EI
zI3H_(#c)*46rD|znzFT3l&k(Q4xM3i?U|#(a7s9j3~knZJ;Gxq1`_S+e5X-=!u3G5
zA(n#8N7lOAb00^RVb8q?)$k%#I?F8tQtX8^I2fnAkM*`c;qO=JmAptg&Mk2p#`|T1
zKeQA8EiMe=yY$8!29-f=@i|YL*9x_!?K;QnwBQ!zYw}4SX@g=!Cs(Epir#IE$y)^G
z(qt=!>FX1Auv;|(<_W(|>_FKQ@`R!MgPfbbI%!nq9qOU%+$aJ2YMZ!86P}lNPE*@N
ztL(6z&GmWeFWsR{!`tma52P6TE*iFtK^7@Q>0fty^!O`<H0?C=)1A&$4D;~*VaM^K
z39vWEp}K~<H#ZAZzmmGb-CQ+gGd@;%OQzrJ0#<2cX01-XVe7~0fi@fGq|nG0jdZsb
z%wteI$F`yCd&1a+HN#rZKVMFKonx_r#REQM8es=)H5ZI=%AM=#NIy<(d8_pD3!I%N
zPHIw&TYS>QTemtOWI8Lz7f}n`<^9#z1F3{aV9&Y9GqyO3W2_f1-x+Bwprn;x@-=_5
zB2QX|Nsx_JsjV|9Y42HWyTVzGphaNKSaZSsIP1!H0*?-z-kBv^JcS&(w11UDl&ZTP
zF#9-~o@cy%fhzr;*K$C#IOeh3b&Hn0c)r|K7guryeeadPVUc2r`P6oJZl;eLAs(&A
zewOzB-SI-a>URRgbcXMHS&QE*8#35TgRm#Ah!MY-v>#fIfp*u}ZDD)R5#YRZY)^W`
z=m~gzW^0?nv!za*l}{#YO|=uvYPp-ImiOA~@xIIUSWbbmCQ@x|IN;sJ=NWJ3kP9P$
zN~%=nh%Kq^Ch<bNfqi@hs{6_G`Wl&rP;q&v_zF$+_HiJ2<K5DMPPi~``gAJIP!(5`
zrNtUAIDYyRM5M|`@@0ULPsl@g%Yg-@+1|?VtL6e8v>MpNj>;Fb22$AzdNuNs%I#jT
zlO@NFp1!V);%#7_vwb@(YwVG#S1V8gW*0VJs1eLGsu^#trrYHOH+Ag_RJj|Kr^&CU
zzO+7HI9O+wo$Z8{jNV}j(`YW?qzD$J<sCxRrM-p9x$@}gYzI%IBO@oB&mT{NldL<V
zR4uf4K1RyA=x)n`Bp~<;DjVJc8<-*iQVY5A%e2LXBH<=9q(BwIUo=0h8(461spMW$
zDJ}cKuRn!n30TlC&ZnJPRmgP=Q*_p>C5Tw;*9a~d)s8ny+^D;g+x;UvBgW8_ZO4qI
zNKxwTdu2E?IMn831n{vAJLLq@6<>O!(|xm}RzBRKx4%HX)rrX?m6!H2LG|)14Zd`9
z%19d7cc7Z+P@hsL2mq7h@^NdyovNcs!j~otqs8E#4mC^+!PLCma97t9h2v2eC~@2x
zb}>E*HvP4g#@7-hSP@ewZ7pWIitK6GiYDx6oK34XJC9mSrVeEBruERVq0VneatJ#3
z64V9albd&f50(lW_k*`hgt}2)Yy8ux#nn>XK}7FQ^>C;Sb5Ei+g)GXLiKsX9DL%DZ
za7CXyZph+j{W9ovf3-q$%DNeCq9tUJ$&v?bN$Lo+7OW#FNU=KP9b!y}uT4?&j^h#S
zKGnW6HVJy9zLs%TobD#~%lP;vMFU_$UVsdjwDqan(mfjiw*<@<3pyt2UQQurZIrgY
zHFrpGBd+-4?%?eyvAQs|R}3540`;@=1xPGLuDeS2J(vf99Y}GhPE4leZ4(q1cpKnK
z>_}yCs1#|b9GIC11dWXk?5h#W+Wp8H?$Z&WeOyib@x2Qv{;~16vhLF4(n>!37ZU`q
zBao{=<(%R9hhpq3!|+zByAQFH`4{+wR=E$NE{6tU?4T+Z+Nst_+8g=_=E|Q;r1*`A
zZ%Z+6=E=VIjESeUVQDa4b9a;_pP1U@A9h{3831Q;*AL%W`((w~_(^rm=DAM!_A%*g
zE%)ZIRGi)y^r0jwpU!M#^_@QcGCCa;_4Qw-*_qczUqZ{Q&=;L^nYtGnxu5`_O8^nY
zN1wOji}ax`0VTC*b90}IeaX|E#$D;DQ{YP;OP`r2^l@!-u}8t-ucy=>-QoKP^YVNS
zJ^o`7DYwnozSqw)N63!?RN4aUno-WDYd$~?Af&(azy(l~ClFA0L!GpvFAsXz9GcNU
zHJ*&^HBK7F4D08(^0a@(M!&v@zkNI74bCqI;xCK18n|<`E$_EqE$hEVW@3a^fBp4W
zf0FhP*qvw*bBX^iZl?PD7Wdcl`9GaH3Lpf^IGL~h^U1IO>ZVfBUtaK+o#3l=^QMxe
z;pjg&kUwY52dW^hU-$NZa2Lg3AX;S!dGrr%{?D5UUY2A1Z(hd|z@qa%DLwt=i~Qwf
z{piR4Z1X={h_V2-x|-ec*URERFDpv${n4Lo{)dY^2~mRVhp$3^Jud%wSzvPB_}{$F
z{~IP}9<}{_d3?OK*6Gp_`}+bXtByN$BkN)@teaFAH`O1+&-zF%R5WjPhtUnPUx(Kl
z-miG&f{a@*zkvAf-WuO?z`l-Ah~v6bWV?FzZwtnE5(rQ%>Bi<KG3u{%daggE#NfLv
zDd*XneA&J$<r0?WQPIivt*}q3JE=NpWHFh=>kd)l?2yUll{?5d$$A6D?!-Kffcg(Z
z6wrxDp1I2uUR`|}c;@VH-~G&Q8E&|j6yA@Su$SU3De<-*m7m_5H;59BtA>qw)LEcr
zoO}Q<!2E!({4zOI7)M<|<oN8_Me5S5?PjQL&QNy(QGexboVvqj#9MOcc9nw<ymA)t
zRd=Ft*PoHC_z~#DDYUS}d0Zbcb$an8mq%`+liy3<d4Tam+cZ=|??-RR?(W}_9Eyx9
z2bDY~$&oXAwm|=RFw5uWw$B}ipAUdY7WUjt@G%(pWSJpT=uvSX(_+dtq{k~l)-2c%
z_w_|3SK>tDP;VroOl4S8I0hS?p|BpeWxYq_<qWM@5WoA63+{&`v_T8h3D7aWPf=#7
zo_gX3gqM5yQus4Dh}y@fdN-nhV9IzV=Jlb<dHa}G9Sfnu4gnyu6Jic+!>Y;`oopfa
z(9AizyCTiw$StjQ&PlY~RDCBx^U$3blN&D+j?@!j+kB*<yIoX0AW1idJ}cKVOB@bI
zxHqpC;qKNhaE_daA)vtz|MuGWFMy!Juy1LJLIN3{CU+;3toe3In{`$D$at#k&>r2p
zB{rpF<C_TQN*4+|QnYf#>|-8C_2o*E1$~x-&~5*z%Ch1qCa-*6TyPaz+YD9x?CHde
zga=UNfnnTzLtD22jW|4=m#-T*G8~SB`INT3LzwQabn&$hAV%#**Weq69JmkFaWb>m
z>dl~e$KQ2J`o-e=`yqGVbxS0U&*dD^xt*QSKHM$fFpC0Bv*A2ZGk@wLf<Li@*cxf9
zkLepOhjs{gVwtAi8F`!q(v4|mD`<6ittTlUpapU&3S2(VwP>;MhX!i_lOlvEWwK#1
z-`>g;KOcQ)^c^n*-%eU&9FEGU9EZ$lEo^bS9Z&0i9C8uwJ`sxn@gTy*ga2*{`X2zO
z+RpSkj1fbMIGY5G<xW<TgJu_aBzgt1+Q8+`7+=YRkzZ2pdc`E<mCv0FsUoBL`rqiE
zJe#D|&!iOgB92phEsm=(C96v<a_7=g+2XO+oj4qD)qt&;Z{TwFZex;%y_Lv}*1BmU
zgz}a-_Wf8vwzW3;-AD~saMLhoIu-oU?hkZTXQciM>dd*5*a~8SvQhLI&kNv~qA-5=
z&AgV*w`{ZWyn?yK*)!%&CUs2t&Pq<n?Cw!l(#RPC)SMkw${|*?lT>DYtGz)GZb=8T
zGN(In5rRK<OBXr2WWb#s+jlEpIBZIN_eoJhps@I8YsksVyJ*gT-{mlqYP|zwlysa~
za%fdIr)9Q)qK-a4vvMTuZ*VUp|GO<g0Z1ea>gFK`VZFGCqB8b2cN<7QU#%cP-%h+}
z-?CYyi>^ghfOBHLHoaz?DWE!zDjVt{;Bs0OPW)0-c$C}IJFY&Ny?Xia!s`Rq$|KaC
zN#qN+@_s_;1L>oYz>ONBl-m6QrsB%lksykh@RNv_7CnMR!{Kq=y^RtvT4C*QS*HYv
z5LB<m2n*Zs<N1lIOYU5e%DCec`SO4_)ni=ld|v0rn$_)ek~AQwSuh28XKA}5ANTfm
z%X?u-4<k0fEVy+w1GC|sWzzAca!|iZ<o1@a*LW3$X-q@phiUjJM$$R>$MH!aS18ly
z*np*r#p*gzSY&*sZSPyokx`|RF|-8kZ6!n^;_soKxQ}k#d^&vZFTU|#vrH5haD7}<
zmWx-oz-cHJ*2U9x_xlmW7wi*ld5bL-#R|ilH~d?@RlPK^qDzXmoF5-{mL4eE!D24F
zMlg|4-(>D_F+jm&fkaU!>)M_cLU5Upu^^OHN(##iYaZfar4H<K8`OL(gXMOAR*rGh
zy77@bOP?Iv&H>5kWdRyk3RWwpn^Li{A}vsl2W#NUou_7?O~}HS@C8DiYcHJjzRQl^
z=>(wG&4cNxl+_~W*#k`zA!8<|m|Gvk52%y9^^Sx;D$s;CoV(3xkZ8nsRF*g|P894O
zX7;@43Ad0I;U<+h-pZM^Lxd{I{A6Jf01K-_aQ%A_MrSGAd8C=b1)21mVabn6BmRrk
znX{^ccI#=2+bf12Wz<2vXWQbd1Num1J47L0W&%cWZlT>-IU+*Pqas)PaFoj7@R?&^
zKeNXj{r2ij^9*2dNc-fpc8;yRBXpluzedBcL24VS+{w{XGlWLgzmFPW#7w_9&u9>|
zvdCqCJ4D#S+}C}uqsW&g6^M4*T?J(_KC+o4G)htKz}@sG_)7~@dJ3m~t#G#5Q8mZ&
z$*=zwPYzN8ktS__K$Eo^)r|M*{5%yBzWyFY>RX^IQ$t3tv*g&VKpj4*H`+Y1Q9`+q
zy7T>6^ofYGXN?HY!qWQo&a}q)qL&2>U2yN*OXuFJFR?QlSOR5ROMNBobJSdzIVQh7
z>~~we)I<)mA6viPUCAsv-5<ec0{fH*^YP@;K-<4V3zJ5=IFHQFr!r<_DO9)P7S0x3
zAY-`Wd=(i}&gYFt_gPz?0&!ZDHy5@r_X($|vqG)Da4GRc(A*TlOJ8Y>$3X|aQP-nr
z=QeK`x(XN0CV_Ku7huB;weo2{nkmEzCg&U~tD`JrpyzFaj3I@?)TJ=_?`!7StVQnz
zON2X3b#+h9eYXrIe0H9ncxxMRr2IYX9yGr?u2Kje7<<fq$CXUJ#_99(NdXZuNOTH~
z@MfK3Ha9JrswofH&2;xJ$abS-;Q+3>=uv6rt?c6Ny7t|=Fl0kP!nASnjvdtbET{I~
z)G<E4cZ7A1@&)4@zwx>5`%hz-uTId0pJy&J&zq=kM<$?ml3WMhHhk}DV<eA?lb~A)
zqBwg-tu0JW@zKM>Ldfm9>piJ7+{STSyC>c8-44&)wRQ!`XrWN2&O!8%VZ%ySuXzvk
z;d^I`c{2o;@<vF^bj`#ZV*KzJsnTuhIoQ8(Dr~L)@dOtYk}xweCVWd0G`H{Japal*
z@TKne^5OCX`<I6zm5JrTMkQ+F?M2FR0?Z7bBWcOnEB8OS%gAJ?CT>*Y6>yX=;+9Si
zNJEDhg<gwK%ZP}WZf_ksFmFo=&EZ=gPh0Gu)NMM*CH^+?$`k-Aa{gQ!$^YQ9EuG4#
z)Y*_iC>ypb;p;}ag?S3^1|P>6CA9S1t++lH_?FExs-bfNVTquIzDr;4;U5>yw}+I`
zJ%!=rVeM5x-lnY1X9rzR4J3ROax>3G-1fbAh^eRC`@H+HXS2k<{^(uIVjP%p#VLDk
z9^t{7#a2ZNjV%}>=bt$ABEDOad-8twVl1+UzWc|>no85+Fe9|^h{j;mS7i%IHLXin
zOWhO3MJ?2nTG<!2z+RNP0uNM(@?we9sM`0#K<&}6WJY+()i%AZaphxF1!<}4ntn%c
z@_CxnvLIZx5#a30qP7I$uvonVlB3I_x7iVDtYsVJnMB_*J@{u5ZO<NxZuHK>wxgTb
zXit=RlF2%1nzbR##cOQ2YVyM0g!ee*<e4anyc5Wihdv-Qi4mLd$N7QE2NzmVjw5Sc
zM-}i8rt!f?+eH^-#f$1Ihej9VE~}g#JRqaPB~4&r_k#rFz;gwC)jv6cJ5~aY+bPYq
zBTn2dDGkkt&p42P_ZecmEprwbH&ALhRgimOIRe7dpG?2FUjE@F8==0e3EJ0t`W0)@
z2namWulGdxoxxCzSS8Vtw)-7$Mfm;OSr}3+%Ytr)Gxd1>Q;Wg7ONG>g9CDe|Y{5o%
zg2pxL`U8|WS_7qS(|9E~HfA-nj|4Xw-d^3Tb7fO#XSMK|lRKI3A>;M1AWWHf#}%19
zmOMP)aa4S^p6ymH(v80bni&YEb93XxJ<N{vzraCKmvPqNL|sU0BH}B!61?PV+4P_V
zTqX+ZKDZ#xX3ERwu171Ec@2Ha!D_Z&ou+Gs=Wxdl)sdChZx4pu!N&ywHR={#2qPnH
z($Ip$s=$-Y?StZtoYutUtaYzv4RNN>_%RPn-b{obm~8FaL#&BNuJfFtc_rMLJjj=n
zQfUA9i=*>A<t%kqt^cRJuZ)W_d&6E6K?y}dQk1Six=V?nk<O8l4(UcjLJ`oRq`SMD
zQ4o;s98zNF?jha>cXju#E4yFc_gy~CkC}Pqc~0EtzOQp#*J(TKKdmM$Egvp_8k3n2
zV;7r*gR2hcFpFa-T>}G}in{kM+3`9o)=n_PrIp?@`~F<!@iGHZMvQ&Rg=6%y?8`<v
zznPYKs?+&n+EP5R1m?QsD<%V}4kwH>@ih&3J$NDwahV;;((kwD_jk%4KTP%aUU9ky
z-)!@>W1g*GS&^c{FnhL-?6Ec7AWU+*(^$WNu%*jD)3}?QB(t`sI-=`*U&~t!cUEsZ
zHb@!L;@45yPOHa{Vd(#YHX^)rYHRQ_u7+{feF)g#2&twPE?*LIWmf#@bh`424r}Dh
zm6`1T`%N?25;O0jvgv?q=o2YcS?sBZtl~nWs<1Zp`<=Dbgh~n2ysd_zYGG>G)(^91
zOLI<gt76Og<0RfLNG@*-u%VAb4Vgox?71ad4;5=bP~{+&&i4}9{umOgMSH=WC-U>O
z6a6|ytmwve+}$~|?5lO`1Vamln!NEQO9?U|&ar!~&WeNOnWaSoHnz=oX+7LoXKl<l
zW2I|J(-$g=N{~5({1!W>oD3TMC$T>j^YO3F;MQmyH+A{=ech6B3h5sG!&`ZBcgUOy
zYzVI>neCA(N+MO#*_jS~m$HuH3?bUG#n$kx+j;M<FJ-46;bTHpsA5Qyy4(Vtlz|f%
zN~d1$-G@-n*!OMNo~9h}3Bc?I(jN;`VliigK>Or5xrUMn<mh;vN>lYVp)PMTM4?xi
zzN~dw)-{2>Uv|J}`$;IrnqLk}WQ9rv^0_~7+c-Wj)sM>`#p=zZ?3JMFHnbT{hBIVY
zvp^y!Y$xa^7L90-krom5OUr9dmz?@CxRFI6Ag(9M1$R-IMQE{=jFV3EdODAF%S~}5
zB+EXiTgm2GLz3er3;4zdh!xdSXs`vBV##ryqlHG^S{jr^WM0d0sX+3t)ea(zTnTf1
zk;0ir)p54zxzEf;I_5gNc{e2DNV7)s_O`i{YxQwm1@c=sY55&YDkh+YJ><TXyzc>l
zm;chw!<zLB*PvlZAYDSe;XzxgDk^|`cfOjzqVs_p>VpH7J}FS82C}>Ma~KyHYHu}Y
z3G#+g!Sl)C;4m<r2j{Clo4edRMOhmUp9Q@ejLLT7k!*P1*rxh8@MQ9drV`mJ9!0l=
z<7Kev0hUBdOJ`|^gqOv;6^9<YIxjFzU^4f|tX6ThU}!656N`%{QQl^8^-?cluvkL)
z7ONj$S!$?0RO=D2i-tlAliQ_A%Tf*0P(Qi>z9`Z>l%}Um_LAA8R@Wd*KPzd--XL6T
z3$$9a#dI_w7U85hXf9(Le9|G?PPybX&_j9r%DnsCR`gbs`BGm+hvkBzo!i93v-*|F
z!oBS&<7(!S%sr8X0USDK8EPNTmmjku6?}|tzmF=*Ew)$<a%v7;edflv0G{2+hmJvW
z2Es~1b6zWKR>RVsDeY#=a&h13BLG@|Ja2E4D=Z>8a{@D)J5WMn&deIt-e~2@hPs{h
zan#Go784%DSffPrC;0Sj;qAJ1mcdAQ$z;=aRgfrA`JKG9qZgC|1P7r!g&n8`csD!i
z(AJ#9@Y;`N=92Mxzs8bJ+Ja(bu?x6m)W$Jm9V%X*m335opM=`P@`2s8o$w$Vc%sOi
z$Ch{&(iL-ydq>4kG5e)#Z=6R^TB6{^%l@Uw%{4~cL-bCMFKZXp$eu1CHn_4P+Bzg1
zPSkEqzQ5{?+vf4bIfTn%zo%Lv^v&}165)78hnhB<XT5S`l@>a5$6DsAk3$!n$0a<%
zMiC2|L4!`*o&NTpO<J(^jy`f%r3IUaS>6LF4r=4EVcOol{QlIAXZWhwVUP2Uoq`QV
zI7gZPPDQoK^nK>eedrDol7G=AUG9d7^K40(kY;6!M(9TdQk76;9~|V<l$WJ0u<V0_
z?)RMqsPmB%n0-L<vJE6J{amkq3LQ^80N``iFqgzomdZ1Dv^DJGNp=6omuh0)LA;fN
z-6r_fr_$M1IKoCEdzUi|H4;@n8w`gL593|cc$w8_d%7vTIYM(<f&$v14Y26MAW;78
zy&@^t{R_K>ozC@#&Eo=+bbk6TFbhn`k6V-8V#dyt9W*Z&7t9$k_XjvbGF6_cZJC(H
zgw?w8@X9WRBts~ap3<^bAI+N6@y77t3V5`ueJXqZ-X#J87$_#h1wUk8T0_Ijbew;B
zoUs_Lc<9I$v4rJ}@U_8tK9|`g^-vA0lu!>I%1FKiZg^nfsv4k^+TfP4SaIn0G%m&T
zrKSo@)7)^h^H8&(N^;=g5i%WWx(yr1H+U@FiL4xO(psU942$F!P>w$MGDWyM?G8j=
z{+9ODvSGWYI5SW*y5>_z)YUJU4h`>quBI>*0bs{dW_g-K*{n4}TeWyvivG8PBT}P5
zrH*Rq81{k@*&Z1gQ$CM~>YjG@lxcd4*4|pj7<ibWt4wmH#39ER2b~$q<2o!CE|#33
z$JR2ok||21x6~XYHW3s8PRK>q?H1QnQysfEm5jMD<${~RgARB}JNy`${r7Na90W9c
z>8=KCe)L`DZh5)5ilk^?*48{CYIEu6AiN^B*^ejT5qBM}qsEnPSjK!xvo!Xl;q)c;
z9P7fCNVP$R<#bqmK|`tKkb#Ht1<SUAg3kFy+gxEW=7~%6S$7o^N^(eh_IE1u`K0Ki
z6dh}y()L%o)<&sY79C`p#(*pgR}k~%Nm1_ZtaCQmWWb0!IS9$PTZXBTZ+`4F_Y*vE
z;i3(&VBvo9y6vYl?WaVCk6w#EDt>C~qLKf}iy5(Ip&aKwpymjV5XeDpXzeqHCm8u|
z;*q?|q&2o_X20(nr5xk8A`3G@LYM8Sd&zR}FRN<hJBq5GxT#l=AqSgV_XnHoG=&J4
z(4-)$%8pavedDUP`J-&7=BATZ+s$$S@<RUzHDO0~VM}5OHeA9?DPD?jC9NSRn|bd`
zVdf(n746w8rZmEoeW5;b1DTxGMA}lZHr}*U2iFZt`$lXv^6bW-Ly+U+oKjr9C9X04
zq>~eR^&}ixH>u2M>DCJd^)f0OlQWrR4I@oWWd>2K;cf*dQwkmnO0RKR!eR@DFGS=V
zgelvOEK9J(xJ@kC^jm<mF^BPxvlE7axoWa0krbWCmU<25+{zI(Bv<5%{`G_Ix19yj
zFw*q3ilQ834z~R}!n|rJ;-Aald~6^(#^hJcmtJ`tDh#Ewm#q^b(|l(}W@U^2x&c&*
z#LR5!Eqih2Rj~)kI|kIACy$mpo6>Mc7VQybA;z#9{_g9gcDw8|h4e{by-Y11g*YqU
z)EH&0U%Y<{3XWQdeKZnH=Mej#Vi1jdL0!Dm$InL&+Wv@f+_y;U^tY{2%V?B=lfv*9
zWTP+DFbwSD^s^4=(Je+@qsJ{*!aEVdcZ*tRua`D`u4dJaI-MKaz7w`qpWi;PwQjA+
zodINockCMSq*7kkWs#2o8`0g+kYxznOXkI;ZLYFx0-2}$?Cz+rTzJ@F)vEJ&1f;=W
zpu9dTCt+EcoRpto7>$m^c5M7T3;Z6%$2_-Ynbnz-TyE6Xfrsq#{m12#2hP~z0kC2E
zoX09DvaPXuN+aSyYTUW6(HTq)y%0tWair)6MDTs2CqW!f$+%?%ttO7joBBU@D!%0d
zB<}#=`hMiH7+W6{>l3-=v$vP&MPa&RA*{A?g`v_~egK%&a1_fu9ac4^KT`ILRPx2m
z-rSH<Htxi&-E37d9Sfoe2HAVlOEIK@Ih0QqJY?tU87UZ>@|rX<W=?9m=9-gfMRq?h
zDBr!~<6byT1G#?xlc~%2V9D-UQH*}9EM79Bg^b~n<0^l1?K+nSPNG`&6sJYqg6#?}
z9cDXiR)}Q{n@e{oqf{wo%sP8ym;|k&lq3~J=X()=yHvl_>_v;3T0`rLA7_WnSk$DS
zNo0N`6~m8ko;p$*9?)r)+~=4!1T%o92JIv{OS>oR25q=`;Pai8lJ<s(*#X01(g<XR
zExG|M8hr%_;BMX%8eF+B8r@Nwrgkz6t8vdB-IN(H)LJ5|siB-$3K4*ukwPap7&0H1
zN#(X|)#g6y@9&80>>lA4U=BUC-{&el*t^8W?_h5YW6*&AO?o>?hITEH_mdi1YQl$&
zel75j9%@(3ON^eJ>$%gR;>xiwWk-G*2RY6%U4wA)avK*s%z*6Cm}OLO)!Ou{sFZg5
zT+1kVPjWR(FFK7)`k4Gi;x3F8^5szFNiOQkAZWM~7|S@43_R!P{yNxdz_#@*`M#B-
z+>PQJbU5uV=nGzR6}3ni6N*&`wx(a~1UvL~7Ulu`$Yf~m{(Lc1E)_Fo>54`q5yX4p
zt&dQ)tB0t0>R_v~kV#BU9KV?Fg~ItTt!WcsFoa(p1$qEpXfNY#t!^VyHf>P}l0evQ
z-r`3ssDa>q$SQv_Xe-&$)mA4^vh5JO6CGHxdZM^(I-~<>{McfIYr5*LUhNZ@_cU&z
z9+}uRIUma@Mf;?fCnkRq7a~o)qPI;F?U7mnTD9&h?q{?)6<d4iHc&z$yz3IPeGsXE
zxnRSlb$wwlanZz%Z*A#p>w<jZZQjX&!Zbn*o4;vs-#xw-(P6P#hV;lSzxNYX`XLwC
zp0ek=lnWE_WL<vn{&?EKn=S=pxeBs<TfI!uhb>Aork%ERkA?uUL5H4nLwT#ERCCul
z#m=7aYA?s6(jm0^w`xMxNs5tl(!Da0%puOFIG*8aO*+MZ(XNz8Tw%QY<`=WKsD|j5
z7=~%NBP2u?Y^K?jU+FXYv7r^uWIagn%qr^)dt*{9t(@>$HkCj!)Maj;*2M#XWLbpI
z7%XIqE!ePPFZ%CNXsglkWWInT-0N;jEq)@&O;yAyo$K7EFVl-G9mj$@TQtv`uC9qL
zamBoeL>9Hw3>E7oEj<I8x75cv^b=a=`)<AmuI$zB>TBysdrwj;dv~4)&^fMHxmnbb
zK+{z=YdTzqEO(`%yyYbL=?dwRQxR?>`oz<jSurJXNe0u@2RB{;_1mOPcGwz<iR<d}
zx_j21XFA(Y%b+JE!0=&pvfs|Z_1q?fp-5iDjhShXc9z;Uux6;CHYG<-N*>h45(k%}
zloQgY+cKGPD-`nBWOVqqJP27(!_Hfl+<*LHo8lz@RC2k;V_halL)9(?JJ;8o!R11E
zKk6NedKQA-KxDzJ4u9aBm`-t(ky7l2vxefzQ=$%9^v3~%Es2OmCO;gFy?Ugx(<Ci2
zc(j0vkgqB;ufO|POPhg~B=ZgzW2J{LS*<~*CpYfczS^zU(tty`G2PJBY(yA;q*!OI
z^I_GLGl{z*z^PHX9A&jUzr}vSD~{yAAXV0SIE|=JL`beoD9{hRwzS4vwY!k#q7}!M
z=R38cv>Q$2HcqdBxx@SWaBN#W2HLNLm*4)Bt8`)S(nBBaIG#OcSU>Ztzu7|{Vga}s
zSDJt4YQVp8HO5YV!POW#kE=17Cs-*ho+@0w{$;^`6&_idRzA^PPT+aV(-!%vTlOUF
z!kZfRDU-l&J9$X@w-$Kp*_5F^Ibq&&drt9(GT$nbKWY_L=}Fk>vE}{B;;b9>922ez
z_@{vPHbL$2E_^EPbY~DkcyM%rT&v%L0ZPCr508V{@QR7kUASfU?pDMt9C`N0t5n!V
zK7yyczHgT=GVS%dAMh4OcJtNTl?xW6<24V8JUl9aC`3hmXBMa`#RJ=Z^C5t}Xq=uB
zZ_`iuBofcFCF{NZL)Rx4!8^gNQEl&`aiYAuolSB86E*_B<x-SWJy_d@*MmzUak~TJ
zEva_f^u-_5g4OB8=2KE9wu4jB&e&^-qo+51jt}u0Kt>l3caNA{?)JWwH5LX&Bg}`Q
z00BGW{yyNmh$$BjWEC{O#kud)9q3qN5@}s^3PIuQ_IdPs<FU%clQITD*I=m{FDT)g
zLv#h6TggA|S$K|}3A@}ewx0{uTwL*A*JcZGmM$5%>p5-3hW~O&o}dBmTj2V@c$s@p
zhpGIQ`-FFm>8&5h3cG>;UWiEv#zR%a6&I#<C^Kx)Q@Lt0S&K#lL5GHuHiMSjAZc>2
z-+SG&2HVKH2)?oRgf?M$Y<Yp{+pm19rzZJ<=(wr?FS*u7*2R5&4Kz{_HZt|4L-K&z
zu|(*H@$oH>_?B5L0S}dJiIBR;gKZQu7MLj{<uP`(YGc`qTl4+5ANa*38i7_1yZGbX
z{LP2|V|n~XLHfC7{p){zry!+^{V9Cw>oqG<U+`^B8pao!=0jh?+@Xwq+Qx2~r=|{H
zZf{>W;w94BU8>N0N-WUErimG>{B1!0^|Ie4UI-vFQY8$y`5C4v18D)d-Hg62a04<!
zs^t@@4PN_{dM16FPiIYiU(XC1;*$I*DGm^4=978$!pDM><W$(7P+?CcqT}FuJ6N~o
zB)Ii6{Is0@Wfla<0=4)?d&Nx-&G?-ewE|y&!rJ@7RvN%<=F|B-7z7sPrd_Sb&EvPe
zIP%4ugm=+J4_}Aua@{PBeOXjW`&Ky_kVk~V0U3Z76aE|bvDlJQXM=#BqUv9tS56v$
z1|x%$u8qb4l-DjAO>_D5GwuO(qhJrEGbw+lqVIyQu6+t|Y%Y>fU<6^Z5<oj;RtTI6
zBOO4uq8finBNgTh>_EQd8{Tj&=l#pW{MeeFegFf_Kq&s%#hmqGtz|`HyWqCggF3Yu
zP>N6p=wMj_Y2a9Efki>&n^onXEZVS~W#guC>o&f54)dt>XI#1f4Yz>RuHsD@o@z~x
z0(NIVZn3`!7~cZVlL;WQ?YdpvIlX{ZTn8M0MJ|zN78f;N%84CjvG0gYw&;QG-R>I8
zhiZzD>ya$(s9SN23bD-!$zpRjaC(kyBF=^yVlJelu=VG1^=(Z2H4w&M1?pA;EH<Hd
z3(tXI!v@MK(ued4)>{Qt>zmyYwC~m>5Z*K5V_WHb=XLz$YrO2hb(+|x8>>h!Hi3lG
zx_UdOOa)GTkJs&Ti@`j_HVukEZ{U<7Xna&grWQnJ<#xT4K;IVkAKUtmZg^4!#98=G
zzccoguYzr%=Dc2`{&&Mn7Intkqe)h3*IwzPOkjqK9hi1>RB*K)jddH`A~N<)^B!|@
zPRQqxJyqE6YSl)lIYvwjr0r4QJ!<w<fo{P;^;;EpTQZLWD%v!5K|zgkR0*o}DTFeG
zxoHI>passsolg86P`&){QMh*57vaFt8Z&7nGndtT0-}M6WyX%?_aw2hxGtb*(z&$=
zS462<@e^VtHBp<rBYi%MH8;pF9_MR!?`i-mAPgb9rgHQBWjPsKbAw)V(xf|nV5a-H
ziQ+sD+#l3#`p<N?Zt8}sPdV|+K{ZqI+hyGSV><k;l!peWAm9|z+BR<$s81XpI1!{&
z+j6KeJ1QMGJnC`y<#e4lA_tnc+RQ|+Kq3CtQfJ7$ct!s6oYAw#8TUHoFmOP{O}^3>
zsr}dbcMy8KDAxz%_oSWT^>2NC&F=#!9`j2}3Y!$tm(F<r7eJ|AIM|!E6?&xytEKL@
zmc+0gJh-op`Wv0@ga!W@oH}Y!?a&%}%mk%tA>_}(N7;D}80<$DPPo0z-JGZD)1+d&
zPX?LFqGXw4JN&05Li`UkGCWH#Mq)kG94e`@yya^t`?bRu@&Iz0k4^~ELDjT!kw3!@
z*8;_hN!)!*ORD8^NqxiEe5Vi0qBBt_v%_xg{ZzqVFGHR)A}>tw!E1DK^n|w9D-FBB
zrkZ#h{gK5XK5|c$w7937drpNXFb2^c_DkoTJDisQLT+}_Tr?lHxHbulMp@`giKVTN
z3AsGsz2LIicFj`8U*}x~Ue^I$Cm4TLDP<9_ri+fD{he(*7B%?9%pxi#YW<mo>dLxx
zIZWo6Mx3_2Y@91jXcvaDyTQRA^n}s!NzVPny-t+hpcSwx@!NAST&0rF#CJOAQbM2$
zJRW8GOKH}Lhr|Psfi;{93;W}>v@=<O_5HTF!L*`lEv3(C?>v1<m%V);ZzfP<nfK-6
zd-59`=n25vh<2s-YuY_!Z7k`Bhj4$IZt$<?t*02E?cemHL~dZP72-%g#skDz{BGT7
zhGkv{;jPE5Z#(mEYYS3=VhuwHL|YD8D6X%-@unCx?&zqGCE!zo*%7D^ss?GaQ0Z82
zs(Lb!(wznO=&N@(l@x`M2KaL-neL&x4$m&-6v3aZ8!CtD+KVz0F+0^mvQB3R4t^7q
zu*V%oD2Ur6#LaRZJW;4-5*;3pl^n_I*Evw#Mfy!!DVLYA+&AIF?A6NS_dt(O7i#s5
zL4C$YIA(?eE7U31Cl<w~PjcB?UMWwMxMiflMx{`|f^m+T@NT{m5TtT8O{yy{j#*h(
zRuj~<S8Xvtipg=GyfRDbMPe0JO@(kLCj>&xMG`%s$sEC7D34`H=a2(V4|4M5Mh6UU
zJz4P0t8jA~0mX@xvAx=L((zb|Tj4$q%DZ<V#5mltu1Z)bSZdy|xeJ&a=8Q+c#>%w<
zrWS-TG`&(K2BSakP%g;K`*W^J|5dm%cTRNC;|6Gj1Z|#8sGN0phoZ2$VU8l9-+2<Y
zYi7VAYv59<Zt>>BGsg#v%uItRt6)w}PH}f)?|m8WhAz=-;O7R8GOL5&XG?Lk^=s99
z8u%BD`8?Eyn4fN1SDqU1-|OvI%~KdUdmI{NU$vCN`oa_CJ2pFdrBfc*GJ0DMa-;4v
z8Kx}g$MmZ<ywM@CHbiQUHgIyKx*?y3Dc1#}y`bjL3ip;H%a-!3JCdJ(3p*ckN)0^r
z=GC}ns{B~ZEr&OnhUL~dBkvd>7Y<KU^lmYG8p@(g1x^p*c?&izZ=Z2ZuSn9?DCSDn
z5*H4?Gb+lVno?T@iNa3+{khF>xV<A++1Dwx+LU}zN{1&-#_^e^ogmI3pkN~=a<GZ)
zct&qk*wCR*Yh<=T8`*Jv<^>gsDV6N&;sXhev0yOuif!ew(n+>^>W%K@eerm6d}t+t
z&1C1VYvPZ~aysBCkn&WnJqOg~Ji-`VZD#s<`TDrGiVW?YQH<3(k&Rn6X(^yrL8-Iy
zulpYkkd9Rvie^@9*S<VyZ%SsDoXa|9Zkv^ZQg>{HSA29oAvla^xlvyPm(8+lEn3AI
z;Lqbf1%NHp_agI}zCvcCF(pWC#H$^yzTvFY($Ee&en+T93@iSPR2X~ABI_GwYF^pK
zerO<LaQu7FubcS7#UPclY^=j=T6EkQns@xpERZ?-ME)dnB9@Y`P(l4m5>AJO7$^y^
z#&0zSMySG0t&9U!#~h5n8yOCVZ=E99qe~Xa7_Zv$`v#E;baIenTvS+>x=0_#9D1kc
zDlh>!IQ<@npGrGA@WTS+#l5J8ovJf6ai6AuS3C~inynWtsAyqC?doB6tU-KKf-5@O
zHq5m+rinf-J298HDryo~46{Ip4eUXsKs2YvQaCxnCoM{`t3YAN_!~Cr_Z7+IOv2d|
zyf;}%0&gUD%0My>%TpePR@=I>sNj<GWsdAVNP2yBA#aIX9eN5l7hv>)a^%_?0p*!-
zLkKd$b6_jn+uWPqBQ}WRQ9VZ!$XX9c#P9lEU~M=!vWHnCA-x%vPb|-yZOZ~1>_)r4
z=wmyW^hHI$wZ$o|DFh{@g;6cI9_{|f;6uZYapdb8mGqi@m=(MObM?f^nk`pHtxa_g
z&6d1DEh%QJIahw&J)WXxAe6H+i5dbLUSa8<@s<gu)iE@4W`7ZjmnCgGo~!z5hO=5b
zAJVzuuj>o!woOeIlM@H;X07IMsms>6=DgRQZ=VIX)Nve05FBiAClouj)qrXoKNxD9
zjB#wi(?+97=*KG!Ux`(UBEla5E*8W-u4G}wi5=W?aO?6t<MGWahB(kz@18eGrwV>E
zUM35}8%t^iAr<Bg%zIYuEB)3w=PC(|-U31kFUp51!k=qDw>#gcCq+Rif>3!srf!}x
zP{IOoH0xFQVklT29!9?V!0nY*IxX|6(w=^;Kya-HvSgu+#8;f;>3|WCH<K`!^`Lb^
zN?SqW?v+XAPP!WH<Zvbfgd=n@y&i@&0~Yszr?m|z5ch`p$Uik@#T5qU!kumoj9gB~
z@RbgqB8e7&H<~=|Paj%{a(MTfMt{MWrq2%AJ%fvu%_A-)#qXl5Dz@Ke#@G{`m*69T
zpi}{|RMDV(t0>|Gix+NA?By9OyPlPByN<s8ZXNium^y%~u;>7|haE?jb$&Jyeux|f
z9L#WH`DoBXieI~2mnJj<Y#NI0w$wdu8^u~$huoUEqYXlRp!KL_qmMfw#>%Zk`3A*;
z2r)(pM(VqO_R@ky@2&bIO(XK0$HB_A#=g5RTnD~*x`9WeV+p%6#lVy1>M0r6<FV~&
z_3DOe^)ub<uDBv_{GA7GjBZBB`7*zD9Jz+2$_UJr(a$&c&J<<nUQ0^C7r=g#7FYxB
zO>uW1$S;hebJ}-($%$;LrkPrnuedy8=JwxprpZcv$GVkmy9Qm6b=*xk>dES#^l-I{
zF?+3W!gk{UpV~+;^b+)WbI;B@B9?OXJc5>)Og7GJp1K+?OUBPY2fbD@>8Wt%ferRA
z*0(D4-BGHGcsbI8kT=WKm|EVoAP{X<nY~jY{}^nzLjs)F{_8IJ&;jg{+l#K%UB42T
z2Po*Td3l5Od&7~<54;*e<$U_d!!B#|{3hXCBYe%Er<wJ#T!}!L;f@NyD{~ObvIY-t
zfJH0IilZYz&Pf-l|0W$A60;zAAXJ{Ee*9GLR3DvuOGWc)5?k>zKjR^o)aSdGhALzR
z=Y7aRQnTw<KyL!_m~Ip{#1gLfTa_(nrgf%V=}hj{1UZug3>+u2hw=Nf<My0$^S^nn
zpb?RSCQwcf_dI-54iEw-BsC+z$$+d!TX7yIPWuz2?)y5cdjco>)1oy;(?J4tfH9cL
zNF(rOg*<X8_NWYYY(AzCb6%PF`%=|My*_bzQr0*yU}>Uq$H%hvAhl}&;&II8id-qH
z7dQnJZUdx>)^mX67(eeRat&a$?S(_!Bap{{?hV&mAdW`<ra_Xi74xsV;`@Vscm$}C
z)c>xO{At<ze^ib1FP{BBsoZ~3xgV#){|=io9p?w-D}elK{w@)bzDJBtRF1a7v<r=u
z4R@K0Op^Z$WpqbQimjHKtP9r!w_DJ~)hL%w_B6lDC<Fl@@ml2lw=OpYNXI|>a$(eU
z8^E~S27}wLC`X@89dcIQz|_Ur2Gw_i9Xj$|tZzr=e?kHRw!2EsAmwEZ?p#f)Mz^Yc
z<yTHD@S_c2Px#YCKNK<&#;S?f3W8t8g-L!OLa#m?W-Gndb;f4DyJv4nS4&VM=6Qzh
zY3Ab9va%cWUPt7Sh+ms0NgGZfsr^7LZj0aH&tW?soBm{bUFG@BpLPkp0el$%;%1kB
zdT|U}C*(M;p^5LsG+u%NmXU8-&efvrj`}Rh5Hn+@ce!J6AKHyC36p@8((1t%Q`~N@
zUIhTe)5<ENpa+#xGYN{;m9PanieI(elg=|TmRX%`*`vFtNz`w2?UwUCJS(rPx)!X`
zzre{oST>d2EEJL)RI{ZLFvM@<fzaw4#488f$;{)dc{Fk+mPZUJk0WdoZHTXy8Irjm
zOFJy;S>HfkmXD8RyOB}-^7$?k0H$C)`!voo#8QxX1NThc<B7qBo|_MoR|z$|dCU86
zMVwabymc9_8l1L_@rJjl!??$NyN41DNuPpA%RpT)SM19A*5dkxrTum|w+l~>>&%u3
z(&h`=_jLJ(7avy7R#d~a7E@ruCG@4dGep><ogFZL`4D+AlP4P$QS5ua3p0*?TeN-w
zFl}m{2OJbG)3}h<QIV=*8lvK({%RyJ0lrYWLdz*1HkJUjx2V@XQLS@9S@>2)FOs2)
zj|<(NV0ewI4~c&HFs_c=x5vHGQ6Ohp?G}aWhEvIfN`+qmfq(ARl6V4sJlveuPzoSv
zSup-J2uTB6Vg!;@(T#5@leL%EvGFO_g?0GLJZ1D;d#Z;DJKH-OA9KL%4e7j4`A#<b
zG~%sD^2$*3L^SRo{7Xr}Ol9cWOZReKT5V+dZ2|kELOF2Z&Sw#Kk8BH0HJ1&<Rp92s
z<KnN5q9mb6Zjj{K3NWe#6(AaEw_qP_40n(C?pS&Um&gw2>_#XR$QBqnAMjyU+(AO>
z%1I;~clDoPQ545gM(w?+<(HIEb}!_5`+Wud;l&UL040tiK{Z-JPYAAZ^2XJY(?^f<
z-MK25S)CVM?BK}nG^@JY<{U}}4X>pd)76VvVk+m3J#ng;z5_D~)Z!R6nYEgo{7l{j
zP}rg|63$$mo`34O+lq!A%~Px$rz_yIA~x`NkNjY3;UYmrqbedu!z0?i)65$IqROi<
z6x-!@eQl``nlZz~SGjesO<AkCKNjM>B#b+o+~cM=aO(TOqY8#8S_@xnDj(awC>xv7
zDlBCu;J{uJBs%?yuh#|P8ycqqSd=vp8~ajRkry`NL+xx7+Y5O#Y<n^0Pan!30wOCw
z+)GKoPSWtdVlggKM{%axfs%@XOxe&;Lww~$L3Da++Dq@#qI$(0lYlABOctV)SLDbG
zXdMbae4ddow$dMd5Ukg`i&6i=wIds8{Mo=?CnQtG-|cmdtCTSHb%X#aYs|Q!6)}lQ
zN%#`+Ah!$Q=ACz4XDSfdo^1iQ&)&sQ6RN!MMmZm1fAgSzH<palBJGK+*#5Qy(-yb<
z8h2M-E&Di!`ly~o9-P%6ohLbqHff6{Gy)b2j!;B@R;UCQ-}P3sM6+>IhF{|ck!N%K
zh^wbQT2P&f3>OWk4@kang~*hX+^D;YTw2ww<f}_QC=8$Hkc8A)Fo`td;xrVH>pb5x
zq|gKBl`J?ex^)v?@3GBg89(T`lT|%Rtdjl8B1=)d#DFF4i<$jHj>q|w9-4c}k*0go
zVZqd3zF<6Hw_smR{Hrfp#Ug)bon{Ra{mj=5QtN&d<p_8W{HXxKGHdT6TG0EIoum=B
zE*_6?vulb+udl8u<EtF|Dig`7u_Z|P9zt5O^l^}5XtMqy{)?osKMQNW2N<3+?IT&O
zqzabb<(pqZY0j*k_<fk265NzVO~?;#9ZNn#LQf1FvC+vMX@_Cv`iD~EVmzp&kOkzV
zw|$t+4E?9Ubou%(xE&6j3k`GL<6rTwVp3_F-KU*_(~Z%l)<LNSlCQ?~GzMFBjgf2G
z;I%l>673zBx<*9@H1c~`XRCuh@)k14I=!bGuNW9cz7SbEQc}(E`&7KZ7Yj=rMbTIj
zvv<RM4QD||Y})Kc=G7|f5@}6W^m11b`=aS}!bfeKjFmFbrfD)L6{lA+f4$Ux@WRG=
z<Yc9Ah>sFdD@E@k9e9TR(Eye%DnpW~`xi^f?Z7=B)@O~gSEj9Sj<@!sKha*kEld=l
zP{th#KR}~jXdS233HgExE)bM^%sbs&<n)rEdNij#ZFw~U6Q!hX7^y1~vpp)&v~$lh
zt<n+>@bs7=c4UUyn(&PZjnR_#B84?AS^Z`6!-%gVb;W(=p>>l=0n_JlU74p-A^c*4
zuB&}^Rf>eNS}MK2c4(U10Dx}Z*b4Xe_lbRkTWI}~AIf9~5)r-pGQe11uDA)3yRQ*W
zPIyQ^&YpJ9#!NC+pMGsRMUFYZf;kpTS3}%(ys_*8K)BL+JOyk@xOW7V5z6R}Z!ojt
z6ex3<vBd3%a!)lpTeVb|6=qZqCX(AJS86O;EdUG7n7ez#YCm;}{XDW-O|6WPX?>s$
zJWbOdPxENN!Im)nOJc@eg@S>+GFR%N<Li%+v^n9Vfbwr;rf9e!TKb1*^5^^;dIfMU
zWQMeC^*lRvj9h$1W%~@_HC)n{s0%)T`?H#~@%gXIZu0!5WNzWCd24|BG7FS}0{0CC
zUrFG`ZLj+)>$cMy**D~lUpDg^mZB4MAlC<7e>1j;TO1qlzaIp-{o>K@)OK4m<EX`?
zH{M~+h&3p_>JDg2Wy}N?_~wc}!O5uF&GH@F$L`dH4BanEM*`gUbNwcNw*CFKm<oyl
zHI=ndsh}Fx6fGoC*Bu|AZRh7-6B}8ztJVGFCT}a8X0<>bZLNMXQX4UC+#$Qm(Tk`Z
zP#CrYG{63%C%n@uPP*_-v$qey+;7b!mCECwY{!caDPA6b9r@A=VktBpaws^ZBpR%h
zCxdd-<U8@KH++6riT=z`v0mJLt+f8z6^pv6t?{GsP0uh2p|I}e9HwKTJ!8|X<4-Pk
zR{gV<zLWxxs+H|<Q1s(LN9E|n6p)l2KiDALXa@?$33g-)#&HSbaTVi_vOCo7umC97
zW|X1F5@mO2zH+c@#!GpJQ-kt^$^3hkyhme(qIb05H&|!+jQ|DhORdAv;rwIs=y7N6
z+D=-t>E2W3TB;GiVUjXDY2<1M`!6$wCcvg-Q}yZLg8-Jzdn~0ZpWB;OZ-ss}y%GmS
z!!!))-xW%Jq7{D$#5^1{wGiR}1R%PFVhOdS5sp8qXVuVrUUFbo5L9JSX@@&Lm$_yu
zP<tIR*F&~bgC!7nB|9v@Z4Hq}wkLEenvOru-bw&>&ZPt~zlrE5yi(!?v*be!4tl-X
z)DVYxyl`S<XSP-9RZvO(t*d`(^7t13igtzEcNr$Q*KY86fS`hlPqo^v)A4f?=pKBJ
zJX8_`L+0U>o!%)kQNu~~8<4Wly;tthq@p7oCGto|YxqU;FTFehH&6`VH^!oUypj$o
zh8h>u2Mr0`hV7!f*+y4<Dy}Ib4bt<N9`ZgZ$^2N`4q4_Z@JGhe9DnX~Sg^5eN5~vF
zk0`CraY_l$R+9S1q4#2RW^(jD_BQG#Y(2-q)a4d{mr)soSBQDG$)?HXjR3AuC@A3P
z`rAwTY7au1UwtLyj#Ey<7JP!GT<YyH!<DdT2tLt?lbahtx(2vo@fsLBdo0lF*_QSd
zO)W?44fb&cBxCsLH0>=h7_{n>ZrYB=Qk1Zo9I0E^)P<7N9T8jZ@#FibZ+1p4uTgdS
zGwkWDC_OHKWbu*cYTQgwN?}$u@GLJudF=jWW66JGm$w4pFc$*2I6S+ST}%5&1OGMU
zug1-Vi-Z6oYbKTMIftt6&RtV%vtsq^W`_M^&RPH`&zqhKP`|4ESm++APuqCH09Pyy
zt+FjQPGd~51BcTEjq9HY0{Rw;8fOVTB<OfO?no<8@U6YXYqG<<3-}i16;cBC&Njs_
zjwk?HJujm&j>j13KVUazS}E+(%&xjdmC?XD6n_2VHYliW>cB`gd$$2;rEGebC45Ts
zvzYjsIHz0;NF9NyFawG0r$P{+1+#G@?1)udk=?vym*2o7Ve21TEZ!_%PP9g)xa0_3
z8fyS3u!19aQ>%+2Z1FQ!mRADnsY?zO33s%K`+@Wb6UR=QyxW_>)d13>Vss+Z2D!BA
zMP{dP_%3b_xaInUT2O|nl1{hz)Z2k!^YYjkLK~&jr(_{jR&?HlSKOq3S?EXuBgMGK
zY+f?pqOqeslM4-}c?EWEumDW`U<H|8^D$9Sf?yn9GiOIv;N)H{kip8<x96|z1X8)_
zaO01PK)%@L20t68gqLi?d^(j3$=wcO4(V?szghM*S1~W!e719_Si3w<grCRVlK~@Y
zQPeMa`{7aqEM@{l?<95mzJo{K$tXCM9N5^L{aEQzEgO{A66=+Oh{I~(lkt)KC4|a@
z&52JA`HJ5W@1Nm!E1!RX-(A{22fur=cBN1QEQQhw2wM9UcwH<D_Abpse3H&w;qmp4
zLa(Nk-a;F3VYoDu@Ep;Bv7r_DQ<V69wOjW5;Bkta5Z$)^1Lb2n`CpWeee>WSt*h1r
zuRtg3vbHLQ>a617+3_2K6oe150XxervXEpIKrK)v7m<3izW<dQ&id%^U_`Iwuj=OK
zAEJQ*{ff|J0qQ6adAyRWhJ!GV=C<z=&14xS`%>btYUfp_bnDfde{c*AKL}4cjuwS9
zyOQDxi^Qz&W}l!#37DL<j541iWE2cVVc)9$?-}Ly7k^mt30*|qJu}${PtL^eFC`PM
zc_3CI&<K!BC16s4X#F`h<^;e{Pbk$$mU2tTuGa=3B%Sv0&&1%*<?Z+RBLS4c^yn8a
zhoRZ#qD)Cx>tyt56TMX|bpjA=ZK-~}wPZxc|2paakaH|&0hvZ^N3=V3Ii4qA?}#m2
zfwzb(7r!N3QKd9I$DgjHhkc<lMtVD1@`rE!c~e6rz%_CWKkT56mVE$B-83C=A#CXM
zH?9I4O7z!;qkEUl9cutljz@O~8?$qP0G9AD*5HEanVXR`;?b{rrWW9REyLd|fIPV`
z_k`Eg$Ag<ep5ELc4g;b~%j_Iw7e#oYZs5hDI<Bgse{bg>UwDd<0c$CB>hRrPN6qiw
z`R0K8=d=CT;NLr##2a|%r1wv~$iGFhUw-tO83fqwMmFaD^Cz(!Zv%9pAl*oG=r88a
zUv4em4G5hpgjN57#5pN{mL<P7W*7fubASK6?{=5po8^};{%hQ`@$kKIKaZhq*Uxqf
zadLh>;YR1ET6#;zp)@&XYY`JIiq|a78KWV&P+1ro$(?fevlqmlgJbf+nP{a^&2sU*
z4d@G^p74OF3D8n4bJ&p|mIQuyy(OSYDi%H^l>OoiPFm>5u#*iG#tw5l-K54#mRM_e
z?Izh2dcC9Ea<GCc`ftwu_&$-pDLA)TseVU3gTezRMS%Z)b@zvB@AnLaNCWw%^Ifv|
zV>JqAiSOV1`Nb2^833spX=|Mzxc3OZ;nuLF=NZz8FT}%Z&gQ6Ev$dXyN})j@m2CRU
z;RGa@BuT)u(u>~l<(wmblgI>^d<``*rviJG4mU?4rT{rky;`srH5lT8$Rj9l>(W!B
zX#Be)Q@#!6C!}Y0r4vSCL&^hCy7AkND;dKA@zLxihG=I#GK79U>df(l7j>;?i|)`E
z{{c_tx-YH<7K?PQE^9@6yU@=M{9KR)pf^Txft*VOC-+UT5_Lkx!@H=&o_{z-BiGoj
zuBw=jto$|Ve0IU__EZ-=rw6y-@84h?6V*y2s&ZUj)rxnqCeW8(jTyUgUfg1R3;<B?
zdJ`2&(9U3SKyv4I%&m32;{=R_apj&9g7yF(XB+hz54%7r`>~{ETrrL*R!jEds=_<3
zqgl+RsWrz{#EtI9sh+Zs`HRB~xL{lixn&Kedd+rp6IjPqPKwpL@-*(t`vwV6V0HMs
z7SxYUWePeOo!qrP*~IR9j*Q=oe0KMjl>uPZ=?t{e;!dBs*X2~5=k;4%bW19G`uM+P
zY+|_ej88cko9fiGU^PoF1zQyO{uLIa4*Cl$Xm#t}eQ@K~g;P-1_^rY56~#Q+0@C{3
z`=%K#(4zy}3jvyX*;`FH0v!#8r2yA-rH<^(d<L$(BjAmBFgxmW^J!M@j7ewSYq%c8
z-s4bYdiE)%-if^jshO#Park-Nd`7s+d>m*R0{Cr<mnR=H^IGN%wzHDUo!oNUw&ucR
zR9!RKG8~H*tvlOh4M$DLc8+P72G`#*@O;-C+B5mNP>-@Hb%ogH%0aZ+Uhmsh+<M?x
zYh2`Qjf3|u<#0PrnO@3&w5!h-4c#c|8253lf&MMNH|F;TzNe6qwnW<7b^wPVpB&$@
zqCBthtuF}O&eB`E+|z<uASZ~N-NNcju&vv9f^~Hm;($j6;YeJjIBYj=c-z1YZ64tK
z6SM;rE;wdhmC8h?#!X((G_20EDexnIvzfWb&o}*=t=l|QBCFJFPJzgd!*<$0dk$kI
zR?%j~UDJ&x-Gt=<*CJ;%HDKoKD|{=3lz+B0K@rVnr!JheujfqPVC~RNYoo!PejE+U
z8Ar)t_)Y9QcJvUifzl##pyiq&NbZM~C)Ev@2W<j{+4YsIFUt43!{;Hd;o-p8k21PO
zwpr+ErIr1t!0P!1gA=gjk-!w9!=phYtL{mG-B;0ya-*g3<_5rn^sdllY*Hbc&|Xk}
zAc^-W@si0pjX6Im%9wN=n?pi$THUiaSYui9u+j1sRa0i@?Y8^y%@E&;FEOSuH6Yb9
zjY}q1(t+}x;|YNsX<zwU*7KtI6LetwuysZEuzGIKdOR?*cEv%Bm#T8d9>>{*9uU>e
zm4aw2w4kg^H_Shc@MEZS3k10|&{F>uYXjJa!j9zZum6I!9rQ|;z8=;$=$}%sKR&RM
zql>NqDffXpb8Iz1w;V_GCkt#eI_q0qo8zLLo|!ixES?SO;x?Dc<S9=i8pa{=z<WYt
zl3<tfLa{PHB~epq+i1Uq|2wdzCH)s*tx+RTN(_Ivl6<(!aHEt92jIJGlIuB<g1n)|
zw!s@OyH0!PZ1cC+YtiL^!#tp9pyTx&o7xHs&R0%NtwV~R)MxYCUB9R-0tIFT%$N_g
z!bsX$uzy<lPG@Bk<%M@;2ggp%5rF@KY1LMuDpz{TtmzoAWrWCk1=#()vbk~IpkD!U
z9kV8-EI95N8Lcu@Di<oYTgZ`S{2K)>XU0f{JM|np!1g>KexAwB!N-Vddi%wl=2G(O
zjnG*2CIF>-XYW|K;i!By-MvmfmIZzl9pScb%KyB$LUzYurQux@2u&z)VVC!vxf8c{
zvGk67qp&34OAfw~eHea_WifkhiY1K;RFRv@^BR?d&78JOsHAUBT|z<f4}$t(ylB_`
zt&&%?5p<%Xc#c%IXyGz-G-<PWD^Xmrs&a_h8+*pJ4tlqshm?6BYvk6OGQ=z3EDj+I
ziaSpV8I-2nB?h*$Fhj3SwC!kREHw+YS72uD4m~@shf8SyZjH2-`I`77Wi?Nyxlk}>
zF+FPG8}4y5S(~+uhrkBdE(htrpD5WK)9T!f?4h-jLH%O?THQZzGR?O}Q}z;cyDS-1
z@|~`E&SP_=6V4~h!&0=!PzwR2(XceP4d)tjr$T8`h_^6q%HZ{e_V`T;B)^Ar1!g3S
zWapRrN<eP)>@0B&baK~BdUKgt7aln3y3F{@*qf?z(|5b>ph}6Ih^FdM_KQc?fQ`+B
zw<5#cjuzuFAk>?mTq~!fS*3~^C{&|5agpU&sTzh;=DCM5d(%~;VG1kjn@)U47UHIh
z%B_vHds~BVkxwFuU{rr*VLz?-R%d2idzV+3t8nIPE2P-F-n)(cPET{4-|+vu%Lkr?
zdU^FGV~DM00VlBOdT6t6t6q6Ue)!BC-<W4mbY;5P{Ce>#*)uQp5OWq=8v=~LIfO1D
zot{>l`L@BJIqrZ}8R6VL)s^ssR3ZuHKF1FxN?vYJupyg7)V+_HtAXd;ot!U#!4bb6
zF$xo00#oBMbNw%l<rfI?^{?CIU4YovgHvmCs(f2%{ccBm!6Ap176}EaH*F=BQ*>Ez
z8kavMjx$-2hUeaZ)j>0R4ZT}e+Y?eu9a&#=z>D;;GYMc}nt4_!zDyoX=;fFu(ZbTd
zgdTvQHv}+k46ykS?240|pU@)O97>598SnMWpxrkCL~($ldQw<-xZ+#!7i2~B5;4<i
z3A!R_3Ob`;7hrLU?9XUOlelkps8}&xOWX@^>%!XQsDRU@TzH%Lw%kM6Hn8UMP=Pr1
z55kTmpp48$%w_vr|3nwi#ywV1i*6{JiE+=VnRiGRpQ2JkRy}!!S~GADJJXK0d1v*D
zf%en8z)J40lSm-9L_fO9`Q~w!Y>E6@zdYbtxgjTy5Gjo4z^#R{ZMY8;v}*4DjxjN`
zC7%P#UA~rmM*3uqz}|g$7d_}kon68_m`an%!@Xn^z9;YECE^*vTKxbxQ=-BBNW>M8
zWyJbKkvY~(1D-RKdKLZ_Jbe{1jZRT!gFUAN{3<ca+Z3*gMNDs*3rS10O2%56`j-?A
z3SDfTR4<CBomf*VyaTq6pyoNcMwt31_U@$1?JxS|e_i`|qR?A0iPxU&texKQ-S6}`
z;^Xd%b3Zf&5F_Ad$#s~((R%&p8lZ)33h)ECUP0?)4illJ8;Cd$i@uXes?!xq4~;!V
z#LXcWPk;u@$-CAblmsvdveF!P$930Gx?nfNd=WYp?7fqH%ECe}c?Q3o6PM6&_SZa4
z;eN5-{LLHB*k6C~Hy7nUlfSMX0bDTm{RxQsfx+q??08qB_}De|kw{2D>c{5GB<X^;
zG#x`R6UZNqJ-rfuLOblIvm@a49{5L%2|#c3Zeb0;&z1R0IsNn0&wmIk-Naw2SUqE|
zeMg5N$3LM%GNSwCpvaegjABTxfLiDQqhcxQALtMXM|Jmk>CN4@K&_{Wa+xGW5a@GC
z&tR`FdBGM$$y>WpR|5Fd=tyOlw+JG-b{m%NDil)%XGERTZkKnZfZ5hbDdm8=EF2Fw
z{;EK)SH<U@MuH8Z_A(Rt)-pwYJpzCQ)dz@gxB!@N{W73Gl>tr%rGIy3%AZx(?iC?>
z>APb1Z*Yz-L7<_o%DiU0Ih6Sg0lN1m0%T^#zGztu>_k8SL^|-I$R)Cn!<v$x4M@KC
zK)#J<9t1Wp?rUDG=0Zg{5`S0XA(d#^HNc+}@CWdsq<~$<Ep36VG-?=@RaD?mkCayI
zo>L~-Q>_b}ZV4oGOp1>vkEG`907c<|jScQONyP7Obzyl{)=>*nN6Dt&ZJG1=7nDJJ
z`g~)2k!vZjsJ9<wG|AJQ*Ii$+qz{2t2GEnPCG>GTdqKUUX7cKsQsnoyh6+Ap>f9y^
zai)^OO3{|hIWPYH-d8-h=>(!Tg)=-7zn;JHvqQs=zX>dLr$~>}wfWF6Z+TpAxt5XY
zG_sW)1E7|6KD7PWMec{SlGnnMN;dYTQayF6Ftu@1?EtXXtk&7C_K%Gr`0%naD$p2a
z4n4q$D@$2+=Z@E}*bB+!%$M>n<w^x^0x~-e`*Y~(fAsbw$z|Z7P7od^R3rYjrljzV
zJ{BRM={Zfje{6>D<MG=IqvszInIy7ZgsFFABEOy|b)Hn`_ix$L%dx$=_ww=SBh<t`
z%YT@HXOHxx>0;~Ipo2%;1>n7MlhA*>t)T)zHDJ&gxM1J+E9BE)I5*&Yy(=Ev&%S4^
z#zXd1oXGu;Ga+Bk6MXg)NNh5{LN`5?zX<~08tIR>?CIb7$oD{MOX+}hPYaUs&o_0M
zB;X8FjWD@H@x!&g&XoUc1~WhzVo+79eqK)W$5nU<faoN~(tq_l{OXS(Jd_LEg1uYG
zkH!ptvrag&o<X%wGtoo-_s;(2qj&SQfLmBOG>Q4=kFFa5(TSv8k&yZyJ4NuDxb&a<
zPjIsPERl}PV3+&HIraR5J%HK#tLgXrLlSVTgcGZRdHg?4?lUquP?!y>oF~ov<0_tF
z_W{)2D0M{eoUs0FRKU-KSh;xv|Kg)T083%ETdKtKm)m@QKE{6o7ii%B1}+dp{$C!r
zA3okaI2?qXvJe3|(#GEW2am&rG{9>HI8YuqI0!gB9ymB?qluK`BJ#)G;eT_2&~nj-
zGZ&lrlOJ4c(AV}RJV;}K(}^a4vyoasFyL$?;Iw%E(zwo$bicxGR?hQ~_isV;2|$z4
zJ%_gVEkInp_Me#HKQY4(N$L;F^nZs^{Zn4>-=S3JN=d(E#6&lsc^=0|frqa=PNvu7
z-~9qcAwT^CMltX63H~>k3wUx6;(<Qlj$E<&e0Ip2=)<$<`Tx%mZ{P7Lij#vNn3#zB
z->*~9GZi8`_eArbiQJ#d!2iy9&nD`1;7mLW-(#R<%~_8oJWkylPk@C<;Ajm5J7V5L
z0<Fz3;?A$o<9D~^^bm4tdjAI1zo}!2&Ni`Q-SqxNal$GdpZl8nRMx98`Jcf8VBz~i
zJD&D$l4wc*`D8U_-~Q*q_HKR?P|UdSI#vFQ!p8^-K+VBVA3}cBuzx9B{=40?arl2<
z>!NtgES;TYX?5+ZKjOoKAN&z-0Qk^J=jrft!qUGeKA#IJPkxo`?gEnCJ0}jCUuPCt
z=vlI-%lFR!)>#6VuPhP*{OGAA1K!}jIcrgH>+(R3-{vU_<0TBkdr>rRe*^x&A~KJ1
Ig`d3mKY#RuF8}}l

literal 0
HcmV?d00001

diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index 4f6d9ae41e..b75277fee1 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -123,7 +123,34 @@ Most WDAC-related issues, including app and script failures, can be diagnosed us
 
 ### Event analysis for an example blocked executable
 
-<!-- To be completed -->
+Here is a screenshot showing the detailed EventData from a typical WDAC enforcement mode block event 3077. The same data is shown for the 3076 audit mode version of the event. The table that follows describes some of the elements contained in the event.
+
+**Event 3077** - WDAC enforcement block event
+
+![Example 3077 block event for PowerShell.exe.](../images/event-3077.png)
+
+| Element name | Description |
+| ----- | ----- |
+| System - Correlation - \[ActivityID\] | **Not shown in screenshot** <br> Use the correlation ActivityID to match a WDAC block event with one or more 3089 signature events. |
+| File Name | The file's path and name on disk that was blocked from running. Since the name on disk is mutable, this is **not** the value used when creating WDAC file rules with `-Level FileName`. See the OriginalFileName element later in this table. |
+| Process Name | The path and name of the file that attempted to run the blocked file. Also called the parent process. |
+| Requested Signing Level | This is the Windows signing authorization level the code needed to pass in order to run. See [Requested and ValidatedSigningLevel](../event-tag-explanations.md#requested-and-validatedsigninglevel). In the example, Requested Signing Level 2 means the code simply must be allowed by the WDAC policy. |
+| Validated Signing Level | This is the Windows signing authorization level the code was determined to have met. See [Requested and ValidatedSigningLevel](../event-tag-explanations.md#requested-and-validatedsigninglevel). In the example, Validated Signing Level 1 means the code failed to pass the WDAC policy and was treated as though unsigned. |
+| Status | Windows NT status code. You can use `certutil.exe -error <status>` to look up the meaning of the status code. |
+| SHA1 Hash | The SHA1 Authenticode hash for the blocked file. |
+| SHA256 Hash | The SHA256 Authenticode hash for the blocked file. |
+| SHA1 Flat Hash | The SHA1 flat file hash for the blocked file. |
+| SHA256 Flat Hash | The SHA256 flat file hash for the blocked file. |
+| PolicyName | The friendly name of the WDAC policy, set by the policy author, that caused the block event. A separate 3077 block event (or 3076 audit block event) is shown for each policy that blocks the file from running. |
+| PolicyId | The friendly Id value of the WDAC policy, set by the policy author, that caused the block event. |
+| PolicyHash | The SHA256 Authenticode hash of the WDAC policy binary that caused the block event. |
+| OriginalFileName | The immutable file name set by the developer in the blocked file's resource header. This is the value used when creating WDAC file rules with `-Level FileName`. |
+| InternalName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel InternalName`. |
+| FileDescription | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel FileDescription`. |
+| ProductName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel ProductName`. |
+| FileVersion | The VersionEx value defined by the WDAC policy XML file. This is the internal version number for the policy and used to enforce version control over signed policies. |
+| PolicyGUID | The PolicyId of the WDAC policy that caused the block event. |
+| UserWriteable | A boolean value indicating if the file was in a user-writeable location. This is useful when including |
 
 ## 3 - Resolve common problems
 

From bf3ee53b277e3989ba6bb9a2cde9a483dc16aca0 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Wed, 29 Mar 2023 10:51:57 -0700
Subject: [PATCH 19/64] more changes

---
 .../images/event-3089.png                      | Bin 0 -> 271680 bytes
 .../wdac-debugging-and-troubleshooting.md      |  15 ++++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/event-3089.png

diff --git a/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png b/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png
new file mode 100644
index 0000000000000000000000000000000000000000..30d2cba31d423fa89e15c48adec4ca5f7aceb70c
GIT binary patch
literal 271680
zcmcG$XIN9));6r5pmdcc9Tf!WAiV@d1qJE7_aY_qP9h?pbftGt0jZ&P2t}lWfDnp+
z^b%Tt0D&ZYVV|S!=e^F>{pb4uBxGi;Imft1yT@GXwW_i_DG?pfxpU`8A1gdiKX>j@
z$hmWuk1i45{zE_{QH}d^-c4Qp{<)F?hBe%q3pV$j-aB`$ESeZ?b`kgfva^Do+qrX$
zp=Uqmqn8j?=gytxJbrLb)7y9h1CB8qO=t1VaGm<>0J%4!SmW~uVSVm01KoU}E@tO`
zrv>|^$B*df<wO}5u$_1UZEa?Xt<kww5~lqk8k?;YZy6Kll9^LpO(Px%;amCL;^t(S
z+9$ifW+&Sx=u2>Ut)F=Ajo<24!I+>RfuY}4ccUJvV%JMcd-V2H9;AGIW^cjGiP~om
zwC5L+0Y>gW*kO@<e(pTpg-aB_d6DFX$DHhTQ;_8k<IbiCyv4sCdlMQX@TvRX%p8O#
z7}D4JSoqeTr<P@B;s50GZzg?@CwF3eVz1cUH`Fc6{l}S2LBw6Og3y)O)yuz=!e6@+
z=jOjFA|fInC@2^jYHRy@x&8Hxy4yQTd|+|XXa4?;Ti?sQDXz;c&ot6s`IFFDWLYk2
zT9RC6WbC;AXBDyV6JPM$7=Po-Y0<@<#BFrz&vM$=Z&4R)qSj*m^GZx*FI)&A>3XnA
z@aM5vFg!dtU!DS)Kg#`i%kxW@NUq1c{zCfav9geh7ee;+H3R;I$j@J)pcQ1fmQDXJ
z#u^h}B3Y~Yc>G%f_>XPi-(callx4p!`Y*;dQB%+k+p8h3{O7B`TL{4eS<|lPN-v%M
z1U{VXeR){;KfvCt-~6+BNnSl~i8-HqY5LDAxU{ctYU|+OU~Xx7YgAG~ViJBlD!PM5
z6TCz(`qBVW&yU>Se-kj*Z3G|zlKVqb-FM#6x8ol|E(fdSya^5<2T+2<;DjPmw{z7_
z`G`bioWZ)+Zf|src!d~+F0YFjT-Wh`I#bL0t#r9y7}fiMO7!G+TTKGvNqTN51Tir)
zLnM#5nJiQA<jU#Od)tP&AS5)#-ewd1$K#NZyoFQcP?+)bHIVm5XBY_enNdJByJ%28
zgUn0WBk$;)?rFLAO=OR*R}pyk3S4Ga-y1YI=e+88<veoWMYxkc%eTzwNIspZLuYT>
zYI)VZz?PV>I`JkxDYPordC3al7W3+ZhQm{{eAEd|Do&YxE6UG`L`5~mG`2nbhIXA7
z>gn6!1!(zBd;O00-|S58#h#LGd;mtV{<CV5GVzLWAok%*=4P?9@HXwl%#8`#w`q;u
zW1VQU1T?G{lrD!@&AqE$;ha&LIg%ZB0c(TNo&gV46$+%rn%KY5fuRe5k!C(8q?Oa}
zCp=rG008N!dMUt(-&{)R+@sq&X_@FH`tW-$dLgNj?de|BJ?Mcf!EhVQ{vcO5pH-`|
z<Q7!8h?AIz6K%tf72O#-X~(Be^xBzi)!TRv{|!h-ZhYx%iMdbkoU(K%F`Jv5z9Q##
zm}1sl#~U-=4M;3un}1^sNbP_W$t}AQD6s&jye$=ADJZt+-Z!wj=rBk<yl<J5E@@b6
zZKNwB*-!%GA>uai)iN8rIcRY3@pBQaZPG<l)#?O%nrt(LWUM>L^I0|db~v$)RW$9l
ziadv>A87YuZESk512Tpr$K6rjqqUoBuZSV_TIX~jx1avbCuFMxvc~q_-|rM72;Qg_
zwq~)bIUsINK~XZi<;lAWyH*c43Gwaus6Ghabhd@b<@8-3@A!IwdfM)=aeWW#lKlGq
zhBAp$*!7E2%LOeD=SDhUt7|4`{}QtDJr|=&?r&dqwsluV501N*;A508SPNhHu?K-N
z$VS07voe)jQjHJ_<s0XUU_$SH;|~LyFN7GnFNBolDpRzr-8^X<AqN-|-B*~cj2g_G
z@w%1fWbrU|iQYn0q5oStnS2JQcHLkcC0f(#71hd0?-W-uTL%cg0J?G@1^)15Hc3s^
zp^H03!YJJYPk?qiWS=>&z=0J374!Kr_(rF<{8ijqW57|BdF~tH_Pk;`Vdwz;d$xZB
z?Y>?Xc_3?Vd%c7jtKOH-at$C_vL>VW=o>PC{dS`@FCMD`j%jbMMDeTm%1lHJxX;u&
zr$RxrO!a$f&L8LyZCvewqBF<-&+?n|@C4q=x>UWUr5AKlwA*)Ax^t7i^8%d}u^lie
zuYJ(qINHpwYBKeo(-BiF5lLiZ<kN_Vh+Ba}LqjEOy!D7cXRwxO*IIx8$6{#l?3#YF
zi+nAzpuB{^N8;P{M6qrr<T_w?KV5*sGOUDemex~KllHJ5UW76t5v+655p!2FEU|7U
zb*W3~{(3ua;Vsi3;5ry)%YjIuhfPzIMA(0eW291M_TiC&-X;#?gj-bi^<p~M2#2G4
zr+9c{-F!{FkFvQ<m)|)L?OK^l4|6TJ@|SJxI&ce&_Pl{*ko$pjt1l=uA;#t&I{_eD
z^5|SYlJa~>BN`*h1U>^Ar`qyodMV?fBYE(MGJZ3y1@1BCXT^fEuy;VmDaR;qfu{k0
zv;oB9Zg6kSkT0FEgDq}&O%Rpx(ZR;`dR`B#W3f!5$@q!m*jIoa5bN8_kzqq`?)wt$
zU*r=&X+mz_Gv?n@PB7X?O$6C+Ucf)hQ<C#J<<$pS=z6uMl(W5`_n}T)@h)F;l}AWT
z*RonWariNg`K43NJplv5ER+|*z<k5KMV7Ol9jqa-9%YyU*t1p}6-Q^oe)|sv#UXCf
zA61GYp?9~~Es7439jdB4cQJdu?1PyOAPDyfy#W{m$Mi#Jed-1&!9kha<T4S<^rDt4
zW0c_S$)w$Ra9S7`z7Eqn@h$OPT0Y%$@N1sh{D}EY8n*nlC5lmU*!gp3C!CBcoN&$M
zb4++!IaeVp=C!EY)Fq;1U%YkLEQ`>orB<kMajfv-NMvGcHy+p4;0vKUovw4iI>83p
z;H)imrirJ}jie2B?@_h6w!*Pb3!X0togCig-kN6NB?yl5HK{cNofae5t+l;`f#_B(
zdneLEz?WI>tHFqAW+x*JD$2J=p@#Dr(Pi--$}&c@HdR{74eSzH+5)r-%n<;R(6$ow
z$r$?k6(jkX0Rv9EvzZrF;?kp0@SDg&Z{9@0;13#X>9_j_N8PVUORjJY9BxS2yOwmq
zw(uqAee^LB4hRo*+ZtNR;q%`gihe$*fIXhD7dBxl{O$(!&WeXA5IW|`P12rb>qJxP
zCkqA*@0RWtv^h~JW>pR;H)Sgg08tlK_NFG(O*BqPOZu*Q43%@Uu#w6bPQ2e&>n{&(
z#I)aTZ{D!1b$*KW3$V~NJ|4VBZ5m6c`T1Nc=X(Z8X#ocLe@;93GcWow(C)77<fqie
z=(KBgOHH<KS7PN@p@jO+w%b&KRbY-%GmXUqyy|5pB%eO&_q<;doeb|Zsa?j_-(&MZ
zD#GGzDC|_&X9UP=4%R~43Kx2P)23@@1*`zPB=+;9r|Tmh{3~^)zqCfq$wWc>lUKL5
za@efiErgJz`F?5GkZML2IG}R>6Xe=ewuyt!y&8vj(6@i)rdRHZQ3GePudEM83cytp
z#24q(F;tG0Zj8Vp*h@XDR*sIWs1X5pTYE=yj*JXLV%!taC3=R`dXU^Wg+@Z!jE<*6
z&-lpvO#;PlnHQBirhBKr9LR;a9rrLIj>boKUVNGvNNBvXq4ACFAlqT1n1HBK5-aBy
zw)yl5Lz%x_?H%N?0>{PgRa45sv+?xnecK;YsKv^%x!2b=nPoJ^$e9KP%eWhc7wZzs
zA9u)Dxh4AQd(7NA5kmp^;5gTr$(KfsC<@qg?iKoW^nioMg}Nem!*1WCv8J7z`OZEY
zy#+OQ(nH`D2Z3NmEPJ!D`J)1A714&@C7QNcS)GBbRs9**hp5e3?FQkIla3|59w%Oz
zwAo@F4|svI9B83@BgAqJrq%hGgxu%z^NpIwAf}SA>-Xp)Bn=2|&J=-;=Lkf5_S#GC
zSigDIiXShkzQ<V3M#c{OSnUq2v-U45sb%PD&+!ctmFR6?0{W{kzQ1~+wwvB~-MHYL
zM9{s4h0L{)yunT8NsY#P#vb@hgZ&9wnd$QJig%g<I0!`J%9B62iDw{B3KEQZ4txZ`
zJVsS_dD%5jU9|jJ8GMejYo#=oNKe8<=Eq@LniN94pK|W0+scv<`F!-PORlk~jt@0=
zRya6Gu?WX>4QGC^g7hR<J-aT<JE}p#p{SVimD_92Q;ZUyVHe6qQ!?>oA%ZVG;&js)
z7YIvx;(OPvRrQUPXk2|w4DoL3xeqI|nO8GtZ=$LFcQsbq2rzbc8TANa{MRz2h3x}6
z>b<mh&L<3nZUD`KtSa;~4%?z)H=)$IVM2AbK89h1{&qP>HIBR6#^~)QOOL0m`8JgQ
z*_LFpnq`6ba=gd;amg&!y|>b44lO&Lu5Hl6QKY^8B&f*V;ob8cCYrN5{*nZCxDfBK
zsKGm>igG**&6HxOp!x(%-VPJ(Ug%$!1HxuFARi^y!37|?xTv+lP8yBtFGIaLxQTK~
zEJcmN6>r5=xsDD$s=-*SD(z#;)|MR^W@CNWpTBjQ5VQ6~Gqxl5T9V9eke99oJikZG
z2-x-i*dU>adi#|0z~^MgKBw<Src-6PI?0ADZKY<9>y-t`9<EwjJ&q!C;Zb#l*yNx)
zQ9Pt|;W*(7+ACGLYukyxVd6D=TR%H@q`0ScxUJqCp`@oBNj8-)RyaQ!^XRcKdt!}U
z+)#cuYJ&foCh>|#X9G7meAj_(P;`J_s7`6fa_74oIaPV~;&rbS8^iV5ShC-gwn?3M
zO{63~Co5DF0)jANKgRqohusCxO4+p#s~J%Jc^|bS_t6v%o#_-la{jtv!{l6-okt0F
zSyGB^Q&fR0G{NBseB`1|5xwpX{wz{EE%<iVU#x2Z*JpROD2qM)^GteQXcaKWCKEn^
z*71+zAAVdgSZU0cc4hxOn{RL$%|*_yE7Y$?px=$>{-JV9;e=WPW|FY<ZUd;uY0>^B
zKe6N(#TRy6a2;dx%ymQaX19?2%Uq8}Mv$@6)uCQ!BxCgHW_xzb-46q<f<C3aYu((m
zj5Qh|I;TJdm(a}9cgs-L;<S6Q=jA8V@6osKhSNP{tWq~fJ^5<jlvf`Xmg7Wc+1{Pl
zW0&HR-;bS0|4kw_L%c7-|AEP-{am2(2AC=A(Bn3FhWX>L?(|(?b7GaxF-<o1hA1v6
zv%kqq=YB9Ur=b<dnjTT$tb}<Uw;@V1T`M3}x`1^)Ev^X>c1eyboL9dv;Yxx5e~sF9
z$4{%-Ynb-Qn>=0yrTg&Ef9s2cp0=ges3zE1MNKO>xkrua#$y~&?%4Yg)OszN?_I$H
z6>>_V!z|AEd)FUB=BX0~dV)0S?elk62RdiH#gnDRmlX7<BL=3{mTci)sVY{b;s~`3
zX@lgppnwc~f#<v>cB9)AZ?s>$xRY3KXL_YG#^!m-odxwwHZ7HZHavd9vmho|rzzLH
z-X@&wb(xeM>Ie|0(Fx|%=HcAXK7Mq#sHOq34|v3050ZVN4>Il7idEcCleu~zjdAuq
znhPDddSO)YTb}~#WPH`1`82N5O0mb#!@lqBmrftrt^$?QM&*N)z>PIouXUX7XQui7
zIy!90a@Vx}W_I`@--zTEx7gyqQH=mrP0Fb6#ao_!S1<|1gtrB>O^!W?EU)LS2GK`5
z*MWo=A;*-pcbl%g6aHtSB=FvqRToo*OTvmJpWYaI!11$n4wuL_Cv+;l%GPtv>@?5r
zmX`T8#dDUs-AzdfFMvhZ#kefuiuBy)k@-C(a>dH0yQRE?&M{=-S2IAiI!ANaHF8UW
zLd9dSEl^dm6djM&NP&u<bkZ841~!#E-r%kQ_{4o#K(fu>JI<**k+j-f4%0RA)C9a%
zh5AB%a#eG<XO|y&JiFQGA&QmC0=kMPhdVX0W~fbMruF3b)Z6Dxsa3oBqo=%Wb-Y)z
z#X89Wj0cR}Hy-ek=oHrh_Lr81dISYM5*X|y-c}3p3K#d2{iZ_QGt62EWEBwnu(P=r
z)){QpkC7y@!xZ9)@rD6(GkD_55ueA@vCsgq#)M{4V{BIf*{fNi=pokF(M~YmV1j8~
zm2*%9+GP>7(;m{>@wHdhRZZ8^YIK-qEp@i)y1H-ug_ehz8GX2<56VuPGjLU0S~}Za
zsM64Tsa#@D6Fw3f!7U_%%`iX6FPAgZ$q=#bVY6Zn@~69a_~~Kzv%x(Xq;J8qJP_&V
z;1^Z>9@`K>o;W=A6kbOUwJwXk+#dcRUcZ`!LHuJP$TnI^jPYPIKf)Ydo$lE=I*J7{
z69K*<RXGdQRZc}{B*$=KVZ|oCs~jGSTd|pdL*~?Nj9!Z+{l?xii1uapZxJZQIce%-
z=T>3`WGy?Rx?N8(hoJ@)IqC)TymW(|Q*)szW7edPXNjOlY^{T=u@~B_k5b*hv9EsU
zmX&;uv-*>JSMha3W|;3>_4*WX6Gb|bLc-}1QFWeQFQzBbYyqFXp*QVq!cw=K2``QY
zQoX&J!?3lPsbi({`n-gTQKl!g*2n868|@+7EqPy+mn*VAuT-^@-ULd3^Q$DW0|qHZ
z@}EgA=ZweDj|HoYZekYu*N$7I5n160!RtqP*8^+ULqZ_2>g?gPAnmeGkC|c;(leW$
zsC@nWy;rE_8~?)-n&~8{wr}GD#hL{^MzED`b)z>^8i?m>V?={v9_h&E24h;8>Cen%
z>R*&qCV3$rs;n%_Z$1Ib=jrP^qUwidhcYgVA^jWg{4T^4;{{wI>E3#=NkqO~_!vGU
z`Mw5B%j8>Y?5t41Zm!zZ-eA7^q(Yt~>(xE>;ByJIwXRyD*rn_8WSf^q<%&t4cfZga
zds(O-4dT43du{v;Pp{Afq{lSg*P_6Ph+SKiD8tUqF1S1^s4@6%bNRV614sc0RJ>`s
zn^Um-ZUx^-0BiyHzF4mro^7N;BZxHg){+`rC(lJMyIVP{L|lFys7U?|%5I&rwg9iT
zTHtP1^>NnrG)>T3#ns7(4}d11$|(FubzH-r)tEMs^l_`6@Fo?0rGCHiS66TaV``Pj
z#OY0ynq9At>1229p{7ZAU)Q4m0BqY%eop3-^B%~cYxRzK=>l4t2FHH<b&F4%<r5eS
z1T8cXqBKu=<vosR0GUPnSpNn5iP=Nm1aU5_yAq5&g(Z@0yWfiqEDnn3xq{&8o`u6;
z+o+c-^m&!*cwe%AXVzL-fIwEYJ)HZbWCHn`hz&zd`Z&dI&5!`gup{yZ!J*p`q86#_
z<zmvvCd5ctMp(p6fuL?Va@d8?{pFX>(gN5<!Ha9^xv!2lJDR1zAK)bnlO8q>c~q+-
zb6w4$?Q+r$`4gK*4NS+}1zE4PMBbLCj>NZ0OR9e#4o3L<?p7r;@4m^afO+8LC?Ly4
zPV^d6<Q0_z75Blld3J{JInQOO%CpKA0xTTHK}@Cz$0pv9cOUD2RU>R*Je>+PQM?{f
zQomlX5v|z%{iV~?nyvF%R(DQA`S(l*W#%r2ic2-MGAcfwKMtqOn)DS=o;m^a4!qXh
zS&32(22HZWYM*!wm2-t(&sPr36vb>mIoM4_Z+{B5zY_$1GEuBtL)SR|jBoQdm6|Ne
z%jSzAmbF0UW3zGOm-OIsZ)kN@>GfkSnlZc<eUeE=4nVbkX=|$L5%-gvAsJkcK7Zq+
z{J4<*6+o;UXwrAp)duIE3z3;*gPpR`d54Vo8$fN?2zjU^bAgTuHG}$U=bKs+N74B~
zbJLy?a<7=jH+!4a8BJpkbK)C%5l52YnDynCfJ%6_ri#UiSSXGx_C#`Xd>Ef{>YVM*
zvY9ILC~wdtXKfHqAK2WDtxVsu(^o2od2HB>&PHqiJDQK^{B6VbWQg@S((^i+sjng_
zv11#(*s-qxq=(j~9#bk>D`5QN9Xd|9ug(Ja#Mzq%z!%jhVP&0DGP(9bA{}bA@{p(s
z^$-p0pIadYr`}nXQhcr<W>awLWOI){Shr>*d&CMNgUL64skR}j$NQG^kq&zM!Lgq)
z%H%bU?)%<OUUju`{9=~e?`VmfmM`Pu<Da^^6zI^atE*_aSDa`s%_6F6(6V$Z>SXZM
zM@s*ki2Rp)>$?%iJpwwQ#qr)#aBij#kn3{RZ{ka?{+YmEPQ!8i;-WbO5B_)&3JzS)
z#fANM1pI%mxBT&JQi-yVhku@wf_9$a&&#~jrxuu9R#x`<&6_uO8*v1lxP(&sjen#b
zf3C5QCy-In^TYYb=x7+DE;acLi>_}eZts7?wEtL39IkIAcKu)UYuq$(O&ErB-G8$j
zoczdsuI-;+EPwnDCQvJx0QpcG-QRe*|9%u$$HOlpW9;?(=FOY;KF8EaA3pk>W&cMl
zeHMXn0=L2`5I^?(&nvn_ktB_0g56Eju(2XZmUhd{`xk4<_-_|-Q?KLBzt9!MYEz47
zGa^!Rtu2^%MEi5h41M97f6h#PK#P9|&qFAr$gs}!yJShwzgQOP)_>ZnhhOtG?6@qt
z{8Iuf{+Y%8DHF}hO34D2?(USdf9_;HZy_P_U!b2=C|<dK-;yM`wfoE6KYz<q^@4s6
z?Jo9YoBRnF8T2o<4!OYOzteix7}ppct)%Dv7ngVzSS=Xhe|j>z^7w}UWuLc5Q5>NL
z!AvrkHI>1jH*`1tJ`sUp3v%4FKXm3y5-n(IoRi6PdG5DWcN>XA+VxB##(x1Hl8hF4
z0*IpTzwk0FUx?2KvNow|68?P^|Jx8v&*56TB;P-*Uj6gfESj_Ka`s2Ee=dZ6Oww|W
z2-jV1c|64S=drSUI7hL6Uybo!An!aSuDkp^_MPIt7;B7kwrj!fB>wltf9Vc~5_}F^
zclq4yhl&4UY!d~pAxZqu<0q{D`2~S0&as_S4&(hDLHJ+Y`?BJ?%QRu@{{{+KxZps>
zzJ!ttY5Ste?IktaIz;w&hulJPSqdyar@uV8Id^o|WA5m{ULzIe<b}EWbTQ@c1OICv
zs;vAxfvhOPz!B8kdmr{+LBTZS!tVDV?sM73bqABqn^j&fHw9Ep>t9^6Rxnq-YfztI
ze>am9Wc=zqSVpRRDQ9tKIN{Av-{0&maP5j1Q^qVvzVYDBg=ac(8!6n)W?s@F(n8r(
ze<6ea65hyFTER>BqlAA$3c-W#If-qGe49iD)kUP?6-rlSVi;mxugQx#T{?7XVAt~R
zul8#v#n|3Y{~HiAFEI?_-4CG-tupZJu!r2w^6a?T!0v~6`s_c0TBNSx&=bu*rTQzI
zP%3N@o@y(5{hD9RIEs<DGisC6uf~xi*f}uivAGU4i>thM^NNX1FO-!Ao-r0USp1pV
z5me?%7QR>KW#N)We>jH0EOc<hppR%o`BDt{AIbd$7S6QFBf#Mm&tt}G>`NwS4|45G
z=RNd}56jw+<5c+LK1Tm_>BqRkH6MVLcm5{$tVgCp?@DclNasTOqeE#dp0}2ni@c`r
z46X|IV`y>lS2-HlCl%lOr77Iu9~29JU7W?M^WXTIkGyMHje@8;Gq6n`ouv<smRa2W
zWYVsER`_diL^v}}yZkr7^(D#nu&X_hF5^P49c1K@CYP1j{hx|<<c>4Cf5-RPPD<&f
zF|oLEVbkZoET!c+?gYp6oy)`0zm(@@{5_;oj){JEI6<EKL~!Nyw{yS5{mWL8lmpL`
zlf1TnG3(-3>uJkDva~d5-_AIdNxn3D(;pi(zYUo-M(jQ78U}f3LilI&B}c>sCVvG%
z{>%$bNAsWOoxOtJtk=LNfKi=?8&lhtV8#ZXj{KAms;zOR49F9~x5fGCCCt>o$M9!)
zR?m7MoVg3WS&`V~y)+Yup+R4YD;l*q7v+u7sHc9iP~1pe;1$IH!1|B6$a$pa!qEj_
zMo%dRzJaAhZ?2WYN&AK2`%7;0omJAt%*wu%61*_K5n<TmPn$|I3w)Ru%%x6aOav~=
zYj=p4s8aGY$(^6%YCcrn9;6?=4!IWwGZaoVu)39FUnL=_Wg^M|mN90I+aexqICPWx
z5OAj?dEUdcK2#HuSwd`mwDDEy%&GR3wtOcD`Ea_*M`rKUq>1LQ;h>_qG+SlmsGHVw
znG^eQpLJIee1#4Q^O1?zxWiD22)E+=I%#VYvhrl_m#UXbT1ZVud~CbmKyA>gM41f(
z1_){O1`)zFYvT%p%G2?(J&g&ygmGXlISjvP6?hQ1HeY4XRuXpJW}&|%n2zw14fA(i
z<HqXs+M_aO*ObN(y2@*uClua@$sSa|S`O`(*uhQ2CW1kizWNiqJxnNTqV|{{8f2XZ
z__YZ3i%yq(`Y?(H)HRg4#wA`-#GeOCn#xZEJ8EWNlwKT-0KTsi+wyb19LCIdpW%Le
zbJ?7q7k)5mJR$u7I<A3YGlyNoWC$X!oyAjb3fjJwm<>7TJa`{6Q7g)jnsn)!k9f7H
zL*LA6OW^%o@&~|LQ3u6s<=j^<0zkJwD*S#9BssM)o>R#euN8#<T9<WR%Y5mr(@$l-
z=YY*jvuh^TM4SrU9AgdwI30W}ciX!krkZdY0vM*Kqwg5vZ}32Ky&GvcW+3oDkrM+U
z6EI?lA~yYHq+j$?W5TBl#D2sy(k`_IZHe#)ZI;X#*393nqwUxAjIKel=RL-<q|3>R
zU|V5s?hd>4+v79-Tjh04H^05H0@vjZ$+#FIWzx1_XfnDi>@S<)xK=xdu;@5pn{bSy
z)nyVQpShxe5bkHb8g!f5ruAq7`CuX-nP#Nw>mpJ?+a?1E;oE_n+8ymCcwf{7J>8pM
zF697nUyQW5x1awWA@L4f&)Gm0aTr5nr$IyxyBLtn9)DKvv}|0XZE1-~Qa|eLh#N%o
zcZMV6riQ^gLbDG=Uv`>AoSF?{837bL{@4bNqLZMu&<}iC@-L`Y7E$K)G4|Ed^hC_~
zUc&<$sixAuJR1Mh1!D={qJmzXmyVsrB+<YUH^<VNBpXYZ0_S^E`-ROFq^uVvfD_d2
zxG*C&L*D~=NgYgY-l8b;Z4#cb(tZ=sKC<D`Uu`kh;j4}E(6pBwsf7u<fSAdb+Kt@X
zmv_wVoV+?%PHP9DCDSV=E3JaUd$WV6^hb10e+6G#15>qev^jNGSs5({vyg33<b-h8
z`5VZ>aK%>2pso?*17tw5H#vI)leo73DP}l<&nu&<Y{I)-lMPv7H|%1yy$6|~j%rFW
zx~ci?-koo9zEb43T#UX%Ol_aJI8*E;5@XXYg!CNW@Jh14u+S;HNx#2Ru3Ybk5}*Dd
zVX&yU2d*EU_@<5>-C94N`jTua8ITw9=2wwPOA`1nm6<%XPzKJ0bU?hF4^4-J7Esyd
zZuv7q2<x|i=;wPg<)eJPgo1Su%R{PHWHb_35h`@%(-d3%_?!e5&xo7Gk8UGZY8-sB
zADzUN;LDAo4_!cnua!-Hr8Zw_y70uA$oW1y(D`W)9c-vwqPSi!!YiPcF7qJ={+iaU
z3}qrZI5UHcb08sw*ge_at7t)#bKi)ZbT|5fbolsJ5Lu3DX}K7}FuO++?6DvMDodJp
zFLN+&p0PGubD5@?IQRprM?!4(>{r7*LNh_$5AB}I1K;Q`|Hu!|1qM>qT6fPAU?i9_
zz*tnNbctU;CnGGx9?~R2Vx<`2&L0*9k(_*1Sb;U(BZS|nU{9#gBYK&?p^(8^HsSI0
zU2l)uof_e!=FM;3&9_s(>FSeLRyipRqN~Sf{C;UXNgy!k=|V{7f_kcpPrReg^Dadf
z&d(h%ZA-K*()UL1Oooa2S8LymA&$ISQBB`W6HkaufwmFNzOAz6Uy<DHzUg;7xhO^+
zP!T;WpPr8HnJzWW$gNP=EO$vH4A&k(KkfevNRD9HY)lsy*e1C5EBu#Ucrv?4G#A!e
zFdW1XZ5IjYFCoR{Cibup9+zpjk;}a`hwgY~=71)qRXMN$qYc+R>f$ls)I&HNJzz~6
zaQjDa$DLfmt-YU9*3!VvCz&VQVmancq;|>eUB1nM3zlmESgJ%}vRpoR68uGS5}V^+
zCY(h?VrZ%$sv0hG`q=O}yUZP&E)w5N&`zS?>WLb;{JqX`ycE~mO*K2D(+C7KOB*(L
zJHB#ZVKsDnI$rAt6r&ztWj=GLdYl2J6OSw~-#i{2`$;vTd;x?xPQQZwh2@tm@A_SQ
zlBL8fb&f_hN9}w1UaQev_>aC-<<ErpWGI*ZkXmNdQQMf?M1Ct|r{lh*!cn+%u;|^+
znp3;+c+C4d7+tSTvA<{GtLZI!b8n<>nvR|vbZfTaQZ*VAocCyE<qlhmDRd31oQ?+>
zk?$8mHONbm?gO1Gk1sriF4t^c>p%a?u@gKs9jf0Ugi%UpH8Ci0^|r^AJCjV-uJ3nx
zv~nli`s=`Mpxrgv+LoB%6j%<M`D8_HHpTU;u^}6;75f;-{jfIzs`wom4nxAia13md
z@x<Q_N(CO{b++%}IC++}#L?}ky~90(D7dr)#NSo+UVyt1BM&YiJci9$-{cPXKCvkA
zOeEmdltZ5erWvp|^)#A6@fTorF6`!5Jb_(nc=RkGF@FPTS=|;%mCr;I%GO~T3!8O_
z3%1<#&DVI1#;Vv(4&Em&A(n{uWcVvPco-N+OmbP&zpR#_FJWg%c{nLP>NLD`1tpzL
zL9<I}W`xusYH+mS%^>~!tAI3>xEKXst~O~9E8=+&j0;>QB&kzRF1kuNoQ}-5Y8;#(
zRre+qBMiwaCua|Cn+??iIEtvS!wEYI$oq3X9xlnL3AK|z&`wm+8x*4yf%MPhEXf9M
z5J--zODuho7CKJY-z<mq6498RfpM-`iDV-4nNRY<6qJFeo2fA2T%;K~(MYY7*Wa#Y
z;C<0_lnom=lli3XAnFl~j8#<w?`qOy;F&J@4=)h#@!$GJu{EuIi6_9Wci!0%9qqT7
z`YMU|mS2!t=Ya&YHyX^zz{u(ESBkA6#%*{jo#fH44QI{bbw<<7^a7y^ll+z5jtIF9
zdtBF`Y{%Q`Ep$Bop_!3DCqmJnnV~un+@eQvr&}j0e`*_-(6!mb#wtEl-hxHL19?xT
zNI`~NXceN&#SkNVNHL24=xERDr9BPsHH~}+1mQ6<RwP!<yeG*;P!jtSgnRnmZ5x?%
z8A5Pw<HFQJQ@l4O9#9SjK%1P6V$3B=CaBr36^r_vrZM_C>KZnlo2orTc;C+3RqI*4
z5;O`m^f0;IK(Nt|>>`~*H02OydY{_*eT)hcXM#}O-ewf0*AWTH-xBSI$98}JD;7mv
zRsxzT_{)`g<8o_Z4j8r2OYTXuxmW^W=!U+5#PX#5o&`;4hkeaUBM2-r5<TVG;Au6>
z^o<t#p%q4k6J1m~amcS?CaVU|W9F34*wC8~YNg|HKFMArq^Z+5;vOqfBUlOKwwY7P
zcJf>ZnxJrx&1EgQX^JRWa9zgfQb#<y#up#Yjj9Pm2QUGN%e@=0o}J+K1;6&s_a|f8
zLR+n1M&TCv35g<Gq<q-N2z&o&VPUSQtxohnSRnk?uYi#_FWj2o4P-M0FTpNOKw(a=
zVHcB?JsA(?m&2AM=$paHFsg~NHTzn#g=*h>7=(_f6w_`}WMa=2+;Y<f_Iv`_1;qw2
zDLr*q8Ly69li0~IGH9FZh(AoD?zHdN^^-3l_BAabI`e5s*YHN@X@?2)4w&JuE&ST6
zkGid~_kjL<u`}L=*Jdjnrm9653Vj#U3qV8ls%Uew2x64^)5T{#qV>=6A`#>9zlf*6
z7cIg9_8p%cr_5!$9wd1SfJPj8mMrE)+X_mE)fwq478Ztu!t=D7aETqFy}R5#Y-5})
zwsRl*m!Q0&K2@7UEbxF7^b5H5qOR+)Khr38hkfG~t3TY6Bqk{SmA&riun;^|V&F2q
z_SKR&0``y|2eFMwmIkuI_nL<ox4And?xY7tlyGn^9J1m2LCP0O4!apH0$?&Oa!c1;
zUx6CyT-zT;U~*A@BG<+Law-D92;(9gVO(ic=W5llcQ^|MNS|U4p@7a1px94*U%2%3
z+D{6s{bxaRMrQ=tQ9DbE^nXwJ&&hd>OA*o0gSCUwhu>n4cfJRa=Wd?Sl?OO7k!p}0
zDI89CeLR9ysH718Z<GH@g8vUe5~#<EV{Q^uvbN4@fnQ?(37fyapu3D?kN?d{|Nmdu
zcN`_>=59_J{)a{493Adf8}UDG28Yu3xH^7$^%EWS-#7Uy&HKB^WKCbW{YgA$E><4L
z2KEiT{uejyJb&IovGV7=$eKpsn84)s*X;id2mhl%aZ5l#BBh#3r=-Xmiz9RMR%UU4
zBh+{B_xH~_$#eT7E?T}5r{S_nGYWHxt-6(rm&pHxvNr;jJA<Oqzv(ysfRy_!96@ta
zgz#5h`Qwwn%lI$(5}4p9zwd)@n0_Vo|2S3xM@J1`Ne%knD*Hd`3gW}Td}l?0{C`m?
z|IY;&FaJ2G{UJzRUVg-LsVAOla29-u*+-wuo`U2f7YP}~U2kFbI!@oK&Xz574j<6u
zfz{Nu^LWvkzRli4^Oa2pV65(>vB#*EMm0c2W=89j;m<uZ3b9l4UOUStmTzu@(sqJp
z#CoMst+Ux=hJ;7KywCe)YXpm6h*;*o*n^v97On$_J%*f0lt~L6n~WU9>li<sx_D}O
zZxVZOk%lsZk3(vZSs?uJ@d_Bcl3vMp($Kb72r*8nt|>x?+MP&3_av!0N$*!GKMa-n
zKi=qn8jE%M^9a@orylqJLwo&iobjJtIDRW|YmjpH6ZSOifl4O!;Uup~Gq)r7qy{YM
z2*4tu^ESVHQJqv)LQ6OTj=r~7O8Xr+Ok(?I(N8Ct#CP>4jlJjch7S%#PZcMZljST)
z9y2ig?`!?d4am~qZr5`UTv7d7*8NY&!O^Zq3V;+J>wRcQk!AAz@?DkFHNa!5xwhbZ
z|M_c~3QJ3;XjneFb(&BewQ`8P8&3{Ev&3`9Dri%uL0RILda;oFMdb44z6Htpzc7$K
z&$HVo`aCHyKdYAi2b6!?Uf;#Q41y2_90Dzu&a`TU+O^8()};^veR^wiu6s@fz0;m_
zeX-qn8QhrJGYd7~*oL0oE3-U}S_(4B*?kl3e=B~_e|cAP*K^m?#_7It2)<;^%h3)O
zYl~@D(`8>F1AUn~HxCIu?d_Ms2Fpr-f54lp4jy4O<raPM%ynf?tv5lbmutyKl)BDJ
zd4BK(UpiXBj}Ev2cpB9Eocaqb2|05K#SQJP_b$?Qffz4M)lh#TbDF;PGK6ID)*9u1
zQI#bZ7(2HZm~Pg)ejj(D?$e5axvKLNGdlg79!cAbAgUR$7+C7oyB_v^<0A3=9*<;u
zpf%}NaZltrkD1K~exaD}420I%SU5Kqv)+~6xhJ%wr%tN@1nfvtR4=Y*y|-_SGMtp2
zHdvL{wt@`QH2R@JSC=5g<=~YSrT2;Vu&vIb%%2iV$^tmwO~-!5{#WXO*C~?xPff5(
zV{Ip`-lU`5RbNOV-s#0+n#sQwVOr5mC;UO;e7?9|b71n7RXfwJ@YBu{RxV=fJ%70?
zy};80VBT9BqU5BcOL{0I1fXPv0$?{avB=W}FAbmdQ!H3<DTrK#BjIr20JBqQ5}?W<
z;HRK1b5ItY`?e;wM)KxMgj}70rwtF}QadCnxUB5{MD?>rzCz)2MpPo?5Cx2pK%@Bg
zl!qF5g+Erzj(6K@=1Rg$x$uUJE|mmh=Jt%QqAnf4+u=6<QOiLw=Osz-thZqASj~Py
zsmEb!!S{_L|HCoo-eKD3!&!mu8jS;GgydUf20%SJd_{e7!!;}DeQL|{y98-Ek@;UC
z=~Xo-Nsm<|`YV8OmnE?+$rmM7xA!K7x0Oyx!o#j6y8rmiD6Ds{7<YbXMaef^nE0(k
zt*`@dr9+oi)7!G(vTfD-gP(T-t~RuEd!L#kU*zP#D^k3c5p+CF;BRh?+W|u@N|$QM
zg|4kn;>@Tei)jBYzojbS#2|=qTm${U0n=nQ(t&ZX6B#oyG|y`#Jf#6nX1=gJ2uh8N
zEgbwI49*J)FOltoFLlE2jri>B7Y>qiI<FtSVwRd2b`^o*XYVBVJ*-`Go1ou{ox43~
zHF2!{5;@qYKk>P6@a6pt7ZTaJ9Oa$IXjOMR0sHANWIV<XnT)iPBJ`TQy7lqeOEt-H
zrUR~!ZU;Sm5>WmstZ**boFCa*tXTNMsNVTfQ(ESe<ZdN_s(ZXmKHW;7g<?>^bZzBG
zyEW#O2Xf!PaHNK+9d{7KU)mB9hzvf5-j^_#l)7Ypm~n7JP8qu>J|Q?IuC?)_&`n|u
z<aV1KJ}Mr&&#%x3>M0pA4yf8+8rzsfopjDic3odz%Mz7D21MQ44p=zhukbSr+A0C#
zL_z!DFTWuP;<j9>;j3kdj|QU`@)wiuv$KO3PciVFxlra@*Hz?5K6*mqbXJq;1dQd5
zKWn+?r%4-dK+#JRngba;abB|+=KRIY#Z6_vPPa4KHhYvRkuL?iOxV;B3%DF@skpI!
zK>Q*|<{9RPe*63a!$lp5r$ma0MqNf|Ad{2_H2C~&Tk`k05HvYOBujzgiskh4Cl(3K
z;apR--df|8r^%%<{ViKN3R?KF_ofG5Vgx!&a5w)LSMfCJ6Sa-c+<pI8<)msU;XXlx
z_xn>s7|4i0yTf$-ad`o<M$&zC39Xs2A)xy%jx+bD)oljF)O3ezQCnjamaQmh<dDPM
zBsHtQKGlIh#xxOBcbr4N_1lDJX~M#&f@O=TO~Qj0cAqC9%>w3vmwysc{Lk_9mg}Y5
zOjtQ&i~&|KTZFU)whNmM1^1OiOVM5G8$Drg^DtDlJc}>39A8FSC<guuz`vYZlDg?=
zz4`agtvioK96Iz4Lhr{Rjy+I>@id+Ev#HNsD6>x)QjHb!NlEGswOFbiS{lVmHyyc&
zQaQzizMngaQ*_=hH;GM_4`GG?O0-h<l(+_iGvkg&^W|dqDvDA0IywR@w@$y;CGv&(
zUmrYb^<40dm8px1exC!{-}Q%|a~WMWKS*1L-SaV0Y<p`SlD@*OQp8E0O7f~+%Fr17
z_5op&+od1DT^4Y0ei-bvn0z(Vr1)~!w#~@;f4OJ^ovge-R;U;zJSP4kG4%(*yLaPy
zAYcq!QwA5QH9^S2Lk*v89p(?N=&uvzD64N+LF`tO<_s=<IvWwBxvO*&B?7z+^m0x{
zM*K>E1D^y^W!num9g*fz(p(j?b8uQ9b_nO)7P+$fw$!%3>W1G01mBNn;{N<DFX>d{
zk=tCZ2=Kd&u;<E`HuTrD;lj3R(1n*DJm*~{1xP&;@ce4iW3vZ(OC%F#kQU|kPX}tE
zu<nKo)I6L_-uvE$&+}&%c1uw+$Tb?m8j-=b8oHl3$-f>O$~U=E{1gK8qH;*O7iB`e
z()G(c3o}6Hzd9!80`+d<v>T%*v~Dg>?!bAWw1_u1DZ`MwVQ23mv3BUF%jRAR`H=ai
z&Gr40oNQWedVqp~KG7>Z)h6TP?pkdF!$BZ&y>Z68p>V->5aAWc<a4@vto#|6OEnp3
z<&p77qIrmGOj10m)<n;sP(#wHI8BPe^D}laP`KN)cc3SrKr%kk%*LweV&>#R`CX6v
zt$B$xJ-Tg!U69SxI~C;7GlqJ1dp~2Fsmn#sA1-i$!+F=cuk(#`$}9<>v}q@BIV@F1
z^kGPh_7z^TOs)qypW=lI5-d5jU3PB|Qpv~~L3x#^LWg@n>3y)=wDSJ$RCK(asy?G1
z{YjMo!13#(H_Y3yip{8@D8tn*+kY*Asy#Zi*}r;v546AK4}b0U{>hW%hn}I*gejHo
zrhaqBHT|;1%?Bn+KTRSY&xgX#Q_pQ%Gnv}pIecdi)wmpskolA_>Npenaa9}9`~=k$
ztUH^K?y)tYB#@@OjbG)PX;Hp5aBOhetcgewp1D@g$b5G~-~KS#{8a!#Mt4m{qvAwV
z_%MrZL8Pg3q|MHn<}W%zCa{?xL<yHoS}wt$SpIk^{4NL%s7Y6DaRv9WLJ>pJIlDvA
zAgOqhQ{Nl$Nlv%orS=q>F<tU9SIdWc<qw!qIXTEuoKi!A8i1D-74Ok*)_4mN=jztq
zEne{|-B~Iy_gz0KE(#Jby@BN=ma#kF*av#e1+B9KU57zdlGKx&pf4#GtGJuk93nBC
zV1{o^!duty71qC|<EfVmI20F&MzI`Qc0R?hI#ra7o&*4=t3#%jSn_A5`|WRAxRU%t
zBwDqAc4LV9=teI^nT;2Fwam9E?OQFD+CfxWoR4{D_Pxz~B7+P@{LtOs*V+iZ6-SJ=
zk#otMFxZwOGzzNbZDKqPTX)NeTY6`95W0SoPEyH7dT1BDzw9vZ!i6Z2olvfQNohC7
zz;`#Y^OzU2Di0i}QBJ>|SbkZN`so$jQK{!_+pU3Z#O3mV`sq=<E<d%YaXIeA^n%Az
zJK+Jcu6m5WjFCyl2}OKnZ>JYV;~P$&*2ixh&Q!`bzk+V4vCiCtK@*1@K4R+0Dfu`g
z*MY7DekON}D|l@KB8q1K&z3d3+oA8A$>F9b^;~3BA0)Cj5#*SEQSz*Y#GTLB7pXT7
zAsF(g7@WQWxDa)U@Le9|7ZK6shJ@G*=Y5_4pQ{Ox4AXl!ycaGSjIo32D8fY`uk4ZW
zQT+ggC?G+Cbt~lrSaCsO96}8ri0+3EzM$OQp!Vo=-G5Wb{yl82TjKKp?9qv}o}$wP
zBcKZ;%-pW)jZB{RT`Z$9r~zI!DCcJ4qT4*v;>G+=K!ML=?Z>+Z6=jXbN_GK9#Z$NC
zp7738LQN6RW;`7ri*#U_CBjX$EFGuK0ejf(w?scn54y{iv(&xiV^rGs*U2CvJ}Ta>
zD>sALv{Nj%KicsPK2sIVTAVMn1N&z}Wts=0w-G?S6q|i6|L?T3m7RyfQ@MTA!&9L6
z>BenjzEF;wqs8Wc3Z&i-v9d)v;chv%CmK*Pb1ZG8SR*yFB+67_O;@|0$2^@0Oqa;~
z<|8lAV6~Uy#XCc}!eY<S%-+Kbzmpne!tecI=Y@liYT?Kgv8W$DI_p}X)Q;4njL?Va
znlUp%US1|QiPaTgIui|O-$P36PbU;>ZKbU@Ph9O0iseg(T11Bo^U|*=H<;nJhr~^e
zGkmrv8TnAm<|OBeJp!xN>^I`F32v;6vqJ@BrcCrCK8#l@9nncyIO9<^@uW#fP+x;H
ziS)YhZ=FS!n0P56g$&MHgABVMw2`(<N_jA4d59(3Aj$5~>``P)e00Eu1+F+tbG!3o
zMtR05&zI05Ztd9SAk?w22k@#<tSIa}*<cahSKpnw%)7dYb!vqu!la4ROr3V@QLEQd
zXIk*F2@gRg!#7{~g|FRu)!{`^Pe(m8YZw9hy)s?A_N((+0<YMZKW$AT+L5(`3soml
z8HBAHGa9$;yWZ*o_w$`j=W9c}^S69EJp^wyxxoh;Jq6i2e=r=&*|HhC)kz^DC)K(U
z$-EaVV3%D>D0?a-?n3j8TnrKTbsIKZA)+wS9kJ{9_)MI=88tUR^acB`n0aM}cLuzx
zbxw~*H%RKdhu&H@C}Eo~hHkXa?B=jdrDl#b47(3*q?m)L$D5%8R|O`@lMx0Xb~1jY
zFZ(ok1J>oeRtz+nQW$s7W!^tXJ<<gOi50hth~Q&1p0m@Y(#c~&n95lj`5!C2w13aE
zr^rR43bwhjN7!~S?>FRb@?l0g7=xlwh9hqp<9}1rRljR2H8!L3czY_mQ-x~WFmE0E
zjc>IQIxP`TTDo*1Uz}kh(1Mv6zIcC{dvBr&F>rseHsVEb`D8Q>PWUWm@$)>bij7gy
zjdw0u*vk{GqHPGzXM^wAQvKf-#2I@ReC;j<aTN}Qf(pl|g#0Xlx$9tlZ^Vkz9bOl=
zy9@w5@h`ZP(jIL#|E`yw2}Y)4H)~vvv@n*Wi~Gd~5#b4JZu5BEHMu4+xL!J+t19~X
zf%HJ7rTHBGrws$E6F4_ODA`!lx}D3K_!|@&v&lPHnP|1w3o|aU%T>XwuT2cSkXty=
zPs_~ktaY&>tmfviY_jFgbo6*noTz*<ghY)wJfC>0ummse1k>R8hs_T3m1~Rij_EpB
z;Iggi&gtl{sJ8nVH|lZ0&l+>+_k(%}Y`wO6u!l;BGNBS#G0`lh7DL7E7_#263}chI
zjh`B=J=>S`q>}lNSYi`cqfE81A*T%;md=^ZcG~cssGTx6_SjMOIqMg-_+LG%H|HOQ
z%V}dzB)3280tPak=16FC5i&P23%$0?iBVg$U_SAFh>DEHKI&soPvBg<mU$`j)l!-{
z%Da!@ZG2;T<FxW^r;ewY_KnM~oIBY~lY7X-)V$_qu|*TC<k6#`FR|1kHlhZJQcdaW
z)@H4=7k$6WDxGf@;(dH=<T=E+NrIaLbTpGOK*@}yh81rG8vvH8bQUzp{~NVT2Z)O%
zwX2mZ%&vddv8b-2;@ZXCuqM*il?YAD*u@xLH}%Aq0h^@QzzY$Pf#)Z7Bi5u{o>sTi
z>RTq*@tF__5QKg;Fe~H3tk1pv@>Xufm}YOJomaG|AVympTOVu{nu5&ZNi67**peq7
zsIgusI6bLlIy#=KY_xS8>*0JB(VIivOzF)pbr{<NBvRtd{QBhJ&4BMF$1iPAtR6H!
zD(n>PdF6eU{!|1PrMkWze3(ch2oPz^QxC29sfzY9*X3t3{#Eay0i&0n<9{CcaLjWC
zXponu$k^<Y(nnZ!Ytv2|SkP>_gaKH(qzR;mCeZIY-z*6t=22`KgLI}j!)c;?fAA_5
z>fh&S{mXbZ_!Lk4ItL0gJtk`BNs;#-O=>qI<9LLxR^0mVJla98!&|6PIX6br5qo|?
z6V9CI6a~{$f6s?WA-M_^$+;cP%(I~`%H|Fyi=47^0i}3U(m+-0Q)pK95l<t7j#8^f
za};SXtH=KK64e`V%w!O2c#%#VMu5dqqht47v1a^ctWB>}t%sjp{i;9egA>&9%QL=>
zpNF`=M9Quiw+}6l;v)?5p;Ln^2I9@e09;bhxDsRKTGSJzQ$}gs>~5a8;Lu@S5KzAf
z%u}8|Xoz2+x1s7wY<;6vN+o~x>>SgWGj7Or^Auec6JG`mXIAdmtpV?e<~N=eno#we
zY|}hJphBS;IIbizN#Is|G<A<Wc;S7%|As~IF2YSFqeomo5yy_8cW|`?j=>_l>^ZQ{
zmSY$N_stu$vgp~IONu%gJ#rjGw|Alq;@zxU2!1|;>WfKWcV#PK=E>v!(D-8T9tW{8
zFR$=hr<iSEBif8Xbq&9P-QH33n5D`D(^H%pFv7D9-Xsj&6u+A}mA{gQLQHQ7)M<Mp
zG?~MPxn-NGKRDdLJ(3_0v0lKYTJNz|!aSV;oWA4fjxOlWju~p;HgdN^eV8lt(UPx{
zc=aQWn$lf-k}O6hLsM|I^{E`6a)?w$03BUw$J4&6dEo#WrzbE%Exn6-R?d@p#~##!
z2_?AJj4AKsGv<T0b^jT6zs&dkNzMS<@xn)bx+*BqY2!#Z1UOZB$I#yeEn-GK^-*Wk
z!3!=Fz5Wwm`lh?>J)-xQ%)@*<Us%sdg^6NlC|@L2<XC(@5beD))Jg~>>^&KSfSy|0
zUD5!JIF_F(QpZED0b$uyBe@84r6;;?dz3kGtaEe|HRh|>G`%;!Q`dGIYIb;YLR}@c
zRiKy`{&fobG4jVIvm67p;O1K$8&`sgYM5<LcF@lUWHK}RUX5=YsXzKuz?6W8gaI_-
zuR|m>j1fK~_N`Hu^(9Ixu%0pE<vBC^zIoy8xoy6&*=R*Zl%N=V+tHJ829EuB7CtW2
zQ=K_IEgd7Oa#!T2qK40A)oEJKsn|)cCWuNX*b>L4;Yc>~8y{S;KwMUjdtw|eGuVGG
zV4=Xxe0n6FPeMwX^VWs|#do>{Cf4ho>Ym!9exKNxI75L8=LsP-#>BDAbR{ODwkEA9
zO7!1$f?5`Ulw)Z4kcCq%@{*kJkD^Naj_NUmbH|dI8j4nN;<6J_X6lWrsFnm;%B#`6
zFYeRvFls#3IcPPAJr|KFrQ`2qFjLcv<T`L2T5`FPw*S~*0l1%ze$3%+AHV^%w4Kea
zx>hiUleKrEUk5q!q3F?<8i(#Un=zVH&Hz)XWPw~!-s%1KI8IHm)rk!1J<=3Re|ZAs
zZMxgoP}6$#>2&3i?oXEnx};=%uCE;KXeT7{;mlZ#dUA&ntrYLA3pGAaDij*A1H0w<
z>fP;~%0Tc@tpq+oA)ifLEyVYdEF67YarRiX<uX|ne7WT^i~cW)%pW_Vi<t9kJbe+b
zVkNgP1uyN~0W797CM>PR=dB}#oEryr5y+?{W~T}ZPvqPGg5V2tpuhAy?YPUx${oR>
zs{Q`=<>c=s>-3tQO&_;8lR1%+Ld6mZpMRR}IT;%S1()wPMm7(5nV#T?t%GBaY|1Ay
z*>Zd0j#7aBXvXK#$IHVr<MraRllJ*AzZKD|^P);X&NMGv&ZLsz)#Rl7>p@D=G)d?P
zX#*b@4-zsvL_2Cc)(MaaJ)=_aXY*>e?ljpzg!a{0+QytaDG#-LqsG*OJ+|E3$7f5@
z_1A%gl21KOt#^;V*VT%sWthzf-!H5_V=7xrFYmMQFDAsF@>?!xWFDt$8v888;}|jN
z)E+|SPZ6wThCXYZ8g(ZLZt4@qIkQS^;56wIz&!T!CVCUsxwu0}&h&&0A_}xARoI(}
zEADUdu+wFfbK{x?rIQePmXIkDtFfA4gr*2~+N--Y+X!oBu6QOu1EqXeHu_-hz`N&Z
z_=psTw+qIyQeE4YUrd>1yg8$s|BA9n)PeX0^M14Gb1mJI<jg8e<JYT;cr8!5@ZNLb
zN$O*k)iTOTB&HPpKla`-EXwVR8}?u!AfQOM2uP=NiV}jLbayw>Eg~Q)AxMdY2Lb8s
z7^EAedjzCo=opxp_a4qskLM`Edp+0l<+=Xf=7N3C?0fCCSFhhH`j|6Hu*r;9Wv79w
z3Ssv3r4aqn4)vCOXNK>+><Th8?@Vh6!lX=Ww%b<G<-L|mj4`1}nK+^vZIG`NBtM@X
zXO|8N8^YI8Wkbg#$i@~v7%x+b(cMew+saXDp`cKMh6@Z-Tp#CFfhJOvW-)$eN8L-=
z7-PCDx<-vXb3oJ-qL4iqAp&Lt$q5oC0nrW7c|cX_1YM)h@e%ReNPD2|{oeM$y~;Js
z%3HNv%*+PrhvtJmE_VhYZZ^buf?7E4i}fz;hh*ftWmf5|&5@L&)3Ep>=$9{!V-35n
z+k0=_#@SW@0(XAIR~BUTTVK93K0{jL)(2l-vY)!#{c)cf(tCd7V&aCxLa`2st&BJ|
zQ#~{mt?GztQk<mS_^JJFNI_}_A_H*OO$CCjK%$YLkJ$)1+szko0Y-hp@n7@eF>U?1
zgP`B^O02D)e^ptaR&;cYD|2m-HVGH*ioBhlQFudEl;7tZpREtYoid$AuRtKy8mTUD
zR<w;;%w5v#(Ot`%wZdV+5_I4sGe}oV^TLa3g*pReiwkN;n!0Y)-OdsRw;JqAhBi_H
zELQ8@MII~;@jGqOhh6IqE`8EQx|i0sl`;ft^%!nD7-X9-U1B*57sv+js^3jx5f=QG
z(7zx-RhvGBSmHA9=73Ls`8ct-1xuBEkpyY6N=w~%W3$Mz;RxRktoEwd2d;@;35#7B
z?rTM#n&{lB=||y*5Eif0;>i?)Lx$vPdplYkEdsV+C{8V-oO4o2AKYcRA6A}Dp_Ty`
z>M#)s!Wi08VuOu(gZhsXZ?LOK@<WcgAy2c%YoWd}vzr}kva_PFbTviyt>FUY=I2&-
z5KA?B0og~eIIfJhd=A&65Zmop881UA?#&i<5Tr*8#h3N5z18iHuVEm1VOJM8BbYCA
zp>&;&NkmVSOcWPPS$cV!-bTa8!33cMdEpIKF1YEHqrPjfz@=gornhDdjfL6X4>JGO
z9Z@%aO}&J_n#4b7Xvpg<b1fo7oUoy%nxuKRB{}>>2Y_Is*9)<uXj&mVY+2g1ySoB`
z4wtDhL3wmw?TS2vxulE}ba})cE^VJaA8kXFyK22v_wy^kj-oq6(7rI2o-#OpnU-Vi
zwQdj0pfXuA-@k7_-4}FiGSRV~T;I)}J*x;O<011ALbVz1=UpZvmuAo_54}XJcqa*o
zboDCfBOU-1?nW$LvZc0%0n+e#=h=0xjZqt=rr!6kr*<w$DS(oM^smOohh#nQt<G)h
zt7|k{h9rpW*|yBPA%E|~HKOMqiSd9&yv6jCloX4qN3-qE=Yb@kj|UtE@ddGfK=5Ud
z{GsSyiD9CzuY?JX{Lfn)juC1<aHB{O>Y&u9liuBjK&m54jeOPId;lfe$D?(d&ePbB
zdNyohW8?XJ;&*ouaMv-<8466DAMs$=h&RgdlIF9aA?f$IPx?6Udz1tDK|k%Bd~@pE
z7}L0UGpHs%h^IT6k36dr&acEX3ben~IbHf^(E<0@i<DmMHiWF&v8Czq37Kw_AM!MW
zr1dxhzv8_z+umQAj|s~5T5ZP9(B2GVm7m>S?8~TLk6}}OeKddIbKu}ETtuzZ>Xh*E
zM|S}gdlfRG8@3`ZL6p66&VMv-M0m{OXOxW`^tV`|?zyqP@J+gmF|CZ;8E?A05H&12
z?5GM8f!zMTO6ks`d0)ng^V=~0rt1KH_Zzukze)dYU1JE!{vb;g%MxVTH@?L5w-@x6
zpmqY5)a{1TV#Y0+@G7iT8&N?&U-|RcV@<xDoG05RSGGg--XU&{!|K@5`H6ntD;o4m
z(Hoh`vLNVo<4$(NM-?hl(=R#>y*bH-A4!#)xKeAi%CXWoZq{|%x3FkQ3`XKN<ORaw
z83hEi@^>Nug`smv{azZA$i;6W;#a>Cn}>F>VJ)ZZDd03bJ&)Pm(X05N_4y8vL@NU-
z;aM)0zJ?YR6J3iqpAO)b<;`a};8C&1oMWctiZSg||J4`%ozT9Z{$)CUal@>BeI1%_
zcvppY21hlU61%5bfB<;~iMu{uIV^<7sWl8cT};PX?_4AS2xwXabZm_Xc|uQsB4V#P
z$Eu6ZV>3#y3!%g`GBPniz=?1R8M5DGJPTJDqdUYqEVOAB;H*khvO}h*NzVmN``Xh<
zN=ho~{i4hRZcP*^a+)F(WIG~ce^{5o4XDU^zx1D~4LDG>VRJsv>u?ObW`Y>_rm=sY
z-^Zo;B$iC*M;#sE;BktIng11Ap+-r5{C}a?3aCfx{^@T2Lm>X6?4*tiA84ABq94pZ
z;Zl727tmLBnxZ{^#&1B*5rMq_uJnTMmR)=@1%a<Y>fx}%20=(Q7cT7crEjL#_bvO4
z(As}IPxy2oOD)KE9S8n#WvP7fCx)-9zFIz?=-KN=`Ew=G!T!FRP7DBUt7?jM<r-&R
zx1;}mx|g@LsSfKO?h;4-tA{pr8Lfzu{Z3kVg^wo5f6$wg5ojVtOP~URZv;8^wDjlB
zo0{lLM=$mLqcif`dx-HOACc@S_@0VDeqh%+hkT?Io`tzL^62>@{kP?RyC!1#>*or4
zq6>Rsg?{>}$939-L?oo7@kGSLGBaf4<oCy-nAB8-fb8X7-<F;4;h5t@!~V~YeEZ7p
z;u-njEVVsS9QX(UDNl<k`>Fb3Vdo{~rY%5sR>Hcb#Z66`!~H%D{r6b@z0t?N>Jj|u
zUH`#sV(CChqd=77aZ&rP`SIIs_3Mz0%lqdRDgN_|-<EuTp=2e1*%R9Nzo!De|K~p+
z*uMZfxZw4~=>+xl?V(Q@fK->CJqfGv+q)6j13Ne?B3}7D9QEx#|COT)033pJ`lHZq
z)dwfg0jnI?!5>Lf6Q@|~#0V5ID)G0RLL^_%MxtUXgs+`qtpFe%dNbZ4vmU>HrN91l
zmi7C!ujK#f+T-lApN8P<yyuU*_45NT3DZ_Hl+qa!!;r8PZhyg22+_ZM{-3k|c39sx
zhnv<(^a!>yMDx8};e?G7o%w@U;)4EFCqL9*%zhIIqp&huVDtc*PWd|)|L6CZpaF*A
zy`D|1>oYSm&fb73ua{~)1<lbr@B38}O9Tc5&Ci*KoZ_9?JI;5%<&Tu40s!ihq$f^M
zq~}DV&k$$3{g3vP{}A#UMTzv0ye-6EDf!za-zmHx3Gg<rN9cd#?SHukD<8?*iDWvb
z;cXg#w@HOteiHxxr1X!|xS)>g$yW%?Jq4XBuY8xK&M!kl(^lJ~n5r`Reiqf=$ngCg
z|N0<Iu)i4tdTS{Jh|N(}?Q(XT763N4^mUVeD^c%^%mZ@NVhcdC0C+XR443$I_tL-g
z(7%4|`2F;2FC9Z>NOW^O1%@hsyU)y=g3kR{%z?QD>+9@7|5363-6Bv)$mcjGXQ=|<
zR@4ps=+5}>%D?}j|KPj`=LhmWw$pt18UO_0G(T^SdTm`D5?^9C<1+{9wPLP-NUz*-
zJPm$`K2oWy^e>zOp(I%lVEc&!{x`qovwzA%_I#vLaj|szN4?PRDE27<VEeTrviqnn
z6OlUd;tAdoIL*bA2QHqgPw0=1+~4r+IdrV-?|4c}Ultb3M{~6+3a1a&*X`ra@`dk$
z3%^7cPfUDS*y(wh3bxi7Fx@!|It=b_NXW{QAIrJOBsgwAezEjDIpMe>L#g3@)b<uE
zo;4%;1NhK&MQCTg;d%YRc02sOh1RXiP^}zcc2OKk8Bpa>6wE@aYq<Jjb)vAvkh9TP
zuS<7A=>RUhOIlKPEwrMzCc_9cSHJr!#{WU8Iynqx_59>Nfp|8DiR<VDXsjTC-;qwG
z;AacwzA>^A-6;!l9B)AJm5(vD`HiH@;z&$2bNXK51<YWR-TeAmJt{r=ris2A4eV%A
zaV}Vrn1Q4OJl7+Uc<}CFmGGPN-u=?F4Hk>nSJKMC-DMcW5<ELBJCf;JYTlDO0!Gq#
z&|6A*VIz}>xJP}gzvG4DBl2f_knqP1h?(<Txa!{W4xh<sM`k#R0W(It;~JUIH)p<P
zc>kK^hShw;-3;bnMCZLl2Ym%OwnF+9T@Y(j{pXRC^}IZsAmzj{*XvRC({7AXYU8il
z-^ku(Jb*6`QetVi&*X%+2YdIVUJV2#-s^*o@dSHg(ARh8S>LDaxE2v*Q}8akUx+n0
z?zUkYXTUa_mh_mvJ*tb*spQAZCGG4I{t_q$Qq;|KCn4vRehJ(Z3!d!&R1X7Qri9-+
zq8d(M985&!4@;MlB6N{))Pqdg(@tYudQ=zQ4lkZ~U8wn5v``L@dPUpYd9>C6qCPrk
z9LJYW3-kI&6O+EmbZFEZykGvcvAbBuduOm%SUuCj8#=^=<U*AXOFj0~dM$%FRkBjX
z2z8F5dmgpEN^(V4D76U2BTAz@n<%q=>0n;jwgNAoGcqN8of$65o!-Y2R7;=NyX32D
z4Z_HrE0^u_5mfU{eSk=suRY*1x)8Ciu11DPy}x8P3cn_C55(BjK)SeCL%U~sQ59A@
z<wdZoMOhSX97eKxp(W>LVwr4dvo*uULr02IZ@6;hF09(J!uM`VDLJDap@H|i#EB}*
zyfCw7jQPdH-sSzt?W2$^(i&C_U;4l>0^KkhP~wY*{FB=t>f|tuHEySQ^mnlK_J|}Q
zZw=_@ThnERyfxd7rv0Z7PO;*CB4$_?;Tp-YZ<1esP7$XI8K13-KEIgcIT(_<TB>rN
zGveB^miN)J1>y}B)c~>R<}T)h&0CB226K^6u2{3_at|wx7#V*#n)_TX+?y8R)PK?y
zNj7Y#m|DB9r3o3`yKfnjq42qyGW8r?(@R#Cq~QavXu4#+o+gZYGt9>D@(gYqB}(2!
zy$@#PbLAI^ZAcPDLpTGk^=u_3s7)k*H_qj*Tdh4<Kzvqge(MD%-AO5dvwUcO8JUD#
zk~bf%a82-JYeHZ19DqwjU>fpY)8)T^aiaM&|C0JLCujdQUys-)Dw>9+nZ;*$5H{04
z&BGZ|(nb|81l8M>GMo1&VRO+GGwHRDJ8+Z7ndPe&**SZ_qt@pws(h7HnnRafQtPp~
zW!r|oOL-_6_y&v4;BKZF3|cQ1symqsGo4}XY9Y1g@oXtgUClIYnFZNx?7wl)sdT&-
zgiF$Cb(6w%XVA%uBT3fA&Z;{}l32pSOSi<+hnJs{L_oXu#+DQfC_2n)V`qHH-B9#o
z)d~!!&`1kknrmrphK{G)-ZATbD>L@9VZPb|VDjy^7H>bG`C)+lQ!)OmgZfz6sr;xl
zY=c#%mK&s$+>PghmE~7}ZjTh+92we<l!tM$M&3tl&~>?&b#3<uf|VYY=3p2VV09V|
zl=5}jOvUY7R5}(^v@fFHKVlbYySFpbxRFB5#Ka2Xj>0=kl%>5BnXO!vtyv~wY_gYl
zHsfoUEYB*AMjUrLyhb$p1wU6|q48(hjAB^%ja{1Pc-0koTC2kBk<zUA+Orp6N5tFk
zTW>Pt^?Levw=_?7AH*ueq8Z-nmWD6!J+&;6Y`Gk<_82fNt_IismpT6Pm$|??vGal2
zg>z}KZqsSFiHGuxV0T*?#y#808&SP85qCA-gyi1<HrK<>$*%N>Dy{PwZN~sdTprD`
z&J?|;OP(|>9YUH`+ryoa$ps=~vRPgasx7+p{!!l>Sw#jDB6nLoKBA7`ay8Y>7C+%C
z3Dr$3n#(%a*1-dIm&(Y<<!6^UK1-;M`d)h!ZC&Z=%?M=M!rP;VVStF2UwKJBN$k=L
zHldC0*gVK?<5L_*yqZ{+P#tU%F->(E|CnPS!we2~Hlg+XN^IuRLTQ}3O|-q0J^`OS
zEL;8rzf<OXXLXssTj8FQ5?`3`@3{fVG3+1E+yNeg-+~?_htez$0aU@_d|i7A)7><_
z?!imbIAj<EM)5riLP<ek>!=-2eEC>%SCNv{AnlWQSgJKuKsBMDnqERFP$mQ<4aP{`
z7qoK9G`1{d83}~!^QljCLyz|B*-Dw+ZrHH-n)r^&(^0n_Y9aQ3qAKY_aADQ3SjJ>G
zv;-bkp!~2azYvRJqaeBe!MhsC!=&K~0T_HKM};PDQ7`2{Jt@@J)LLsaS~7BP=2dLl
z4H4ZD5QB|Y_r@n{UDa#d>2EwpDax*|ifVJ&oljz3mf8K_qV-V7F2*{<f^j;<bTWRY
zXzpkva!EsN^9{7RZL5h}0P-eLjb$&7&(TJ3y8@BAs1Xi#mNnn>U|qBO(Zc=1O8Td6
zjY30STv7G!eR{{yF`zi~PBX3<-iemUUrt9T#x~$TkPW<{Z)oSzSkd5(mK?un&>=Jx
z3u|CDp>U@OnVnq1;_#+;x0TUTmwBS^36xp^j>~-d@Gl{w{$;1FVggwJ?;?J$MnAsN
zvj#nDI~mzp_=+2`6KEF!Za1F&^1MT-f*YHj$=laB?w+Ch*9Ch<y|8&j)qlmz{z;C%
z-U$jgB63M3(I<1~vGnTu5z8bY|0km*4$51+JmcqbPX2v@Yi_N8O&LYDh>JJ$BhsoU
z^_3CKJS@0g!h3|YPn=`~jSAUN5c})#Ng=d<KB?^ElbS!pNIRet7a;DbBDsDQ)Ig|U
zJXR{@Uo`)f7~fU~>`dWVWnvWj2gIDdJwRBjZtaC1Krp|3C>a?G^k~oEJXsAPg(r}m
z1iZnw6`$}>uN6}`AK2X7e4IB){gGX4XlQUI?Fw7A2va_VHx(O%rgt<=xEu=YjN@9I
z$0THx8&gV`R}rEF@MAr-35KYRT7`sOVa5H2wf=nxV<~~RoNEyxrTr}-zCFT@gKW-j
zkl{V<&^hs7^nK8edw`9t+Kt10wC+z$O&z>5c>SwG{8<P2{eg#c^OrvVXv{}OFLwD}
zTm-tN>*$nRPjNG9knPP(GCMzi^)FxZf*dm7c>mejDb{+>0<j*oh^3RQ*<-?E#UevU
z@wgMGSi5}>aFFwE44{&i0P%>}k$yK1b>%76E<^!a(3QyyLdgkK?E1(kf%R>tQ>^{O
z1Z<%u;(LwiHy-)fp!!Rg)gkZP@Y4nCUy}Z(gG^RKlQ1$eLZ;p`YJcJz-IDagKdu4E
z0GxVHNDc2};l5PIZhm^8Dvk2|_ZG8X{5o=DTk2ncYhtne^EJteZ1M+?0b1zgMYdhR
z-n>VHb}-fbR;e4|#P9p2fIb)J{V@=1Y&{-y5bxj5;*H`A0g#CWI`%s^>bMmKlX>WG
z8n2r+zr~t-yMRJ6n#KbMG{R#9{nnp&!o@Ows4p2Eaqu@0h71W;dC1WSwe3GTai@gv
zoS$@`Czow2wlH-)SqydF^0SSOh<jBRj(l&g&B!Dy2?+^D8&=a<0PX;S5CMc)X9gY-
zXYAIWYA0V-07cOjO~TZgfmocn&;7YMYIKR%Ff=X#B2LPJ5Y)nniah~f$uuP`t&?|w
zB$=ND5}Gw+_|3_7@$of~O9yDa*gtp*;0mDF6i~%9rD;F$>95(nj{yKl5GW}*MT$CB
z61YEo&vF<}KB;5n;)DdSkhihvy6xvZl{NnsubY29%K*&0Qp0*u0RmDl9RZU_f#J5G
zpcG#wuf0m<$A9`%tW_@8tAP$D@*z1CJR^OXhG(Rg5YAIoXUAF+vDHmbP?{YFxXqpZ
zGKss?KD$LzMYFUnUuI+UuocD~753{R9P6F+V73b~D@|I5^{yZfopSjbEyW527rvF!
z{^slTT>uRlN4~}V!sB3MeKlPdovr$T>ZB)I_1@%X`)#SRmdCG%ZfrIR8?-r3uyt(?
zPWlqBxlhkhjAUN|dr~jYV@_Gc?0&d6fJ%V-5hF>`fcNQe4(DlC(vk80S9;!{vo(3u
zFG$!f$K)R9ViEC^)ROy47&=Ms*Q@P0KTJ9a{QWPs@H0g#;$#1MhcDmAu^bLvHp0C_
zfc}tq<6tM=^(py9d2Z4waL=>4)F~^rqnqQ2C9p;ima1ReE16F>Q3%COJU<O$qDR*;
z(GR{xP0bx9VgO~3SO!hc_d(f>8ZUZqM4a`?A#<x|qdANc-#%oy?0A3w_H!(E{-dfI
zI~DQ`)#1H~yuf8ZRKAUjS<c1Oo8YYgYk_N6VYY3;0Vc+}wPrFF;AO_^_n$lKsHqO|
z7vw?!DA1h1d^WFJB}3g;c?;lqx@vtx>NO}c07U418iYiT^tX1V+L@_tWTTe}A8I1?
zINw%ZQeaZrRRnnwXm_+|suVv4=Ul#gKcTwPGptK&2%sqgn}ctrl6DGnPw0w-qzI`k
z2)3&}UCG4;B1;6=>H!9{d}R+4)Diu@jUuUQm+3Va#GJR5vpyl<?9DTH)F`ZnE?cSF
zOow?R*xP%0cKy*L+zitj=4v+>n81gF>h1zP@}0SL;b-F;x)e-^Z`)$_Bpz4{*Dgg=
zn#O1sGFl@R6AT9Ao>>;%^1GW9{El)qj5&M;le$^sX^+pLxf`U0uzs(0uSQ+>8A61l
zHlay-+)+!@W3Km>o-C+pc@OiJ*X|yKaqX~Xz2sJmysAgj>Xeie7!y*%t}%q!R9UIh
zJeLE3cdXwTbQv5XEc9u<I@Sh-hLq%78Ad5kx3%;M031a0csn0Pk8E@>6z(EU2@~N;
ztAcxn1r&33u8Lx?dF3#d)9lRju9w&u6HDr1?+Fbq39xL$5@kQ6pjRa7O*OE=xarQX
ze1pltvAV@qRlONNOtU<!oa<dmD$%HzKyiB?i-nyty|3RIOzumdsNPyuOSzVvbo2e)
z2)wDf(5@+{f)A$`C)<!7B@ZRvLuW6nJ2D_J8FnN1Enhy3b#3iYY?pyl7ssqh@o;xA
zc|fhTe9lwrjJLNz7^?&nO_l9q2;-Hl(6bx7jxz-iDF%e({;rPI5{`Kn;cZQ?xgA~!
zPt1~P{N2?<+x;~)5J^l%1*^8}1iyjIbFsy>f(5PsYg&b)j=VtcRp$>?f#fKIhoiW$
zxBRH>YOchD2anwLfjCaw324+0Th7Dc1@9^I5iM7)mW~-}T&e%)Ka~-mhcyKGKxyh=
z-2$+EJOnc@$Qq$OO+EERX{y#u?)m%&cc;N_zpeti5k-FdFgydP1d+UFG;T|^@eNTs
zf}ffh*d?kc5E`8$S0uzmif+OYW%coSX0T_(;?YP^pROC+(OEn&K!m$Fuxtplo)gyE
zE0oU%(@!5YNoniO?Y7^t9?iT3KIqL8#`k%xvb~8ng{hHb^r=nl?lULjMO1U!7n16j
zFJbXt3B_Mq3Th&62{8VHfH#PF&9Dh5<2UO*;<g6Y3P&e3`+^8+qnd)o_t<XRSW9D_
zIoPB2S}x(5N*C?g4Vz6jtG62YV`HN~Y4t<<=w}1LJcP!6QTj9|e?bD5S)pR7b~k=m
zfLT!z!l|%Flx3ISC0Rb{(6xR$bMAIv_-LxSh^Hskcx>ho+=Rt>DhD!2P`iEyOZZ@=
ztRXD4mT(fV`PS<(*`5+kZ*sb(rW#jzYm*FmK?2q%KT|e|MKX(hon3DvjBY%0h4@Zo
zl=CrU@d>J6TV6l<Twpc6Vtu$|m=}Na=B&Xqh$+H?Y?xxLW2t;~WWDcAi8<>fSNMj_
zM$E+q?=dT-$K$&#qQLN-xd=f7-yBXG_QBp1{cNzLfDOGVOU3lasLSnV-Y-7h%(6r?
zWWAJhSo6B_Mm5J+H0Q|P08#OkDhhud45k)s64t8gV?I1ba2+rv_{B%k%N;|5jWzMY
zlNg=|o#?QyyXz^0wFHC8<n~8q6Ku3fOCM9M>h}!m+B_lT37u4r#$3m=*V0DZjuKH>
z^iFi_vS<>lmtzR8I&phx7Z~1Ee-$I(NxqMx(3I5tk}O_rAkSz(l<AyDwNEzV*;bpW
zqyb@Lm3_0t$L&%rtJ(Xi=KUqNG3o35&I;CtcE!&;;u{KD&O;cNbKb4&ENsyNUmn8$
z^LBk%5>%6+)#$Ss5VT<n@+~VPe8}1&F*6+IHS$Kc%7pk%A_iE#VPAu9a(QV0W&Mc&
zZY(W;1>dTR)6!n#_*Jy_Yj=5dhr)~^Tfio4nv*S(;y{s`gQhhq2`eePomtV1A|`I}
zO#WuLPch!v+dO)dhpr~&2Xlw@-U`C_7+Fi>1h!UJnfrF^Jv2UQ*#&s()v#)peN7~S
zUvYFlTF6*0DU_p#@mVG107<>fC^wVYU#j)^NIkNlcNv_sl@;TwN*-8n^F3eW`knpH
zwVUF`&f^4YivkAH*=FEc0S)mq4CzJMv`SPOM$8JW=mxv-qmkFXdIh$!R{qRjt0o(c
zWW&r&&lh8P#obqI${d@f%gyChXBtC&uh{x9nqCMdzMJU1Du>jd)Mw~e*^2mCXt~V8
zVj6_Yn$CnT({=D8jX{mV8?2ODkK7K5%7W}Dz1h6-JiKFYV~qKstFcly0v){!WccRa
zx_M!pJFsLP(jg2Jr56+lXnai(lM90t`wCI5MXq}4>{~u3tKiOt!M5Y~vmBp;UhKRV
z$VCUsTL@QrRv)l|aHAU?@JCsSy}SAKp1r%N@u_2P+8k9J>v3HtW@kiQI4<kKIHV~+
z|2Cf+c-KDJrcAbenyJuV^(lC)TG%>F9RG4hLe|m+^Ws6{yfOYOKAVuDSwlbz!?(Nh
zGZ`O!&EdV^#1I!_bVgdEEjr|2WtD^KtCUoOC-AP<m81ifQ}r;}$Y2lmcUK({v1(su
z=@Zcv8aFpPMmE6Mq5{y{vjrn?(MsX-LDff(O6}y%Khk*DEDPGb&8N9hMO1iYnGZU-
zS3f#P=lHzF@Jk!7VO7D@?W%xMQBr?hAE#||ERV&?Kk!cwC&&NtOGNK{1H5a@i-Vc5
zLJm=U+et5~eyxY5jIU(b6bxwJjlHDl>h~P$)_Ui#B2{aBzlh@g5QOcrp667}`lRPh
zJLXgXr0H?^8)j-}sLSG;^%6)EjA^MY6ruUSbN>xQWkoA7_-k(_*u>d5YsgrfMnjb8
zET3U>M8BzXX&6*g!C5V2FMw#faIUv-$06;7uHbKM?eES@vR~cGC9L4H>Lsv|SV0<*
z#7cf`ci5bLvaOSJXW>KoH`7Q_NA9^^%hWJec`*_FB99%m;AjY6#*<YW!5AQwb=BVh
zE^+tG>+C$l^>N<hOA^(isBXd;zmK@Fz(7e3?i<#kTblc-_uyB!g0v6X*4qFxLE9I$
z6L1v)Yg5oAUh`yZ(7D2z#~#{JyPH!?)}_R&N4)pquthAqt3cb=d#XG>$)o0CQE!LK
zvAn%TeD&~cNYOC3e~78R?CMjL_9_)HeYK7m6RYilgG~7rQib*SFpZZQ-o@DFb6eMc
z*J#G1I!;i#vtl(>!X<jyH8+#QNjr2dJx`dl)>+F%dmNFGUawR@CPb73-pyHGvD%20
z^{~&}&QFkCJF*~KwrO%8fRY;O=?NAId*xo#Q8|yo*as30uHU1Bz34xxs)K@pJQ>&5
zsvv<|-GX`P&Y9Vcejvml2nTTf#pm&XVO?mD>Mi+w0O75xb|B9Xg;z=B<;P{#{a*gK
zEJz_iKxG2}HmqKwDs&6ihy_py>F=Bd=g%JiiZsSG6{kdb<bR-fBZrn;R8~1TrFqPm
z7sP>B998EN5mXlrASM*p!h4(#nWun=!+HYv{Nl0ay-$d*eEZinumx$#2P*#<u=6`*
zOLXo#NNIn}PZ6tJC=@s_7w2mKLpEfg@HXfQOEJrOw;-h0`{h{_G}C842P~}ae+A&;
z<!50dYe>ldl?~qkvf+IMMAz4ov-sDRKWeP|9V{|Av_!?nhc1%+HE82^KjKG>-@3Mk
zeOv!os<G)d_a{D-d?}Xf3q)d|W`b6h(JaRH>FwiKYvT(jBJQUCbz;o4j=L)(Bl@Xf
zsH71P!XfbkfE&x^%z(=MKTmP`=-VpD3X@rtW4PFpAJCse#x35~M5A(LfP?l%mXxaL
zMxltVAX&l`C~Io%9I-k@EbEgR5c2uoX8%Xo|FMBL{`b1pkZ*OZOo=!+IIaW1$dEJ;
z(LR59nGXOhRoj`rh-jJdO@dc!1t6kJ5gWsC#pI%g;-iVaYf^o?u7tjvHoQ7}qWFny
z0(tbSSx?XSb)TQ~Sk7@;*Mkk{rLJzwwDj>H4($OP-n97_1T6Q)5Iepw0MNA;81Gd5
zQ0iojlzb8G0M@yg353=Y>?hp=+@2l_WYzAs42`19$g0}!>eCjcA@uAewa#b3(_pxk
zqd5YT3@JqqLG)9izEe(8z434vYRA^~`-uFM8S*=i#pcm~1_*6|eb7-1BBB)WHR&j_
zSO;+8M(18RBavR?6X)aZAZJ%>A3bNvl^$dB*?5uQTL0=~IlFLMtT~)@o$TIsEAaOp
zKE>5#cN6v6q=j1+u5ksCNvqgu*vpQt*|O6!1?tIwMnH=Z8D^`E-P?x)YJ{AO<3L$u
zv5kwmS^8~yso5Ft8{}T@8NMMtlQN_wEo8%mRIv3|9r1h=!x6h$`DQw!q293l$DX^*
zW~KcAyyw9{o{tJ2$gYyXX8CUK0BPSyky&3@lK1XNF|3hZ<W(uT8FpJwj1;TFPIaNL
z(x@uvo>dR1tk)-X2nIF7m>(-uVY%NFoRHP$qh`mlA~HTR^lC^}wojk_Bx^|L5>O6}
zpX7fEwQx@0N^BGW3Ous`QZRy<frT}FJ1J}R_755_Hm%+<5ad=K_sPzOg@g?X!$rMp
zWS|ESR)M_xeQ?uu^CGUk{KHOTtV;uNVkE|<tz5LoLIq|`xi9ROZMUj|%O)9(hxb3?
z_=K1GZcF*TF3mB;$QbP43OdU2-O20CgCB?@fD$b8&wqv{lP2=IUr5TkmI>QZlzi1b
z^zk!(02sVI-^F>PY(~ULHoW|jT9=JH;R5zasgO_60OGKX!^kN#7tl?IM!9&Gwoj*}
zn-H$mdar9{h(kh}8L@!aEKr7T!ol}VrV-9cjCmqQ3Q7l3pdHeTr#LfkjSP>KqYian
zW{R_n_KUOBjfIALiOPl5m;vLM2Px~3!c{}*g|;fvO-AhJ07T+|@F-H-a_T7NN4b60
z)FaO}XY#7nD#N2d&@9ls)V`KXph7g8%-h(Ek>2pG2LF0OP6l&@s}f^OW0FZKwBQCE
zS$n(Vq5S*ab)dL3+eu-##>bm+c_vh2@t|Qjb^iTHlbxy9<B<(dt=4FRYA3PFUze*+
z?gzy6?oU>F)e^W0QcKEO{^d!a^IKuh(i|vaijq?PFf1vjeRo6rT_Q7+^lteQWuji$
zB<Kh{DI<zV_k|)Dj^IX!^yjc{QC?HL;4lQ#tYd6REwRk7<B3$SLky@;)P{FJmMPpv
zsnzinBq<$pxJEFI^chfbIheYdD7lj`9OnaqF6CHw=J${7G|iL&<#(Abtdy+%Am`<^
z-YX-bs#u_iL`dG6y}yg<wVoHWT1m1k_e0AbX~%#z=L1}7A32X!BkNLav%04p^ktz3
zPoxYb!}r}x5NX9ZvrNVY!xfd{-tNMl7(Pa+ftiOYw?tVynlH)jtZAqThY~C!y8m=K
zf|ESnp5aH7BjAU9M2Lkj_)Qz%<uacvdZTVcsMl6JSZ+rcKv&io@HCuXaynAONO$Ec
z|2kQmAe6MZlr>+I4<=P>c}cZVU<(u|$tSKI92`d7KJS|d(Sy0Bv>o(sE>!DkrWMkh
zV6XaNpI^#}K$_W40bhx2U>`tbby0Vm%13%U{{Z?&))NdS9d|?E*PQ11`!lgKaRo9D
zA3gH^tOrB%_Rzz-ASE|Mwu5>Ib`SUM1}A*256!eP%^sy6k;2Q~Q?A<DZ$r(Rd+kbd
zGRG0-_nSi{iO;?<zIxNNQynNf%}9X7Pu?42!F&$WM96vQwtIz}4c|NxFl8KxE{%+n
zya&3uTa~Yu`0!n9{tc`c&iC94U@fg)2TV&&_iIanpV;xFruGKH6eWWmv`R;q30P<=
zgb5LPr^ERk?Ma0aRC*|xfJk=A;0tqW3Xsa>T<-GKv9djr@OWN3`5lqnVI!SEuw`>7
z^pFMG{RHSXH;ohGx}V5y>`U$6>1xS&wq(@Ds$tv1qN`2!B$Xm?C7k0u-mULAZNKw5
zkVoc3%gz)N!H*aZ3j|8}d|*E41xK^K2X`4mD5QXa4wxF3K=9-TnH2L$hol8?@B*64
zT_Kmdoyi>0?ZfIOBc+TT1d6)e28j4U?TCAQEx|J!IxQRa++=bl%LAB-8u`iU0M;Nu
z<D>PEGQ~KrYlk~KDh7Pfy+#9-u@uHS>XcR;?HhR1QQ0B=-Os0#3nkids*L+;sF{{$
zay2ZVtz#oK^x0vw9RNXtAM6h$rZi+Im-T&^lpP$uR(LgWET%np8bK~vdEIz+Q&xiU
zKIN*1u7^8%K{lU<P}H5M5dEId%C?nzY08<0C6Ef-!ro0G-qrn;aq1VZJK6zlrnERP
zg9Nh%>K&m~IeT@{T80Giu`Fh=2<1{A6EnsGFWxNQfuSG?)liW_uBcx3&4ipOF=pAd
ziP!gbpW98TfU_&oKzkk*_l&>6G5pdkbyU<>y%5;h76){Mopf}^M<o`9Yz}ROu)>Xz
zf}MsElRA2=_V6~Nlsx=C<G~D@9>R{Ai5E8Fr(7>3s(Vu<46Ng%+uHs`bg+dr7pJH3
z<qeIDZaGeZz6fIzdkPIb)qp%4%KNjg66h8A3$|V<hfWsLMMZPn)Gnk;(^SW^#pp>b
zgw)k4WAxZ!XlzEQUd@+-7B6T_tOcJn&|~%todgR1Rjd>%7^+{jYtiqf_PT>Em|gJv
z94X6I!)<Kh<is7ND;!ELNKhCt1a_#oSlS4b``5E@c-~j7tzBKtzzWLA@S=w=w%+TL
z>N=?4N=y=Lpeg9iE`CFtZXuYn_GPCx^EK=wHtl3U=3F_`P3!beTK2cY>3x;xxdz>F
zJ=e}b*`8Xiw#J5+n_GF-9N2qr0_pj4XV0vR6xj?QD8mrmqlhH$J#*NM&yMZXJV-!k
z*k?bho~Pqxgm5>5De1vJqGD~svlbrK*OOOMEUy~D;HfE1lW+2o#=`S}>9Eg5DH<(h
zEoB5A;**3pidJ6!Jf+s_;@c4D(I+n_8!_4z8U7Zi_Y?+sSQ*$iq;Bw7K!BzK#8O`M
zt5Vt91{7?FEmPeceELHN_SO79-$~^OVZvI+VC{}gJ`>yX_*>x!xS$=gjHsx`!4Q*=
zo-el}BE2PyQo;YI46zGNTcw13rc7N0W?GDW{;~z4L@epSvYd`$YPVC1yEuc2_xN79
zfGeO(0S%cwEl1TgmG+a9f~71rY5{cfp3#0cL<q(U1#PT)dQ9g{vV0XZNppr|t>kx4
zG*m*xY7P^S;VnK$b-g7mrO&>B;K0C&ClD2f8vqjpEIgO`GoH^QTNsynrp1l17N1Xk
zM9KF+91<UC&OPeR>46Vz_av|#l_jFvRj$=5_pEmzJ~Tkzn9P01EggZgm`>hITe<nQ
z<EAIjXCcf$#}j)!QpS@QXOlqn8dn?hh^BNLM;vwPNIAwWq?K!9cgbB;&3R6@{p*8;
zmiw2vO19gJhI>p`c@DkJQWChNX5*gw9CYZVaZGq^by<vA&V>spwHEb=#D@ybzjege
z^6k4%PF&(4GPtH@p6ig7EQHtQ+UxUT*G_h<t*Az$IsCS1^2BAy0X_+N|FfDRY&E(9
z0<Xw^jG6k6MbFN59%vPa>9hTG3bMrE#|{8wskG$^a!O(_Hl=qcElo7j9WJtEzHFcs
zbV<T=d4H#hD%=d)9q3~1+v@RNbF`>(+n6qf<$$3%#a&!akv`o#TlM<wQTUASQCMGT
zpB(iZiVoHZpg6QQCwb;HhWIE!EFQ7M=0ni_VBB^OIRbL*8SaDASNBJ7dUuZ;Mc<Ty
zsurq?YqpZ$3KpKLsY%wP-GAtyza5Ul)`dmgCiew8XhwB=??z!Kz|ib!c2r63BwqTu
zzcI6Tz~+0<@wdlu>@F_nR<YW!)ok~Uh`P~yixB=Y*rczDtRBuvSC~J=OB5;T%L9Yh
z6O`B~J-n}9el)+7)#tMO5#K`axFYw4N~;&&rI#qCr#q?w-W<PR$%RwYj1p=4g<;ta
zZCkIQ8#9QrUW(rhOXcJ#6^&w6dS*@SXcisv^q1P?2g_Vg0D@g#x`HWAQUC679f-`*
zzhp#FHHWkcuo8jD?8kV#AM@LOPvz}9Kx9^dNaY)H)bCf~5(xo;7Jpv)(@ZR12nM#0
z$exLc0)RSTcSBZ5+R1N!$0PjDb^Bh1_z4f#g0O+|DXNVDJO!Xi5_P#CQXwVN16%N@
z|8NzxcCY&a%$y>w=KoBCdaalOu!ZfX4{3j#`0vyofWHb<QMoz(DRqjqiO4zVms0Ni
z?#upR%=^<L#|+Kg2|LAF;VVFt7Edzjmsj!UGx;Cm0`&ZUnsL9E)SLWNQm=Ds7nwA}
zWGzoNAUEqtT+M{b<A?xLq6CHee_*fwj)%n_>H~Q(U9GpCYZbR<fGJO|^*|Uf#s`jc
zDQ6w$I^&#<eiW#a9vrtPI^BinqrPi(Uy%Ld;}xH|P_G5%1Offy(~j)_xG2Bbvc5gC
ze;jpY26?@bktN(Z8~mq>Rsu55)pq+d{o}}j^W6Q@jO!xOMoMTwUXN2~uLWdzyqXvG
zY5K==k@_ToRQNQ&4aj1C6i8lw>zE5_NbT1hl6VU3SBY#rzz2^Dxj|MX49q_`XuyXH
zD){YFPBL_l)rKRo6M-!LQ+JRfvruU@E>_`MTZR?C*Pe-i`GJwRoAmr>D9UVSA2qTN
z`Sr!xkeaF8cOCT;K^JRNY@GAM55Df^m*u3apq!;P7Yfj@f-8nR^hU?ELRM~>tGxyj
zectK>UpOny$rp9f_e}_{q9TOfBC^(YV%mRjvVby(vcKzEA@xceFw9rQq$g0E^f4T@
z=ng?<?Y10&Vj^E$%jw(E!X%S#-L7Zn7!~aXGpm2?T3?9TBI{m9Wp4pP+JT*5(pjum
zmh+A8H0l^^d~udTt!4Z;0S=W9()4R^4YFIc!Jkuivp#r0M3TweK`A(x{KVrBOtHjM
zwzvDngMKVdXl~f3<HcbProvz`)L30@vTTg>vb9}#jU`q<X>?GagpAFAV6L@L3k7CJ
z)>6(;Kuy^Y3D1gUmXZ;QURT`MJwOJ`9WdnYbL|X0b$_ITrEJc?Y2dJb6casglLG!R
zOk(0wxREHf=m*^@(}u37j=`^gP%m3H2+@&xa0-n*T5ng5e0wpoACs{yRFG_~mRXb8
zHyiGj_Ceshr?!i0m!fb~X+T|shlGtc_S}Jt_5N=p%s0jQ=>fo}UZVVilY|sGA<H*E
z2vy{U2dBt9Xq>L9CFW5Uq=1X>J0!FMdxDFrBsUhWFL+zghjl->orZ<JIQ!H@oH!<+
zD(kGu(yc2+AG8N0?OTgDZW=F@M>|jL)@U4tpea62c;@&?(Mz69qaRg8y(0kY()u>8
zUH)PraJ+UDmqQFC6mv8l+|k5N{TRW<0dDCkc||>S@zyKqmin-)z5wP!#r>n{Y6ypC
zi+_m*z*kVy*x1;cOm;ljrWXDNkkt}#V$$8$B}M6$4?a)fr0c4s4MQWR+A<;%zIx_Z
zUA-0o8H(?}Y18`8S*yR4&vVa_H;FTH;-%4s&eW&)`%fekVG4oH9Ad`q316O-><v)p
z6}^>9FfoqyUfg;I%<dty;@6C<F_PGy(~0!F7D()`fqnle{qtZ+0<iN3BJRR;9!Hs@
zw#3ckh@)hquz)3^*UV>V5zdyTt9VmgnNEzCV_Gvd!r~rGcKXYuVHjH&fQEbqcR6_`
z-eRM|z45C6fNYG{I!#<@+MY-lp1JExb*JVY4%l16#=dpBCx}fYojgNRKFx(V&O@AX
zfTdagwMceq;hvVO8jFPzi0y@_qlrln3G*wZiRH_l*a2;B(ajnfnxl~QhX7Vd!UPKV
zkGg6k)|-tIWsHnQB1;SBT|jKUym;nyp&fS{)ua72QLLz73B&aU-mIZWe(lm@s_~4I
z5x!&a?bnK+gTvdL@0QJ~*tiI|x77FOW{H%BUrsgk87#@Cle^E$^E966B0=O^FFNIb
z*v1siiM&1s0aTD&b5+3c9r#?}Ch_I)Z@trS=2gSgn%!!SkjHA*E!m3K(YhH$FFOO@
zECiQ($R^NQ(2)k)=&GVmE=XLxVutohj`)Xd8|#R?*5j{t-Nb<L>I(Pkq%3Dkl2lCi
zG)UJxi!FuYrhA!oqF-g;0TZ39j8|)jGqW-%1|pXOEn|u-+!tEvKR2*Itff%d5bRdS
zCYG`Orc_mcm4bsA+TT^xPg^W22wonzv~O;|Ki%WYpd1)ThAkB~z)DlJ^7$|``V~W-
zeXpg$&Jwpt6?yHU);mTsnHT<=WYNk^dBz=;D{+>#_dtTz)<`;KEFD%{P$*l!17L=!
zu}GIoLIH)RwYzLbA(_>!CdtnIjjl}nQ2Hd8s!Cv}$&_r89ZRL*DxN#l{hDmrynrO~
zWn(nLpdM`v@A1f~k1Yb3*^$_MfhZhRbh#J6saY6MtVkA`Xaok5uyqyg?Y_%jYa8WY
zKJ1-eHs#asbaXaujeIw~ZlZ_5(j4&m)~Lr|M0?^O&i;o*BcX-$iI{+QW29fHMm#-<
zG~wz4z5M>dc^)XsSI-6VUA%|Jz<&M0Gvyc$acXK-qCWQJmeIrdlv}bTa<}dFO;do9
zn7}d83m;Z4gDVg12ds67MU-B-y`Q|w(eyaXOWXZR%V_+}G>0>VLT;87yE5g+5tNO7
z7c>C@D5lW!#l^NEQDQ1LFzX{Tb`nA{r8WHW)Le;DSeDP@_R98bnu6yhVUvW6S#L5Y
zmUxB&=_kFo1Iye{DPq40CZt^GwgF3)8uZ+8`%}ig1(5R^qBJdm@mWv!1(xRurNCH0
zOLx+kYnQ=taXIh*ENOBLka!{?5PwGMWJ4i22u(p~<4)^yDG0!(+mlYJ1Lga<5(b8b
z*Q@ylM%gUxkk%)b>y_FSC5NNcjoLdVlxXtE#j)Nn-56GK^^1wHAi#~-d8hk8+917Y
zDpw-sWxBcv0a-+dRr{G&)5AEoG||jd?^kr6oaxt3K3DiSd`Qn%82=-6P12ihqkxsS
zeu5xUV*wqmRZTs?WHncB0b=@9nV>%Z9#O=RJdU$AmmeUHXJaPFv11@*E1%cXzC1U5
z<nuE=?!Wb_p9Vd<h{)u_q^;!eP5->|>F4%`t7WdrU^#Lppk`r^8}==g1v_fM5nai&
zLiWqIuzjyRsD9;(grAdE+s3xNVZYKM`T+|gSdbN9b0ZNP98{tKSJ5S$Syp;SVlI3#
zksJssEc1(6y%-Uv7}Mg}t|<%ZSj%n2zv^2-?X|^fK)tnfj>GcguT;k1#=vOXyGqtu
z#U-gP4Pl;lzAviIdo3{VxyeN2ErJe;8n*0&q1zWuCd(gaabm!EYs=V6+jRqAt~CzI
z9m;4O6qgZ_rMUCo=j{Dj5X{wxWr<Vszy1=wra%lR9@0z$Mn9r!n{)4~p4>HlOZV?H
z_*qQHg3*-D2WUGq;Zrm1P&|>S6tp{r1zV8Q2Q)ZXs4~0VP{VDzE0~@7W+VT}ktjcR
zwolAAzwVCN;b>eT>pfJu3y|dgyh+Flh`=>EIzuYy3^EMWu(+7?C*miUn*s2~QOV&)
zX8`6Dbw^$k<&cwK18`f!u9?%{ym1katanUFN?+PecmTDhb?v+^P=i}ZFcQI`aYi~t
zs^|-DT@EHXmc>MSBI+NELF;;Qdvhrr1ADO$b8E@ok9y0p@^bXAkLiaZ?0kznFn65u
zK~ADT3veZ`^4Xuy<QH+iPj`|hlEbS7J_3e?<|zTzfM@!EXEZ-jCnOmHNS|ens3GKl
zXU2eMfTn<i1WVu<N5^l&cE8!e-{XDXKLF3D0q?{0L}FBQ_FQ1G-5mPKw+88tpZ8-9
zPZ<jH=^t4Z!B+JC|A9k=j50PV<D(=Qa&`<5ALzASz(l<k5X*o#c$V>f2*K|ksiQ(h
z8Q+h5IvyAJi?jMp7=R~{C<5EKN-8Ls>5QK^;6`&w7rkRU#aap=pt4AvmidFJeyh~{
zk)}wvsf6As)(Qh%#k~@8DkrP3V@|jr1L$C?uE5hE?0DP+;toNvnJD7{KzKX?uw}&G
zTt?M^jy#@iz$=r+;ZQ;4F9Gx<x`7P7aFc!?!f?W|ExZG^Kw+5qysjE|7_f&(NEoBW
z_FM#)fbc>gRB@t%60@Z;XK(|>G2sHn(Is^5s~<2P-^2<0um_n9>+*jPh}4<OiP^ZG
zk0v(RDFfF6P>9qKfOf__-ETy2-q%f4u`wBcUJwar77Jx_UK;*vU!LX~)bQCI7muqv
z@=vpqcVx~?#ojm~o;-x6kQ-n1k=n`*o7A#8I)L_tXUGQ;6gPGu03eF)%}jr>5-}|7
zxcFd+!DDlZnTZq<C>&I;gC<dZ;babD4+pN;g-4oBmip&;RxaV;;o+Mo*kFY8!{{l!
zm^<6>RSCfO*ipnn1upt#vMngS3~4=e9x9y?D?_tNibZ$!m%ye>hzHc)6Mj^^VrlmQ
z)-8T$WzLG3U6c37J*r+^4^uQgl0jl_Q;vl6_ctFY*yo}FLR8#JlH|%qYpFNt2&(_|
zz+Hoag6Tr&N=?nme8)1IxZ_H}tV)XlMUhb62h*dSQF4sSdtgsb8&Z7O2&ruzk;Guo
zSi_|0+Rl>AY<b|$;Ih<Uj7%Ri$VC*VD{yJ=<YWBK%A7doG5)|_PP7)<7NYuEScSto
zz6cod_-F#QdDx%T$=0BAfp2E85no!IV=DM}i-s(Bb#_yGfVRgTIgZCEYiE+MmJO4v
zDuqn6-1S>3A0(~Vmmd}`e4;8(a~SBFe`kbt5rq+X0eJ>gwQ2LAb(3}z<d*e3(cTPR
zwK8{_aNzk5A4`}jp+AXbq<Sy8-sW5)eg$B-TkoiY!Ulm3Oah-H|D}h_n0l5x&jR~m
z&uhuus;&1^$hE3fFzCsy?Wn)D!4WCU@8w#a9r7hSW8PrxZMx)%SEcR<nWaI@jX(2b
z4re*5#6~T-B}W?6Fx4z0R$tHp&o7~RwzSch{7f`kUDMR2yn>GNYumcD^P^WlAnBF^
zHEAvJ+7i1?>*Sc$<$ZIT+e-swfbkE6Nuq^S{Iea*`@8$MK50T$PL?))ACbTeNGJ(^
z#&DCbt<lyDOgk}tBe=CAmUo&8r5fVh?IlWuoz&F5RtnaGb`*`2A%YvGZcZ93gHu%?
z{4Favk-<U9z^C+CG!miYIc*+=fJc+ib!P?Pzcc7Dl5fTtPD5(t%r2EOxYQ4r-MkHW
zvlCi}cif6FQa(rUJI816;v|GjK19JpM1VXz%Y`q%>3S|YKnm=2z4)5qtMfF*epD*{
zqPsJc{Tgr5CTm|b=magD4^lQcmr?e%(@Hc;UEUN@H1LXy^mdB_bqG}NO52r-<o^7c
zm#{N*GShv&bWH=!D}(#~#i^DSO}-+MP6<q@(SVZ;qO&Z3giB606LDGt0*>w`7Xa8j
zGKmh#EOdP$^QhO((+@g2@~rnwZ5~MT)EY@y4aHg%+dVU&b@eVX&56x?N#z_JnSuU>
zkHBYFGioI;UJKJUgNxc`2c-My-rWReC_y6Dawccl`>iw|Xmnb-oY7cX&?t)h{NH<$
znl}v*tG#nCVTCfJC7+o&LmofEC6^HWvpIM$z%nM1pDc84ggX?*ca+RXkUC>x4DCk@
zN{y~1PK=d~{RulcP|L0Z$ip;QO+iNqDx5RONbzi{NAPQLGMj`>G6j(;-koBgF|Ir2
z)gtUuSb)GKWe@O65)@x~5qTp&$|UGWJnu**%fu-BfL&?MgxRt};tiVwMmJX!LU~O_
zgqO&ivQ5cjaia&`(_|FA?TqXRWafVFu^0om%R?KSoHjjm1xW!*D%On4>SWQ(S-H*<
z!%E(X{oa$%LJ^z2u|H1cuGsUyo0)#Ru{eE%r>;$U>B{B`MF|Nq7CGb>EU0r3H|lH&
zP|uy^Xk~bEeI;_XgcVZ{>NRo8R`cyMs2_`~Z&rB1duRa=X$#6!vCeeKPy-|5A)C(j
znk&&0C^W-2;HIx13Du7d*aF_%AXdo51Q-f4Y6=%Ave__Qhwi9yt7D{@^2fyne{E4A
z76b&B6F%WpcdN4xrg4hkU|nLe;~+}z^_!{i@%}6bAXx|c)dV~stIpXMd?$CpPiE>G
zAQ{kW^>F9PLO|VgRXs0ne+Cd`nJRquj$N5?=gIA9PR`3QPmTj$oL|3|P#z^;H)<(l
z^A>T6WV^9bNp~idFPfR}eKsQJTtKmsUdCE9(^`{p#xF)1{Bs}v$iRjDykyT@McpX<
zB$f&XSx&I^Fdp{A0AF#60BPG)!|bADrH&*WWO{VHG121{i*sPUfrNRjSvI6g%Btu?
zF`Xd_@aRr0Ky+-mEM4|mKTi-;1%%jCXP62%m_4_<*f$zSGlEL@x29xoE%#r;8CmaQ
zzbhx>X>65*ZpZV&T4UGTZ7VolD~s3kA^#1&_qUilPqs9Z0pq7JLkyTcFet)tg^n%_
z8+Rl>J-<ge?lxUe1)o=~xN&P>eEhknVv7<Wh*F@p!<F=2gt9WL#>A@dOE_P5FvHn9
zJWqv3L{<kU=7v{J7zhIx?S3Ov-y!p%0^cF?MTCUL2h=BjDsR&n055)=PxAFi4?-DK
zMaR8~@iHu|$La;L-^=vq@8Yhl-X2k)Iyl!0i4`BJ_Z?@>od$sfnG4TdAV-<F0u0;#
z$Fqv3>Qw-WmAQF%c#zn{9(+Ha8~Xq8xuyHo><nsg89rJ}jp>%Ia!&z<oY>w!{MRW$
zUH_FJcSI~n7P{dQOH}^p`oCQE&$;X`h@Q!btx|_I@5i+oiF6i<iLA+AoM!@Wzp*KM
z_ocZB%|&*NFdQQ$Fsm+L`_dh2Ggrwo;z!ti!{r=UR~8jn6mRgME1n-GuEm}YAbTX)
zFI{;KU8K}>EoM29SXg1M1@Sx3lQ&FMM7`rB9H&4z6r=s)WB5HU`BS9exz)tj-&a@}
z8K0~bkuIm-J+vp(QTuOCakI^HAL~my4mG!)tnQA34N>RLNic5kpQ5|vlQ!^LbGad}
zP8Ph!E<WQW^g!ilN6wQSBINdxD}dMP(jlcmkrzRJlk!zutc=Ea)Ub+=#T?I{lXz3b
zBl&k6Z`{8wAB>SRxOBL0=!KKw_NPuLTm8m(t*F<Z7ZfZ;2M-x?N-KWlve<_K+uM7V
zXN9&$8}75n@A=0lPF1x(sUBHg4PQcu1KGVA(fiftn$=!A(<KX*M1elj=XW+ub~f&=
zXF_Y&lB<1`mX$X`cA>B+M?1PT>OJ{{p^w(&3KyJ9HO5sRCCKI(Z60Xs3Xtx`^emV7
zXiEiYEO;)^BKD3vzGSS-I^s0sWpp@{^Ck9-KssUfh3R+89O?c`Rlf@W!MV*jumb8D
z2#ErUc+oI%e960#3+uk<RD>(rN;RxcSr<E?&txeWI5aNwMTI|@J^zCAncnrJry6wc
z@w)Bk4LIYx!EZ~g7O5ws4`-J@q>l_OShal^+FyRO+VI6OLkzsWb$zk-Ql4J!+_XSt
zq)APSq}m@P5&`jR4uzE>;g9DV{gR!3k%0LU3Y^6nk^0uTH_V^-K{~Yn53@>?g?<d}
zu8&tVkyu(-VJQB5Ic6)SZv%5_Y^%xYYdZU0kWkCReJ7R8yS^T88hW<uZ*Lq$`aS7h
zj+wGG#Kal#4J!!Ct50_yO>=~ESa&{=W3pdSHDPeQvl=tCGaWt2|Mg1QKCRc7M_fol
z8QY6Vy{BfuFPfZ-Tbz6QmC}a3ULU@8xzLfq77rvyK%KsrR5srsrl^#@Mb)A*<oM1Y
zk`4CO?fsVB@FSvMpfUQ@0B^LL=6L-Nw7Y02MZEZ#wDz>?`R4@^M&jY0M}iaw$Og?w
zRdU?a3@IabEy^oqED3Nt@pp+}g;!fVR6?9&`&RWVnOZ(!v#GU(ue&e%=r-gt!#S$j
zOD~3B^^5uBSweBfiG0=J9XI6lj#VLH?u=POmxY7Ab?sVA$$Rnmc?U|G%)JVGO0MBg
zX2J7~DT%%f(GB*$xb7=}*ec9>yM>NBOr<YN9MghF;I?51w>T0HCWJAhPX)1$-A%*u
z5FRkVcE=A<Gr5I5Vq-4qS+D}>DBYy&u;ff&@1e8-KcOqwk%L6ts1qmL!%YZbtB-FQ
zRO(}-zNLZ?XdK@84Y1@zJX|b(qLNT_Ar3!t**F|6Q5d{YPHxWvUC6g&oWgj0?Yi~E
zBF#Ha?brSb)!2E7qL*{&MLX8AKE>0#6w$G%){UNuT7bIMv_@KwJTY~@f7c*oewWO{
zI7Um^V4+JxnU@a!oH4*U^Xg`+sja}TWoUl<WBpcJT_B^bf6?!wjBi*Dx64A^yK^KA
z;lmWhF^`qE+Yn8xoHcvt)c+rQ?;RCY*0hh#C`wX5BuEaD1f&rW$r%YslAIb45G3au
zL<B?>kes9BoSIA{QDTGS)JSY%H@Sf({EqXzGxNTNx$nB`uDkAC>-(=c-JG*`o!Ygl
zo~Np|cS;lT;9%lP{ro691#t;pl=Pzg!3$r-Mt3r$I98j2Cs7lgEO=3kB-cFj$%iXi
zRn$#ZPq$9^B*Lw7p8rJiznMZ(Kvmc;38wt!A1Kb6oCbp1a-G`{DV;osxgG*eq^r@*
zh(R}1ha0b&4?KRY={PlD<v0O5gjR1<<1^V&J0x|@KZ~m%=Bn?+uTq`^6^dUIjcdRT
zqSH(}ovUB$DuXtXD;NZXERLfx4z|aR7Tn>;^+f#!WcWiZah;U3dM!wDjsD<uv`2ym
za>g$cn$_V-t$G$%nbm%@Sk8K?*(C$3sYdjiqa85E&!*E=k97ArZy5&4aGBOKKfxS(
z_hu5|)udDS;Tx{hri_E6Sja231a;4a@72sam}16?zn~U|FEZ3_cp?nuJP4y4yNXv-
z`48WY@2y}PsNXgHz!aLwhf>~9KHFSR5`&+N38CEV3pXp7?d&y5QEy>^mV1*6iM5Ac
zU;`;>dor+)$h`}{bJXabGsa2yUg;M0!}AL=Zt<TWjEcZs@ZyW*EqwoAuI*hOee((i
z){Gv%X~SlI0o_Jkm;`0=6T|1IVOZ5!G6b7-2nwP~Zp!1QFvWnyN-TcQB6siF3H=Zi
zF)Z!;<y6KwhFqWUY|6uV5fxN}*o!+0aASTYR@g&O?Yrx@v%rN~NJ%7YZD=Lmt=xcY
zkF+P=1@o3j-ps%9o;{bkgW+v!lCy8PbuH|nO|M$h1*Yk@X^<gEiZ)Opb7y=xmSOm-
z3TD}{H#76DMW<HU3gY$lg3iHL@u5AQ=CFl`K8X4Drbp@pHFXM&j2H(w_oQ2s)<D*F
zei`rMOrFOdwQh}2_@;`%gyvmxNFG;j)Xj|YgGou(n+mFRKQ}k8IgB^K>tLD3m1b#1
zsz`UIG>PRBl;Z|jYpdJb@yN0umEAGId-6Ct93ys~wzmbV>5%WmuuoCHu#$9~yCLwC
z1JqiENr<j_ByQM_VIiNSV_Xj|84Y#kkk`8qFcG}4_PUp_iE`SHbX<IlVzd83*O?KK
zDc;psz2+cuKLjR**ZT}BiG>>am6#xZFS2$V($n-h^}2)ij_rA5U8nMSS4Kqp6?jAH
z>u%FCjOz_>_lJ{{`TqTS#Z<R5K`*1zNGDR95O(a@984WpQyJIc4TsbFE)a_rS`N<7
zn$SLJNgZ=ymll*%*WJVTAUJ7w5DDhm((F2DJxD|-PBd6ZF)rPRxp)H}eGUyuLzGtx
z?0GDQFU88FIRc6ds=2)$Sb)-o`tqlWf`kw?R^zI>lv7nc+NV5TE&@4QEXHF>`<Hyx
zaO^!x)obCA#)+BjvcOwt#FLRo*{Sik8{0=FGFpQ8LRj36zdx|Io{=U4jq$!208Khj
zGJIHQ{+OC`Y8mY}<x#rf6^>}FM<MqnR|LJ(ZK2_0dmv0Qtck04;Nn6za3Yh+a*-^c
z7ooqem$iPsaKCBkXNs;YEzZ3Z!ddl#xYo=6n6)sAyqInnl$6!dmLvkf)uwYglv!AU
zDBze8T|HhF8mp&Cw#E(Y3+M9m;NLWd8G7xc_|6-Ij?R`sXccgz(XAMdD=EMpbsf|e
zG~dQ3pgzuev1o%8Yd3F>9x&54V>}oYZNhz6_aaEu+3#IWM#PfG>@XYC2kYB-X`E6F
zO&e_75#(X3LA`kw%h{>Toi{-Xi-QtyeyP(-JOmaWSyf~&m}7U5gp*{ua_Z6Y*0{sI
zhtEW-8hgkJoifAWT19N-^|W8cAA4UfZe<9FXmEO3rBv8^uUU!f{$j}VB*|}yN>#g_
ztjYLb6;MHuv*6xau{wzq4UG?g*fmNJBA_b4f=?rhLTN22#cn6{A!&DOj5U&9>}hIs
zG?JF0DmG&4eBF|jamSHnBz@CFANA-gyT55aDQ#RWDsxa_2Wjc1E>O68^x)sPwm*T8
zuMRjkLBe4!y!e;i6I-PD>Nn@<T(fpQ%xQO}^cdF0lB@s`OWEQqTOo6|_WUDbe%A!W
zRdmJjbD@@v_Z`m-*u5h?c4(Tmm9%WwrpPi?L#?^9u{24Y`K%`+Cn6V4ZInE-)Ri}|
zuZwX)z;8=ulf81EB&iPGe)zFm_+i1jvc{GyjPu?nRmkm~wR2^yLX2~rOi#&l%E*Wx
zMd)SfsB0dk5COm#SDujM+dQr>jUCnInXg(F7}9Z3kDjm>v4-QB2fMsY4emfyxmmDA
zve&~k2aZ8`<QkgbMnADinq_qp`PX7R8Sk1(5wlzsW*w2UO4IhvBF)3a@;##DmO3a`
zego$1*5KB41HJUa=H^~5ah<r#<7g2-&mFtk@TZHjC&?foXn$9=G6JpUtUd3lLses5
zU{0<3lLD6QXkhb8-Ca)-@)x@K25jy9L~HMxbK2mSSmRZ<mhGDPrPYzku(hVq=a%Ej
zRD+V{!_QQEn;)Ncy|3_(9_>ArK^#xNE&{6$g!g*g@G!T^o);pOvo-i|O^Q=Uv2k;w
zY0i%$vRa;rLuPaCxt$)(MRgC3-DCBSt3frP;fJiHJBNF0NN&v3i|PFO6X-C$QE=x?
zhHzEOq$nBEP&UDvsl_phYe8Cj1-xr_Ei@4yTbYEe-SJrM+%O*2<QFPYa}&rI5qGm@
z^%P3=Yhq4@n)>Q+B2(O{LS5ZOo492es78({&o=gJq+A<9eM%7`<Jpkm_1)R>6x}he
z#l+Z~Q<xL3aqsB3I=r;!<cd`^!?6f6xVNi-*m~CBg9q?p*m1?)w5R@pj)qFHd9}gV
z#&$*X><36#-_KCe)VF{mqo(s>kICM`U$-WjBFMLpR5t<DXanAbsDDoKhT}Jx4_S@x
zYfUbGK>%*=r0nTU!vOophvCb#_`zVNv)QJWSmjDWvDc$qJO}FdxV_2-vZci}fkJq{
z3mRK}2oYhwy=3bXIpN4EJ>5qwgO-E#<(_Y>Lk~mg@i5c~ky7Fd*JScY4o`>rDF~C@
z<M>0)rigs&@;vVwf-a4wcO67X1d#PgAx0g#Q4NrrDap{$fgS<1lot-DCpB;#8@~?(
z>zsy02%Diw)B&~D)Wm#!Hx^zYxXa}jIi>V|L!{~Y(~JT~PEug|qLKa-Aro&=(<9e=
zyy@xtVPndjkQ*iKS6HS1u1?iRFGq`-PnT5;{PgtAbQN*#_6~`cEh)H6kAp#i6e&J9
zX7FRKFuKFVxO|V_BZR0RLAWCvgFX#2x_1mD{SI)~_Ed(sc#Nw%+Gm^hrwh~CdwWc)
zgOJOnHX8w-x*4U1K;GbyNxvriW<RUm2-zx!zJmA;e(w}5%Fp;GMGyyhO^BTOdygH?
zxBN46<KT_x`!h{bck1C}8uCv^6UfkutsXBLH0O;-PdM<vTTUXVM#(Eq({(AwxWME`
z2RaYJ*m3WsVaxazu3XIFbQk*_CMX+}V8C?M$u;wC^X!B1H#>{7oql?V5&f+NN_z3H
z1c2kZ>sb!_l$n%g*_ouAeL`(W9sIt7*K^!B@&#0V7@ObXfCv3s%39{orNW-eL*P5}
z&&o%Kju;!M`mQ2xei<6WR^>P4sWS+&c+RuOE>uU#msr258WW%7&PCO1w<~rdjcQk0
z^W`0!6Q&vtUG>L#*_Kb#e5`JbI~InS2IepE@$89Cg|a^l!NcyoE5e6e>IzMDYqX6u
z2@UPgmpORkeZ!(&eAjIrQ9U@<$u6vz7Q6EkFu|Q3h`9+(Gp<Fo1dy(ROEfOU518=c
z?Gd)v#gB1&Yj2j9^RpAYVlsq)$EprGQ@%plo&^VM>^0dpt(ooYnm?T17ZqFZW2IGY
z7}7XMR^`WV7be_4wdaEpuAjYjK0l;5z@SE9V_QVTpe{RDn|D<7YQhb>dzE03CEJtI
zxfi))Q4Hb7z2_Pl37L0|r{*W05f*uvg=)C?dzKcbtUTTObWnm`KW;2qsKgm|PGw~;
zDuSfwsMk^$`XtWQWJ6Z(_=%tfVkSJ<G>%QtkhhT8$uD2VFdk_i`UZ50-B^?7Y;ko(
zUS2eOE$=s<i!lhCi!?5jmUBdH!47FY0I}K+DF(tc0QQnwIrd!PD;%pnZk)m3q3MQE
z=Uiq#$ryCE=MZF=Xlt`Qh|L5Z<7%LN?bhpfBbYY)9I2H~1y6;U5Ddqm3yVbs5q46=
zH*yne;@O<1v(i!^QWk(8wHk;jU{hI;c_y6KfV=>6#kaGr%Nk~}6NPLn9rU)|HLedW
zR?X2HeAhOb>#=WpcgY@fQ=##zvaO4naID!jqmNwiMoO`MSuLN?9Yo+(CVQ8AbE)!4
zZE^i{38MJADWP_;7YV<YlWMW0oMLnLZ?N3LEte;dQn!kNURpUt0kgG+Id4m+CcALy
zBbysNx`D;((@(dWbMyUv=Jo@Q>5GMeTQ~h>StDw)`;bx8je34N4>oJ~>>gBlkyodd
zd%mc#bai$m(LK}Yc+)ptMyE??+51knj@HM-DlHo67se+a0u`J;=uPZxV=7ci_R;1T
zH{{qIIAgkuFEa|NxV_nIph2LcZWB-Il74RWfMaN4{fa%w>pJZ#OJLz?`xGX~qhn_m
z(v``;ygV6)_>b)>>jI_%5FWi$rjifNs0XF!b>AmJFC39w9Y?tu0%Q^?XQ=7c4G+34
zQ<;*yf`KIVPi^(yR(hxoKGC6|r}=Yd7?oL!KnSqr6M;34CcL3E2g_<5j#yexwQJv7
zhx=Un162D@y=a*QAfK6(VxUo*9G>%Bkj$soPq{<l*m@Upr{$|8t<HUTyei={rR|}~
z)e;0su}<23W+&#0tRwpC*!L>(p0(`yOc?p@9Kz>5K_rF_NkhXjkGkbmiSl`-Y|pM?
zWR1&()KO<^1t%TbjGJiDhMaS>>zm70ywdc&pDonwEDw86N9L`3S)n1*)XRF8>GXUw
z_K*-XB2>5(%bL`NzZm+k*NRCfC~@42;`JN$1n(oF92rf=nqZxYM=`V|D-tP+)1Nne
zL{Pb@MW3thxyRdz;xU$pQLgV6TQ%L(h*by#2hBf&Vt4y)2bz<LkQWT(a*ZeECcP+W
zcXBv>7aB$b?ngFt3YQ|MWHCR9{E^Cl+kC!x@Z@U<t~4k`v_$k6>a!aXM<0mo)_QzA
zkThbAs)yXpRJc>q&{qcudoZHnf56T&bbx`3DVl0lDrpkOU;Pl~)JDD-x@fPzY-XA7
z8<atJC5@~uci`BjRzK-*+}@SsN|s~cvNVD=C2+Ent!ew5SK~oe?73Tmwq^{=(`mO6
zG8}CY%%iO1Sneh*JqVS8t;GFAuO^(Nx9>LjHY{cB2tn`KIvhBtWx6wzO39lTxsD24
znzWv0vE@DJ4P4UD)}eXGpJW&cN+q@3xG5R9;Q?A%MfWk48%ztkYr7kE#pJ(z_2$9x
zST%fWIJ{SUjdwp1^Df>%sCZ2Ns4C7-gf+&4OFae9s)IiFrWl?*<<nPqm9wRpDq{^E
zM_Wpgk#6_YY<>cKy4QZQ!ERgcl3UttzF}wap2@J5+hvx6n|h4{_Eo2iB2!=vCz#j!
z0|9@d>2k872Das`r)WpwlDN8jwsxXm5HYD6&;$hfru2jq?bOg%x_2UwV3%~W$vs?>
z;o+Kn*R$X9--=h3a}B(g<gJOTn}0KP0>b~0cS;;-BASn?cE%ig@@DRNV_c;Q$t(9l
ztglB!r`XeUWlK6H6v$Uv@(gb*ZtcCN8LNXA+ITH+g>n>qwDC&nt?BE8A`TkUT&W4<
z;V1{RY6PPTG%o*%M!2292F(=(J6o;MPDe$pm^X)&g=<AmVSxpE`MuRS0<1}Q9$bv#
zhDIzgo@%bA)(03{MgAEV{Js2I)BxPUL!r>71dEbB;<SD9aNg9=wSQnOaATEu!gJJr
zt9W+$h66tnCCb!9+>|f3Tk%=wdoQZ8FqD!}wL#mIE4$l>@oA(Rk9?!H;z8xTyz;jA
zsoaOEVjG~GsNAlzb}`uXKxqv;zFDfK4R-=n9BV1Q%%>MZeNGOmo~zGyN)I$vwFw!c
zXNXy<&omdoRRd`Og+!{vzK5qA*RE%e<v|XVY|+(s@~WRVnCYca0wEJu_u8FGj0nX@
zkJXEFpy&xTsQb<O@INU(Mk6{Az0L7n$y&%d6$jDkI^?}icXOkYE*d{nZ(XUeiP5;w
zuKr1n%&&Lws?JaMVBH|-DNhQf6nZXrwwIgctBb(^Io|r+D=6p%0l-m88B+m8q{`Wc
zXpv(K3JP?EN8E59ywrAXtruJm#uKx6hs}57z7hT+CV0T3mXy)MsL;IjkJbG3w@W**
z62oT=3zm<Q0$i|fDJqfgkco#VNF+u2q3??~{iw8?cea7FbVb<dR?Xa@b;i^SvGXI7
z>Z|OjXFvxK*5Ot<ztbDdKvMb|&=D2|jqyC1yEuO+asj<KL+!)n{4RX9Q1}<ltPZr&
z9T5uq|3Tk~J7IOsHTPkw88T<-nm;_{o)xtmCR3_D%>C)P##mDNm;c=+xl><i+cu7^
zf8z@GBCUU)q^^E<$w0rK>13)ZP;If(M*QD@{IAWQ7V`2f1EJU1yHs&z|Dj1$i)!6H
zl<zG~%l>Y++uYaAmMN>BPk%o8Gcj@r=Ng99n5^Lq<b%g_qqdy3CVq$`2TECLn*B#f
z5z*Td0S-j~_r`w|@_XT3!>C4}`Ssu752T$pk}8pP@DGRu4d-NYb&}7!-)n)p)LI+a
zn!!dLD1X91bm9XXgm1{T2=TK^v%T{1Prl5>UFUoVzL=o{htAq3=oDIP*?RXJ&KGCj
z_#=ngpZ!vny=zt8e(Z_UjoLSfsN}hzq@0hE3*4VGcPEE*;zva`0<H2R*vVfx{Um#3
zlM}$U?<d^+_kGb`+#hKcKa(m;)lTBq;UB?&G##%ZH=tr}Lh?xTYfKi$Pkais-#-zN
z|3?W@BG;hk^@koB?JE~!pT*@Y``%NV43Ezq{ri*t1s{yi)8Be}Ig{llUw!Y!DgNoZ
z{3yHcucTiEUJoVFgI@sa|E?|;nE=^$Q>!EXzZk&-0NxmRnTPumA^iI-0Sy$t354#6
zwd|e$&@JUp03}ZXATh5>D}F!U?{4|cm?p9TENZ*PJ(mAs1lNHb=mEXus~?T<_g4m`
z0co+6yuJ66VB&jM+L8$15Pw&_`IEtYCqRD|JV2ivG~R`L|GYmZ{`b9A0)Urr{Y~QE
zSAP7>zpn7A0@4a8eD>tO7y%_f&RU9(VEumSI@zs5slriRUv#iWm*BNCX|G{OIH<MO
zvT}e`+{n*=*~gcfi@@dnH(K*lN9C-p;$kGpd!-EOdDsc-Sq!+V6s7U*{Vyg$4F-Ir
z?G;ZZd(@@1IG4(=(qifZPdJ~);+Zf7Q1o8-ym^?v6FMFBDG~j3sl<>PfhGG|7I~H^
zw*Ol!dO|5910X2DjdIY94QIa(I~_Z^6YS`7rQlrGdTcyohNhDupVbNs!A0jEXyqK2
zQo_);lI(dJ+qjC{5X~!`tDm~lT`kNxX_sRB*`TX@V~5aXreWazYh6^YG`G#cHTV{V
zj+rna3f+Q4n~|o?mWD0dFL<|z9DjjMK#HZcQ_^m_O(OT4uKuuyx&aMR1k;$@-cH9N
zzW4;`n{N3ezwhW#6L(9<=^Zpkb>*Y#k!Rl9OG1PbxP*r3t@u0h!S=CDMs%Xx&#r<}
z0}neVIa3)}jYS5k`CpKT8i*7nxseg|q`|&^ToDKN@%rg_t2;9&rZp7X*PuogT=e_u
z{-#oGn=j>X_!y!k49><z2MFBGH)S?dk$a0uC6zRtkhQ^JL1ap<;f9X@VIob+^7-6D
zb6Mts_))=Bng_@YbPE@H+2@2w0OdrjH~yl_r4)l6-gnb^?|&$gvq<v&@@bL!2H3wT
zeBOs;NxYgo$7ML7$P$;)VAn8=$8ZeFKD4Qb-K#H^1P!aO3WIiR9WTxs<{i(8d3|qq
zdclEXP0dC5{dYPV%<?kaXqv7;1!jqZw4dDbOgQHfBN*a+eYmE$P*?7`26aD9J9Tn7
zll|SlCMlJBr*~lVzUkQ{@5W-r?BkusD6>Z;0IBMfh96*Gp{9`#sU=kaT}#w2O$~C>
z6?oxID%yWpDP=D_;|ZDRgF;L_;re<_iK{}1lehLh#*G3?aNh;e#(h6nbi_d`!D$)8
z<EvEi>iO{8y%0ptE*V`)U>46>Dc+)oHWd4?5yWw%UiYNp!hGWd6>gA<aH~`zHLt0$
z5=w?kkDqRN#Ge_C4WVE>;~pLJ0RQ%#c5KH3Ym0W+G7;b3izwcAq2@_ogx4*-H<?^<
zy%#Tqsl-ty&%4ND&^-1jqH_KYwYrTrPzJ%h29cT#-igPbCa$#w%PhZzW3HnOAg$71
zvyh`JTKR8pDsG2}uAM!<hdyG~W~V2CnNc{0fERr8Z0Jgfz~omV>*GS~KeHu|PQLi!
zt&^XB6AYcX7wGmcB~e<l;>W||^u2flOLivO;wr8DBGo6doe}1Bp)>AaNPyXhasL7}
z0q*hJ>{o-@2^FLKu$|~(ix!l>2(q{B*jiI~hQFsotxf|ZSP*+$rQFsfvwG57vt73S
zMq|&3?>iBQrxyTLOG5&2)4lbQ1KUUY-dByvSa4b9_p4&`b4(|*Yi4IR!Fp<QvPRU+
z102lz;H_vpo#vUXgNg^XhZOR_ks2Dxllpf}y?371UFkHzwS8YIdbh@7wFy>AIV|b}
zEwbP}(pTeQ@`R_@*6-KbwN<<sqG?j0^21ahmTU0vsSp3P{$W}xw0aE#a0A{2=5;9=
zx8oRj8l5g5iopI@nQT6+t*Kl(1o|jwTZ?A#PKfIB;>8>!65T?JUjE&OkB8Qt+H5?3
zsRBW#x#&Fw1NWWW^08^ZUmO`4^@G!Z4J;D@dPoV5FuVT}>%uq-Srb<CY;#~|QDgNw
zP562ucR~|ZEXZ_${dVc0Wu`xC%-O!fZY@n=5wHDND8qYl+zhr8)#MxNL0X~IgEWD>
z71CQ}?rCFH<d$d`x{*;kgRN+2Q55N0K8+=Lee*2k`E|G$_(G-2z}L)GtfJi~A+NpC
zL$Acu{n)cPaQ3Uy1jteInQ%6X#|0D{xzb$Jn@h3~6tGSyJLys&2)99uKS;AVJNlt-
z``0yKZxWuZe&}>51}lheAU5rd;RBLj$=4$6p9GIz;BsEpOe(Y#=8gW6CQ9o|5U{pH
zJAOJ1Lx7$qHQJ{jjJw{0k+yt)4tbMNxEU`rrBD#|u+-EIXuKO(il({dk+%ppvnim~
zvo}OO4KdeIWbnqFD=2XbM6@?u(DJwY=zPlUF^d$aY2{ZaRV%&>|DqjuOzjwd@~2Ds
zmp>rP3+&IqkY}Bb({BKdu*V^v+g2fvw~?&rG0eXitXWunJ`2M%Zt&|<=Z0AwIEhkF
z#Skgi#ChpkGI}hsIe~AFb<)#@i96Fk6Rs2$z=hg;Pki5;`|A5nzbQbJCdFOs@7V9q
zuQd{Y3WbFn$wg2CLwH@}W^>UiB4Rx$P|tfpI2{e`OsQF*R2sIA<?EGuCuYZ@PH7=K
z4<7m<AAyX*5wNMz!)HU9WU?U}72BRgDA9>6cxmCB;8ZtsOt*MZ#l4P;Lk{3=Cu5Ux
z&xGHC`<t89mGGEil6a6JogduFts4g18d_ZWJz<!Nyx?U|6ctv1i7@)iD?JQTf#WWg
z=IICPG?})e#+)~UQ?!Q9V&{uZM1^Kt37Efk6@(=Kak18}<~#xNcXrjzyJJ1)eX`Z%
zmQ_awTTaDX)0RGhGwZLi4u!&Ik`=CtSS_sK0)WlDbu1n(9lFu2le}w~UIWQ2B#19N
z1mnBHP>`BdW4SEmBTN9qFnW0cx9%m4&pdqa8Hg(OE3boQvKGxj+e#~=PsXU?Q_{$#
zA5)L}klHZb$51x*60SzO6`<hS2RgeRP423xUjB;a<nS1RsU=ue7{-V$qyD6LY+&Jv
z)p<2p=7ctNNq0lA7AcdU@#9YsL{qTVP=PObv5^dl6zKCs?S|(B_9=GtkKCF;H3r)u
zgM*?H>4KeV=f|!Oq1XkpaY_De2X&!yl{+|YG_uum<2#cNX6>#ty7ZY(7tbTUcbNQh
zx#(~0j+Fkk$66LFZY#fsZFnefP6(F)AvEOzqPDs=CDx;JS%{k6BsW=wLsX94b(<Zf
zTJQKyRuv2k;*Uqk$8$nU<37FS{~SSXQQ+x&9{Ij)^qF5M9CMfSb?3Yl^}7&KGCRo4
z7*@^E0KQ;;p2gaAn0{tU|5jo*lRoGR<uEz&cs`7uq@qXSqXFyup>RnP(Up#{UC6NR
zyBsPmJD9l!<-$v)0^LVnnk}p29cu<Q1L2#VAvLG<*Jf>4J3+lS{UhKmyC;cfs05k)
zQ6T7W+E|7vV&s#ZqMTC3?dhzO9wA{H-*(ANiRV61=<TG19tPDV6TMFnP45&^N1`22
zB4Gw4dyy>5gdBc`5X0tFEx>LnYb6!Z-sQL#L-+ag^X}s0%)ZD4ZQf3^ei{NP>bB?Q
zigr-H@M(g#!qIx?mp#yP%0h<IN<Vt9Z-6L39~%p2lam|V*sqwHuorUCk;`;{x~<3t
zRk8SZE=5)k`P$g<YgTe}Rsp^=$YljIgC@8l4Qh_f0A{uyDSDPEhR5>6wr!!wC&yA|
zbT5=Bi0-+DN@gj%@a|B+PE8rxEn+&c;x8YlAn|tcPYd*woi}x&YeN(rU*XL5vgMUM
z36`D@b580df4hUVtG{@yT`}|hbuB6CSh*l6VpvnhR0n9>_OOUdZN>>sCRmBkL!9!}
zYuZBWj!Chdfl=u2uke@)n1r5n8MgV9jrVJ7K@Y0-yz5y!nnUbWsZCGHnu~RjsCmh7
zSNG<L$In5PoAQ9VHZR5xtkRDkx0WpUO!`uQVdM7B5C%4q{xt*eP-P#nCN(T)V-@U2
zIO1gZh+K9cHc&`Z*6LV9uZ@5G$VbF3>&qEm!&*T@XFn69t6=Rz4#f{nTNDtBco6qm
zM`Ep$$VHzi@iv^c`=uDr6clHY-x(%v3sG(??YT~EX?o%zcd7SoET7F55tJk$IN}g4
z$zo}8yaMukk%sQ{T^}RJMIo4ZG7Crx(LEY45IB07bu_E4X;w3mv3&MZXel6ZK^_fJ
zO^utaUzw_UUP~?T;VEW{*2fk0Fa*F<9Zoy6bmG*hs7i+BgB3MoGV5=%>Onr{AD^Vz
z2B@{#KR`x~%DB>+)1W^Mq&#B%W1n+wTgx$0VZ27v>>c`OF1j@5UBeVV@>~#9171e<
zu6mq1fCDX>J5)|IQ-d59?F~w6if(DxVr|IAP$}O8q~>C1tI2^-J4DM5q1LuIv}~y#
z6c1M=SfZyP6k89|B#s(W6Q;-Br~OdvomvI(piyAoC{}TLvRj5eZ^4xxn|HxnvY=?K
z(W?_T<nW3_v#AA3+j?D_2aXo{8#5n~tbU%>&APUJ#LnqzwU!K>ZDf{1kM3TXkF(nw
z|0Xa>6Go#^k2A;IEr+WCne22MG0Lr9XM^rOcz&5<*bP1UOgW+bakhbermv>Wl7F8l
zX%k!hy~2?XI0<*zL)!JeRIQgJk~CQ~cH3eq*rSQBSo0kUTuUP-#fI2otFOH3r&a6q
zDU%&{IndJ*n$8_0fPt;W3Or<a&1RB19nj;)C-v%0pscY4cIl9p>tC4)Dx&kHNzQCN
zFy6(KYUc;4ZSIbAK80_Y%~CtMSqjc+^U%#jtChW|sK&YB$MJ6$YXj!SJ77sXXdlJB
z5M-bX@?h}y-W3tM_dhgWQ~_eWkBu?6af#ybmM((lhQ?RCV?D+LdpNr1y!;X`o(b*H
zZM$uC?S!k-vy;zR-i0tu5go}z$Dj;yYkVg^vFN;5)RDNvoLjdnqI+=qDx>6*X3BOw
z8-*Hwe`JhuCeC<nVLvR9-0aD2&md~OA|v{&%#WAww+_;Wj*!q0!)+z9QI$*^Nx1%!
zdcbFnI_NoLtxK{SSajE!D#bKS_R6S2Y>b_PHFi~-S%Yv@35MS7@vG~ie@ITobr{iY
zN!v@~b65^ey-(mF)Y9*(KkVYV?LhuAnx+dr?x6_Yn~!S-kq^JWT%h`yv-IU8=S#?W
zL-xoXw?y5Z`_o=~JHXL8X`XRuay|3mv4d`2-1UKOL~HL?pr>OI<Dz?OU@k~+=;hdA
zd+#0li;D<_a5vT;bkG%8xs$*5W?<p;VNJmhRI{uSV-VALIycYC^E=1g3t|g=@;r7{
z$%=aZye~F8ca5+zEh)S99yaduHYf_ESSJl1O~)-WtSP@^HDrUGqZ!L8EUVX#j~A(e
z3(Y8^7T(^mLa+poHfd#Zq*?nqKrl@Wc^@krC!5|^dob7JOldpZE(oe{Z)kvw!XO;!
zJ+PZTk46>X%Z+k{{S0>T58&8Bcm7zVOxS6j<x}hlSUP94=fq?kFMHxgAX|EBolOXS
z<h~%NlE|vd8VVX#8~}eT^_$~_FzW^pANs^@iKb2-A=l6?1~YL~<Ms`(+0)d1{VRoY
z3|C-#Q@(~E%BekH4!6hFZg<DSvc5x3fH>nV5MAk0ecLz&2a0X%(oiW3Dck&5IcZ<P
z>V9uT>k{)9h<sX4`zIY6GKVIIbY)&vb9e1#+pEhgSg1ZoPp^=Q+K)8bbDMd@lG=F~
zH@a2Um*sODt7ecTaI3pG-?Own2|G4VocBoh2~Corqu-X<w&?T?<`YiL+P<grMl)g0
z$shAC;_V{uVxYm2w-buiqF}UTxIo)~Qg{!wnb7@MWHQ`I(?P_3wB@IWLTVJ0Qlfe_
z*yd%})Wq+&d1Kxoz`ledeulK3O$rBE&V#>?uhFBY3HEd}R^GCQ$uQ)baTgHh{TO3}
z>j7wrLuu*cjan-IS6k{=Q9X86DmF$*Jqub^9vhQXhGjM))4zvn(w}_X0K(L<FBCp_
zdagqGAIm%$gr{?u&hmF!p|IX)brCVUZ7&<TL0>X(AC-``IK#R#jOW6P%(nW$Xjs~q
znD$rZ8x`FNgX<@^0<jyVv=g%H=S(u$vF!#PRo>e#i9<WA#U=H=6=EK{qbl(XZIk-+
zi6VtthXXH4aL(H>7OH(yLkObrY-(Z^x#(dJ#qP;k5xJvf-0>bZbmprZM>pj^mcMYO
ziSZ_msbjb4*YY*`v8A3c9^kCXmcL_>_&RuLcKcA+Tqwap=yleU>en=#u`{~Q9CQcB
z9%PK!KN2#<PnRC06#XdHBt|v3-Bz&MMsVM0RgFmdD$N&=<zw$w?{emr3SseGvoFgh
zd>jppL<3Hxp1wK#A`rrO$k6pt&%I7a5F@d1897X{VcU~^CsMdMT#Rt#Zc!^$H+e^z
z0+Ux{j6`Icj?Ip$EoU(F0R(G<7&hO*Cv@<xd<B!fpZ*8l@cgoJv$U9>p1KZ;U18;M
z`^`@U*3}6v$-3-veM#0mwT0n}$DE(ZeMY@f;+nbDu*XQ;71g&UbjvLkRorM`K4;&|
zFDKN~EG^6J%<C)nhWfED$MuE{Z%<=A<B~51LO&Gv0X=JhM5q?VBu4)RB8#+U!cez*
ztF5m22u%)Z!*@>gvj<{For=<WPWw>|?~PaKMyUo?x#pBugM|5Ui>rOJ;=0c?wUPS{
z<atv}Dv#)oCEe55MKoZ_;pMG|zxR6C>BYp%BUa^sOsB&Nr|HMLt4aig`kyzp9Y65M
z$Ch0<SDQ5?wm%+>mURpbF9s#w+*{u)zoMMb%k0$0*L&Ez?Rnnm?R?1aW!HrqNDSej
zf?(uk^d|2yz0&aby=NI0;4Z)kADzx!MNA=G?TI|do<)l(m*%Zz&T7pN8x2832DhDh
zPO(APaM|2tvmEWUcpFidi`2W6n-GVQeN6rCnI>7orZ=$$w1;nt|9dy+H-93)R$KvW
z1(1;~csn=n8`&ZA`-cNm)N=3ajM7bz<(MyRFmJ4l%?p#XNfPV#H^)v$@g{@E1l$-R
z@+NLxDTglwl|`Nrv~^6~1EkWQ-vi;Ctufa0W-Iuzmt(<Euxf^A@ZkK|*E_J<tY}t0
zc2#(@G?f8J`3_mX9YVgPr{6_x*ZPb+q7RStGK;yL<j$@%Lyg&&qMPh?J2zzb$HoOv
zQ;+v`EGT>~U7Rr<#u2Q{b{w4YPU~yL9uqe&FSFf_wIMC2w?j;8nO%zJ7zU8EW7Mo*
zNjVW9to23y5f|{dPu-a)#bJ0XEc?KGI%f_WBg#s7?qwvT_34I7vDWBZrOW%QRF?u@
z=<Ja9A=sSt2i7Jv2k?7__1!92RKmqEyfZUg;3uO)rb3PS-s(PTPEC8qy-R{8@21~K
za`oO7hEz>%ENdy`Td_?ss7R*!oH%$8K9SO{)8m)%f4j(^>_RM>JyqoCTT$0&qoeS|
z*jH|0d9!LtMNA`u5s#;e3?!7b<s!-wK<&}wEXj(OcugtO!~6?_gI>r>EtH^sj_dX+
z7z{$8@~v{-C#<PP<E=@<UL{|zehQ0X+jbo3xvBwBM*O;Q%Rzhyy0#ZP=lt0M(1FVy
zb)Vvm{XFmXoy<I&Y`WGfyTD8DmP}<&VMtA`9?UMX#Oh@PRG%Cl+%&xXVs6sKl_%Z+
z7HBwx`WhZ;GwWEO-?4GiuyB~PbdA!gr`C$1%fDoA3fX%^JK!@`DmE>Ms7Wx_+ode9
z5e|8jbl{afWs=R6Rsc2Mpp>P7mTuI}A)kqkYEDi57)!DOvE=^P%sU`0j3`)&C2I6>
zJB^+)v`FDRcz-4*Q@L&q+&ohrM;t5*dSgotns`f)c6e4GZ9>3cKYmFyePP9wG$PS%
zz6zXSez3N)X;F|0wQ!(r_DQ%vDLvDRHOQfx^@`HKV@NL2pj5!3u(eYNWCi;rH+*D2
zFOs}5^fgoEGgAs)LYROC?w#SzK3?A)&%Hw+pKMWpS<-1ZUBM9?vQ?I2Gx`Bf{vFG(
z;f!0RV7CWuFVbwcP87fPW1;w6N$dvB8WY5&ZWUSmd*=Oat|<p4cC8rlqz-^!&L@Id
zrf6nFP?nYho_dZ0^{!y)V)L~+*oidh#|`;4g#6vb1aN9UMnt8{DW_gp1ZrLwo)t7V
z4n*KPa_dRT00wsb`=#45{EZFQ-LQcGdE)fGbvz-L7`x*#0#iCbW{W0Ss7?H#Be9RN
zV!ioaZ$QOUW~>Wum0gf5l3Pc~FPM2{=7aYumbox+zmWm&`b&FWW>TZ6Ya&rzX&sgt
zu<+?y!KIb2utu8~=w&2Ytoec+Ga@GGpYQb$dLFd8oNjhs5A4h3CTy?~gsMlFz?I;Y
z)>Ff$0@?+|PwQ3lm=pCJTJ9DQJ5q_c_390zZXCnf-R0bFSl)RsD(g77@1_JlqY5U<
zs-AI9V8PAVh{jOI8=wvhO!kC|7#2%LQ3EA=fIqN2rZ-7tv{N+a+dsmey3Cz;<YhD$
zEIliVIZrM2q8{}#)N1&qQ<#$SAM>`9wbBoON?#@4<K?*gmhVY&`PKhRl3eHt=m6<U
z5tn_sNbciy%d!rWuxi{Ou0P;+*uBLsS9Nw}_K=L`FOo2V=uM4AqUNW!ZFX_0#UR7)
zlw3Rt>-=P+bj{uuXq@InF%~X%?hZQR5<G+Xoky)*0Dt0qJBed|?&1tRr?80mZ|HG+
ze^+;S!WjxQ*Qx!N7idX#3v^hvAslY``uGPhkcbT^NqVZ;^FM8+jk3gr8ofmx2fZ7B
zzs8>=8vnE5Qo5-Bj*Pn#-&`BA<Nl|J6VvMNnMmQ^zrkc>pL68W<&3`NdliqJHqZs-
zSprhHsS^)r9a<0rj}KO`B!UJ-edtK}!l94mH`(e5!a%RQ<@Uz=asCG$_GiKWmV>kJ
zr$v(@b3v|oN@{c41lG&~iZB13PrUw(!Tp+fi})LoF0AfvTbul(^?;LRA@omrAzjHI
z?h^m4zHNZ7`iFiWKui2r49Z3y6hDaTrh5s5oCjE*O#2xXBNP&@T;^$hnA>A8e)*JM
zR|jq~b|z62C-JXMK#|NMcsS|!!l(GDToifF#9xyBpAY_5zcKIb4%dD~@co6v649&3
z0P)}3)SvO`|MsgtAj#`wz-+e{ZvBMo|A9#Wa+BpqMG!x1THlQn_&-X3wg2+9;~ww#
z#^g^C{+(<iP71tXcF%zy5Yq2QiiN|g4NU7(sENgQI{)KMe*>}(UNLCwCqMrCK|lG`
zA2YNl1Ev)~-Zl8+G=8|E0l0Vts{(Pqy4T;}+Mp3It*fB0jPKR!Cu1)F7<=_0C$8@W
z{^QuwKLOLa4yKm+ZwhH|03>)OLjS*b1pxp8NZH6A^q&p!Tto;~e*5iWUtU^5{U@Ww
zA<AO}7P$<p?x$b=Eeb%-{#SYbzoWcpRs46LFd)xhY7HoqKFw2HkJnGNDw!^WM)?%F
zP;ZZyOHSo6svOO%5~3|!sky=`Vd=9;ltI1&mDUK?Zw}vZ7{)d{&;{?8`ua5;P*d#X
zF^b<Wxv_HNnal3Qt#*-1NF$IRtCMeY6Dm@tyx;Y>$~v5`Hp$(|Y2-+<n@E-1KJFnF
z9g=trvs2D$9C5#3cdIXeS=O9EsNvWLk?N%Pqe1xd3gx%D{fX>*+?NQ|j1C#=XC7||
zCC#sLQg3Y&pAU3q%;&NW3J}%+TmTca)a!BZC;1ROD%I*_vlgaN_?Cw`e2g9_s4{7v
zkBpLGG)1{CsC;JE{?Y(Wn|8F^5z*p1*xfI|yZ`G_|CvI-Yj4`!NNzD9(w@tCcFb7+
zyILp*qr2AZ%RqNVDR-J+7F#7LA(1&CZ>flwWPY<PN0)Bstg1G|b3EY?@Z5|k2trzK
z1uDvrK7n)gyl>Bl7^&@n+}{LAGNjo13gO1h9(22aSPOTq!6ygSLi9Iset8_XFehMn
zf~&!gyyh<Lgibj>c-cN@r*yycHOi|!yzt`Eg|tLapZ8-83wM2m=T3B&wubE!@f3@$
zXJPm_Lw&rDHEV%tfrVM`={UAGJABYjhijO!JP986IH=8+qxE6O={PthxlDn#w%Sz`
z@meF(zPmxD;{zO{vhQw{=9>(=JEi&DWOZ4T>`~f37=~92C4l<SHj3+48}ZbEn>h{B
zBH~5~ef{Y=uz+Oz&|~RGhWM`-zSZXP3Ry@I-F|KBUM&~&PBgI4fz0C61+L_*)yRIW
zh-s=DzwjM&ppChMAw~zbwY_`b9h&qBQI=2JlclW?^&e*FKNMD&8;}z=#3<<TOYsll
z5B13cr5cM|Cwb-5_k<f}p9nYaXlO4<0(7Ys-FitR!@QLe_s27D+L1hN)J_d38)geq
z0|8}C$ve@upZ)(~rq#f{J)%?~ajCoo;67_40V34LTXnnBc>+c~EjTd8_-sY!+L`)v
zWpkL6DtQOuKr3w<MkOnDv3CJvB_GEtujm;vY55W<MJ{q!WSv_v;{`7vIqu_l2$_w{
zLCJ7QaIdu?jv<^t<t`wwP&^ujMt6vrUcupB*&AQ)Zuw_LuPBpB&PL-i3HG|wT_xfc
zDVDEl^zbeI7^MFtAO90zM_7M2%IGhbPNOsjI`q``2a2_qZ5ckGyH8K!x<Xsz!MAQB
zS*Q4x+3?<2UyE6~JJ>iIb)2-Z#1Ih0_FE)QIIoXSL#bm;bhnoWd_Vuz+~SQ}hK)(s
zd7krUFML-`4yadO-@PK0Dce_BHkH7_Y9CumconrP^}O(&%`|&XyC7#x3ht*S&DLIq
zUkca%GQf~i6X|J%iyKi!e%8E{aHhvD{DEBMmQO!!5KznT?BWfxDr=)}g0Ba)7OnuE
zc@}Y4R;7KF6#tTwpI$@2wyo2hNa6s&5r)~a8ME6%%WQVg_fps8#gw&;G-nYOo{Nuu
ze>dGbI9ss8Xw7k}qB<lmu6G(h2R|euB=mR8`Eo4O5p+^u&Fr(?gGTmlHt+hWMzKD7
zRRS|i3-w<<`}gE8ked0;J-8gOfxLsebcMtb;sVrTKjHd_7TwEqoq%cLt{Et|n(|yI
z*<}znUGr6A@4JT+kSxit7DJihqirLw7acpKj~h+)d0Nuab<TCbF3anH<>AY63*Xb~
zC+k)Y&O*Y5o6Ksw%|K%Ud4NI7fXJ{h`3B99sB`0fYo5>;J~WxMU{e5CbAu3bxfhTA
zsg>UdJFv}j<aXi|;X6AiXk8N}94Az;{#14(fzl|*5g!O0Ka$xq+bu(y)ruJUsp(g_
zD7vOBC|oU!kQX%J5juZ-6w5|ADB6?|{ItXgVhdzZ%NQ}AJK3bW`NdS#G~a__?ydTZ
zKmEhKKO1TC`z>=mxY8mZf1&hKca9BEPhBoLP#D%%ldqu6P$K+A@a@U!fn$xmU<--M
zKS;O?@PXTzCBJfA*@Z+M@7mZ1C2W#iYl;{MG&MvXwqlZ%k89GJwA1=m)g~$~x9=ap
z4?LLzkY?Zs6B61UTh0azaBVNX__Xq4dc3DIOa(`MZK}QLqs|-!iwiwe)zA71;*$F~
zJo?yUnK~hPOvI!21txiOYS-l$@9^>K%qduDdNAR=YVx6#>GJ*uAMmeC!G6+JgHouz
zVzWhxevo=fxCO1ibazqUgU)%q6B|oF(kaO%IUuKT!$HUb6a>G7Vv4_>xfJG=%ZJ+g
zDqL#85suixP)9eXm5HNy2uwL!HNU0Z<}1kR<T*@K?e&%Uk>n)2=PtY&J;}vF;LX&v
zzw+#E8HDd`9;GTZdv_rdFMe{77zQltR2pL-)Aj2i6EM)<a>Oz75q{yn>B<w*L$z4A
zeWw~G^_(h!wYUbhv}YLarPCCi?X-Rqs36u@ivT)6l!JyFqejW(Hm3P(sH9l-qh~w|
z(4tEu<cSXxZVj(;dQVgg_j7)&IB&X^%vsaEjzv*q!?E&1GQi*VsqNdsAJel_R;359
z=ue1As)?P^+_F^s?m~EZ9Z!oI(=0CnK<M&P6;674Eyv|AV-dq%sSY#)-PqIlz^ik3
zHMa7iT9B*##3s7Jafcr$L67O0aPWdQZ?97S(qsO+9H;M!BP5E#o4|qBG<ga?)9IYg
zTqqHUlI2YfTV2+pFl)-Yuyfza4BeL7`ssO3TazZwDK-qL3R#3DvDGZ|#NkcJw=6Lp
zRXdMQWAfP5d84EQ!^T15HMTk;TCUfmeU3F7Q~Dka0V!$GqCM7uql4MpoWCB{&2I>e
zWT;I6nl)lpi3QI7?3QS03}p57K0bW%%`~u`?oVLX>8Z}lU85RwBEb_76@08=6w)<{
zi?D0Bek+}UXyWNv?inYi?E!Eo3m;H?U?Z=_X!NuzlL^v3rJM0F?7ZrqmRc0x{wV1a
zu$1MBKNm_^4cyYO<ajf%5pnYMqN38ejH%!bP(`DAHW|yCP--kz6$Uyy-M>h6(ihr_
z_!I-=mD&bs+Ojdd4NUg)*40p3*A}&zdEc_V=a`gr`WwJg4>lI4e7a66+Q+fDq(Pwo
zB!MhXyYJ}}o2)nbQgjTup1nmvAMS~3B7{F1ZLK5Re=Vq4U@x9&DyOB5Y5^#6T~(Zn
z?FO+~Mi$KIbvxKNI^cMBZCKYO^gYPz{-;O}LYYMY9S#}CE{+JONGES?g*`i7*`{E{
z%rR|X<E%-JBD$ole+^k$??w~5m{#Ayt*>v5Yb324biU9$LzKSSERtr&dLM`N3c4R~
zsDzE4s+h6uG~P;S!tIcH{O->B1L(7%m1>$pEwmv}ghl%)GS_!2UhFR=|Ng^QB(NzX
z;o5{)IhVHLN)aG$bNZ|yHipWrZ0m>ma4ztzhu5oUz|CO7Cf;YSRoP4(U*IP^D(bj-
z3-GLo*dO-Z(As{H!r4ZRpnHhLHkCWS$S6&Qo$>T~7$~f5s6tmx^+EEghr?`AVR-AL
zDu-z&sa;bQ^>9#+VBlzQriwhtsjiuUZNT&vuKsGyPwGYfCtMYl`{q{FSzkS)zcK}q
zGWN|x`(j*KhwvAZf`X)gBtNMF`W_K3RiHpp>9r)%;YzCGctBM0TghHL(Vc3K$^)=n
z8vM0c$!!g0b5gvzS^ev|UKA`L2$|>lA;ocm2)!vvAVu^^%tx6)X0E>bstJfYhWjhO
z?A*uujSAm+Z2B@>Hodmu5lW-Ghs=TBlsJ%<@2a%tyrAgHO2o8aRohxW(+u2Pkg0@-
z80J-R)`3~9%jx?_aY;2WY;}sG`5a-KO;gg3G#l~}ZGb+u`B3E!=2T<3Q+zB^Sze5s
zZXML3W(z?H#7HJOkWyax{?+{z$*0TxjTWxKfZp=sYiVL<`@>Une&@#sg;#zTXKvpP
z>BgHr0zgIfYAC83C|Wsd&K3Mg2aoSih<N<dgK@**i-T!9=xk{B{}agHFFmhs6a3%4
zX8-T>HTyHl{Q->v-cBA9;G2cOy8rP-{c!{Tm2Z^}ZZ_}!i(~6l<bg#)oc1H_{o`Z$
zNdf#2IduyN^?&^GKd+=m0zezH=#PmOKThm_8}a@Bxe?$0D(qkO{wE*)Z*`7LWZ?cI
zhx!yrm~@Xb>({8p|E%>b0Dqf)PrcKQ6?CS7^NivRTSCw+pq*hLTMi;lxaLFOVyL}0
zk2clR*Cn73kV-%|fN}6Qf8$lwSL%f-8e*T-9~gOD`*jcOZ7jeON&T9cwENs2SqMIS
z`3dn9<kDp*o8aVCT2C0~efq%EoEOjViWDs}k@7eNw@=axD6mneUbQ7s%53>uu0EP_
zZ1oRkZPFV8!CQ<3{oO$y(u$!7(ERimcRRQDK;sQ$U~n=%ZXH?5cH>qBgE;*iA}xGf
zvhg*8;BM2%qh_$E+9Pw>Rt7GbUz;QUfN#M=w4OPkR613KjMSs~;n7&r&)ZIrr{V|?
z_X&!(wzZ8SgemQ<->B8Kw$zcf+H3E3f5+Qzb)m+od!mK=7MUf_L%o}!ekBtd$LRBa
znz{dY<$sb%U(WECY*_D~IFs_pNC8!*rdQz}XS@E`Qki$EmD?0EPb5}S&}X2y8$=c_
zTQ=B894X#D3|j}<l!d+-rT3=gGx{9#BZ%<Vm2IYPsVD6`NlOElJoNGakZd9I59lm<
zJqM^hQP(vw_hKb-e+giH!`A_V_4O3cxvUW7J=y$l^s+klKlIxCt3EFO_e;mq-QIWE
zDR`RkCV{*Ydh#zXvw5+8E#_|<g0L~*46-&J<uvQi+X*E|d^#rtx>GW!fj*A#@w5%v
zRZDX0`A~E5ZRy>#v2=1s7PWI3C`&t<-03(W<8Sj-@(W$W82bc=HtuAHce??dPRI|P
z8a*6U1N2V%lceV0)W{eAJb;gYqUzrSGSvVOfWlkp3hQ&$a453=eIMh51M$_mvu~a*
z$(UTQAf#lBQ^g^2e3kLZ2TYqxTYyT0&*aqJ!b=(YrBzOw3d?8CuDtl~H>p?R8<zWx
z?TM>(xT>Cd@(?hoWVNu1KTpc1)Oqj&7x?!&{TCdOuJTO|jb8y}R>Hm~m<0I{(ncj~
zEM@!bLFSMS{}coD?wX>+AQM5L^|jX{4itToR7sZ@62J@GT?BiWnYk4{927+JcD_l;
z6n$AC04Ux?CwbmTt#%Wc`^N)E4uLL>ldygrW$ACv2hBb8YP=?9Uf>IKt-5`G)4UC+
zLkDVkSLVi>TxQv*cXQMyj7c8V$q1g~T%a1PaX$<kZxz5^%+<^{R$jD*f#A{j4IdlW
zM4%G4mg2N@0Kn;xp{Ahs{Js;5|N5nFOcoFjI~P98zw%FSCmT>&g?j?4-FQpZe=Lp2
zp$KD$zMT76MLKoM5#z`Eln&yHJjb!MUKF-!xbL0QsK&E^$}@6?s3Ta?#r;#igcdna
zqnKiNIgOGX%ZACFhV7w7_)?6xe0Vm!_fyfnAzVaFA(5h>)O{*sT*Lq}IwfckXC_d*
zvFS@iq>{6;ci)Vc+fX6j4<$tZwxauhQR?Gj@%_&rNlIe7BOHznnMYfKY)pZooL0|A
zw?XMQBr%hr2am>2X1Krdzj1J)grJ_@!(lx$wy_dxK8a4$8UYS3SlE^an?*L>^{i;y
zFqnJ2By@mWc99#^3Q+=Taq=^{suk6xuv|%Q9p0Sgh-nsc+iaizw{iTisqz7=VXZKZ
z^^MQAtWh|$?|@FJ>JP#eY)l;`nTA++S&KC-vZ2Zfn+cKkk#J0-ikwm{v#6Ur4+_m6
zJ(d4FVED+&l`!eFy#2lOd<1%uzw7HBBwYd2*s}>$<$kF3z~74;=ydCB2(mNFi10GJ
zartj${>$+E>w~Zcu*`GocUKI+>1V>uPh~-p*CrJxQh>qqplcBy0Aro5E{ERocur8L
z1n~0~WJ;5zZ{)yVv)wtplm=d40d+rB)n6PonBMyIH!o~uvShO#3n$;9yz^_XvZW2+
zH$C{R%s!%-2Z7Xm^C$*}61xxi(dEWe39G9SYTAq3m6ky38+kYx*TyWNlJ0!1<#9w?
zpBxA)@eZ(?jtxEQ%~Rrsro2vCI+yLIu2%gu=7l5t449#8V{MLR9FWV<$0F5=m<N{d
z*3r|(_fLdlUENa&;$MSnQ=hb&ZlD$O&TR#zT9==Xjk~zA#xakrZnp96KRqv`No|s&
zOPR1`&CLKPgap4Wk{F>oVnnjUwOT-7rh~=Z!?2K=u!IqZIrv7j^DkpsBKmC{Kr3lK
zF($Uo;#V0q4_J5XF7F}AXzeB-@1KBQJ|lw9N(F`?ml@wV(#WWNF$8#u9ow8O>jh>`
z$aFV^mq07+QG%cEPLUB^@@&w8#U=D@A{)BB6>DFEt_&i*t{Ir%YRq@x<-fgt`rAM^
zs!V#7N8iA=AtR!(h3ix`9}--?_{6+7em4*%S!k$|bsHYLaKt$EdZnbfetyd%=Uw+e
z%JLO+pf<sLbJ5<xn}iGn)1o<OEkq8?3i^wi03~i@(_PXUFJDViR&rhahr?WmUKzb9
zd?|j%zj4cSOnIj9ec$N>vM?EsW(c-GBvTl32DW~zYWYqE`?{2vC5FF-r<>dR^G9Cr
z>y%J8pk5Nwxb@<Z`MiY<*drr?2<Vp-pf8s#<GSmECp{_&@2`n*ygP@GTuu6i`2&4t
z+Fc~lKZ@IGyj!lDhJ4VWp12-YgGjJ>p+J!F#dx@fDPg-?J{}4K_nX2Z9-(*nHZ{CI
zy3yDw+1yrp;gI4Dy|h@`yDkBduAj>u6#BKAi)#Xp(vV0m5+88o=~a7deY;Yaub{-i
zNqIiPMr|v3P7~+FALxZXLWAJWDnHWh|FHMgVO4GI+vpZWk(O4FPy{3-RB{POOCup2
z(%oGyDHRC;L0Y;)x)G3Wkd|0<Bi-<g<=*bscW+sHU%zvG=bY~x|M5Z=YmPa`9OD^J
z+|PYmr71KO*{*N;++<>JPCE*If<bdo9DhBLw8O+N<m_jfpaAv+;wjJ4;EjT3PAzLh
z96n7yY0;#ELq&Z4My17dGHdH=>3zK~(nCxh8H=C4CZl01w>qybr0qXE{8@L+$xi(G
z@%`yZCUitLA7l+4|BwNhaQkZp!~;&-0i+#|qz4;-kfdzdv8&X{$>G}WgFZ(@*6>>l
z`B8NO0I(uXa>fDrNnPCSXuZ*S!M=OJ{bVy%{M7wuU3hP`d@cF(1c0&>t^w%NZuP=G
zU<Pqdafgp#?5?qw!u4{KoYq?|-v0kJyykzi{6ECYzvBP@Q8@L(4E|u&e(>CX5%K?D
zAmabEV1HOie>3gB7VL%piE>02FUU^-CiTLdQLMU){+|Q?VGomEsKI`64vGYKtZ09O
zw~A}4g9BtxMiW4q2%+gy6U=!xW9tyO{{MBCgEyFtusei85RLjJ0Mx;bOP0QQPBEUm
zfB<TA;!)dYN(6&M+y>C4He2Rz!lDl7Na<b>Z~1$d&OAdudH}$tV^^#GSNLhzr3xk`
zwk_Rj%c*h}vlo#T2x%d>xde6fU^sLTdWZwS7-+qUA^_%JRhA<&j{wp*kp`+}kZrn;
zNATx(@Af-p_to%<=VtNf!N>qmNI3Ikh6aI5)U7xYq4yEI1xW(mxNN5^m^+Le;lQ#+
zvN<x6+T2*v!@V2RtPfVq2G->wEAuZy7@+efuGR#}9|AW6U<JnodgeuE4si~t9ZnP9
z??lv|fU9@`BB`e$s#66=0i!<C;UihGIH(GHaL_AnHmH5HA~rh+<RvH$xt+$>A!T07
z6iD_|Ov_|mN?@d~GPKhjQTGvOuSiRRym(Y_0?IN4_LG@+)#PJ#I{;;tR7WxTgaQ}i
z>K~|+lsyKUjSP@@5pU$9_17OEIg0uXYPcN}Y=}xf%r`q_D9MiY4PAVOp@jZf-4@aO
z0Sr<lS<fAB(G*#j^|TBoPj!_ACD!Nmr*-+JX+Ed5yCYBJ$U1SAA+on}!+7zkB9iz_
zDDuN%gApv)RX)(fc1N!8k*3R)v7{aU1whT!YW6%Cgxj55#tI3a6_`g&SSZnZngiDd
z0<#HwoZl|fEXF6VD=Na9|0Yc%X0@19no7hGjByPVD0<%4GlewXWID14MK#{4J?!1;
zze7;~2VZQ>%a&ZDKDqrZC(#d5G;Wf&q~kFRdP)O_8#Wz6o5WE*(=t^#;C3Wm&QdR_
z`rsv=RdNjh`1MbJXyZZyY$R-}8msmZSab_(`$f3*{@)N4!d3^1m8eVGe2XLj_@KS`
zCWr+SlxQipvKeJ}$q=fW?E;*kRrQGzb*?;ld2}0%i<%t%RShqxG*=y#ktUOsnscDR
zi2>WR*9L;+pj+fSTrTtX7M~v`D;2~MiQHlgSKa}1`hc8b0*(am@;y5141+<MES$l(
zXQW9$xQ{DFG}w{_+DOTSNocMxBIMWMpC=C`kbfT92Zcw|G7nP8^z8Ex-nu<#eX+7H
zQg+KjTKQTL9OJ^MDn+H0w|z(zRn$8-3lcDU5Z5>en0^otSr>gsb%sdUX-Pz#9WcPp
zI4rOsrfV3&&#`H|hX=O-R@h@|^gHfDt`~<^bgDefr?mDUB1L^bP)6_Zt?qN%0s6aF
z**!jL<H51+EYO_!cS~a=?*X3@;hgI1g;LUlU=9RP_?Hx5!(11a4!coxJV+?Si^Jy$
zO-PtQEWa*Tupn0R1fUN9+0!<I%Olb;$Lm(s6y3~)0dw8iQ7;i(73{(ZOTe=V$=<#f
z$wlzan@c%sa!v5-P2A~sSSA)h?yJqp3jt9|HgzML+sB4gE(dr*FK=??Xb2TPM6EI+
z>%7iy{7;&)MsP5;m(0xzJxHS#j?Se02_$_XAPbvQ$aXEOo(~m7kXuTp4(aU;f9qQM
zi*>a?0htJXnx!d2R1nKbM8g6>Z(kXWVUIJJBwDLi+x`-1XRoS!{@G|%xYhaS0f&r8
zx9a9%Ns?n~i-V=WOx}Ywu+GeuQm;}YPCbUnh!#Xq`DE1UUZH=AYMB4udp!QjbA}$`
z8XWJ>#RhA*?dx(r*Kj|!J(!c?IWE}QjdedM?Lj#O0oGR#*x?ne1NKNcBlq#(YVbQ(
zDO=LNJmFunOW5R0gnLUl)ybzz#p7<}gu#I0ab5jD&F0`6<>TpJC?6Yk0okLu(~0}(
z;rK!<e2n37!jlEbNyv*=6mRFF5!m<dBmdIY`m46q87I}ZH}|K_{lT*R*V_2={r;*!
z{{l_?-y{b2Yr*~>5`%sw2VPBMR+rJO>O(C>{?>n@*M!c(`{3ODUVr_F1n}{4fj6#a
z((LY5ZPi1cNZP|w`_9QEKE9TB8})zQwe-7b`VWBv{4}h*jLy%K-fwNgT2_2z9zkLH
z*)z=-#=p-ja7@uW3zVs~q>alFxuoQ|<-luM)$90u;H%I+R=Esbk(6Ev1m!~B33WKw
z@2$q11fBuF!-3-Vrt5X5@N>JhwyPh4Erv`dmjP!fv<{^$27_%)gCv=&648>U0bC}Q
zhTr}II(&gZ>q9F!u>x_rHv*GQ3-3z%XifXgdMl!|rDI(7EV+T;3lX<~tDm{e6wye}
zRE5$A>Q6JSyFN4e+{<&t%%;U;b_Rxh`ZAH_uQQI&NzQCv`Qs@r0sn*pyTB|a`(rK-
zmIq0+m&}#A37u;@gYW7TJ=r8L5;I+bZFV#VYR%6T4wYjDi$!WdM(GCH5X9Oj*dV}u
zP7$Dm-wx|WL6=0WrLd&Y(I(e%f39^(sS{5Xy=g&*m&cQS7vV+7yWqUa-t?YY5M=1L
znh)i^t1~HQS{l}vn&<j(wO?I*xyjo=P&0K>2_CVCF*6}H#$#`umEeROO&J=Pa}9JN
z9)S1#I=D|ijT`4(_K<ven{=B@+IqM#$a)R^y9dOXrj7NmBGet+BmB+2rT#-0x878H
ziLV_{=|s5g`D$K75G#X^9N;mzl+}>LK_H-Tj^b^y`VA;Y(nlZc;Z$XXp*LS$C6C(j
zd7J#E*h^g1E72u4@$v3|5oP}*CV-v?tA*q@CBh4QFVd|GfZ*Le_vImpr$VqLWu`=8
z^=&KkOVpb?{&n^J<c}7QDj0M)=U@qsDefqoojZUpJP0kk?p7E@)hhti;=%NsM&@k^
zC_3DM*q~yO0fjrI`9#$#Z&HVw9&!5PnA(F9MNedJ2w5DUKKi)}@`o?-{w0_L2~~V;
zr+aWK64<OssXqW#(NcvK`R(VRYa;xM_vWNc)0St=BRUdu2C^QsO7XD1;$+8rzIr$Q
zVSWYRi_CyoBFPXCAp%KG?o@UZmhj9f#&Rz7GEl14n=@+(dfmY-Ks;b_;$-W1J#Q#5
z7$+|1y7!Va;_1LHu?O?vtbugip#W*h942ODRrzFy9AH<RRKiwnjJ67vP*P7^**-9>
z$nrBQX?qj~Z@JDw7B0HKayFX&_c`ez0+()}_kw~|T~qEG*k*!$nANV*ZX&qgT|BZA
zcH1byIb7CJ2d~5bK!wiV<a+3N1jYdV5g>vDt61@(heHU`iat!x=_%;F`E2CXe{`5A
z_W|r&VUPd{-Dn!hrdr%qDvvT?GZzbI0%dd4$nFs1aT&zZOm0yPF2B2!vn$Nd1$bjd
zs0J_3&8c8Tu(EJ+DPI&Ns0mU41!c=jciWC}?`7}%f>TZ7kEzflpPMul6>eH1p6Po4
zft0v!tmBELNM3!T(TJ~dDbnH~v+6QvwgEDo%~lk?X4b_amt|O|*{2C^r<s>1|5Jp-
z1u}P~+M4Y=w$RiYjXF5lcLg5;1oFXd>*J&csOe6W22;FElt$)r(oGe9N58ewL|xzZ
zkkE}exNmZTa4H}=(0&kPaR3Gajb!UR00IW}tgT)tWA{@Kk<qoUBj6xFxJ%#%oi()j
z<iPl#`Wv4B^Zt4x*;>-LV9M!!r#s8>Dflm}e61?-<PZc}Duyl~<~mKDI|U(F^a)%H
zAm`W>7Q0H>;gJeps$;)ks{dq1;al++uKE|Q8tE6V`d1R>e|Hk*BkmP|@B-=a=Cvtb
zCbt{;Y!ZkM#V<)9l2KbUI<y2LB1;q(q27(99eRTAso+Jntu}T{LaxMUy}3jr+4b?m
zx(7n{L1Z^nv}0rxFcysf&-3R&eu<K4xl<!E2K|-r1HfzC8&-Op+qpDy>62FK1r!tf
zck*={oW!ONtQ-M4ki?u*-+~3>bqI!S8xoZ;g*l1`ZfE)i+LXwd&+xGhG%Glk80$}8
z!hKiyWi;ecGo~)Kq@9DKb8g!Fi{F3~OJ5|+d71dBPGn>Ee+UCwtuIpFq74-2^9zj&
zk#jDdi*{7$&Tr|LxKu)Ab9P@`2@i0n4)X^#J+NPBd|f@YVmlFV8<N`LLBaH(<b5x#
zS$N#K7~Z`=k3=*BQ`ZoN1_GU1$=IGs^k7|f;AU}~q>JG_C?_y18naEV1nm5Z-u&^R
z!o-oZJT}4zNLcOxVZ=nJ?^6+pD?~oNQ_q1kO3FSi*{nt+Z<^E&n{G?P!)Lq_NC46!
ze^}yp`m`7j5Wot`VIiv{x%4~hGb%)cB%D<aY&i-&pg(Yv*aXgHca74+p3uv5h4q~9
z--t5*;|AW707DznJ%#weo4qgVCoEe4wyx6H*)?^c*o{sJACp5JckN^o@(U<(1n-df
zsDfK_Z;yX)XIuGd^5*_kR|XVoxB}gNUB)hVl%8k+z0(>XVb^H_Wg=S9@MRuFeMHaA
z3kE;utBE3kCjxYrFd2t~V99$7#wgtiSgk8pgXS>CywDicB1^g&1m3ek9h^hU(LATo
z^S`zGy9@%}SSyO?Ij^)pLyu8;7D|`x*Xb+DAl5r;J-vSfk0F#Xv<>|~e&v@e44h=R
z8gyRDtTXpuS7xtZ$MVP_GD5+iFlhXkNi_-{5*zdQ28bP1cz)iSWbZpk&pF9UnDl0i
zcCRpQ(H-o(+G@6`M7F@Rb(een$RF84RFxRhu?fzl&P41!x83?&vuPlg#%^nJXjW6i
zfCnp@qcO}phyrWBg~{%$dj!-5@Qj5Aum49tM!H;Wr|uJ`GWMZEQq-g~&_GviV`{I?
z4bOs|Q>AK9?LL64$`CzOq0x47v-u)3#?8LjaFMz`?zJGfPVasKh_<@4jcavCC)mTQ
zo7H8b+x3lcjpyi*?o(6b)MKXsVe2W*Dw@Hkbu*F^T7YC^tUc#g-9baT(qQ{&5#H?2
zXTXD&5p4*di#vT<TW9*TP!}N9^W-9w1iC&@KevL*<FZbF+Plv&R~*a8?Gd{N7=2ah
zP{#p<Z|T)n0(UKGZt{pTqe+->RXfz^&zYlo>U02sWE3sHq7naFV|r3e^NzNjaN`P4
z#<gk=?*<jy%RVK=WN$yx>)bErNmvvt4wJcHIx^s!o2A)QL;$L_XTI|Z7`zsKbpM{m
zFmeM$v1U_0kUPHKL>^_Dy79*3LC$1jt_I6J8K$=N`beud->rQalqrdhewI47p^w5G
z#T7eF1Hnw;ZGeSj2?PIihN`*$4U1TS*_UWvg)7e4w2yl}e@fB&aPHy=YDzDrBS+C;
zRAm){V0IChw6p<PV|Y)fzHj?g9P)%56*})v!ky|z*+^K$a~yrb@lQU*`n)V^1kL`d
zW3-hP(FVr-tF|J7H1TZBgfIzpnk0a#9_XmXaI6C&sxKBDLx`l-oJ`GvZQdo!A2f$+
zEZc<Bhj&$?8)kH;WIUd|qk@Dbs9EOMYj()^ASCT7^_kQ4?BjK~fZ>%)y~{cmI6I5Y
z1aW<?n>|kY4N#s?F!HQ}KHj1Fy+zq36Sun<w$r9;-56nM?u?Mr*?aeA?bs`u(R?y5
z$)k>_h*=5L1=N!0)>71A>8I^)gZ}-X%i+8oz%VE?m(pB@U_<w~#pLS3eey#)p$=#%
z{gzF)KX3BR>c2a4nVm!Ofh$EM7FCfJe4IDl_pD(zXN<_oU-KMb94QsH)zCF^@$7SG
zfGx^$5&%<3)*I(Pd2ZVDLASGpjoVhwfvX+FL*R07^zc$uivp7pvC&vRw}(ZKksxEE
z>^OC)u53{Y*RzlO*z@XCbSJMtr-6Ir<4*NpKzSD~H>8fifk1QUeH^eY7-~dyWl~VP
zrjg53fS1KdC8$DEz+v4)tUizsrsQ^qayW9<v1vqFFF9oQsXf2S)!~W>K_LBdt+hWX
zt-LbpI_I;GxHvBW_n@ecr#*)*|8OUvlrJNNjG{q?jQ(k)oAC%Hg81+I`DN{ayg_T@
z*)tLZh(@An0b%jz#m<sue%bE#%^BJzyX1kXdBIPbY4VeLk}3SFy%=|ykkt^_X%cwR
z*rMObNd&2MBvL?y&4tJ;x_)m`t!b9eDNgi`j?4CKytSP!%vPjxt=%h+Z<FWnwa}Oh
zb5NUSL{(;Bn7A@WvsHt{+ousDlf$aZDb7#0hsr)<l3Pe2IqnKPrD;Xwk6fEtxH^@y
zsV}y!ps;)I(I|rZ`3&!&#7)#AjpSvkc+fdip=*KT4~QxhJKP4bg!P9|gy)V-2h|yM
zu({`ECE?4Vs9hd8=txsI9J}@Dmy9fGg(dbTGI1N;6VMdATQg(|0gIHFk8#~$W0-i_
zEN*=;n{SgMkTEyumE@t412fNuJ?@z6xu}jSdB-8PKhf0wUWarL0jmJZu<-Tvd(gVG
z8yD6)HNQ*)`sd>vJ{=6?j-zG;M?KJqR~QSUS7By1^g2;y*8#Yi06tdZJas6g{Zb^&
zryiqiekx-YaQdXVn^(JBXJLM~chm-<^VfH^qF`;kB{nqMZeE6&wiB8ncrLo)KIc4g
z;$0;BTTDk4nW7=pg7Rz?%8-hSvH6|P`uuRX+sN+B)Ee90r&vKSqksB|P&AvmnH5J?
zrYoIBHU$34GT4;s(PS3$o|_}BIDLEya-bEv&rF?$lCx;nsIq-^B=E@ur9e)A)Z-}=
zV6EqYbnWi`?RTFcn~lMaX;J0)QukI36?N}dv&03ai8t?rnueL}K{evNPn#|PB~e+y
z_yrT6xayKBt~r?L!`tzzBlY=oP8abmq$-T44++h_Q4>k#KeI5R2%2OpA7T$uVk1+T
zy{e^9nE^yl5;RKmI>yGW=i|d_io+I)YgR0rtfN(6i6(WUts~DZnnMYk24GZon`z{%
zqr>hs8)gj9F|T4!MCak!kU%eyf4!gWiR+bOl}}=ME2_V_LRn<XW#8eNX@T5V{0HUS
zcY2;$lGF7~>`gk9uE@_FX&-l{UD7mtai-ORrU2Hp4LOBj$S&cFI*Q=y{J545+Ihw_
ziG<n3-qP{fX0OyQ3d3GLdTSv<awps~&(WW#z}k(NDm<_ystiDTHe26i_CLL5<tT4v
zO6z6QVhf`|lDMLnLvk-CFF(^$_Kr<Iccs#3XPVIi;Z_D6GwbJS5;9DfXL=aFK{-J)
z!lLx&23+iSUQ|@U?KLkArEhTRJti6(<SV4`>?!v@94}&!Ai;bYFoKO8?yc}@WI^35
zcFu%8IEyi4im*5MxpaGhpIUS>cef+)`Fk=B$t~9)(2OCxNLr?Hci;2!mgJOGyDdH)
z$-CC8$1LSid3|mXM%t=pPSQD~!ymLOADjZoNRW@}mEy@dJ_ddDW5ve{jtE-qc?E$O
z6gxLiqh9G8d8P5$49!h$xqkt{aNwho^WQRM!;9wC$99*p%*{6%$=tuVbzLW2|AtdI
z_zO<K=@bCa|D`nL84k(+*E2;>SL9*XmL3jO@bs?k{OU;5-|1KX@=kdDfxFxKFXRNj
zih%kW=|XJ;!P(Bs_gM!W827)MWCZ7>Ln5%&0XA9^e-eeBX=#9-BwWq??9c!B2=W+S
z{wT{$MpP>N<0`;*VIVGgeEUPvG!VnzR8#EzhjcZ3T0n!@#s36%XI?x&4jkxj?qnJw
z23dU@9yHUP|I0i3KFvSO22>buPHl(~_80t%;eV%+`=>wrcoQD{C!!fE|MT!5{22Jj
zUHx^XOuPY&#E>4Z`wV9r$M4_yPu=*;X@uX`uVwlF=(2o=iq2o%hnh9LyDmu7i@-Aj
zd-vmcI1>A#ul~F}J=1cI&xOg4yzYvF3%RkV_-*GeHWJ1o+gCh}pzdOVA0{2#Sga6k
zBT{$CrrS=WD`W0zn_V5V$g_3&+Z7IbyN2xnciVryeRvswSt(>Pnr=oDpa=?n=+C#t
z`6a3-7J~H~l9ZsPizNwii+}A94cAo7qoa*tvcBZf@*E}J70T%c{&ox1*^UPKo64K8
zU;>Ax-G$KyLj`95;N*cpOh@I6<*h(|<VH)Ws$sVe)}!2o_-BLNH?H*jo(^lPHt*!J
z_Ik)(n!xaCGO%VtMlR{JY&I^sT}5Ucw)t+gH)SJ=P3oun0U`~I*`+cI?@<y^%U$c;
z2h5hvS3mJZ<Vy<iO_(9$ocoaaxNCa$9;GpIp_F+o3keG+8rk9<V&J@*2gQX{9_AR6
z4qql72*--0?R=T6#$$hI)5rOJhyC}4l_Lakv018D3cYl$mpJgNay{B)tC-r3(=Njk
z6UF8)`LxV8Z)(BaYBry%73G7f3|hh;;Ur>%mC3tq4?^+`jIvHU_nSlDj~DLL&AADa
zo#E&%SkiB7e0xUUzyv99g;vk0g#`${*F+0Xy>}#>7TB2AH2d(qCur7ojc8<XT4VF9
zEra#lxXN;Xm)&qH;*Mj}-VzG|jyirQt?1V2jEW>v(zloP=YT2G{4H8Pw^|lCU~%lW
z<ZSxT2LcEHqiRZ#g+r6|J&+I*MFB0rHwb$iW4`cGIh)yU3qf46n2CDa#%?orG5CDG
zkG10Ix76k%^>$96H#>Gwij?8!rs?B3@KBh~GJS<<KoV>1;*jHZHX}dGXL|rMAl>ix
zT0bUXDWh*AY?9si$nvB{M#`~qm%qaCQ?5o{w1IzP_<H-W;%Q5`7>|48tGx=4Ebge#
z*QSl>jBl)P%xdeOwTsG^7cSVA>W7$1-pU^OQbbVXT%;7Q;&V@0^T@W;uhmyS(t{%I
z7(#!8M5F4K*-qi1>E?EDMF-)oIOx3QXd}m4#=#vwhHXxkZci#Ty)N)~6gS_v1}V6!
z(iy+xg%vBJxi%*eJs@?Stl9goB;$WPwh}z+gba;Fj<=|d%%Aa{m|3V?vM9ZepNGO4
z<r$^==<{b#k`;tK7f+1?G+P}C7l>TTT81!h7*Vaiob20Em*A(%kjl%U;%=c+3v?(g
z=iCqzscMZmIowm(3u0NGS=Rl4;z<(CP*l-W8_?meSL26K6Ld5a;Uz1%A(J3G3w!(J
z{6!cgXR%F~FRzHDzKnaMddHee4M!Xd6#IR--s2YGA-z!F;z9F8X&iPP07`NLzOH)l
z#(DG4#l3st^*h?1j-;<<<U$VBBxz`?<iSFZ<%+gAVLi-E*Cp*0=EEQz4p-Y296%%E
zmic4?X2fqms*bGFTlj~w_lNyt4Q3<^33?s5fzX_fY6Q-qt0GHb$qu7&Hd8+Z#rzOd
zp8~0IMvbF8Qb6D42?xGV!;{#@HE%!pPJBX}*5%Tu(nX@G(=~)n|0WERO|LW2s018+
z;a*y-$b2jp0PUBB_&T4flPq4r%g&dhY{xGBs}nkh%rd2KyM~EShSr~2?cKz6xKf0V
zKEw`N)m7BxADfZG5(Up{n$aJ_0f$m^X9xvt9=-5T@^#Jya+CBMl>1X@>;bw7!$U4m
z_?EpgSg@4RqIwn;xIF^^#t+mEyXzpu*7=ywQbxH$+Ra)6BldG+F-W(vskK<b-5JMG
zI;CE#uU07mYEoi#22mvXk&cV^L4SKTcT&2Q4almty56)JZoVMiptT=&`We#GC)l7N
z>$<J?_7Q<b>B9(?CxUt>g4BMssU;|nLS|^L?9tqfad3`_I`#k=@{IdY*)yi>odou`
z`#d~IlX+)J2ig6AR2}SKzAD;>YjW`+S%0yP=$KgPh(f)*a1bo;lY+Fbw8&ALlET$T
ze)+&)P<u0|>vOvl@hp&bZ0Eb)@&CDh38eyV-90V**Dx3g`bA`wk0#-KR);?OahC5j
zkI$cm!C2qYh?wK&I~i6iGUi8%cd)VmX4!$~bSrI<3o?o$5>)1N5rSbrP!7Yt{s}8@
z9_To~x5nnE()bBqfdKjrL+e%dkdJ_d%IjX!F#)Y;l3hc(ZUT~4Udb=+oFTy@ee8*M
znPm83uE|?`K*d*F)P!!!;*Rsp2k&|DR`*IAFa_RPD{!@-KZz^A7*W9BnKrS0OLQ`k
zsBsd*IZ<GXz!A2v2e!~&KVznmri-gH?cx>Jyi<eC*8b(z;R@b|TUR&r8T<Qs-a>{M
z>y~T^p`V!@Rmv0V&;XU5zKSGeRh5g%%A@>#p%g+V<4f+BGx&S8UP?MtWs2kU-Dx&4
z#I+^5#6H>8puA@J?nX{e1G$SjV??04{7g}4-04;kPd5SSOfAL2>Lr-Y_Us9>`ueO5
z7D(Czw9d6njMm#krpV7kZV|Bfp6e(wQC_wQNz=&(tf7J<lFE%7BcH$23D_cl#96=*
zXC6#T)9WY@w3M~Ghou6&BY4<NBcZq4I7U#jwst48%qSG`-ZyQ<evzcoCl3GIf2TLu
z8i}g8<)*R9^$G`k^{g3roIXMC*a5oKOj9LX<hyydSozjmyNkFSt$lUGDEVIve@Q!C
z%}70IOwOsua+yrx3C~FgTM3xsu5JyVmXCR~OE`)~HmB0^NriU%Q0s%Q%qjs(_d?x?
z%sc$K1(4E-T6sEYsz)`jX$(QluM9_)+&QJa8^Drfte=lV#;v=W5U(9!cPtm~dxkK<
z`#%H*xFw*eWdf@mH;qTQzfed>KGV9o*ffNsXKEZalRHeI7Df5GszU=0t8T8w=xBX^
zAxob?%MTDL7~`sq=TR|Y=c~&kk|xEoF0JvH)5Z3YOtvuR=LX!kv7NchZ>VeQPMNV_
zLgq@Xq)zSX@Kh{ZrogN3-X{20+^RKk>@aX>)L_VtP4y0`y3E8hfBH2kxT|*XG#T!9
z2tc#5uwEr=@TgEv{Pt5X2iw3C(45^2tsy6k;N7)aZ$8|9gC)696q2@tTkiXf3c={+
zyL~$rN6_0->i;EYHN(dB^}g5&P|1Ad+{Q;3o~2*q66r0{PiJLQyA-xW{0UNEJIXm`
z*ymNjVBRzE5Xec%Wi;m6(qkID=G8+>mAI)=Ud<{+F={3gNa;8}cc}*FnDV*qf)T{F
zou6yHj(ML%O#^NjxGPAzw)1W8oRRc}3c)SI)2rx{u*;O(j@7Jt2EOm6wg@m*zCzwk
zz2H6|%cc%y8ai+V^rolc(l^tozuHEP3MB)s7rbdcz9u=+aMMTm1b387FnZkx`t5`F
z@v`Gj`q8{AP&)gqC^+OFB~Q_-uh<|5?KSzy<1bcNh*swY6z!LUXQ`RZyxV^#q)*0|
zPR<{l(5Da#6!#J^R3~%V2X?nW_nFdm!2Ij>hv{1LDMg{z0E4EZV}d-dapNn<=CgsI
zyzl-}J_B3H0^CPSdDQt-`{({Uln<P0gqJ{W;Z;${%OV4Z{GA<EMsjA9wRE|V7qm|*
zr0|c3Tu!j7I>y*LtBWcfR=sVy1G@(@02O&(lacYetq=L+Ez0hdPr|W9ozNm2G#6-*
zGuHJy7}h)0GgBn&6tj*rTa=tmUpxAOJn$yr&P@5d`kmSbj`%uuBMONwIsPV5yf@h8
zU0gebDp7foJmi-0ukA?H+6bp~IF>}yXXhA{$FnU=D9Lr}hePPDh!1%_8GsbzJ4Ww+
z-LK$aEm{BegqB!3=YJk7K_Tz}78#0)B&gDo$TJi>T68O&;Tr|(^DzE8Hv?VTfK04=
zy|bE3&TlIAl;sWwnX1Jtrdm@1o4hi;SbC0K_m4O}%!tdKzop+9VWJyszy!|fQh;k+
zmtj{yEBbVP%_~03qJ>^1=CI&2<Pc<{(<ae%Bcw=z^D8_38Q6~~&?ukFdUO)g)&mXo
zeZi`<h)$5<bbPQg7VB+?S6ZeTlG1#kGhVYPU;aTX<9JcX4I(#nZfb>^952^zk&*3e
zT}q2}yx~A6zndNL&j~VOK(eQ)SIPKpB`!3cK{sA%hiv-^<BPi^MQxXGeSlWXvVC|6
z-!3>;O=R*TrkA}oW^=?XwC{<^wTpPMgw8DKoBGF-x6n4qU{5rqnXqu})01Sib1~xK
z5Q+`v;!B2a(=Vuda|vV&1vI!ssVwMj*Sg=&Y{#c)K_6$v5`KTU<5CqZUJxz!aKhMS
z-HfzlP`X_ov{KUJJcc`tgJ`reaiA(9KFP^AY^FyQ{w0RW9UZ<WKiIGT>D<r3AZcgt
za!5S^d6k9i%J6|((gjK4Tc{4(lhmkzKog8)pwALW>ZpaF-&QhAIA+0P?RKmpr5~CZ
z{DfB?R!n@J-s@Vo*m`8IX?Lh;s9;TW)TUEqDtGfvj$u-m_&fco72(OPmblOreoKMi
z3-Q>W8wCNwH?4#!^0a{x!?bo&bwNT4hdF`Dwe8w%7JQb-`9)m|C$aEpTT-7MWr|>l
zmq^r&S$(#{9E?Q#44W@5W<=8rDin0MOfH2>6*<Y5&Iz2)iKTkr>*w{~VcGWx!wOj$
zPIx*Urr{QT^7Sw2+3ZidyW{RYWNv$Lxqjf!QXU^3#vB2?qBZCA&6wxB713g4Ap&>`
z?-JGfJ7^}2aE2^+kAlaxb+*$^_hy#6C+pV;K7p-NIi#?i@P543Qtwc_>V@bDNP|aS
z*26O`4YD^WOHnH_zHP>6-Wm=#fGTf0baN96c9Vo@M=A55k@Xmt6kV)0j*2n98jxav
z_Mo1_th|FwjktNqW~KDaGgWuXs4`(OZjBbzSozsEs`e`;RcL!(n{jEZ10+uw0~ki$
zUoVSJ*=u9d|JfPQkNi!diRWl%#C(@;b1HymOsv{h@^mxyROjFn{I}MA+?DNk7i6f5
zd-ecH$*Dx=>6-f~*YPHp7mdTiTAtBIQI}+x6LBhoFVkOmMJJ0ci4!{(z%A&0H{7$i
zVUa>6>Dk`9thm6EH8Y2|va|8KMjuW;?cf{nIKQ!$u3^P>j5Zy-LosBr%Mu}bFJ}ou
zmt!&vw$9u~=amV%S)FhTBQ;8OhV>sUwMuvdl)cud9j)Ih&WXPnaf7L{!+LFP$W_h3
zRQO?mpx~Q%K2&owGuX~Tqb_nxiBr3>Zeaap(mbc%dF@+kIhAv7lu^L+u<U<TA{^X^
zGT1xr3z^Hc{Js$WJ8cKpZtCGN7>H({P`sB*dgB8z)TTz1Cw*^-MC+YO)Kg&G<A4G|
zg@OQ{Nwhr?Xuliqyc!C>@Iy57vj|!aKliP;{KGk1_7GmV>(fu)&C{1|f7*z3h8?FV
zHpPVs@ciss|G9aCGH}@UK55!Rp}fEyUBH)d|CIZxjtS_Y<qsqJhq1BW0W3iY9twm2
z+TpmDs@$ZlB(eE(r~UhtzUP8GKR!SchzlHv?A62#cUHeNiU5-XZuY$v@Qg83u<IzK
zX}UlkK_^!lnSJg43Z=LwpDH`zCnOJqlRf2;e|>fVu2aJD@;Q0yTBPRgyGsSnyhVQ=
zH~w)&=y~vfBt)wA|1bi0zfgXF6Ce>){)g#?&(5!_{+fYbGw^E${+t0RY0W{bECu8J
zQ8Mm_=Vi^_e`MOi9hlj=_Mi%7>K~b620^2Tjysn=_hSHJT~`jgd3AAc#$D<>`R^3D
z!PlZdHzD=Tj_aTXvbGflG7jm&s1D*9(wAc3m%8RWJ0UCnxMxhHtH+M25zEI!iCN!9
z_c$?+dFVb_wAalfInv!qO*@3P@ry6GQf2PaRx^r?hL^ft9$->DE<sL~f8yU^#m5}r
zJQk_PmJ!i|WryQbHt;MQ(J@eh1&5<b56t1>09}re&8|mnCHAhkl4O?P&Ui_pb(az$
zae}c@wnPV;uWqmJaHwP?LmrSLki7yY3kZUN(id-keI3r9ZHm#d#|ebl)&bF;t*b6$
zKwc`CU2lI4%Qxw>!IUV4*SQyCw$LR?RsGiVkj2i22%jIDJXZ-+U-9{#@jd{3T3@M(
zA2&fD`4m@rD_=in58z;y4aimaZx`aP{$_4In8FSnN%mA;JXUsfvqnpjI}Mjs)bzPf
z(0QV~mM^kc(oD0^ze-u|isDBAw1bcG{vw#dYuNW6zE{*FI%w4tqbo>01#*<(xJ4wz
z1cBj&y`8K$-p7Ju89bZ*Bc>IWDk^*&-Fssgd09KzyBJ<@2}-9s8O)jOn|n8OHu)T5
zZq2@l;`84(IgVe$NL{z%%%76v3)KNyPXqi~T=!q|#I)w}kcsuMtQ}ZmA$qywUlrl?
z?4_27frKmXyvhCZ`q(d0H$SVT7qJM!?NH>&exZBiQxn?VPjhe}+Gh<jl$!_Zd&Xvk
zflms<P;bY~ndsrqT`9~(kDh+VxP6h@3l?QWsJ^}4c@TR^Y~#)gnrs{&Svxdz`N+5V
z2xsX#YV0mF3n?~1T4c5SxISElH;(5u|8Ig&|9xoh)T=VzP99YKAy>^j>en5$GLq~%
zdmK5cO&P<*f%{u}y^xGf?WO05m@oL*wvp)<uerZmqKIgm&}qG&Pv<>_aCC!2c=9Ez
z{yoYkBoC&hW|c(KmZ}Ldmkud!^uwWNylYMXOt8OeYhKw3Xl`e3lsk$!sYcJOM1)!5
z2@%)QZFhpDOL)<j$GnrD`hG@Dc}13qU96MZRHw22Za2HfUsu<Ut|_z;j?7V1=z)-?
z@d9~^JABuQVUTE1#g4L1mKs%p#94_|aKR;7mmZF4jId?~%`%W}?OUJkm5<K?oU${|
zjz9xyB)Z9$C~rH4O~p2?D=4LH3J}9s?|=nCB3CtQ)7Y^#{`&(I_-QXWMZ6>kx@`S;
zQlb|!odz=AOPPdW9+Ft>+aSo0f}*7sSSFZDS;aS?^Ikia->7jC@^fi%n1M<kM`M9M
z|4SqStez^kVF>eL1LzCwqNjq8504v@kkHp1>#!b;8;Ze>)9aFyK;6Z*x;w?9u+l)}
zc-E4J67zYYa<(<;x0cepYOTG%A?rD@J%#T0?Dc>g?pv#2`|q{$3lpWb)?@~S*%MD%
zWqlEC{s<b-PW(xpnF>i3s_yVM^UIY}*+V4}!FzV>ciJPKENEj(ZXj_|NA46D`q-FJ
zt{QF?K2^RkM>}8H>CML{mvd9)gHEg?B^QaeTMR#4`HJMdUTM?xZ9n&;`{e_YRZ8~;
z0B7hcDzgVa3(@|xDWs9Wd}yo4Y*KXLK`XM1Y5lTrV^YMt<ct_kr?q&pMS}@{EA{9w
zGG$@Zv?9t^PKjeics(OHUiYo6wlf-FZ)peQnhR?q)BU$WDKyf$jk0vKW$dQIb83Hn
zN$AT;lCm79p-n(lT4#|nYX?cIas<MSbq$j=l}lWM&y%Xw*HGpx5RMiD`qi6o6?J4O
z0~xz8JGmBO0f)IdFZHH*8k1yA5v514Tgjn`h}tHRH-Ob<DNd4$SgnRFRJtyf6fIsm
z_1C`Yj;3J;sfQtYQ790QZwmA&))Nv3ogj7&J2yr@lUI}zt#!MxP2*!+*20$bXRPIB
z2qhDc*lfBix}~n`L0;GCvB6Jgt0OUm<+$>?R_WnTC{X<hd{q;2Ez9H2+5g!O4vOH&
z!7{FV9m<;pkkcRk;G3P(22Q~9_rkjyoYN*WxO@dkZ8917{%Gf^0om*q+SU9|ua}~P
z^U7<=x20Qi$A>HW+WJ4tUNQ&fWi^!BBlxxHwxdaOD&n42gBQTO@DtQBp?vY>ts!8d
zz{C~M@^9O1PByv<ic!(T7~ztp*Vvnl^KJ2ZxJs5yWEvsEoqWm9S|FeEh;|zm^e;vi
z3yQaBUHO=%ePnrhYh=ijlq<&@_h%3KXDDb82uAfFsFOw^Q71>W{u1LOsdn9-u}+7d
zJu%xXZ{;&{K>UhDP^E3{zN6)yuB$3gL9|sG;%p$>t>TEvXRT6atgdYxWe5sIXgf<T
zf!FBFJ1~O@*Mx*861L#%Q1<KtaWfa5PL%<$;fRGgE3S-L$VfoC7OB?=tj&2%O?Y4;
ze}!L(q?`L#aV*YzUFy)UmZNy&D}Z3`Y{>7wWDi1UG%o>8tqskvj*pi=)8wK|n4rIa
z)9iPZa$t;XasaI5U9>F|jN1aXbjd5~b{SHs8<6-{#NCQ{f>L_gUtC|@^;x;Nnf8SA
zG&34>$mqn9bu6fbsnspE#v$Y$zp$$D0}ZXn-)LxW9{-}DwFXB;L^-R_f2#uj)Drxn
z0Q$x1`9EUy{Lz2<p5*#(b0G(aK+-<VA<(G!{=NU*?UMg}UmzU#Tk`9dZqok`c#}U~
zNBIFHIQ~#7g7WVx;Xl8bI00sK)g9wCXz2k=Bimtf3t<Z!?mSgrom`i!Fb~U1cYIVL
zZFrB790%N2w=0*Niu~&mDkVf!w(52=IH^D0b)602C_Y(wh{#*Uf|rV5+0k!s9j+mH
z1S<s!@J_$U+y!{0cDm41xuEjoI=5wOpm@S_-7|RJ4V%xIve?7$XKVQPJI4eFWvkzG
z)UX{yk@CZa?WOz3F<+qgK(fUQK_5qaV4b#7Kd88GZUZ&fW=e6?YDWHI&0ABV4Ai~?
zfK#@w!FImAlQ{bNW$=~q8k4i#8+$4+kbc26Du6WXFRoCm`dsC^APfs^#JN#|7UMHK
zJ2AcP$)9Z8<w!dGmOz`7zEr$XxC~|$gzn=)^Wm065|lms?2S2b1(dWQ&js&!ok!K-
zuBleXpO`HeUYa=Hk*K6LQ=-l&dNWaoa}Q$DKj=qACv6dnmu2|n<2O+xE$^?K>8y`c
zWhey-g~np+XQe$R>@3>Po-z~@xW)?AG~ihQ&LLp@ryqBx7XCV;5=d4Ob}Q|RA&_N#
zoJFgi$;OVVPey7tuYY7KH<aq?q+HV87QepJI-qq0V}GN4RQjsg*$`={@EzbUH4zSO
zp+HoDv%T-MesBousBP*+S{jMVJhu6|Z)xJUF{xCarK5WPr-$_)hHDYrZd&JKu?sjz
za1R+ZtN&ovvRnOXo!jhS|9ZW53sGH{RN;dq;}JU&N1#g0IJMc(-I+7VRK*?>uuqB3
zV$6d=-Mo%p@L}Lq{(913)t#X?nX_SPjV!%GHf}K6ToR$N?R@1CEgt6NiX}?(>nbm8
z$Iz-eg5xbjR;yUB9F0Rj(3>QA)AZ-K*Wcf2sxWBkB^A!X7P$<#jt<p@bhj30*_N3*
z9234c9<!t@e!RgHNZ9bA+_z|o{T1JNV*Xo>zW2>{DT&un;6l_^WO2{6_AEk2BN8?%
zqVGZvR0-mI6QZgJuVYERdO!dTl$e7<@!}#_E(aG5bv$QuY`w>2Li)P-fhIx!P-$y<
zS#fy|-wx*Gntqy*n#L!w@mvp17D0#L=Bm$%DLaBrgNX(B+KVn^?d80XO!3kL`Q=b`
zQZ14rW0kOm^*3en+t;5pIm3vnw|G#AH&8RK`ghcJW5NPEk4;xFYs=$}sBKI1hF{D@
z5V|dR?WQac!fZ?1YH!uY`I_QJM_1p*4l<;uim_8nkuraU^w6?ZP;aRcQ<AmtgQ>sm
zNd>X`3?;viMx(8r6_4r618O_PxpogpZbo%aeJhIH{0666|FKbjImjU7AP~4zpy++j
zbzwu@WzOU+a}{d1s>qtF$Q+sX@iN-+*fym&)#ln(KZy+cv_u+HBRRSis#jv6us)fB
zO2_9)yl}z=N0=A9vWh+`H*Q;sUhJ*SD&^#|o~&v>jizE1Eu<B~@IKFkp)+n(w`YtB
zYPnaY<;q9WKb#@j<`mn!lnGEJ);x+g5rwygaG1jdC>P%RY={7n3u*G$mRqzr+J}R=
zu?)E*EjX!hEphbbh($Og^LI{TQ$ka<;Akt7GDR=(o~yw_>p&PqfZ1nfp&b%p6`g-e
zgi)0diEcgC`26T4h}jwyZs=v((&>V`#JWbLy&N-bY@DYO>bJu{ZCQd-+>GDoWpd>*
zUfH8!N9$|Df>Ud1InVjm**6I7Vv*BkqINd7mkL9L*0SE1m8hyLJ?~N=c|L5-6YCHe
zuPYca&$;(5EymhBc!2r41M_z~#_ItNk82g|-a9C81*_j>tYLFDrT*$7b9_L4=rQa~
z1%o{3t9Jh2&kFFwqRVaF<?2{!HjJCKqzM*Z)wn|`UYH~WI>g(SzRuy+t>w@fwpXvV
z{7v(C9IZ2epV*kL2Q!7u5f&IF%HkO24oMb|q`=#W#hey^#Zh_jHxP@NK%O7EGkXm_
zxQYsT;>z{-y^lY!3L+2G+{C$yfA;HvUIVvo^y%|wTx^jinu;0Nfn+zD@Gz9nj9=Fk
zGu|#9%lN#5&C%%jko{$Gl8Ae3$RI9NzW5Ni=nJ7h+2!f4Xpm92Dfa2L7qVfk?5esu
z8!u^7UBrDjU!}wnTFh56a`K@1RIKS<Yn2OXUdT>uk3Q%`qr2{=n?SnR&*<5)xlPkv
ziM}Gq>DPZe<*4{s<aYj8z7}BlE9(p^E|PAF&h!^LI~ooES?6iyob1y3e1Pa#Jbt5L
zk2dk{<#1D-Ys|h}qyjfAf=5^2Ojuw>Y+oCb<ayD7eU-F%+3}o@WGc_N^yk^QgPc0f
zA)y#&6vmdifd}u)&2x@fD%2_YAHVgm;tD82;WUdDV9p(SQsMfUGUaL8D3&S~0&|T8
zzaxsAm=8SY&?r<4U!!wF47?lZ_S4n8?nJ@kt|6nX6<G>!dT`%D28YR4xKg^*L8JJQ
z?hQbCnB{BkwH37sMiDyQn60BRLK?CI)<#hP2y~sHDDV~S;1|i-cEg2&$H7#l^a$=@
zmmZweooMe5Q^*7J8CoZ-3myvKnTp&Z2IX$qk)}`FD_>n?bTym%&<2c02E}VBch}fp
zuu3uYaVu?(83UDYHe=_O&oe;-9bsQhRd<HPE0#4dSY1XfPT2F^yUrC$gKX2nsBcS0
zLD5vaD3N)G(9o>Y8rj6Qa%4+h96*hK7f6D9IxKM`WI)h?x(w*9^I{|OQI;v;irAQ>
zpmn*P^h$3(Cv3a5;?-}CH69NgiV1=S4cXgyN?fmT$LRMkY1!;(T}usj?VAZATV_AZ
zT{I+C<cj=q**BeO$hr|mTj?%s({-Yfy3Be4^AW^<Wtv}>5ZgGCKu@PddH5pzX~oKz
zOp1gd>xUJoIY%4hIhR}ffSlk{KeL1qWa=m3!XE}0q6jy)<u(^j-d|uDX?|ThkRdnY
z4dk;U(OyzTV1#<oP+9`@?B`$kDlkC(VCgOYD|xJJfV=il*K6{y2zqC&cE@oA5Y-tJ
z9=s%PabdE|rPy8ru+{`csYN<&p8Sj7<d*X4SvHEWX{*(}rli!!>P}-T%jZl-mJctw
z7%lhQi8iyL)0u7#5)|U8$scSAf}IPJud06bKnI-#|LU@oW>zx+9!ln#w4zujd2Uyh
zwhw_|cUl+!;#-{CFY#`_48qc2>iIOiZxw~N(t5Puu70mJ5nJ%2KZBDc#`)%l2Q4n;
zSxdW(8VretW@S5BVV!q9DDo#H<?uyl64QO9xXxU4P+@@2-bf7_pGHGNuS4ptTS<z&
z`tZ3HwLWZ{5BYT`8Mo)O-nCXzyZ}k}H&=pQoVX4-*d1)~7}JGXTIfy|(0|OcI@eLV
zqQ-d*r_*s*RsN2C4!;mIh=@IkG22$5&^NWVdE|AR&_c8Yi@loy4P`ohaH*FxG~;ec
zUB?~Ywj~zl)jFl3wc2B#VI`*to#ZcvJuUlf<twXkmCXEnd&w*51>^XMc@hL_T^1D}
zW7$|<q^EEfTAz+nIi^al)6B{e{78V}rO%R${43?Q4_9NV#mx^NH+O|zVC6KY>XS~l
zGW2deEMNXA(eW~Bl$-u?Sf=6oAn8v**b)i@D|Ts)v(ruPiuX=yR$%57z119Q>Pghu
z6TR#KPlXZ!c1BI{@LTuh-NU`>S;v)Wcq$PQB9i)mEb)}0etxD0@1~<-M65xzTD6~$
z+}p{jWLV(r%wap<72|<hs3sMiD4zu0va6473F|+Z#qpxM2nZQ0OLVaFUPaMI>Mb3_
zl}UdZGIeOW<IJ*DWqX~}Oe0f%y!~93#W7Q=*-81;twr_6_)i=9yprGY30Zdpdn`od
zq>JA>E%Za(_*~OUbatF@!44Ex@^JN{v0osEKIu28Zc<{Vz<h`v@3TO6{>F+0A(^%N
z)$Nju02!L6rc7GFF#4h7Bzs$yk;lm_VeBM0Ls_UVKEYnq1iixQKI$-=+I(_JVAwuE
zJAI5h$<dLlFjB2lXK+q3=jAQm>rYUwUK`KB;y1ObTwaK>g{5{!kPSrb3S_AuIPRV!
z`2oEu>#wbh)#y@(fP>HH8wa2DHx52DRxbBF@G))`pd(K*Jp#$aq~Y<c>9wjuvtHTg
zGukhH*c7k7LB?S2#{e?s{EdZgw`VP}*Su<<s_%CKbnpqR`V`>9k{aOXIjqi8AS3Sm
zP1nlWJ$8@L4rlJ69Qtj+wSSXIaRq1h;=fD%(E!%h$FKgC0`&oCm;C%M6{tml+mH9J
z6sWi16_vGrr$8M766v@9l>+r5NJ~E+FJxvp`;~up+jwsS`~BGE-%$H~24Q+)m9e(Y
z53lx&h!Xl37>%U8s583te!M_x4tOlrfd)kKFW-08H_^>?4g@jt_h3L;13cD2w%;2>
z;n^RjnkYbTg-lxi8_BdP@L1bw#5WO$czi!9LqO{9cKyFf{ry_7zZUHOnG1FT<w6-O
zz8l4_w9~gMtGBI;(0ZyowQpkaf-WLo`~nI|JUF!}vLl$+)ZROPAhJ{3J6w>MUvmw)
zn5*#K9aj?c>H64qNY(k(tBB2=(W~;uPQ&B}!39%)GtCk?whv0fTSkJs3k%)b*|jfw
zaBUR}`?TlXFIRrPQu$SoDe=Tu-}6V~^L?}aX~w3(u5GTLe&2YftC|DDFF4~hc8zve
z+Ub#SpIWGihV{;k0$EuDuax$K&Q_GOLooOlfgt%q84#pRTF6U6&t57z@YdloO<{}+
zo9b)2@_X?-PoCIwpcP{c#Jzndb-2o{it7E@$qU2(?{V~hegi!M_GdqfWFG~2Qj|i>
z19_#Ki3pvAXRSw<hBR&rDqiY%brpBX!P$;{id7u3@t+2y>dnyUKw;Xh>dQGSbY2B@
zY9y43Z^+rp)sDA?X^n;vP80w)X#*2`-D7Fh;zHS4HlNe^aCST^V!XHPQMUIUBOV)~
z2fo@^aWGq@N}f)zksN$tb(mcyEm9#Nk<i_A1gTueQHpje;ZTF@-V>KxQm3r4bHY97
zK7Dn)deD_kRmb19Utc#&R>!^UQ<7!3+HiZ@CL}Q|8@D6aRC1&_Vn9%FtTpq{YN<GR
zd{ywEOp$rFW%>RYjkCW$<;QL~gm*M3Li!fcF=KcipSqkhtqu+id-IoMy?X~^ea$pP
z((LF=s3cMPp2~S@{nvRehv;}Qc;Cc$Lfy^o0}Hky>t$+vq>vP9ITF1YC#Dr@#UIJ#
zT)xD%)1mwk_GQycfi@~T`TI%s)46500Ml|_gST$npLbVVp)`>2R&n6f2U{BWD398y
zFwf(msJS>4(tmujQgE=xe$NU=Vfu-l-%fVzBdBGlT4BdNcP+(;Ms)z;QUw>Reb|Ua
z*EU+}`-%9ogxN=C_*3^9MYJj)D@#Qt4X=$?v=HVgF5f~`t7yT$IPayN(}ewmY`jv$
zM|{}cgNf)h&)V>2^bF}-8FNwHXktKfELgyW7RqxH`?R-~go2I^b_Q~AIXP%6x3b4(
zh8L5YzL1C^yoGhRp8eWz#83m$@z?Fm25SA-L9ih6M9mAb>*`cdCMi@IsmS9A(7etO
zj8s&k)7@lHY80Mw&BuOhpvL1lGOfU=UkuaI%B{qT6*aki_p;}gWV-x&jCF^C@5aJP
zt0Ka7r@C6y6klWtJV(<CE`2$zxD=hGL8r>oR?Fr)6xl7p<CCMiyVA_8>+`1>_}LE@
zB=A7!gTJ1PHS{C}i$cEbCZ<jzA91^dV=O-Af@i=eNpPEqb-kmQ|5{bKGLbn~MWuM7
zScFteJKNYHHn%B}GJAPDil?~BnzwzLX8S4<PPuaR&Zw&hOYEqgm#P!2)w_WsoBSW{
zLI>Q1aM61oHuwfH^%T;spIb01M!ziM>Q`UEzdTI0ey{5ER%N5u;Yyw;Dade|mdy%M
z3$y4rMh-m@+F4h^m*s>(jQu*Smt7yv$1i*Pwi#1YW=Ry>;6f8w);k`C3Fh5s?OLI)
z5Ya&O61a}gh5I-Kr;+%wWWFPKf!lr5A~GcNy&xS#t+ZO~4OGIPVOXzwitVcGiFFyF
zB|8n>Z$Z_5D<q{E+an$Gg$UvI|GBW(g^s+Idt2GH<&cq5k_sap9X$4-#mob?6fNEL
zH#=%XUv5W#=o9Q>|L)QL$6WsK8)2YSXcf}xBoh3pNTQU?vqrOi?l_O(NfCQzJ|P92
zcNa%BN_{?sl1gvp*u|vNZEGW|tVOZc^yf^xQ?lwA3+qPH??<?;aH|qzd-h<gWfK$)
zzw{t)J~5MZ&NQ)HCyeAS*dC$q%SO1rQ!9b1yAsy)+wM&Zg1lGWo?VycQrNtTLkyFH
z3F0;_l|Chsal0y_hzg)|#^6b+nuvtqd(L~Zu^nTKs8}nX8Y{l8DbPstARi5gUfGIG
z=&Mt%Cc(8r`QbVLZdU??!135kU-*&$pS`@YHS-z{=r)tQ=4VlMkER=oEyb^^<Q+0k
zM5l(g+!g;0M}tH@s`XN8tq;$HUI+!fc}v5Y^rcbXG^w|oGd!|aReRL;b?Nl#9b3)0
zc9*?m=WfNyzP91)7GxDn)8l?Cc0^nKH>fb^#@H|j9TxCKi}D&N&&1FbV!-ggk>RC0
z4!^Q&pzd9)B;m(TmCu^TM?q1Lt>F`GmYk<U7me+slsD_59v>mR`N*NDgdOcpeMILl
zs=ihwPF%F=Kz&@6M)o6)7e9UTf6NH95flYCh!loM*a+FnF+A{Lfj2N>N4Y(h<c0!C
z7z#j+WG1`lP55hS)Ov_&N=DQ)k=Z(bsOd<sNg953PMD9)?4gPG93vZ4{lNy9_sNV2
z#9Gn*vS8lX2l_J8@c`4A2L}Ij>nQ_}6nRJ!bk`6Vu9_7|W3M(L68YwmaT#`<g`x*j
z-34o_bu+<7zQYwR)k-M(x`daC-1bWm%Z+@z0`F5<pNvp`i<BV!QIiP;%ed7I9OgD(
z@^~AER#Kzo&%N0hoqsp_1XYR2w~k_6RpFvQ!)9eQdgQ?Um$V@|5wC~u#Q0s!8aODV
zb@L<ne1IPta~I)4W@mvmz&ZQ(0B65<@4;X41!5A1;KR$~paZOj^#pXjJzg<)+5lZ)
z#S3X2{~S3rAh`ow?XTZB`zzla?M(#$8SI_~wsDu>#nS+u6O?hl=KpmZF17u5>Ja?v
zGj|HK+3I+}c)O+5Qb&Zpt6+!xI~D9-A>FSW#IGC#@2?!h4><@simpl&KOyY{$L>+9
zl=4;c*52+TH{>$Hd}FpMe<|~W@bfLsU)=N)c7<<&=qY8&d98n~JOH&{hwjSY<hIi8
zp(R5@vEZp_c0h$6Nh@TdW5Dw7Cvze2ozk{9h)AF-DD)>i?s%_DP~>%P<c;_b^Hg3Q
z3dk(J+o+n=P@T)O)^>fEg9k$_CTq^fYUUxhA&)D&=8|*IS;XotqMZxVDWN*7-Ym1L
z6TFdn*EGX_pc8d`VM)_?ij;#vwd(547H3r#qoU(GWW)Mu?sdlRo5-y+B8^ua<qKuE
zY)f+7eEsu_8h7j37hE)HtGr*S@+G8QH|C1G^CigHTKl-NvTey}p;T#{I_R{h(0MJ{
zE#G<h;Lt9dyCq6x`cN?3jh20Pa5eblZ_Ug4soObO1v>J(S^J^FId!&EkG9l~yj5xh
z<1YU#B!t=mS9ZzMCHglg64K~bOKyE;uHsz^mvj}D#M4__kMozj7)P$nWgpVzT8;1&
z5N1m@U>O_lf6S(ZszDTe$*Q7!y2Y~av&k-MF%h|rX|UqrHan~0UB0S78eYI*-p!G7
zhrLM7@kn}kn)dh=NlY&X*~L(Zarz?XgAO|(EJi85eqFg~PVRm?R+a7My0PU${ufog
zZi+kYuCX~w`cixwW+g*kG9YxP$0aT5o5k|G>oc*<TGu%+RijmPPavE}rMKrg#pOqf
zXOD%ZR1PW~ukL(xw!07AtW%as_!~muvkFL`jxA~1TqvULDsy|sElrAUR;M&HRz}u{
zm63l<dHrjuNi|&u*@Lg@8?6iZgmKZF#rQF1ONNhMo+xx^`?{$Zmf7P=hH_8ypcPLA
z@{`y&l$e?7qKp_7xNqtmTr(IK)bcxQT_ls-;qk(nIuckqaDCVMoRT_p^MA4TmSItD
zdmQNAD1v~1q%<f3(jlGFh=3@aA{|3F18h_n0SQ66q`PBil<pLU9=Zk?YUqLca^l{-
z^_+9>eV%ha+~+x8{NM~Qv);A->mR?UJvA9UqS-D+>_u+E@2(5esm4?oZumd&tV?Qo
zeyDM@>5mqpl@^_SyvBQXsQ=2qcc`!+C4=^23%Vg>>jBny_U3%AqTdZ%v}0HGW?yDe
zci7^}GD!Ua2TZ)a9Z~P)m3As@PWDc@B{kYK7{jGh`C7K}^W<o>^L#|%PL-6c8y&n=
zBYatcqNUj)pm1>rFBqvi=HR<O^aAnfGq8X;gV8w8`Y=p%VOo3!^9nAWwc!s7_Z5y@
z+UlLiYh`JEtrcDx0jt@VPKHhR07n)n;9FT_(ETy*WN{3?COU!3qov-=heSI53d84V
z=kXl+0Ba{(yI#>>ZcW|$jgK|GAJ(;#INt_DExKL)f^*g$0pKJKUa&QSn;&+3S+Cuo
zL6<VEk}g4@xX)rw)3=YlI~+M~8IoS8aMVp3apI09&oQ+!sIMk8zPA!DX8Q74Q&i5_
z{O_yf1a@snp54xb&A+8*yZ+mfRVZ%a5FL^R%Y!;=bgv~g%MW0v(R|mohMuM(w0kJL
zOR)Ttzigrgi@pndzU*u?cib1;$K?6#q-VDSyjt3kMlonlY?3>eL^?yQ<pvMo9NTn%
zS1F}fsLB0xrV$UxoIXEf?6K$KzgcMf3;62)O1kgb>C*4pk146;8#BS2L;?HZ$&+9Y
zEBhUjtJ~%<G{|deJu!l=+d{)ikp!$5#-xV%(NHzrz!<$}ZqSp7eyg7!x$%9V>S5>B
z$eM7;^=4ZY*!KeD?iRhaI%92~GT6oOSSAD3vC3Le2{X|X>wKT%9JhHtRlM*=W#g;%
zS+~nIrbCm}@|wz?s1pYx73j*85O-Z0%q_KgraisD<zP0VaLYE@eM_QQWlaO&lJRow
zsdCf9?jMa{$*Xy&7)iqV^pMN7vQJon{alN$R(!>o8CVq=`bN=2ocWi6z2;_yF0Ri(
z?5Tm#gVmoItbh#htvl^oLEAAO=8<ItMTfyrA`fQG?PiDxYNRkfQV#A6Lw=+&>Sm1V
zrkV@maxpd3ZF77X!HZshVKVSOXDYe3SXFa}gr=kUoI_;roI0)OM`gh)*(H%dyeG6k
zv@Fu7IPWAYq?6<KJ!me`9?Do7mln{)ST7<GI=wK<knY<8MI<hs^*MEf4|YX{TL4e;
zxwBf0N#UDNrGEjVktzm+>ujp2@5n5?#3X8oPkoV&;uUKFf5y4B4LC*1xQVSfDa>rJ
z<3h|NwuLN0&-;tds@?>jir|SOCw?DF)u;rt0d`2LXS7@7y6TY2#N!2eYT9<iBw>ek
ziH=)=T<E|6x|@%!c4GPfga>WJ=wliv5o1OoL^3~%krK1gmEJ)xIDS3pc}S|4GcMS=
zzUQWYQoL`|sV{Ty4h93Nwl?e+0NKl%3Kx~5$GCTTyQ1c^*O{0%OOhw#ST@^(be?oF
z>}?I)>(Nun!!+_>_lje=G!9wjWagoi)CW6#&BGR%PM<v$EF@=>b1uZ2bT0=kYjbzy
zY(9mJt;Av?&im%!zGq_gp<!IC8!4%3&doE;u9=RCYt6hVWyLhlYs51vc09O7VX#Yn
zzFh`ZQGbzUEwz%)i}ChxEmflRE|}i@G7~{SjswiN`VMg29DNb`P))E{QL^v(Dc5AG
zk11`@4zGBz$$Uyda%I-qQU$769qr&=nOXD0VWP>}Q@q#@z1}Rrmz&_r!QSLgmYql~
z>AUU=_A0>-`mi>}vc-LV+Iac_r86`2ty<LUd)Mzn{8>~_(}W%)5#E|yNm{s5-%+}I
ze#wceHOA1#UC@>bnUvjV(c18wlj0(&nYc}N$LwAIRio~~U+u4jZZx!R>9VvjzO)SJ
z2bp!MMOz?;QwP3AKf>hpTHyA<P9@t&b`bqBj2Gv?>|@n`Zmfl3M9_RKq<b4@IDVZF
z^FZxsbrq|!{2$C!#<Ke<G=9n1h28B<xwNCZj*1r>HbiD3X}39}-hXU;%{(G=(M$K$
zQsrqmZHizI;n?;97}=R7MlDLGO{ueONAh;cRkf0*s%@sPSR#MEYqhLNf|($ekE^P7
zM%6R=^W+mB-|$`d6igbqWd@?p#_ry3p24xj0U91)A||S26xs72YFkk`c7-k`+WOLa
z??@fQz2r$t5#W>DGpF5y^I1hJwbGeJQ}L_|nG#{pMpGq%<-VT&rEY$~g%&3>)~`c7
z>PBFm@SQ9DF5x6pYH6-MI-L=2o=kdMr_QZAub^XeJ-#8;e&W=}I77iQl#XI%Qx>V>
zUpEKUhXBFrhr4(>kazU5*hG;o=r%#o0%d#!-LiA+5?OQdLvGf5et818Vn7e*4PlIZ
z8hBm>#^?8k1c&`tBi_lfDQyWeKS2hFmX>IJ-Z;o&emUoXI%ymPp-vho6v?Z-Xrb}l
zf_Gv9brH!NJ<_Z^$b5xdNj4%aqUOa({?ti01eFTD7(7eFkq|EZSTNl)HFs22f$k&_
zB^De#s>f^H)=Ru+pNZh(fu5Rd7R_`Zd`2xbIyP5q&Q(t`o=$a1;v#T@RuJntGd+SA
zLJtni4Zc{_^Q&c4v==#RC$LIAHiEf~DT3jkmH{{a=}naGsUNk9eO&3xy-w|hi?-C=
zX!Fv{wZpjOExD#W1_V~kinyCzh3&X)EwI+}7ax{??F8Vf1Fa20?Sc5aKa{>+@Mto;
zX?`xxCzc}Cl^X7IRzo@$8qGcTB$Mp0ABWfMlVl~OLNk`;YEA-wa}m}(itjPS4#Y3*
zEfl=mkA@v6ajfBT>A@XeWk`NJ5c{BXY^qBd@f@@SdEeux_|_-8M`!uvcXXmg_ZR|V
z@@-W>^BvQDiC}1pZhf4_gqA{P0dcX(%!x4V<shw%C1qG)`O~P2m*%uOz>Tb3km0wC
zbvEYO$&&opC@$}h&Q<hfeQc9N=Aq@Bg&{ms0xLoPIcYT|4LmLDfpbbK3cXP~)6)?p
zmUqn$R=xDqA!Xoe=bHyKmTaFi1?rB#P*J+Ba20<e0KlPsVM743WVrTivOmPH5IBLL
z;mpeL^~9mJzWt%jrb5zyo{dD$XiZ(aMhnfk>jNW<x(H>vnV1V|tY48|c7_0rAJHyC
z?>LJw_d}F|ywL0^A5^qwR@GvY>)RMoL`{p~V<3cp3PMV1F@D$L0C(L|oWZdCMO{ss
z(wFnpr!k0U<I*ij{ma{^+9jEc;veq3z&h{PyHrwFC8*-ibcLExM(NdL%aMTNB^HBA
zda_|AZ*enOy33v_sHf|l%x!JmLqI_yxN(K=9tA_*j5I%^Aob8vv#3RPPh$-`Q8|@a
zl)vpcMfPw@UveJC>}Zawj>r|{z^A;)@+)2)pZELtHNJqRx7sPHn{|~EDT29tj#uYc
zHpc4l36xo>0;@~2S5sE~4K1NO=(9(Za71-o<hgO$h1cAgukZ>={}|1NJoDNmfH<ZZ
z2u5^oqE{@T>fJW``lF70sX|}I?Q_}MRt;;K=%8ZQ%_r#;zqI-m?%&8+x5^2cV~pQ*
zm8oxat4~H1nYm}If7&q{)lYdrt7s0QyD#~GrL0&sLCF%tT)F2cN)u@f5p#IM$yc;l
z*8|y&_BWVRWdhCMI~;D~zUujHo$ARkK8yqJ4V#L*{-YQ3(v3w#$`6yr>iuZs9%z9X
zOX`M<`HnFQ?C=lu1;bcf7~hdbKYyq`7k((8Q2Z!yv8U4QeK_rxxm+2VvERNs_WeO*
z`mq)Jy)1w1X@Gl4QO{CYp^YU?S0|cjw@(-fd*H5le9rFd_rp+Yp@b!P8Ok=iDVrZz
zTcO^lGH#%K7!xMFJ`lo@QFBzUdRxgQklNPYcX!h*>4b=NDGr4$>^?K!C8$FViS8K*
zM%3zQKV*OjM-&`pvAWAKjKb8`3r<%IE1GD@2X;U{Pv4=wk2ZyC{9>#cpa5WE4)S7W
z%<gKiN0x`Zuxe41+#AH<lqE=%bdO%{ncQNW4nUuymu}^UtVb5secI7mdq<Am<Ja|(
zwCC$%&^At@{^AMQJvv$ec43Vu4g69hw<v=PnmQ=yJ}YbDur9lbq6!<Cz#eIZH2jeH
zvELnqZ1<1yZ*Jn6!42xKu@7NWHnSrqmaI+GS`3~azuaQ-uZ~FX+kOVCI`aD-DAJ&!
zg%JYR^}WAlPZKz;+^j6>{f6J4n05G7s(VFEXM+D8Oo(GanA$MhkN9L&S~IlQC{1q2
zxPJVbz$}w;g9UELtoApC>eroomgbpOp?L&pA#=IC%_Wv5T^+3E%4Frcu=Qpms8{J3
z5J22>;VmJl#x`tGlyl6m0n-O&6lPj4DKYuiZw(LOTy94iO&9FypK&Hu&h*rHI+a!3
zS9J)Pdvt(WV)?b=eF#*%a#g@Y>|3%_{d4)F)y0N$a#}wD)mBZeFv07W0toVn&8<fl
zdhd=JW_(P}8zoGWVx<Yp3gb28HKRA(dEFksUBjmcn0m#x^DrDQKu5&E@f{v_a*g?-
zzxI%I#mv@Qo0|vciF{iz94M@*(ZzoER6ymOnW`{P5X-y6oc>!mQ8UvoAlg89jPq1!
zsYKXK#mZ0706|f32fA@Y9+3u8K?##QDXDxQFFN6lbHPMsR*Fl=)Qq$vdoy$7mVzzH
zSvXw9z3*$7=7kodF`j~f_V+s^*Ep^|K~GPPPD)kQ<2=Cm%Qb#!?C$=Cf)VO3ZLSXe
zUX6n&3zSZD$9-+*PJxR5=aI#N5RmPLo6-!t`?iZ2MGzyn<7<9)rb0D0>P7KARH^K-
zZBlFs=n-GauCAx=Tw>Z~ZGn<_ry!-?_1Zvfg}ig#xWt>OQPQ%;sYOvgWQHCCP&^J!
zwrbM5ODv7(fzJt>hWwAp1-ie~UR4&@9XY7By(Khr(odA_xEx?IIA=J@nrW{QXyQ6!
z`<f-+RFbmI@pO&$ildOT5|}c!B<)YE7rnI~K>3gi<V;-GyDA5nf-H5+nM^}-#9)i(
z&s7KZTn|8&CO*}(ura1m#7Ye#R~na{OLW8fJ%ZU;mp1&An$O?%XPGV26F(JGvejRM
zWE<DAbmc1Y4qlRYC)_ct8A%ZM6;I#{%x72LIs-Otp%|NG-<jll4i1B{UX100G~EJ6
z-(QhrHWf`6>{^T^LvtOjzSM)2j?HYYAgz`kB@G$NCm|UnmkO9RL1xGN%`BuuM&>c$
zy1K=0O~Yx@9yA@I7rj>`p##Hq4=S;SGC}%eaGJ&=B-Bzrp>MmM<3YbJ__t&O*zugJ
z(YWO8-g*VQz_qVbDTbE81@gic8c+mZSEK^u1)IT2yu(t;$<6m&cP-jk38JQ(1QVr(
zUAt7W(g%tr2P!+K>UmNnB=77Vmese|6C7WanW+n+=F$97rxctng`K&}X&2AuuM1Lj
z9*WI3C&BS^w@Rvhg%w5uVmFK}F#s4e9w)2qPSVl~sA%x~VUpjnDVIT0XeK%8RMCN%
z7)!f;(Ue)ZSxZseadvz!DQ<Bm&#vPr^KjoVeyDic8ayKNZY;XcIxu7kJ2SE!v2&Zw
zy+dNh@?6TT=T_oFf>aOgQ{B7g)C6C&J~5v~x}WJC%e-Yyxn~*IbWeT1lgQLsoI@S-
zwZJ`O@Qq4KaIusG`ILV43Mv6Se7^YFe<!QpF1h?1<2yXval5Enx~Rd6OpxWyb9UND
z>}Ms#7*U=o5<V4+w)q=~`cnbkeY_KQ-!&9`3?YEr!@(@$rJQTJb_dFWG=&TiRSWad
zf?fYQt`8YlHEp|W8>BRuze<Qi06>$K{i5mwqC8dl{m?DlOyL6h7p$y|3Q>6_k@!Zk
zSnh)|nNB=K{X8f4vF=q|iMzz6?5$a#-}hEa<?onfU~Q$5)i7B#;e|TL8qe78-kKPC
zWInms?=V*}zHhFQMQ5){mHwFm=We<iTEc*{(MeLUE1f1D{Kw&1PCFUX_zST*x6bL`
zo}DZoiP&)1&2blsMRB@F(payFXD)~lnd&s41`2W-kgZvc14{-tVR;4aIBt|QjV184
z!#!sMkvtC+r!UfA!gvb7SNFIZqGnry+-ePEC>T0=OZ1US+o?D8tzaV+7ubC~%M_Hm
zfk_suDix<8nOLLKVOwEEm1O^@64;Kp*Few~h6s`;Pp@3SO3+ZZwAoFujI=bPuv^u|
zh{%-m;;rVG6X|ZR*(#COgUd9(a>L7rfif$F8}Z?r(_ORXF;TSz`uzn{rl?8PwQaZB
zR5-3VScf@TFvIcLfs4{Gy|=NWh3*YFWcxByr7$u%5Qcl}@^Z1wfb`QVg2Z*s=zHts
zKOBE}UhJ#}A-4vd?h(j{;UazrB}jZwt0n}AzCyb{67H;n$`HZSkgSb*R9ag>N!49n
z;$Iy64jV5lYb>;{6-xWkp`@Lhph>ISjCy@ys8t=`GkMt0#}kxI(0!o8xIT*SAgKBn
zNXSxom?L_|9QX`Wm9gYb24_ziDqxmNzpo}D8vGA!&V18Zlw2>T5c>kE>R{_B@P(j5
z=VH#PW^{OUN^8~_@{#&@iFTi~-G~fAaQQ-d&DL4D6w!Wb-BK+i3+KecckK`kLkPe(
zmVTQ!T2BjW_TL%xZ#e0(CIt1J)a`a`ujgt?HfXxRdwm`Y{fc5*a0F1f_#Qi-lE0<i
zu7Gc*a1oB+4KX{It9_EFOX*)l8|qBn%U%$xykME^9&H1{SNMqw9nB~LMbxELr_z^m
zsN-f7_S{<`J@Wg`XFG=13rjXe&1petK_=N_MUawZR<^Liy>zLW4gzsps7JK6{?Tuz
zS@&O2yfZORJ=Cp^{Di|*36q`e+?4)i_B8HLm92_b#yC^mp8^ZY%ZE1?%HsHxLPjHD
z1AXB5`g+YZ*!oA0fvCFT)~<l}j|8+jaACr-D*T4*+gz<70mU6|6k+VU$fuvNS$%v{
z=LUD-Z3t1{XZK1W(Rt1ag>$J5ab(qrq7u{c2sC3A`H)9C+%wfFZNICRRjzAV)nryy
zk-_`aH>zNeRNONy=qk2_snFYy83Iq)otwZ>3tf@UkU##v0>hTG|Ky2pMFoQ8D)q}5
zpVZ}fNQ*<bR*oB*Q0uBzW89Yw8Mq+yYrgRwfENo-X7f2>_z)?6Sx*h4_osi$qr+oo
zT4LaPRObDXlR66Qsb2TWVm#W3YX=%*A6l^~mKf(y*~Y&^u1xnqd$+3U`+lrU1UCuq
z!(iIldC7j(Wjwlivb>5{C}}x@hgiWJsUqurY=`Xxxx8$RjC9ZCP%cY<^b|SwZ_o_w
zG+gW*Po00yJ&ynpjXy7;+l94s@~V)}P!#zM3p8?>7Z2RoDM~xOyibbqaTkpblzD~V
z)yq`Uc`NV-uz6jtRqZKa3m!hLrwxLQB68)-wP@jujmFq*{UvR>EM`6Y$yR4NGfzIz
zz^N=YGXe_?gTHEp!^|F+A{K9-FCy0WUmR#WQC9Kxhglk3qZ{oH!%O5(AWiekY>nZ(
z>pZxoHOM=4tcCx6*K*(NT9>&`iQndLTOcP?@Y1_)B|e_%F=$e@M-o9~?wFLZ(i6p$
z_&;Fx>GHqadrL@LagzPS8rt|!;X-bllv^N0A;Zk)ZOwQ@>2Kx+3}&@C!nE7uR>#}~
zG{v^Ok>x@Wr{BG{tD}qEGv0LhHVTYEzTsw4l+G2Dw-aRZuJeIYN^ng+86o?OOP9IT
z!)+}M<5~T>W7jE*fCfFxavbOsBw)RlCA2n?nled?f~}u=_Zkhk*Ul`ti6=Yo#`C5)
zl>0?g1MfA}cx&oO*IUp3X;-~)cYVC6#BzBT!qxN8Fp!xfrK}6VhjctSs2>omHK{Fc
zKPknzv~@}=dP6%xtD{__Mjg1m1T*@K2LeVrvvKck{hF)btA5=F?8)%`&Q{|VzunC6
z7t<usM`N?_8?oG1#23JetpK>cr78@V)I&8cl2R|{Jm4Vjf<tWTDyfsV8X4Z!n18%a
zP5G{HA@c#aqVwdXmLB;@`L}>^!|MxFpnnK`-0xb2D<F@;Zeh#OZu}UB*Z#9R5qNtE
z<Qz2Ky!3MZ05pSBz4_*+)3EU7_Kk4uqK^N?4z%gh*^R%Ma!a&o%h_6z#<l<DzQQR$
zPk>xs0l0-2N;vSZxY#uy<NM(148Rx+p?#NHCjYKmO9JTD64Jkvyg`8-rbk+R1Q<b?
zCuirAB~pB1pfK;#%j%Z7lB$1lYVy*h{43U9Bl6S4ZEGcheug26839*LSHrP|>L1^D
zuw}=e*+(_($s$L^>hy}L;rI?*9nv)|vz4GAZ|&07FuU&K9@Iaed_NTE&+CrHSJsCu
z)d0prC9nK1Hq|eA0Q0W}9^9i6Rq4!;2mVGM%$gT?8mOmdC6m=AxX)d5>V2*<-OwV*
zH2qmiJ31DJN)UrB@y|e0EYH#Vas(FuH;Sn`yaOvX!TLA;zSaR17-&ZqO7tw>Trc;u
zd}pe+x%#g#!#oYCj>zZ2{J<R>ka!n>^7)KQyVtT<F1mALdt|zPB>2bU`L;}C1rPkb
zaQugKPlT;kf9y}Cf#(hVD8gfB;PO6h@*IAK@g%3;Ip*$&A(1-E%Hq|*w_eYPccl4<
z!*6RmzF{<zwGq4gZ>0Y|Z2g9RJ8|*A@A5F|IfLll1m@30$Jbh*TkXVW2@DUuN?;81
z?OoMZbEj(6`hD~h=KAt7&5f7nr%m)1c#{u+6`mq)w7=O5F;a&Ie(9~9zGXfyH0!7T
zwRrpA|GwiS@Qol%e)9hjn)&x-&;gvpmX>}&DgQF<z^1-2M*Hu&nB7>83IA99!5nWq
z=Ki~eaN#%ZZU0@XwHseF>i?>@p3sdE-hbD%?#5!y`M>K2cjGA-{$Di!{QudeT(ANV
z9_b@iFC@9@6+~YX|7WP06hPpQ9Q{Bkq!n;Auxaoc1BJZKF+5igZMvEVK-&cuj~e*|
zV+YTyzZpfW^5FcZKyrHv7*@V&;pcgXaXa?zQOgITEn9%DK-<Ot@9kc1VnV=+8#9PI
zzhhJrZ5XxBv>SZrr+GVQ^ugVxs(7zTxA4gWyq`nfUjo=|8vu{_Dk+<r5F<kKD-|cD
z(*v`ky0X{(7`?i+zP0$p?JYF`A~74#5Nz`7Px>h`|0OB~@B>Gi^FD^$?P(7Hjlqs?
zjC;wFQ8!gS(C3(@^M0msAkpdn#;lU|JrKf7b<AD<qaw}Uz5s1D@YYO&<6DWY*G$Q(
zPzvFDg6Lb64e7tO*8dtR1H=Ka<hIxEuKw*9bD_iWL3)&9*AfFSphp1sWjlV;i+t{}
z)STnz5%)}WF)@IcIzVkH7Nl{a>(WbYIsxXCb{44gyAjvyQx#GhbeL9{Xk4E$beAhm
zv^-8^)Yltxu#bDxJg*Y=AJ<CnhDzwHi?_vcd(ghE&5eyeW`4Y(?vM7pKXw}&$MuD(
zZrG<oWLHi^wcR+c+abrT<4Ppl!cBJ(A%(77^3T3RYjjm|imsnYle-y}D$$#bi}`3X
zXFB$e(hpWpgu|A_Xh3&U4)X@uP6`jFDXISBE<gb1eu7H)-M1HSPRk@SE4udJqYQrl
z#M#KfAlKHUx&j9E+J%9)WnW24;Ko5~$-V~FON=!1J$h;LnnJpi_!NN@6%}}0)ju-5
zN^m}8tx=UagufhEX#{8p6Q)kZ5z3SQK|u$&sPkHYTNn-N#wO7FO2G-QdCjM&b#D{i
z_&iX2+T&!=S%Q?Po_v#)VW;8Q1H8^O4_vhDVx%_3%!Df}hytGyEON>YGvL!-ij{y8
zi%<kglST9u5k}k6<Ns@ak$<j*loxP*4}$dQ%k=1{Us>=}-j`-hCV+Bm26=?)*Hs~<
zy|EIK%5*fc+|b<q2Avc90KZ@j`eieBhT>i`%`VgL(VJ-=BQ5sGOfN4<{Ax2)C3h-G
zccPQrAvmU5P8IOto)x3xWv!Q`IxqvBL{FJ(Os$%b4JwtofJcE*`dqWbjOoOG<{U;C
z0GHcm<KL<i{Eq0apW24TMi&kz;a31isEQgV;d>N;JT`pQp7fSbibcp^m!r!eQ^-d~
z$qXr3dF+e}&P_r(Ab%uR4w1c{1|Qh@%{LJ&zJB;+`1*)pQCPzDL2T_k%O~ZPj!9?8
z>Wl&E{!y=aF8d*3P1m|19EfXcmk_ja&9uBic}+xN$r#up>gWH)uJ9jcO#dbyA}X?o
z(4a3^<C&{}tZDLy&49=0qcmB*Gf|3T^~>=L-?(vkNie!`gF=(K2WK?7bb96n^B&(}
zC(j{I$~Dgw^cdfN=iHcVokGrfo-@hv*j+NEx+l`z^Yinu<UsNn_DbhdWz##qqUrwh
zKifLMIIU};-lrWSLBE$#tfD3||4Sj=s8_J%qEh9ks?D&DR%8xoD(#$@trQ6RPe1wB
zXmPVue%#=Uj+KuT?@R*I-h3SD_uK$D$wu#mM8*~w!AMJXcmn}NLjg6dK~?pO<K4%)
z0pV>)srUb*+%ceJy9*pTcZZU$E>-|($mZdF7ih@kq@|DHsabBu@55#mIoT8|d7nm)
z53cX=7xs<XRt<40^ND%Y2n86OR=iC`9~p_KXSXYE7E1ks`1$7!|62^&zEKFjwtaIu
zLK=whWUm>D-L1H8O8~`$v<OucsjCjzL*2jxn)q7pIKy1V%Ivi<S<JZo`?@iz=f-X8
z;w83xDOq<@BKp>*2+|~uUS;~agMGHQo#b3q{(6=Cvkv?FVt#7|+WE(iOW^=MvPmdn
zE1=)M3O*kM<04lMIBFd)1P<2h(zcxF>Ue|5-LTNdCXhT4rRAr_qUkQQlwqMq0s`nH
z$3zq||FdiB*{o0oVSkUNq5?+<`x(>sINghZbuK;(_7SnyOh6^#O;qygJqSW>Dc6b6
z`H$Bu_74D)pOuPutKmlaAc%#MO=9f#(5nG!Z`_0lH%}T&g2Xsvn;R>YGpP|r>^)(h
z`=cX~*w#~?u{*jh$0Bp^VG$e;_CYqb*%2`9E8W<|O{F+jYzvgL1;~lGmHU*JVyxn~
z{)!-=;|wCxL9!<I5Ad;(5J@A>-6C=G5uwBXXR-P(cN`0#5%5a3ul#lhj;yAjQFgC-
zRV(VEZ<xAf950UIZqQLIujS(LqKF}8=7#6e)h@C^hN*7aCTKmOCo(X42BwU`qMNc}
z#|JyLz)G2uAbB7I=yDm>won&`|FhWoH@6Zs-~-Z~Ub;{oAz5(gDEZ*S_q{_2>WRa1
ztE4Dx3jKmA_~6i^$`FOlSl)8E$BU6HX1tSP)KR*tj9xVI<1cCL)5z<2VKusW)ji*x
zuq_C8d6kRJ1SjkLu;1%fOA9Qy6a8gN{(Q))NdO$|YQ=*eJlL*W6*W(S3j*7Hy8C@)
ze-ApL7?)ZCsgXfnCfqg$XbaPeocN=&Y6Ved)}4!yLUxr8>4~t!?m&SL`3Zyk{ipU0
zZk_T9xH+4s%^^c|sp=Wq;<h^pyB;Z_H9Ra_{Yh3M6hI9AC3E@fN6U+oS{{<TroKGr
z<7!h!0}TU!S8%?WTi0@Zc{r3Uj|N`+fNZ(;v!(*X5FGN41;x)Akj*nk8tcD;QhxqJ
zrhoHTKQ(Rv<PMBp_+9RIH64j=9wj+6E1|A|e#D0x^Yv3CKw~h@-$w()iMB)k(?!T)
zS_|;EX5q|Np(*WNgrqXhM@0Wef$#a3hv+YlHsF7n4gb?@`1(JB&;JNM{~r^4Xkw%U
z4W3e_^PG6yuUFvj5>X5CPtoq0#Qvf3)rZHwMWSgF2Kv|~ntG)oMB`uDxTkX93G?FR
zL-=0W+6CRFeGhcM&#w=`NN+q``|!U8wuOI=AiRe#LJ97z-=Z72)iIW|z_XM}u5@zS
zowbZmg7r+}tG`Pkc9i*tZX$x$fn)^+8zUmA9tCzTUiv+5gH7SV)eb97gG2;HYv)ch
zI~M6D!+q0fuQL#0$kj^7qV^AS0CgKKW8}v<GkZk8OI(TkZi~zgzA)KZKUwxyxAUVR
z5kI6aNy><J7W?ak3Am_~-ONaQ(4YL`FoKO8OMI;+8*rHY>KgmTN5})b@4C)^7zlj<
zpxq1Sd(Vy}eX*k-dDBVU&Cskk-<MfA<nH|d<T-8hcy}^~F8VAUi?a)ig0FbDtdB-6
zqWDxNuXznGhR@;)4>V4e88=69xYCB!mPDp|D|X9ArrP$aC3Cl(zSK*w2fVLUbCpy@
z&H)^dSKgHE`lzLi<Ou16ce2@Bqwj0&pAWtIB~uP)14<U*A{6hm_+32z1h6x|&jV<#
z(?%>{>2-etFy3~S*f35WJ^CGXP{(u&6X^4|xxdAQyfqvVx=3q<I86fsIEkYEcX)6o
zqwnr-2G$o>87W=~t=u2Fa5=3%=0!kC)0pLlTBF-LmP86Rrt@X^+H9SP>_YDR0B~{3
zZ^jrGo}v#Iy(tw7+J+-6@HFShZSF)}NR)S-skJ%mKq*dk)mP)AWfv-Z1#zzijOaYl
z#mggZ&4-N<{XUe)u_O>wY0>0jEI9KZ>0f|Hc!B3)@Zk0YcKhmNbjyo7H?4S0jN*w6
zC4c0WVTld?AxMs(Y<^|3D+`c~fEo-ejT9eL5p{tz!{i_)FUu;N@doz5v3Pgs8W2Ak
zO!O{IU1N#~=pSQnrK2AvKW=cODZVB7v2@5d8c?u;Q|)raVRd#Q{6sx?sM|GcMZ0Z~
zxco^L;TP>j>vWn&N#Gf~7M;et<(J(`@n+I`FoHJLms7AS-P$l?(Xj;$E`t<oh?!wn
z-GpeD+v`fUImcfTH3cr9>3O7V_s;zGk};Um_X^gWWY1T2YCqessgK`xv}=HI8~@e9
zRONodzNj$m5m$fNh5hAkg{0FvN>75{YY5doJFzt9cNaNci?$rQk|<@n{yfQPk}Rp$
zf~oQrk#Hn4mZGX@IYao7Hl!s{92H*hVRjJWUo(;`aQBDen|gC4jmPUKY0fMk9y*+!
zY7QN0E5#rgqq)hFVtE9J<*(=VraVdlx=nWW>;0zWiV}7SNr=<ATDEx`A9t#z<zaoN
z2s93lB*qkmn(+%L)@I|AV<~Gr{1y~%qbJU(I(BkXyuI=8#h&%*t!``2$Mq6Mst1g=
zHD42qUaK2y=8HqZx1&M|7#b7pT*%RO6$Q_`KM%~hVt)eWo@1T_Wj|_cf}cO!pLmYc
z-X*A6pa_(iH;!ma7^&e!PH4GQ(Ej>iZ*Kw1`|6sXw^jTufO4g+VZ<VYNH<b>s3~XY
zV_-duoTSa_zLjkzd<l(X0B_QCgYQ))f7A8k$>$vh<PA`9)dD`hQKpLDjT?*B(#%n^
z6DJN-O2rNOqF+#-B3{f*lCeHts)>_7bN*oH7?Vh|#)xxv!9ubN3RF3y`fMB&=7$G6
zPph<_uGFD}5dpu}DpF2B$7ac5&=U`%$Af}tZKiofmBp-9+anW*yWW*Yn+umXvZmsO
zLLSo-9raKlfDX4c8_F$S=<}IU+tfTs6AJY#H?O8^n7Vbv)5uO>9qvN#MWV!qCfq{6
z=i@j&7g_IO?pmrRsKhscfNIE-gTVMA80O<Txoz~+N5zec=p<)sob+YIu6f(VNaA76
zp}v!3AKy?bn)zHb!LIAR_u`hB$>80VDW?=i36Ja9ONk#~ktu;Z@@Do1)QM!^KGkxY
zqjLP(*nX@W1N+>&8~|lZyPPwx(&A`ncCNaf60g5TIbf_%Xk0jTvOfzyBnl%pL>3`L
zZHvyrlLkyTCzXwc3TZNJ7#u{FWu_NFpKY*(9dhJ+E0c=to7Q*bqG3k!KFSjdy+-iI
zNZi%6%1(Z#9ggN2T=;sNZ%dEx^)=eR@?!J+!t<>Wf&hOkL~#dda`pJ79E-h*6&K<>
zm^FSjdGK0H@{%^*lrvhnYQs(4Q#`jc@SWuAbpzz)weOQtm)_2kq>9qzBLW?YYk2oH
ztosbqX7bZ+k{SR)k4>{w5R^IKDsE$BVM!qzQXL2pJ;yxQezsf`06=DXA^Bs*)M;j#
z0u<02W}Ya{rGz(l>6CnCJsP4K9DHwv{eX~L0&3?IZCsTG`E*}yCxUJz)=Nsmb0=Bq
zO$@N}#GlB(y@)5)8!ZURS$)^9R|1qKY`ugoRXr<R9W!Bbqpyj_(!_>)>f`PagtF!)
z7lDNY{K86W(~7;j+|RB~eE0>^T9SjrMEc&zjv<wok#Ym;V;rHepl4&(M<(Y@+f&g8
ztI|Pm4_=rRNtEtMlf{uQ+l7S0Woq1^PhSo~++{bAKv}txk+o9RTlu}nT*NX`p}0&Z
z|IN9$LmNUEK0cX7N@~-RSEbjT(;T{7;@!lDlw0=cWBQ)azaLxMd{{ig{s(juT;NOt
zpg(;jke6f;7n0XLO;=X}!q(^YIGMlA7DSlE6nB`y0+*asnY67O4x$gaSA2<bDB8^E
z+R{?AAy~|%4JxIfmk8mzABwIL>O)`}v}*;sf@8{7%gEO#=N{Ab2S2w(q|||<l<_v)
zp9EvfgPzG!fB$`4?PdhIvR{DMrl9x2z73jqwc2)6*!cPz=T!H!Q!zL`nO3##c**!j
ziPLjWAXFDM(NdRD1%L_C6-<F{Erq06$zIAe;H0$wA>UUJ`~COJ^)|-FsAmVObA^ky
zN>;o)xW=$L3EV6KBJ<3y+ullgj5%L2_zA^&hjkJ#S(fe>IpOaz`4nr+`XBPnMyObj
z;kwjD)BtisDboYtp-?jAL6qMj4Fa>IQnvdM>-Bx{0u}!kEnL;9LF(;~>de)T$)2J&
z-DOwbhZ)bO;LAuCBOrAM7O#75gK>~M%aEzcKBp0TLirup-=j56x)yD-+flK2W9-Uc
z;PJKh_PrB9moDqE=W}@X8V=Q!Cbr)?nixAsPg82i1{1%B4|;PM30C?jQ?u)lztA&p
z7(q3C_cfV^o`NUp!tG-a#tOutjVEU>8X6C;TPg|lkKQF}X6w79g*Mw34FtY;=Kydo
zy?JD!us!4McJQZ(C51a%o9CQ<R3pzsz8}${C2JlUZ1(M7Sljk7n?k%DL%r~CQEARG
z8i42>mUslrsB4}iO<nf+rX^Or?tXltG86FAnfomOeKXqtwE7pMZWn;}coUtOT`T&G
z`-9nim`}IA9^I<>-nKoL5WReWj7W7c&_-%qIr|GVJMXx0jUug*F9LU#ZY_tjKE-m@
zrL;)F%ozSY<CK~XJwO3^Crl1JC9HptIXvR_#gVL6n6+p;14y5AyL`~E8*(SP^V}p+
zV#sY?93{qq%)OqcB%{rt7`Jp6KUO+Yp(K6tIh*B)36_?JpG^qKTuQOxTd|jTkfLEr
zlzQX`iW*<M&cIvTK2`~uQxD5yq&E>Z?&9o5T>Jb_aUrhK7T=?-QY_+3!6{i#^UxVx
z(%&dKUvHvRg}A(=#PcggZNi`@J$PIF1tD2A8&6!s9XvT=z4pXm=GJg0TYY_G2ZE^?
zD)vFwDQ8^YkYk<0%Xi%n`o-b<*@~lhLs+W~+dJ1onE|h~A<>rXuE$0mBSX!79@=cL
zgl#))xhcDz)@r(M2Xi!N83KY`BLqkLC*M9HUmw~M1-g?Fzc4Qi-TZb?x<2OgjSGzy
z@K#Z|mXswi^NMp|YYdAotcRQR`)49wtBY1UPGOHJ{qo4bz|`z4nHrUM``qL}eql$=
z=PG40p`{OL-a;&Pe(&gXZfg_Ej=`HA?N?4Dg;ZW^7_MB8H#JyvIZZ^>9QWT5wBu4|
z0*~5leRn$g=2^b={hWK?SX+zW_S=9;Sajq>2!}qA{wssr`Qyd}(~~)~(EQWtIH!p2
zF}tHkHohz#alwL5dlpglp}Pu&1mP7l!5$C&PoFl>fi4GkL(Ydx%io(uF+}_jU>*bA
zC#&HQ_Tee+j4H7EJo`L7B!q~q1TwC_NTQRw;n#eb;2z+<1e=dSfYy@He|Wz#U!9tP
zKAI^)eh=PLVEt0Qk22VPSh)S&W4v_T(>AK{B=Gq}0|lq$-Nv$gm+i1pWFsOLW<CWz
zNR@0n)ou(Y>ufldNb~S3jIcEdH&z=lQHJ*E)rpTuU(9(dbLdypI6tSI!O@((3WC1N
zzIZNY{0Z=XKBtX0h^~97H}5v!m9nlkROy&Nflbq}n)gQYs-RmGsjjB%@25kpm=ANJ
zG3f2H`6bOL1GGEaQP18)VC*!UdBB+c_v`F+ETM(8$4sn*FQ|IyR=NdCiahcxBfQ6s
zEeN2@I~ER=pV?93V$Rm_7AXa##CbaOb#8LJcsx5y`;J*?_rqevwV;$Dl5(%49hBQ;
z8zj%!?{Wm7knrL}vA;<TghhYTJK#_BRB*rQl~*5giJ^FYWV|2cFl+E|rTp|a=T{vM
zKUgmI7)*Vs+<RNmHz;i$Iwg#tO<tqg??sr5zi)qsa1}@yZmq?sAr^n$-#kw=xLM4=
zRGQ*R6>8xr!cIAgyZLo6Zo_yv;?oYNKvU`=N853DK`-=;XiU*bFaLl-%|0rn^z7|P
zVbPh!YCZRS^~qV|p}vp7l2LV*-jH2GQQYEL;*MfYR|&c~;o5TC?X`}kFt?^KOJ@00
zbt-l?sV<Bf=EaYg!V9KxohY|EMm;>FJuX}EGg|THr16{z=(9*1{AC)q0>~fqsH}eL
zdK8HcZHYmW%wjX!ULUn{4d#MM&a>VBR#AUGf8o$VBsr^xvgn#3IS6M%W(k703Z0cT
z-ig{akBQ?Pg!eezc7I&9X4pLDA+8V+55wd+!1p>YLGXgsJmXMzV(#-oC6w&yh%-PI
zsu{4;x7q0aeC=_6BiL-0oJrakpcA(QSFNmR)Hz;otudE&{hWm%G@$OyK>9IBqZzvx
zMW72)<LE+_6@AV?RM{bdGInH_d**E{*OCi3`Mq}VQY>eT+5N85#J{MPDj1a8zWSCi
zjH1?_W^tU$!uX6JcS7CQJR<|;wxVd8@ea^mE8nOuoev_6ewfehx=P3m4OL_I;;*Ib
z_29|BXpz8uS_8MRql$G^)rc<Kz5vQ6SV8t+b;|3BL=r<-2jZ>$%f}OZ(-V)+t{>N2
znWF9-8a27;;i<p9>Lc@jae5({!+*go*a2pQ6%5H^wCUek8_G{OhMPXp@mgR?9gFj#
ziRrnS9gjs`;Fz<=4yQHAoQr5wg}#Uf@stNb7=wdBKh&1K>s08qP3^p~N4y_AW0ZBe
zU$4xW%X(4TM=E;Hs~<EzPGH;_qgz4yZm`BlNvlRtBh2fVF+^w^X`1QQ`(RgohrMB*
zNmGfeKv~5of_OcDr*(oLdS@+G{L4JBKN_W#*R*O=_U~$*+5Z^qMTOVUCd?DWVwP-O
zSH5&cq^YdEjzQ$W6dtb^pBg>L3Fs{1-UlNqZ4~<=RPN-C#snM;G1b}kwb6C7z*IXm
zj_bQ6qXQq2V-SQDGe0AnaICkq{JkLr>6PH_<38mno}&2k+^QRp28$x@HHlEBudMPq
zQauhkDJhLF^>?Avy22NnHuZ57oHG8pH0UugyKS;DSpVaGKrwbdE5V1sB*!s2k0>zg
zu--$_!Q234^Au2Zcp&yd=4s|gSRpX5n9PHnT4n|pw9j_A=<a)^p~Fx6BfE|QHlwht
zdUisX#)(+-DPL>DaXR_uq8N0Q*y_UiYa`a8tqxO1+)kaMUMAWHl${4y>?7(H-1unp
z4cOOSYdExH1=Qm*wvhWJ<D!d;TKNQvbuqJJ^y42x*I4(@<F$->rv(ajXO%n2ul+xE
z&?_R&O?G`IzF!-Eyf+clcgITgXLK6ADllhWi0%Kw<6-1!pmRmb;MsvkDbmcKO|^b;
zZv1p-Ia+m@Uh#loWoK$PsIodW(WFAAwJ6lRRv%U7c3yqqST_Xib{LRtgRl-af~mx{
zLL|KxZIZbW%?%+}Wd23|5ZBLMrCd;>tm@S+`yWHo2m8U0WdfMG$?1NVV`u_^uyj8!
z?X+0d0xp~VwtijB1atjX#u`Z~?V9)|+@@(;+hs3J$G6o8@rx_o;w8SjV^yh4tVR7b
zDGAMO*JF?ogaC|8{H%0+NjA6`LdKd#;$S;fBWkOsci}y6#+d11ftbUA5!k-d!rD6=
zDj%>Mi%AKDN0}5R?d9;<IPFYukL|$p7FQ27B{wwp&lNR{dM7&z%bs;2%-3OZB#OTL
zXV-+m*GR{fWxB+|rZjS+;G?_zPWf+`68|!Bxao}*0pl#E0K#q(#Y<_gUBpNO>;yfC
zx`J6n2b@I|8E2`{G0|@0Fw?rLt`FaJ$XO-BcYk~5iUo796*1+<tKMjP{LOl`Ayu$^
zTCNV|X+U-K+Di1pnt5#m?djlrU9x9nZRnL?IhU{M5)G<}OP%y%yW7FR*(isJg=UEa
zq!c|Ry47aToqn_+U_*cQ+g@8P%8kQfMwZ=GdlMB~V!&M|ppQF9Jfox;u7nxTu{^O<
z)Q}1jh?IC!v#Y+aJ+1-(K1k2BTIPESIH~BzSHI*VEe`Yh-Qcvrdozq*_<aYU6At+T
zh3p6Jpx-=qQRUBiTCN6?^0bCGOx@l*h9?gCajI!hv3ePj7!FRM`Ed+5=2}YVazvX*
zcIc7&q;n1j?$F)Z>DnTyywYFB<j(<U%$M7)=leLxbMs;F#TM?aMNt^lqN}x3`rl|M
zPCWUdExwt9NoQEnbD^DE#TGS^S<k(@r$=)=+$v@T=BdE&?<vnMN<N#C#QWqPb#(3D
z%5_6}&r3bjbz9n+GpM_|r>F1te9<o|AkciAYjiH9DOD3cK?C%FwmS2QjlXYXa{G5j
zk`HwWn7^lq>+bKKwokAC5Ct6LPPuFx2)Xm8(mjU28dpVwN1-&Djq{Z-Q{ETR``*c)
z{B>eXiGEC7x-}embK+5@IJ%4Cs>(?wHL?;X7xh9bP^osy#GsYRJ-$IE4IfG7a@3Ig
zVScaMHR0mHj%Q(;NnmFC1UFl&L#D~lJ7-(A&~^y3F<r_bsU+0$tE{A2DkH0H5nH=p
zu~^j)L3Lk7T~OY(o4TX8rT(%Qu5wHE3uqtfr03^0AnhdCbm=IscFMPsNc{P*W3vO+
zNlqX_9acv&du_W4aXc2;-#;I%E9uN`X1`i#=lYzx6W+!eU7oBqzocW`<zr>n6Dz@R
zj_IF+9(e&Kn5ds^meSyPb1qiIm!H&fWjNG<MFukF*<=YxOLpMM(ke;=$RP8Rem=s5
zej`nHlf;Kg@~)S@E%Pl&eeY!ElH_rMUtF3rf_kQRf-Lkik1|~3HM0c>xHLoyS7PxC
z+i=lI+HB4KT8;B#SkX;;i*pTo4ESSa_5^(8VFegqN-Q@m(4)$IRAYiSZ+ktjP~9Z>
zXu;=d;$@73CL$%T;tSi+=sm%tIYoi@#@-VZ7t&KeR-?D?`g&lsmP-}sG*UjNmI*To
zzZfrir*OqlL1s+XCo>lu+|IDPITSrY7KC`ku%ACNlwH_7?#?x6Ij#@|zm}dtWK4Ps
z<oZ12G|rt8@bH=*ET2yp&~R(%;p;?oX&@__)f9f7_uf8c04`nvH(%OtsU!Qg?;(!e
zeoPg1Nl7bK8AKznWe>Am%ScibWuObK#W)75jRxQCV<v86OiRrtCs8s6p1H1>PKgxF
z8}MW@A9B=EnKNqa9=ZBQ`-9|SfcUYNR_S|Jn_0b^vvOL^b+<?J0qHj@2s92?laF<?
zB_35Y+TMCh6N8CiadK+pU~ry^e&`LZ-Fj4qsp7C*y+pIvkz;Vafm#ey&n`ZtIWKk>
z^_Fd1$s9$cCZICDPOy+iRT~a%*A9-K>Vb~|eL@L_FSV(HQQ^&M_(Y_Go!@)13BD~u
z=AH8R*%Wm@18YCm2&Q8ab-X9Tm2mRWDW;~=>$L2%F+cNa9oLr>HO-Roe$VC@vBR_!
zp1Ll%^diCKJ$)ZTMP7B?m2*_$g^9D>VQGYVp6JDe$p-wxSRG8B1czdFZ3D1*9#JWD
zN!8?Vyt**9f^&ecLqm*r_C(V3bED-TBet83e2GK7NFjhSgdBU^OrYi3lE36#(wiMp
zZuN`jb(sp#`2cO%TnOD>a_n9(Id{y!kJhUn81Qri$SRI!S@@5N-{7go1o|vS;?VP}
z;{tV5rB6>m!7Wm}<862D8H<PB+v0e}>>9#}vAtX)#<N3hE1Mt-$x4ssUFne*9gbaD
z$iQBO%yQMiFzKfRQv@5V2+7iC83)RW;b)EYU89vAToHH1z3bmnCG6K)64Wrku_pqR
z4peJHmdT|3@(a{5ZFt)d%c!v!8m+qdN{~-bFK{v0t;@|A%;?y8iaX@cNM5Qo&&#-4
zbLQLB<Wy+!H)|GqXlO1->>q09Y{nK=tr|ueoCH<?!G#~0g+m=@dsTVN#L%O33fi$P
zxUe@+v5J1K7+M;!jf8|*WAjj2k}Nz}!3q4dc65L~6;YX+v4CF(fh@G>p7<D&=;xj&
zw-`qlDeqrHJTL52k}zRDy0+u94mkb(Q|TjMR^S?B`SlvK1F$w`N%hkb4+Bo)YTj?e
zwfA6s?aLu=Y2y|VP}|%L3mhc~kXH#ipSOWgMbxziI|(rg7*Y^YG{Bi_@>oW)U*EM;
zc%voZYcCqJ<4U#!;VgUyVtY@C+4-Zfk#3$Yj#MY)BDf`$0w=i5gUx7Wr@<3neG()m
zkfCvnxh5>^D&fj^2HRqF?Z>+BEP-t}X<@hXe&XJm;ntUZUohFj=QRTL{#^I&akv^x
zc{4-V^htjtRvK1@0p?JLIfI$7i~6+Jop3ho%c7UT4(15)t25gU@wcmJ^Vj|N2KzjW
zS%lMi4FuyC5?>z-_|GcxGS;~l77^Cd^*OY}uA_MBVneR+B#mJG4)46K{Gat8GQK(E
z8^d)=a{;Ik%ic8uPVq^|zNT}_6Ygtsh}P<>?=PP|`#Ck8O#BlX1^>q9_b-&1Tc`hl
zQuC)^1W;8x`@WjE#n(=cZoQfFyF=%oAC*T^#d<~#a6aT?1ed<P0ksZQ3(gPqZpHlE
zc;AB=``^0{Xl_EA-u(B}IJX`RU!Qx4#c#1vXo@so=(im?%;U*0IB7PLTgHS-oBrG?
z0WvGvm>bluo_+M6q}3KYF@Y3S)8T2;ap=nyb~z1>l>txNcujqwd(6WCV(rt~XuY3d
zTOBo0)6C-6-`NEKubsiRHu8UZNlZFmx5H{CW>J8*6hV%Acg%)C-F|h)+^R$`6C*~B
zcJWoxzkqE9NCT~$z*_1*%OwZU;JR{2XF5^ZpDUl!_%+=hWbP0ufkXOY@<VANBzH>y
zp?l_AcJRO%x4M|h89>TCW9Z_1z?=YF|1U7mF99LntWT*fe`a2l5eFF6idf^_qR$^v
zT6jpQfH-HEg*_%Ef;?kd7O%s}3^SQtv<I=8F@F{LB@rN`-?IW>db9(tl34yU)Wv#2
zs67N=90fk=Ufsu%Uc#ZOz8h$U=k~O7rmRG#`&r57XTPLv0E)L9K=Fo=cMbn}YR63i
zX!>3(POwg;RpWhN|5O)iI=gaEF)+YnGx+Prnal*9FYUhDe?%7keRodg0B;p=tNwrT
z*8lz1|E<9PR^Wdt@c(`Ve5(MGh`iNPEpY1mhpUmn`F3o;$@R#gb+f=nddZf24#N*~
z8uV1PZ6J|qsK5ud*&7Y`tMNj_h&PNFcR!ER+DH2vyIl7>8qBO3_~Y)BiVN4#278t0
z42^4HPI!246v4x$2YpgVD&p}<fa-S4wnqJRG?R9*b~-YRv{>7yWs$%9%1yu@lMx+~
z+R#(ILjCg~?;n?SB+yHB(j@F=i}ZAKo!51F1)z_=c-zE!yac*|3&XcXfSKwxdAg!}
zR=*f?K&0kL$^5v|B+HjFp|aET>#9umTB=z{-}Mu|^VRiZ2UUgNzi1L8k|V;OkO=9B
z&rh=2R}z)(44XkkYPv6WtXF)9O1wAM<Y7+bwn8xP4!9)b_fKy@rEg~u-fnR7^Bw0Y
zl-$p`%s=`h03_wsZD(veI*Sy8z)zN@!h`PJ5}5J??S($yYKQ7JF1T+4&=7z^Wad9#
zO&q=P;c(-3&w0oZ+YHSyIVN{vsC=dk=Gd$(LPX5$6Ubi2JbwANIRlmzf#i;zlsQfw
zFKk$`6GXX_On)AqO3Cljnp>12dlj;xAK9t_ejwCsTyBzZ(&qY&L4z#kiD|Q=eX3Je
zdU!R=kYq36oU>@4pT0iG1=IeZM0?2_dmmwXf~cMXL~=0X5B(}RmGl;uY(sudkp4l(
zWxo$R18YK^M}%0oQ3P}W<A!hiYy+yt4Ywp{mPI)Ol%yVhZtq4#`pE=d4HQ~ezgxV8
zyy%PU4VML_&2^@SH0(LI`N`+Xl{Q)bQ39yicBV(Z0$HR`L+~s#*_j9q#uh)H&H@89
zEEC$2HWvR;fSY^Pc1O2KkP8XXivFgA+?pF?ZTXT;9qzM52na<La13QsC(nw_c;q9P
z>}@IWgE0h=TCvRu#-)VNIEv$7OBi0<i9(f8LEx7<vy^}1(m@I|WHdhJ=Pwg~WD8`!
zNA`)%-dyue-uB!{m%>fj)Q;gK#dsEZ1*Xyj0mu`GQ%YvuQrm^A@aMp4A>26I2;Ca+
ze%tk7UT51zrf-~PQ&wU&(x@LIy?glS#;qnA;PMno-}mbDA~RBB1865nNq(u($Nn!?
z_S_S#&IlzqDBJ;!A5V_VKZXz*b+L;#>IAuq@tO?L9VkjOX3sSc84QuNjWDG{@Z-X&
zW_q4KyJ*4t^l!EwZ5og`EbF`Q4YCn}g7;X<RlaXmxz~om1Dcl>C-&w}ylDMaX+i<f
zJ0XdHjm47-+1ds0&OEK$-Sfphv+F`jHNYu{1mrZe-vhbckLA>FK+B!1ZVpn{wQ>gE
zXKsRN)#-4Jfv=nm0vQWr4pyb!F^p6tsxkYV97!Jo*;>Z&%%`1TCIQREj`~O?O$2F&
zMsJXVdy~<aqYBBxCg1WaZ|B>8O2+<_mlFOn>G2)LnDfvc$+;Cu=fq;BKl6zCY20^W
z`mzA2iY@64@a%jnV_HiPNDfHuYnWnUmOzFzWH`ZK%ahf-sE&(mkdqdN%seZ3U2Mhw
z!QNYkRhhNnql$t^i&BDwq_jx4G=d07H_~0wB~sELAkq@j-Hn2jG)Qhjy1V<V?Tp_z
z<GB6Kb<XdfbH0D(n#;Y}@4KG$tY<xW-$!KJ?Y3V%?tHnpmFBIVpl`;_9NRrYi}xCj
zN!*Rdte&o1157=AR&T6U%Qq@`?${K0rJ5Qg>fa9l8gyFe15VFoIa#PnludHLzPfEv
zs6%XwNJ`j|W0jri%M2mc<uRemGsDw#WX*1B5e&W_b%Ms_WcV$+8vzSB>*c*lh4B0b
zcX=*4F6S(<siZ_Nm~sV-^w~Bz_USB<6|2o0CHM?Tyk@Bz;jrmS*DEg=?qkUx;kizh
zMeo%OD*8)7`fss(mFmpIqWvh#A^w6Sm1VXg6^-VH>?7G}06tYSURkM6BA6NnKV+jv
z%GA4KO!T6i`PR{D+wIx;exrei?#uwTN{u1ywqRzH9!%8_yJa@0iuK052cC*4T1G3!
zXa4>)0|z<6zp%pvlAwB6`jA+HcuUK4f6mUqN+H1nQ|lXx&=)s=hI#Alu$GCRHsTbS
z`dX?@f~m!=7jJ9Y`8cwVX12TSmFr1H;fT@na?q=1H?ogODL)41NVi!EgYmyvMfNX+
zW0l7ohFj9`ujO%gU9y<)`cS$xyUI{2IhAoNsi|<`tJ4k&4XXp!d<2pU_v%G@qkBbH
z=5~V0o0aP$A4&PnIt<DUwvJ4rp-GtDEGARyzu=VbLJKAnjm~HY8<k4W+H+#cZ0|#U
zuR+A6lD|~;NVuGH^yBi%PcW~4SUf_&+}Apz?)*TLq$j?Pj>k&+M3^cH8P6MC0bW2>
za5)YKiPS~XbSadhHlsGcoIpVd`vq<y3pf1*`8G?I+iNT)@iGiwb^ns+`hz0TW<pAB
zVJU;bhv4eEh3E^2j+!f1d*a;*;QX?X<)36g+YLs;71&VO^#ZB$9x+4sD7Z~+F5ZeC
z2vaNPyfBsWL?B7cR-4uIm@Q*vV58A|U0>`UygFGEGqEygv9?W{LxWpntpu)Bu^L|4
zsc<-YF6DeGS{5f|)3N~>k0thqe^+b7TcAhu-lw^*Ewnw<N5Px3S1JX9WpJkkMsxM1
zvAL2SjOc3%UyI*y(f00Ysc8$9s`wn4^-9E{?wM+|0M)>qv05?bk_{+CxqDYaRtRTj
zEn#g>zyapw!*?$}WL=x=e<T23{*JTyj+gI>_*`f&iwkDC4Dl>8pLfXAGucS0EdNbQ
z_e!h1U^r%(kD=n^0e21b2vmhJ3~pa~HEL1M^I}Z^`=y_Zca)xT!g<tPw!BYv!pL7D
za~0d>2op54YFS<5h2y;ftdu@uGs)A&u>KgI{dseNRKdGPAT37CQff;EcP2fs({fL2
zcl}sVdCKoFX_@Q=<LM3wS>mKr*M@p+03pZR(W{B~r;OKGbjw+c$y=;|wYeLsQj$lc
zukCM0Z-btkF1X<}<`~Z1|Cr#Wq6n@x$9h8vf5Yy|nq}1U1nwI_gL9n%Zz&R5#;)`i
zL%yhicHp^kWwn_*JVFeu3!9`kxV6048u;Na#Cm0UW#H&U5zGRTbN5u^W>;$+;QhDC
zp7vvk_txs+49Hq{QS#Dq4Krr@Go#cEn0C;lM-AttU1~i1pfx{#>C(lnxX?qn9`#(s
zv2J!<L*(e`_Ss+1whTjupa%VH`H8)t>`r@xs~z^EY>jiS3hziY-zB@+Cps)ReHlDi
zp@MsT-fFA1A+f$GNRU=hZ`x(cT<_hqDxp_qo^h-aV@AhlRC#BDzJv7qk@bq-R2X#Z
zGT}=HTJ}9Tvy|H7>$E=kY4T>xN$E{PT22TCQ>?uE+EaBH7Rm$csFg@Jn}S3JDAK&2
zPg{!jYKa?-Y8<{^*o#U@l#hHj2v6I<xNECw9Z*Q%nX?>fCAJpIMADdfQ18QC`YcN&
z|FMQavA>p#wAf*O7LCF$h>4|>K&bBhHii@1L*HSWmM3a@gEp}=Og;uoAC2rI%e<Qb
zlu=E`x$2`+O(P8z4<?P`4=QR_Mxd?Nz5)~m3AJL~DS<i@H|78qAd@6zoPk;Y{am!r
z{JA!n_Mr+Tu3%nk(Dr9!nX~#vzA`l?YKj*NW63)^{B$a`7$Wq74(-h<7#}l98@Wba
z!)B}}3vXz2NlWehv$i*UL9&p;93m^~VMg&S6q-+RwegC4v=B!MtPEAY-BMB0-D9O{
z4U=khSN@X6ooy9&l}^@Qyc8f$Uwi)V7MYzE=yjtCL&|tM|HoW;eZfv7V!3jx23~Oy
zS3cw?MK&ZdnL+8%SQ7hu^Xh?L-wrz9XoQr9xINp*GLX=eRNch8CX_b7m+bHv3@ye*
zzMNhb@yj(zwrn+8e@z<ONsh-%_0*9n|Df;l4PS*DcSq4o7}aN~PRl4h^}BFpKG@@M
zp_7i*lQ&H1aPk%kH5gdYVOYU36Sd<+LrW_ofvhsw|7t3J*dOSlf)b0<BAjw0y}+*d
ziv74?V)Rz`)i?G1@t7X!NFCHjdU87>ANjk?ui2<J&enG~srGj?kZdUss?rfy@86X)
z#@OR^`HZI}e#Lx}3$0T~bsvB<ww>AxO}(Zf*tX<Ba}gp*kYAC@=xfO`(*XKoWSM2I
zU7f+ykqsQw#MNBW+r6xhdlyQU<<z1LPAwu8Ek-_e3gG<cmHbuzv@8HAFenvxoxI1V
zE4jLS@jH({ZyK0A?nl;CsJY2?6ud8ffgjm3N!@qce3Hm3NfeXI=QMBwf@sCuxEr+9
zp9h&TA7~s~8UidxMb!7^D3(`SC@|y+9QyH|RGr<WT}LRT3D(8UQ?m8__WHRfUpTt!
z?>yeBjQ3tzmxG=&4`b}&I)ML&S`*M+dy3cDUf!?O`FTUH|Iw4|`X{KO%(?SnrSFwk
zR`$$m9!mhoI|(~FnvfLuf7c#j%UQ4_(Yg<5<(d4`9)oH(W$@1XYgFkvq~apy6VFr^
zW{S2+&o-9?8CW*s&F{;+%Dq{X{+cIbKj2f!Moz9iCz0SI{ekK}<RBJDO9id;n-ivv
zT!BHpE1yzsE!M@#5g2-}44wFUN2CUor$(F0V=4*_Yq0BLYxy0wX^!f0egu_O#&&Ol
zjDzNOEN=%))z7rGLoA6x_+CN0Z`>1aySidO>zI(u>DzO1##@eTX_vv%$E1j>63yT7
z6=#Wt)WUyct@DcespsL3O}hqYf~^ZA48B6JL6@aj7~_y)$@>m*x!dQ@jb0E_Gq~T5
z^ndbY*@D-d!&UUGBsU|@ofM17ubbz3IGb4a@pw1(O~)Xvg&^<T>z_MFktRFVY<f^}
zD2uJn99x*()$G2KnzX;0vb)s2ue_+Cn=_(MYK;xRGK}7?GJ^i6`XOrOHfmvf@1EDH
zkwUgF^Q2fa^CD(qUL8m4;dd#H`92u+*Qloqk2L`d4ZLM)Vv^RNPsJ``Nxc?nWU?9a
zV{6X4iHI_MiUDqbds!@qrZ-5Fm9}H7LO07vU~Ep^BEN?5i)}5i1y&*V<_Z9%d%ck-
z)%^^Y_!ZpUrS3p2(cR$V@--Act5)4X5kRQ!^&WlP*bCoRaIlk<);tmn{%VvlQQYv=
zPb*vKw?ABnH6O&jPtuV)M0QxH+y0Jm$o-i{c>3WH0ziM2xGFMLs4F(*hVOh+7=4hz
zTK+>c&sX$bebTmMUg0+d05<^HOelZ!aTd+o5(D07faXxUpp)O=wDi#K9=;jg9@SHl
zLQ%Q7XUCm}jsuaPpKr|r+tcYmzw%yWj+w50i&=?AZ>cjU>QxbW)`_896|n@Gf&2e{
zHlYAVfVx;2nKUy6)FKx??yfD(AvoBbFuJDOCA~?uFSD3SvPya=XK4u{>r}#K*2bL<
z-BtnjwG}u!4hVtW4R3cs3Uq#&w<#2$!vR<ErZE|uR_}^)K~reMg7^!w5p1QcD~HXr
zE(3Km<+V*?uJmYiW(9kL#{pDM<7oO=@ghn2<d7kh1sw0{*GZudD>?FrG&@6-GN!|n
ziSHpjs7s8%_VctxzScBgPVq5qZ@?TWN3kSqShz-`O}e%5Oe1^giwg^C$S<6<@4T&|
zbQl1X4c~`z{%f+m@gzFtMuukoXqDUWvf#`fX{(LU?)pjTl>g$}lT~{cHipT3G*^@>
z<lQ?cx=tOVtl_!B==>W)!S&JyXl}D`M_Jc}<uM2myfr4<A&=!smCI0Nvp9PX<36!I
z251!UknB$fm7iGEtm@mF<(4`98WGw~jA~pTi@>MPvdUQ@E?g2IaUA4OjEumlEA}TQ
zp$?6xUF%kZf9p;Cs93sHu<PryuDwTI5k8F;wJ6=O@985NC>ORgtHzb4CgT3`&Hf(B
z+5ya#B7B2df|?IhU+%vm6ylYf5UzbLC4+dE(_9(rMKMH%D;p{76T0Dy4qBS57(t#A
zW&&QP-T>EbOBo(<qgKaj{<dWa<1h2arMJtO2;7;wA}@z+Rhcs<c)DMH%P$YtXen?S
zGyD+C3oE~U<azVuNJGg1EPCaPPd9y$%49jnvW~!R<vHb|Z;;Y}vNPS<!_x2^L`;j5
zVzQbCyPY)*!Rx-l^`dhs`3le63$@?f<EpTho<R6Tg5l~uZO`FOH{Z2-Fmr8*TMt0m
zHoFtuj*Zqgpp^8P+UMZIDFDHyIob^7pjETZ9zQu>uijwg8F0Kxn8{y*CGreEFiGI_
z#b%gA=cZUbLO-BS_@Hogn(oEx0gdSm=194ck<W%KKXb@@6Y>9vq3n0E9@?d`pWX<`
z%*5{)X1~idm5^I%g<_%oYiMr_I?!a>_3nQMjQ*g5{i=*iWh|L?;!Q>`BES@CLD5<N
z)xj<R-kdhmUkoUwngB*+<C-?(+l!idQ}cQgo*znqKWdc+DRlZRxrrI;7iRK@FZ0Vn
z+hTwChksuQNSplM#=4>+2AmZKfLoS~&!SP;1DoI%8}*;{SAzzYk$BK}`iph_AY(3o
zVK#EFyz9UC>i>TAe-ikg1pX(1|44w_++$tXkok6hcfk70JfkygBe^O7+FfuyAG0HY
z?g82_p(yN<=O?>q?zeWvK9l`{1~>G4;gp#e;$J56V+sFfo5~1`meqX>rF%Vqo;QWR
zRUnVVR$*hAj2QrNI*1_{UPvsyZ)(6%(s2KeN&MIU8P0-6kd7>F!*Ju4z3kT&mxLO%
zpO_G(@HyWY&2&?pGO{_-5{Xoye;IEusLJt+EZ=w2836ppyz6k$a8~a_cNpuBu4i?E
zmesXJTSIcdJU8y!-k~K%&>C$9DbAB^pVzUb_`wYS%j*RLT%y^-p<xuZ8;kBpMBn)5
z0ly9ca-#i`HE!&#)7S#w@OEuj+h46nH?jMdU-<rF;G+yra0lK|_=syv2}QR`wI%`6
zR*V&>%8ow85Oy#}n3p(UPL1$S=+%GTA0YrYYW4=h`9sNC(3z1A@sIO~b&D4rM~MOx
zuQv7(oam6@AD;SG<onki0t`WbqG)IIILF#!Lf&DB4r0uvCh18Z)I)W{X=yT!qU%Z7
z03uGn%&JCe$m2V=x^qF@ZvkS=OfTRxs@&4~l50Fb2tS=oCR=$Y!NQ(3ai>T8zCFl)
zuT8V+#6d}$IU?*e^oE9xej|}6Ad%X^MnmJfJua_nDJ2)Uk+^jcs0UG9FeO`&cs?ya
zG3CDOGYS<R>tI%~S3WYcd%#m@lYlj^#MVq*$BXnLE<OB?JadBKjC;dQRIXess00+9
z9fPrV;k^BT4l@sG!i;&?(kM^_VOH(-N=+G@0pNn<v}e3+zThI~N-FwF=eYpE8}{oo
z)&viHGN{|y`s_rfUa$GmvuZ}7=f8p1WVNsvi3ZVoQte^Wgzx4(Qe`lbN#Z|2#-}oM
zyr;b9*>@MVei>5$pQ;%Ceq0qIbK~5}N&ziC6M-JVG_JWtQ5C1?!QDG=3@1?=v>4B8
zR9~?Pt<`-V#(eJ__CT$OtwCdvj^SC6w@kb@&XTU!Vdx{D-Ny7Lpj1&)jyA}GePsXT
zqi<gaDty)$W7%q15pPKdFC_J#fgs8K<^-*2HfT#iEN^>;1?8?!;ubfShzPV3kzKQ7
zyZ%=4qDDfoZ<yQ!L}Fwu&)xC1bs3>7_63rIhdA>b2;9!`8i^(9PWaJ-?F*I7B@(Qz
zu(5}<@WI)INDt^+c~Bi%a^}<(ZaP{=4#TAaAUURBqd1=&Ns+CGx^Xvr1(QP?pIMS-
zuYvL~H9?<i6oI>o!Z#j!vTr>0l?CLFoM<8zH?=R#u%@yJaUhpRUugKXE{jaxpF?>m
z#}ora^e@b5SE*iQ$<XD#{d1SkkEe#e6UuQ{M(p$SiH8wO01K87z$L>ZiF7+WcC_M6
zS-zWjspCjMIjpjusZ79+wX)JJF(0#qUKnCw&y!}@o>(4m(zc5UY117p)ztMevdc_m
z_>GkYlMcG}gHD_X9#-&SANyX2$qme^mrqCUH%3i73kOII+$Y6y+^+{ZOB?!K1D95X
zjaT9T?aJ9ME7Kaz(rp?py*@nHyKe^_wh=T{&&7Cql|I=_6``%W@{))g`Hc3|N~6w(
zVDmaHWR5WSfF4T>*Y5bpWD)&>l%}U}T$`tBu)ASp#rsUR8Pb+o{?+JOWoV0I<XaXP
z&+}*jII!DFiW4<77_Eq89i^ivPjI%8Nc>-q(fMdHT_m7X>z3|txZHXFg!-JlgHdAV
zsNK*eepZyhWhuQp%t*byEJ(6RF%b4a&M1c(lcAQyeX^c<4pbZtJFlhm0|)WI3cLhv
z)i{32n#y}Ii>=1#U*E8FrXzp!GgONYAz^7cAKG+$GXK6Rh`OT2th>DD=+ImnIYGhU
z$c4yxJR&9<3Zwm(>HH};k_MxAskaitLzLgyOaMAw(m49-*3TJkPt}BD8`ioIQfzq^
z;~*P(FKz;DHKdh@2hDafyZSX)ojGecb^;6Bw<m=~DrP9+^v|4)Gr&wfTQHzgs6?t&
zp<h1cfBZS4|GG_kzZ2f9fN^C7!mk<@zL~fW*ubopy~<vi!N5h}NPf{eZ2*!(Lbe?9
zS+a4puUJFc4sm@r`^;F2@KL7#Q-qY6#LaSiZ!T;|8<IV9qHmP)LU+)N3$IvV`CR)b
zrvX7mbO#HKQt=l<=CFN8yOEZG#nb-#Fg6-|WJe1WOUH8jPC5U{I<H#Snu0a9IZ<9e
zq~ex7lvuucHB>yWEN044pGkLWc7N~nrAK*E)SOfcN>6KZIrHym#K|*rcfyo7|JN7b
zK%yBI63$5j6gxLYM9-;(XN$=icR{+Nq7#YelT8L00j9SkLaeVK0LxSK<y9G)n%Z}y
zlO77TZKH~X5(hk3!+A)biY;M+0rQIb4${bl;xRvW#u&IATI(+H3=>#Dv^-rO0SZwm
zIC`2ZcW27h70nz0(*AU4hyM#Pf=%2p{i`I?S){#{_Dh{+&|Z;(qDl39h+)pk8BU8W
zwubKNc)tR@?htYYA53EaZpOdz4(vbW9j0LA9T30ByaO)6lRN<ijxu(tr`bIcccudU
zeial0E$8R>2L3ku0bsl-<RzhYpKrAgv2hp2^w&WF=mq})K)<{QK;{S&E*jDKP%cgZ
z6x_l&@0R8&S(j%9uB`tA06zoNdw_z~g^KL98mRI1<n$8<dBb=<_=pP(CXJAk<pF<5
znm7y1y8m&>P%R>*qD`qlGDBG-M4~VhX@CXxIq(34L<GYx@#rtZJ@7zZ2<kBm<m=|T
z7c;oGVu=t4`}u#mS9O^;*^NCw7j(W#s|-V78_c__0KjkR)`pRS!~(Mi)vawycRbU(
zHipOsH87P+jt<=Zr5XE(7{fvQJ4`k8=5)IQU;xaM5d&$Y^Y$W4NqLNdLHaLlekh@r
zJoEr8{0Sqj(8JKB1%T}yxB~MpflvS<v*H!l2N`NnzW)CnZTly4|I<wXq99b*=IYyT
z{0{;iwigbS>qm?s*k|+GY5Jd1{=co1WvwO0Z0P_~{?;*f?Gnz?v=t$wmP&WjFb*Ln
zWJmVC3CtS`(NqFhKh>g9a%rV^z*ld+9N!;H?DQ13=Q>R5he2FG40t166Bi_bZYne@
zHLrD_g?#Q@Kpvk=O^>5$<g)jooHO4{$te6cTJZ*S|5dOf&SEe61blkKwGcl>Y3`!6
z;DR$1I^J!fgF*Qlz;%8S5CICPg)DyESI0#`kl@>3hz&tZX~?9vsx@KQNU?FdZN5tL
zbn33*uevJ#GywnMI2%;@y2^?+HRiqQA_iFBAdLx3Ec;B%u;qx+3g$dscelx0wIc>o
zk5S%&oJ5|6t!Qufe^JW*Zj0EN!26S`_KZJC|2BQv`}Trcz3f2z;I6Id%q|7(<h}O*
zRC$zeuhiT*GG~Wgf670{N=;Xk0qpwB{X}0Wq>7te;WMgzBImY#4J6Sgp8>A6URx-@
z0qkV<k5dRt->qR?WvllFq;{}eVg7eHzy(+SDC+L^K&|ev#f!d^&3g}4doPYT$OoN{
zxS5|`a9)qo^}avtnX)D?mHf5wv$Xi&bRdN1i6}Slgppp5H2_vgNHGoo#CAF7BuZS;
z2yA4hR19l=9WoVnJL$OwdGBf6@%WJS;xF3!z8e`|;D%baW|wyYAUgPfNPZD_O~fa<
z@OVy|OfN}5DZKHSR}z*6uV$e4rvYB6hJn5k!DrL8*_N`z1lwEB)T`q+^_5G*&78VR
zU9mM%i&>Kn^c>YAZ3S226!FoNhbCuNPL|m=4heqd|NFivP(gX<;DFl2KGsCrY0*m*
zJk`WqK5set)H7B!`dNV=;o<{SbD?nYl??>(J#AFCip0KDJF!8m^(o!-xQu+O{W@p6
zeOG!^49j-(2j1|+25M`bnKLOYz}}6oR^VK4ciHB<3>x5(({mD4@0{({r<QRW)w8Rz
z&r{SWBU*rVs0Op`f?~*~B@dCaQkm^zr{rAAGe+cST75~87I(BZbya9oFa24)8Jhul
z>Q$wOdDoar74Ax_u}R;7nUXY0k|W*(1FkT+=zLa%DQ~{@nR(u{<Zm>c3Iv3*avfVE
zaLSN2u+um~i*9PPL%nDLm7(j^+1{ICTs7*n_b`Lr9nFrMvO5tqq!V!EmTasqP)Ed#
z>wEJ!C4I`Hi&P^yV^}%p<*4pN^pbSm@UhRVb(p`x5R3L4$cIzoH(<wraR@*WneLrT
z&6nJ`9fXybE^o0X^UQj!dSs9;01|;x1a}<|($?Y40wwA4-YNm(lvS<l6wezR-;6j0
z^JvTVKe;9&!2B}s872AGEOwT560gC2ZytLeb=yYac|eyCOequ=y9~#0vRsa&Y4)4l
z+Cl`ol~6iyEZGlfBYTN>_GGG2;6~sVRwh-VsifyU=*sYd2|Us0KF=AZLuC{$=~nNI
zDb_>cBL`uhO3OHqS81utJBgNWwquG98J|)*PUKB3d!;-kLcvM>0HZLmZ8d)gIvp?d
zd0Lc)4A}?DJo-8Lo>fy+wcT9!uws4W6CqF7#@vAnJcUbjQNN;wC}%i<{CM<CuXU7G
z*FcbVT&B5<Ha?_RpHgO4C+Vul%JE(UE0fhi=VnPM`zyN&2{XO$IR_$obbJfut@FnY
zwx!Z4<mU(bkWZ&zYHs>|fa=9qLZn9L^D8II_Q+3rf0NiE^aBZHQsqVU#}8`bI~F!e
zCsBzO9%+>{v@a;%3kJPprdFv?9Q*q0sg3ePs$14h)}_+Q<b<*`YV}fAd7yyu-eLM?
z?fvnh41DFTd#Y};Dlo0yiw`Lv7w%XBhTHwp%fgqu84|HyqU1)AJix(3y?2N9dXl{@
z=53r5IwM&kK<B|;>&KcjG9-%iG19Gq!^}%WpNh=iTdiJG74`j&{=_@yUZvWB4wXEY
zovgaa(knK<x%?1sVSvuh7ke3KYjM6Jq)0S?)dbi4M))~9a(@28f#=a5OphQ5*IwQs
z4lmKnLyO;iq;~H$9fQoE0^7{j&!3ExU+6IvbvVX(<&5k2qzkEj8e>=w>vzGF^_F*1
zoFXe!Xi~E7%HDP>uThJk{L#Su971@2EB$VU+PkAuy^^E0)s&$X^7ArN{OC3kC@j3w
z`swFu6;_^|o2PRwi+VF@+i|$w0tn@Pbh>E^fH+~z7F7t+t(MPYI3_mXC_lbY#c>Fm
z&fzLz1Q7l`n#I!+{vAi9m_);R^=i6D(22enA87R7DDW_XPVKTx#*B6W*)68!_0@g)
z9Di3}OB(0GPX*h#^0Q7l`2<9N<0E{a0Qw!9!C?^eVH@ez8jdm+BU4O3BZ(&!K_L@y
zADaEv{e!6X^0Z8sTqv6t24PtknjekVryV?@q~Q4~579{ZWStG!rO+^O{iLwS$Mf-u
z17~@$=|6)@e80l}IB)!T9?gmF=NyM~QJOwxr~iO@*E>c8i0@Ah&rdd@%C<l-{>Iq7
zKfL~Az54MJTf(1r=O6#Vh<&({U+;6V2eGJMYnuIkN;U^uGcLpZ58?U$Fv2s;B*h=Q
z^9ZCyBBpKrWj6R9y21ZHNb>(FEXMy~g}qby10*>l&gS4*UVT8WU0J7}Axt7KpsU-!
zxt)!)9&3g>i|zNm^ywM#-N{LKJQ0bWTBS8xr~W7T@_=<K!G8X{7Q}BwXyXn^@eZ4C
zD|xxiOOIPCs?gjfPGb2L_;YTIt?ZZIbpq{Jzqn}$pfj2G^RhVZB=JK5$l*wkkAlCb
z0WK?&y-W2M<hy;MJ`4%lL{p`*mXE9q4b>|3$4jxm#VKT*L~OY~m4eab_%_5OD0nTd
zMH6BTpY%vS>Bg@eWDh}bp>uf2Gd0H}1riPqE+v_&$$uqNdmn!1NFB<Xw!Em|FxoNs
zsgOvy-gdI?upp+pO<u&%@Who!0zFoZt?-1|s~;eDdp^Vs<Ri*c)rpZ}S4^5yqQANG
zYd>aH9t83Er=0n|A5QJiOtL9fpZ9<o`f3(jlaCcNgWotCX5(TG&FS+lYl+1V)ebM4
zTR$f-WWN{5I+{A9!=65CdsE)fk;N)RkmMkW<cP^sW5U;noh++oJI@(KfBu*91&M$s
zAb@pU=6hW?b1gpHzOnnlF-oQ>`OZ4#M#2+9cjtYv53l=I|0uxga*e-lf7zj80&aM(
zwUk{KuPEukhy`i|TEd<>)orIcUXepM5H+~7Cq!vjDx($)f+XPx&}qDb<}T5;P_+WI
zpD_OZa?Jl^vXs{Gm=&B|V)RvgGUk&L*D+#NL*67<;ifPnjyLKC{~C*CUW5q^KUWL|
zHJ`yRS$1XUf=S$|v@zhlb~%7Q#N0kUW!aV3ThxWI%PsVvCN`XZX@^h1131l{c|w+6
z;Vkc8LZ{~X{jrLl&Pa>d4QFWWplOo!xWtV0T*vvRh5kWdJ=Q=hV>+pXu8RGtyb1J!
zL?@=RwNIMxacyuvm(^MI+R=^0!GmxJMdC<B?Lt~P>!^J}<zLak-p{;3ENJg;j#-*>
zm>o|oo+4wbq0Mn=o9@tV?0}m_HR>6g%E8#os&8z6lga&dj+Kgj#!9tn96wgsv_i8t
zCN5n$K^^UMOwQqT!-6MyRno0#`7KipH1>Jx$B@OUHYKn5aB+@ADWy6INj8_boc?0U
zB;|ox!C#DheAAK;(8o6`Lw{l=>9qZBf7ZB&MbJs3HalFVfW%^$_*&;~(wVrzoVV4L
z_#N$fz3O-#p#&nOg_=>0_vt)t@7xl??!J0?k8%YL(d16c$5%P~zIN?`G}XJBTtT1F
zaVrf91FK@LJ}PRE+!}J8S|+PvWojhbTGC|7_NJZeBfGeIu;<jl*DxCvtLYxQ7sbA^
zD*Sd8v)}Q-b>+_T(R#-RXxXI=dn@lxIwJ`E5&rJ3{mq0B`U1l-qqIO8JGYp$p2aU_
z++a1VHPX0ExBTgHuq>D}8Jcn$>AE?yDZaPk-*~<K<+YnR>@Nz|-_8{fF-SG|b3b|h
zjIu^qW{rH~b>x0GL`Jy9)uHq=vqqGy`HaV>srbN^S}r=lFkDM8(}u&t9yc_jJ6K(H
zUc?YkY<XgN$A@7h(ANJ7Yq+!O%CTz&NIfJgM(O|hjYAZH+_&=1K6cdrF80S6T5VsF
zeGBrb5%D`zEPSg!5~I9M48K<AM?#y86l!r9IJ#$tB-=$deXzKv&4jE?QNvUE*PG@&
zLI^rV0VpnI3P#&>Wo@>-Nm<p1w|gC)yp0^g?i-wXKRadde2Ei!tF!UP%hG|O;X6(i
zJakdq8Qm-QH>l-o&*s(`W-0)h+!G%`ObGX50g|oJ2?_5Aemm-4pMeiT(5XgCC2${X
zQfGgG&R%zTGZQk=n2|Lifcl74#*BGYX(Ngb$#cutoJ_`}QM0N(f!z-WXV3gXCZY_l
zgklo4`L@!;E<vZccZ{MpC1y`3Xi5sdo)nY>icdI-sOoZe2%rW;`^eBFHV#QvSf9t{
zJ5N+ba+`0d)YYSO2HF~_^LbUaZ?Ce_=1FWcrhh6OLf7PrB7jUUVbu}R5RSym`)j((
zYqE{o)08Fqi%fFlQ!JLMD%Qeq+`h<w`f_mgGf4?}5Vm{C$#@?=bUNL1S<lJnYj#y&
zPrb=&*M2#1T>q*-+GD%MYB@_i<qt_8*rzSUZn?DGY+Y23Hzh!8Tfyfe>wfS??}6#$
zc(+-Ym0c`W7l>5xK<mpPj#8Gauf9e*Nvh!0wN2KP7@?iE;-htEkadyGOdTk0bFTGT
z9H`74nxUA`%d3BU9Lr}=ve$LQ{sQZoOHnpj)5H9JX^I7Tw;Wi3GCKk=@;XXQqRhVM
zQM(%WYvln+q1VNB8IRW*_HXw_aq5MWG|pE~-7P#5)H$A1h7{;tBVbi7Ga7gqNN4hT
zZ7)y5Y?r_CmBr4snaKM{?qXwKoHjVx#;08k0lTufhNgVyj{1u8Z&yt?vin*xI6GFW
z@GlO?%tAR{=__>vee&Ha>SN;oIS3~_AHlMHrw)#<Q`+)s?!sU>WzJSi6G$d<rDUb*
z9gJ65uRq#@^1oSQ`LYsaJ%Ev42?k0xD~7#oB}uw+*^!1jo&l@K)_-026oZ%MQqf+X
z!JR;wS14}~gp#j)-td1TlIgp_*`#uqk3TD-IeAvfO)$TZkB@+kHsds6c(2S>)>`7-
zKBO{>V@Ex~8`5_Es5V>r@O@40mI;h}=T~A-_D8cGL2=TA`a(<C7|}XVw(41rb$SF2
zMRl#D#vr1@jb~qD_hh&(I@4q}bKF{~BAylm^-dWm>nUGFXDu3=O`RR&T6;bccSO;x
zAxX0>_jJxM{05ir-wfK{EXP+|P=ycH#v<w@C@O1Es(mbRv9b^$Wio?FI=;DXtW6Wk
zj>v@D!E5o<IdxUb763=C45A$?FD75Gq}rBq1XdkWE~u%$(it><!2Oucf@_RCzxw@!
zE1zcM-5ac8!BsYHH_U?Nc6Ac-Tg=#T;@!7q3{*F6<)GPkk>pQ1b^Y3v!59W~%eqfF
z7S@E{MY{<QzNwF`1JH;{h}J?WZu`28wFXQtF_brsH{4d`^lvJ*R<v$?a@+q<DLFKP
zejH^c-tTIU)mNo=tZB1Oc$!XX%!`_7Dzc!%DOnf^nwzSi!~f?9!v-YThGK~EmTpc@
z9VDVZYlb-6PP{1odhbF0fJfQOPR_VrOYX%7Fvp64)B5l_b7Fmm1HU`r?M&a%ZzO@(
z$Sz)nHa@mo?1B8-JPsQ*(e7_2Y7KKHjP<XqbvcqU-v-@vWQYYh-5{ZpWO$XrCOb@O
zwmMX5q?w!T-SvT!1=WK#7Hi&xJ}}}0x!$guD*<{kOX;6Bt_wGtJlh>8hEy+MliSSq
zzG0%I$t%Wa5;2!bF}Z(#VZ4SgrRQ^S99tzqz!(GQqk3F@cxwB&ApPWi6><<St0SES
zFOC6>ED1p@xa|sa7Yn=7K}NXj0R@L!#+_?aB8kdLp^KMS_EthCR>@7WgE4&2Cn(pN
z(9>d{G^`e`JD?z+B`7M=lCiW^Zb>dw(!PSS=imf+3#rqO7?XXP3N3XtKbp=S<6Ed|
z={M#@XDGH?iMHWL<ZaDYySq>&Ib=BJ?SO5*QKTW1BEwMK#iaREzMk-4EzV>LNsTRF
zjeM}sevg`#;TY39FwLZ5%7kM`jQ~cI<t9|G2^*=2MhLpii5hGN1&?ia0Q}WSdrpDS
z1MY5@<wU2fYF+%`S*u)2*V@yhlPVI0y}kW$*Vee@Q8Wc#gn228@?x4NIcqxoSKgR;
z7G=6m*oHv59ZgT1icM_j#7pSWhn9>vOuALAKa7~+<{<jsGAbJ#nyHK5>EK?#eGvPo
zt`5+2q=rpUXMz3={Nhj<Fw^goKgVrj1%oU3gANEB98t1ep4*s$PMe2R+iKMSff1p6
zNrmKQ44}$YL*I=uZ@h1Ah}-H=q`A32PMq_0`S_!7l83KtTP)~xsBkT;%k>Y*80Fgl
zvQ~0l?U{9KdLYG&Bfn6Q&q=^E%&5!4)@}@R-M*{vrAbRgRuFqcxKc}-f=s_LgWuY#
z=@SLJw{$JUcLaX$P5*giYk}I#v@E-lM==C&<tkhgnhq6m={WYyPVt49T)ELJ!dxEh
zTGpt(yYU_l509o70O<w0pH+yQwX`VQ_mQa|N%BZqI@2@UulE6P_)b~--PP+`LZU7D
z@}sy2A<x3ioPp9f#492QH4h2oZ3QmK&E8hE_K-ht%JJA4wWYNl*R3lMU8$fQ$ChXN
zY(J^OC4KF$5a4IKf*1rH@!4!=s7JZ?6S|!ojQpF2C<C+;jZ(4J(f8294y!FfG#?p;
zU|xLCzJ9tlq}h1+Vjp7RjCUBqcU}?YMj7w6)5(^3esMSxvbk11iFR=YMvQ1!>cD@U
z9nR7DPQm2+!K8cQ$;l`8!f<x<<Y!{{oG5QPq(WUG<NLQTWkBg-GH)U5Q8ep6H{<WG
zvk&SrMT&0mH#49$S?1g6Q)!7jW$VJE%u;y`0=c0WppmLnO$-(1OX%P3g1`R?B8Ec;
z$d-mU?sdk0kcDEu`N0tf?JhV{o}_|4vL3SE&CZm9k)O-~Yg`nM##_+-*IZ)~-%1A&
zm^f-5WIzN&u(usU;9-UgxVk*0TgxI#pZxR9{<ggykHO8!8fio5p@YR<jp|vwzdTZ!
z*VqU;ygg4WjV|8m)M9o7z%b;OJV>Fz`b%MEc(_Pppmy4uI&BMQdZE`c)zp7eG06Z(
zB&pW2s4z_Gcdc9o2(7Xqwv4d(*}v@w{~VBfWVmrCthfF{38c}1L*|s@Df9g?Ft(H$
z6f!g8<bJaxsBk@;KppFg&Yi&Dbm~LX+tQVwUObn2`(JPb|CufLA_$~KxT19nb{Xp1
z8+-=4N=-RH3|rTst9?fZq_wAXE#+@&@$Y{p2Lg6kj!Xm?-r#ou?g6F9Y~jR(|My?|
zQQq&Y!6tkbXZgkO^N*{|0O6z<&)`R@?~nQM!+$Iw5*!9OsjQE=->@Bf-@0i$FP}(3
z``urDcnGp;1hYkVTHaOT6kCciE#5!c=#O=CN(M~FP7~252VF--t(?2;5gji-=-gTa
zNrBz7hls29HIV0j#FYHUx}_Ds=H<NGK}PBzJfxrHl3m-)lLB3^6dg^1$C?5RuDXY>
z!$|J2Gy2{nmc9ZVzLrB>1Q{>QMZmP|D@_0L?n4$OD#3rO@yF$};{q{yDrf278nUU;
zI)06HwliQ5;Ig%(;WnE$pISsGkbkzddAf*mj7y1YcGH$g+^gh|gFXW)>w^x>@s@SC
zxLhL0HZZb7#L{742ZTdolqoS3kvPzIVn5_?QLe0fBRrNQywM{1t*VrQ=JUxTcBBk{
zg}Tr*d7S_bg7YeGrmYE5hwKTUv|N+{7FHuOL0>h}Mg;1}`Rm1>=so^Y{;yO}C;J&5
zx)vs=2Mab2V#wr>j*(}<NoHLcgXX~~MgZZrpN)Apn%23G81O8C^kS_nbFlI>4eB#M
zt7|%zC#MB=S@g67EK|r2pekP>>rg_|W&+eWOk>p3thzjKywySFp$>>c-F8ge@gPs9
z=;3zAEFN4snU`_tIktwRfDRPSz&+n{kmDa){?`(KN$`Xk$ya*7)&R!@a<oQ9nC;~V
z?XMIPP8#eVI1z~Nd`&VHpw%j)iA@2cr9wIg$e$%xWkl$mJ=TP6K*BI8PLPOUhpUEH
zY3FkW>@L4i_IOj_u-^GylklzFCARFdfYOxPEEDzD(=$1O7Alg1&O4VJq!woA*k8Yi
zw@fg#>62Qw+HdSMB3#Is0T6kI9<B#>dqqAo6I%R{+DcY@HG?kw?m|yRW^p8Z;A3cy
z%WajJdv52{c-Akn&02p{!hh%|7l6APxqqm$mUl$v{N!zy<1M&W{CC5M76jbv8>!vF
zAVu~53gV2Gkitp)4%OEJ?h+={$8l=!%SWOE?S@52O(P9ShioZ>#)_3h45Z-5m6P5a
zuGCuEzD5CbYu!WW%I_}rb{r0K3(~a25IZTgt=X3D;aRt~o3FxpDR8xp+}KUom<J8u
z2{oPWH*^Tx-pX%gJfcCPq(vr_JbrZraV1!pHz5Rvaw@CbxCXSs$nvIqDw)32N#ZTY
zTce_PJHMT?{JsLgL|YECEL?vk3$_FHAQnpI)>qUZ7}pLz9k9#Bm9#DF8Tu72?mXjg
zcWrzckqEa~?{bv+v_1S%JIuWqmU6ThDz&J4>#j0)x&5Abrve*jw#M~(xV=MSHsJVR
z<d|Y|ao--~krcf2iU!}iM!mgIcXnIswcW~kY1w(sy;~y%c1y3ycxqSQp^8?wERR$Z
zR?T`75xf=QRPu(|=gxM^#2XG`A?Y`}QeLzgMKkhWP}H;`nE^{7c=yE?Gz+BhUZKM6
zt@my02dF6uP#%MveF~3Ih-KN~T<h}L^stj=GOCh35j5TOc9x!2=w7lXb^}FuCgHY}
z<<1Ot&b5Q6r07C=!1~3=R#OZqsGtV}OY`$}NAKdqVV%!Q9xdb`UtBThd{G?KNFu{X
z`h++IPzhMEr(P@xiVYCI@<g&?CrQHarP&VD!&8Ii=_zh=S9c;A?KVUOYPF7-i4g0K
z%COZ)tjQG9Y874RJq{vn<m62|0iim;&@scb9FvBoeJG%5pAO5%s0-#|F!Ts~lmWGd
zLD)0*QT0^To;`*Sn;6J05T6Ro$-Vb2?S6A(ehw1okMF3Eaz`T-$qLl>m$vWF++Ohs
znA+zENK}S=)x9RU9r%2xMOXEpai}|h6i?n)yz_#)g^;H@A>thLzN35FC1kc`p#FrA
z{)2t_PzP+}K6(CR*oTUjty)I>U}9*(7TH)29z$iys7OxiBX+r!186Z6(uL<Q>xIxm
zauWCG4f6A+;X2cEx5S&Wrc0Lhlj(VF4Su|t|G6FCp_f7>v~V%nMt#URPj-eZO{-u1
z(Jh0!R?S#JBj-ehv*U&?yQE!zzPH9xYTJ{Q1mYCAspw;=&Q@60@2WaTT5L#YU3%bA
zym{;-%c12<&*k1ThPsjGv~x4ili2g)>JDqEXeZjk>AbQV(}q4q+OL*O0oOdo21uI_
z(VHl2>9rtRkBze=`t;K9wb+TDG4#r8iPF@#tS7UtBR8(XczhPrV-b+SH-Vo<!uvKl
z<F1S-nPbMW@&ej1vo#rI0nLlBxb@V?7&JZkjF?=and(VA9uhxomd~Yge2LdeYe7eh
zu2Z3bNqMF3x`lagE@4NN@aA3w|Bm?E8eJ|T#Yw7TP0Bri1aC@f5_*bXmqsqbnSdiX
zh{^Ge+T*X3M^CMxu6ceRXd}GkdhWb`R|o%1m!lzV>eDxS$^&sbW&Mse56ac0j;ye*
zt37Wxij!bdi!-I94KJk!g@Z3ulH*l4NmiT|;X_}ne90`a(-=l_-u11%e5(Kf^F?SU
zdD%8%4b3nDlT8Pxo!A)NFq>~A=D&rZe9GNT8(KJJcLO*YBFto7>;$hDxvIPA`pL3L
zC7qYmy~BfAB1?rOO74mFIbxm~{wH&Ru9_jw6l2_F8=cpyfo<5nl7A!#@cV~m)^xEw
z9~C#Auvs(@&HEg{@54HOga99_l~iq4Fvc2s*s<wwnBu-FSJbu#`lO~$nj83vl_5lC
z1Q(QqC{)ySahzu)eBS9O5mlJs2r<+2UCFs5ZWL~)PDpY2MPHE7*SA*z0M^-Ta(l-5
zO$$+5YnD;tEZZ};#*>Eo9?{6K?)E>);YzQ0fPBK(n-QAnRaWjC2{x#EwH6TH4f<`&
z^>FoYUpc;ZSL$p(sPrT-3Aq!)-972pOPX@&L#?HlOsS}q%g#2h<c=EhfUAB|sIO(c
zvdXFqZVaqeFArg8!}uqutJBx&JU?o=N|X9aj0v|iwY&iw0R}9~2P6-eZ(MtV04(mv
z#ckdVA(9bsIS$eoovMsB!}F$v34rI|=rVIZF!+wHoE*s92TGQ$f#JewTMdBkuZdiZ
z+g-MheKrPXP~M&w(7Q)`>ve43Pke?yipB@-uS~(kHt4KDyEt7+Pn<u84(UWqAO9K$
zKUj>oQn=~43a}wm30>@Wv7Y{BB+>2LoQ}gLnA3T4k%|;@3g&cZOmiKcPP*(oUQXpZ
zKO}VlSon?Z7oaJ~pDl)c20E#8zUE8hhI<Z(jOx43T&L@Y#pABY+)uq#8;-64CWSQA
z_hkDG>#2%;J3nT>g>jRA`-lMAXBS4BYNU(!9Y21A6N*F}r{*n3n`(PUquskA6^6}$
ze)JU)>fdVJc&r`C54e?uE{BR7@6?35YMcNldx0My^#5s%|M0a$K?k|@)c`}Jf$IRh
za7v*xbeX>tMsDxht>FwB#ztuByH-ehz_5(~z#Bp*g)Qz&9@OA9v!uU>@W6MOH-62l
zbuxv{ZsU4={K~5~%9oa~Vkigeu!5x)0O<MF=I2t}h#u?&Oek)&M>X{*+r-xjUn9W2
z`7guagNWMn#r!Q;Ci9P{e;@&0C1{|=BmGe?|9ua%u7HpUwI>c%s_svzvtI>Y6;vYE
z`7Z)>Q?MmPmt&s(`$PY>jlR&`L(J9<{Eg_qu6dw>4PfQBLHhl=zG8r{qG?A4hW$>1
z!KQeCP5BqDv444af|uZ{Bss6|{}=fhR&bk+T<W~{U#v?I8XAFS50U?3a}hwY0{<Py
zZ-%?BBA&YMuWOc@nS@+9>~)B;TN+*y5D6s@2s}Y!D$<ouIJ!Pdq7$0gs>SC~+N>%~
zTriPT@P_uGR+4H98l8Xg(<F&y269=<d$QPi?kKosI@_CZ-5jYl4E4u%;I0Ng1O+c#
zeQ~1yA`QX?lyMcRx5yrD>=w)dI!h<qyEkCeI={JJ9=D+hBrVM6Bwpu7#ud-z>YwB{
zV94F`Fl$a%^pd#D<!AxdnB7n1Vtc!cuD8ufHGy22@4#gQGG+wBW_{fR!t+h^Oow<*
z$+O4TrShzpY2&JSh1=M&`!l@JuHcNXp_<g^u3*28%Fr5clS?NAF5I7+633HAgVgxA
zskmos1FJ;pZ~FW9?ft3+o^UP2eH4e#z35{0?&^{4M!!ffYYB%%oLAOl<`e1=?o&Gs
z->UVSnnKrZpPL4x6&KJwc(bZi?2IFlB9jMjwg-2=C{(yWczf8@-@wq`59h!a*|%6l
zqJi5&KCe~0<gmRAnsuHr3=D;LYV<8+bIaa2OUhFnM=X(()GEa4c(zuiQhZ6Yu#A;x
z9GyttFSF~UN1i_Qk(wEd-S`4vf>ZTxZVy-AtUpw*elNaYw?=tp!4;yOHob+)=NsE$
zO&f0+D<k7!(R3b@&97CYurX1e@h*3c!bfo<EmBMlIg>yUR?4sxU?gRZM{rN0q2@Ql
zcDO!H)AnB3gK(7Or>v2%o}S*w22|@)3$eSbJh|<bd{t=5pLHgCT`O|V@0?1V+4nug
ze(N1oG-T|EHz4pC|7V)izk&qd;DCF^s4Tc9{|p^xsX*YBCfvpf{AQRZkHbN1lJhvK
z-GGCo15O+gbG5w;zfpbnl>q@-wqGAgk8}Xtu>D2<RC*>T%e!XfJ;Ow0?pJclFZ)I*
zH*PCWE}S)x2A5a2nbH{78`>zF#cQA<?`9HpJ!rAJjl^<O)5`J&@2#&&yJx0VYa&IE
zTFW=9ir5{&JF>@BGv*453R-0ZD)yHL1eSRPk6~p*YC#OPm!{HziR;#xgS~Bhwtipr
z&dEYQW2?9V`Rk>n+G49#(kJh91}DVl?byQioeUOaW{JCp7}erg1r$_01HwT=I#TQm
zN%#(aP>!^S%h|&Uc0aeewD|erRUU08gI*3t#%&a<&inG+5`}pYHZ*p0qC~MTj7eHp
zb&g@=l%&1En_>Bn4paABM99<6%2S0Qk2rPCUbZ5B=1TYslY+f{@mW#;8QS@CH%!)9
ziRJ;Wi5$A48;aG#*5|7#GF+6(Q=$71%Mq3S6C)*kXLh}z-UU93otjw-18ZG)b76+1
zLsCp!pKdl!ad)l_!J!0kQD*xp7#{q0Y8r{_B?*dq`eirGMN=3bxlL;N45$fhsM|#b
zpO;~XPRZ;GFo?G5TJCTF`c5!NMV@LCi#us%P$?Qs60X1KCW%iQkL&xW8S-&9_oeKu
z<guDtwJI#;!uiXGDF7wrt#2u(-Xp9#oiA*Eh1Co-bKkmE9ywg{&_3MPBZ`WKN6+hz
z6pb0*v?|qY{%XSc>V6H<29qEGUXo9*nUbHbDXtui+5|%bLAG-6mY-+rrlT!ibl`aj
z{YIm0QOTnd&awPJx(B+Lcw>53b^GGiy^E=ct*c}|rjFFc`j{0p*G?CI`DndU)Nh;p
z9MU2?F#i#LUOqr2YHCd|lA7}{!xn~RdjWETES8_()>Z=fTV1%%Hc3jO+M_nj$Y0$*
zb-9@qD?v+^jMH+El2Znm;@s)(e-#g@exFM{I&>sJ4o(}**^<`*p0fsXVy#l0p+YMe
z?_D%sp-4FePcr3x-U@bcZ$Ud{LirAf-W7#)g_0}5`Q`j~*}piQG0DkiXH0kwa{c-k
zUWU7Q8A~w7>l%ik&j5j-OYg^_0c*VK=kJNSS|CX|Zt3MZetEcW7&uT8EfjP}WZs8_
zjK5|G<|3(mD$G^$C=y@%fKpvqPqvekrLLI3d4P<4L7u%#4g*iE<~j{{ujq)yIHn!h
z-Pg)kMp;%gqc>ZIo@(8=Wa2%<&?K<TA>jmL5WRo_culTt#`e`8qAZqj)yooD_>$cT
zuTd1i5j*1J`Q&F>lQ1+Cx13Hms65myVI^il#34F%y!;@9hL7Pr{e~_a4V>R4r4`#y
z<U;;`@kqWWD-vRWXYw?5>q=00Jbly+tj!9<YJChJ#dK|*-oP$1-0`$Wpigtxks%gK
zuFcu}<4p7AFct_T0&$f<UxTnGm$<mmgqZP^K;PTLl=P|RQO~b%W}$xAHBbn0wA`k2
z`naDRiq*duA1@jkeCur47wq$U-f7}i!;-@~^992ayo7QE^b^cF`NGD>!P)8PZOcz6
z$0%A#_a`?5$}QiA+c`K#!wqLHgokIvL?x>`7?vlW*_@KVo08gyxeooh8~0BbCH*P!
z-K0B3{yttk$Oh?(O=S^yZUDfygEPPHVd#1K1onu&!~V0q&~4SsRo-~zvn6kP#inp-
ztGVDE0>4;oCx-a(YR!?FTWbQg;OMR%Rv{0Iq^&<lg@smi0@glKUq~YfKRRSmM(<Y^
z!C}PQurzw<(>H6XBiNU8V9ue|$7f**`ZWgAb4ng<&@$h~i<I<HoMK+-riq)%p|eN8
zp<HR1;6o2$`4}^ytXuZcHeRM~jddGd!7e^(FLh)nw=cJ0>C2ZSs3;ckEM0%C{oh@s
z1Sy=+sbf|X!Dzn^?3Zr9<MmBaY8x%Qoi7fh-@Si5s-uesqCl(bGvS6`WdGEUIyz^6
zZuV}Dsn*l8FS#Sul!1-Zc&r=<Rb4D6Ulbh9tZkpf<m9R-%+sK)$#F2~jKmEEp^tm2
z?uBPJUBkh3i=QlJNWhvfS^8ML^78La(BG}dAIy^SW_dV<n!de0mSVhBwvaxuZgcPU
z_C1n_rm)VQTGgj*WSR!lywphDW12n+O}X=Cc{a{CRhb81Ky2GKfl!`<!75}&gN=8;
zz}(UG&OrfOz*?%xRHa&L<8<}yU&jOdX5h*<et`8PgVc&$_j!GqtSGN<DWp&G3DGrz
zggFxv0&3g=DuTXMpXw`Kf}G_kmg8NlCU$)DG5N*|<o-UhHR}~a*R0#CKNB4Ez%_2J
zweQB{4w1+sE+kdYIKf&r8X1Udh#jJWXlw%k3JcYk!N%Nc;$<($Vnwg4F$tPYpg`4O
z>+G=YW#7H^@O_b3xVzuno8V_;=$lx+1k>lHD6b^d*Q;dAg68t|5AxowDHON4m?dUs
zEs$^6rq3`e?O%GZf{9MSh@yE=chK*N+UyO(Kp?IH@Y0zOJ`vEzuv6io>2{=d+I?}h
z;VyA;*8hZW&Bf#J6X+%2I^AqUH-SLu`W}_mue43NU!3KobN&j<_PhB(#CVHzdbE%@
z<9-5q7to(=PhOlK5D&$x@A6$7Jy|}6b}1YJDAZ>6bLfE5@}#Ew84K?P7&aof*eRcM
zQ$5~@zE~EX=6>Z*@_sQMMj7$DJNL&>!h%RQtTq4ndhdY}Jlf)jhT%>B`H{3HFxSUj
zK?yKi;_qwzzdJ<}kI(ZH-}(37`fCvppf+=_X#qyp_;+pRcLf2!G8dcEufSUW`cVuj
zP&knF?*?EjKR@yB|Kf2Bs=r_C&3AtTkplgt@32SzMHu+U*w@(NZy>3lulFtjIF0vs
zDgTAK?;pjrtIGfuTz0au_rb5t<A0=e5A3Y0ixiAY<@>LH0Ugk(bv7vm|An+<LA>|=
zFz)}W3d=?PL)0FkjdHg0-Yt<xI6dUD!f%3qO9vqD#_o^(OCKLy(k4i5jTFH3$?hNM
z5hk7G+*?}oId>eT!jt2uy`9DaZpPi5^4*2n;{H(E#hb~@Up$d?y>q5ZYbAO<7tg$V
zx-<=AD@vhdizep9s~+m`*bH@w+jlY%uHjH7Svg_7nI>t>*AC@na_MXhT^$u%xY0_(
zc%3cYdoH7Ibyb5spg}kKa(W;#O1@M|nN)+YlZWrbNZ!Nn8d58Q?~3y;M#JM6nw>D9
z-}T~u=uuH5uph87hFYrWEw%hr!C|6f{N<JFa(6MVam-Jp0oN-?#BT#~#2Iu&N);6C
zY?H&4@21+~t=}{o*DOmr3wlYB{V?;9NHUCRATTuvZH5|hSw!`SgQ8m6Mq*jB-sjD^
zlefXpxGL{>N(sE}9xRl5FBgYDU*())1xOm@iYkGFOH_DhM;ON@`FQYY`q#tRwXBCw
z+vdhrC%hfmbwTu*W06rLWAy4@*7$w-A4q_eLCf42y=sSr>xRaLr>ZMd7~B@H7r6m>
zt{mDF89Qzn#m>7Y<u=628NyHEG1NO+8=U-Tr4G~+lSf<9Sv-QL2CA17m~$<USgT9*
z56)`f#5cx2??3WBUe$tiaQC47Mi&H2BpwkTHg_J2%?UKC>g(1kS!lLshXDd)I0_FZ
z5UP)(CWVS8#xiJjXG2_$SUYfA8C?>{(>OQS<m!xk6^jeLe5G*dGR{hngypF7zx$3(
z&92~~zo@}rk!_Vj+G_z|MExFd<}Sn@2pThh28C>`SMV_W{moa<3enaq??@6zXZ)E4
zFxgLRZCFk;D8Fxhz<tZ`9#FTZAQ>Qk%IXBo04#lR=s2@XuvWPP0X}5jmf8Zr*^&No
z&PwwTJF0v!_sGfDduT3)wi@CKO~swi?t{Ab$E{DVGVA|ZdLAtR+;1D#V9zf&)14QU
zAx<r|Tsb;=x2ySbP*9S$GVyFq`NJX{-Z>;~NdYWMoXjB2hOg5AxHZ3lek=6Pus`f!
z*k-$Dex!2iEUoSeT0@gKv(FuMLKk-W!*_52bP+03d+pCRbq?3sOZajN-fM}KFmx6(
zRtF$F^5I_OuEPDULqDt6hejwYMNWBkE|R3@?dSoX`2i{^0g=4q2t9&#tsPH3C4~lg
zgg%QpdtUc`LnbnWtvaIBupTukm&G+YdXQf2hT`=$j;OG9@wH=3)Ac**r5_kw>Z0Lu
zG`u?DAC{ffEY}&qa#{X!b(R(LQ;r3TXh)pZ)yG-j-!~~cFfUaRmFt{VuL>4k*><bU
z?L9k|ZkA1SPAbn_Y~3CH*tu{g%ZFL;K*vc^A}XX2i_6rx_<{5Gr$Idjh=zHldqN&&
zU*+SDelvq3FLl8OktqD6wl{G#YNM}xQi-x?{JeeJ-u{q9J=)-mJ!a~t%2IwDA)gP1
zdAs@u7@LR>Hpb&u^*usYb|q%?*<94<3hy6QVYcG>>^jd$IZUdL7u`kD8w&!R%CSrT
z7kh6R7WLM)4{vLWpkN`=p$Gy3qI61#g3{d}-Q6Kl(jd|dLpO{tbgD?lNDMFxA>9lx
zbiRun_q`wQd$XV8c#r?L=Nrc`18dfA#dV$6b)M(#m%pI|1o^0d^@&rIAp1zadV=}h
z+6SPZz!iL+Cc8%A0Wl{BF-GpY;hpNXTF<8hPNVY$-v-wh3JfhLKX-l5J;f3_dn{Aq
zs|zKM9x}4l@@Sg3-1Z9-$XabHQMMNN`$r496u_;#;XJq97Fyr|xq%bUxY-!c@A*{w
zYek`V2)#mN)!ZwAvF;Vk7xj&n+T;Gw)pz$u)SMJ<J68n@ljM5`6*Pk5oAxWU>Z9lC
zjY%55GbGn+u0P->I3mbzF}P%zhSLrw>L40se=0A9M6utThjPXUQ}5)brju+bDxVeL
z{7$2RZ+zVEuL4}V;!?s_V}<H^mGlLyV*&<Symg^374q)6YvTHsHs%-fKgXC4kD1Ub
z*{9#q%FGMW*L+h(*+e7+cjL4fk$a|Zy`J^s?!Xr9u;biQGqboEs?O=<Qy`}d@{%yB
zpARxK<d)49{v=FJ$Cd>VE2{7?V_4>el3z-?Z?DPUZ(LC60VfDkg!sMd%6E*P0+?Vg
zV93*rSj~)p(l<EjWn8N0jmSd?YNplXQsmaTNaL%N`!%Jt_EIN@_Y3amytKF`zt2G8
zTynl=KqNcRjay4Soh({70b%51m24`6H#&etuB0Uw)Ow#0UhxToyIY(qSK8(U0NKS1
zyqVrsvb9-+z1C>{60|}n;c65bRAG?oJkUI)0=MXjwUWISKH9)mm~M(s8Ra(1#13O?
zTpgBP>pXTb?yR5>s(3)+S5szYhN3GY?0HZ>Q4ztQkG)uR?Tmo@$2w?U<U8i}Jb!OF
zfFOT{QK=%QN@``H<Vz-TwNp<yQ_lcXV#$4<V1k}zc86orfQs0qCFpWLc0Ti{Eze=z
z7afWuOVHJ7)%EO|Ps&_*_h4)R*xZ;nE>=Z_2~pvbvm3g#d{b`;!R_|K?v+kThpoi>
zYo~W*Ou|6&E7ufpPlclTjDE~dr+nZrYpMK5p=P=h-roTStqG|Ln31ku!6Io>c|N`S
z`Zc<5EZ?!_Mo$iTT(&gZlxyo+mNSoPzf`6*It-E3nD`s9D7k&d!xXjmKg!h?CCQBv
zDy<*u6c)Fkzuz+OICqs3>W7kB@)#yVlXxZ~@my{sxB2y((9WMxjTdSHAt|AcX%WTw
zIwxgGbmk_4G_fK9HN3*FFh1nk)phwB8ugT9siIVsb9P`UHg(r+O}En3?s4I#PxH!i
z9NJ<5+xeRu0;j03N~~pI#Vu~l<i-ygQm`talSXq7i+mxt3DpX#wrQO-DZ@Tf-qkYZ
zamy<lNHVFNvo@bOFdZ!x4b!HQrPUFL`y$2_D16Jtn&w!Fu)3AZK`;q+O-<ii`4;j)
zj!34r&1ag&16^;%EYKmxdoN$CP~9T#{`ydLQ1G?VMU#dgj-<BTMTo(+M?Iu<9VT_J
z_1<+wJQvPK^YR=yJ)Umdqf%K!-2)fHK?&mPv~A5Ofs6n2-Lv+b0~lOx$E$hqE8e2f
zZ_5fr)sr<0pWl)*(!czuJB#H5Q9!JRx2E1_UT8waSMiPW>*efw@7NQok@$l<aH4Hq
zr}4mWMICTOht7(jN)_Rx0$Sw{<ZRZAX~}NF=Aum6a~<{`+Xu%YTngYi8fTpL;efU@
z9VxXePpWjV&rw6ubX$+?y|WTTVrfHQgd9aW)4f8kQ4vgfwE;f}`qAO}=GS8>t_+e6
z@sai{hNt<_CIc&?{UE$UtKyqyGIY`0wsqfGyO-=Jaz^U;yPLTU`%%PsS+SrV<8?M?
z&jqQ<&|^MrDjL%_#~j=>7#k}6+htDkGA|A%c~@JG3fR7?Ew=4Wy}=SMyL1DZ;RrPJ
zT%-vUQ~m6506(JTo@Kp9oh9V;z+ft7Lj0AL@fly4{g&}*=R!JAIB^*%{27>tUfc#4
z1i9z#L_nFvA?TsV93J1A1|WjxpgiP^qR1aO!K+Kh;6v*TM?f^?GU#LWI&q6w>So@D
zo*dFS9D%>g@4hqYG$nWfxD%3F7+AwG3G@WOBw;6eKo8~7(N3q=7L5&sXj6pT=Ktl6
z|9i=h{{uTP{|9#bKSSrpqlE;MI7w2AH$5o!#o2#_{6mwFcgty^cF3@_dujm+yGWNt
z)#Q>qe~Q=_`7@JH59T^-e+PBm0UQMfgwdsPTLIovu%2*RLNH*Gb!Zilme(Awqp`SC
zG*Nofl61iSgb&R^oTF~UUCZ<O<oNxZk<;OQwMnN=lS&fHyP`!7#Z{qYZ&2l9Ae+i6
zD%^Ipg*=)HlyZ$YUan@gb3qI!Hml$zX*)kOID$N|!w(({K<$jrR%tkOC%9Sm={)Hw
zho$#x%4b2&V`Gd$=?==Vb~)4T%C69v4U}$o%!9{!2f0G(yxne@0+LfXi#w`;j<#Kc
z{&Ol_Ua-}<9V|2A%N2#Pqlb?%W|-_IyQ(z|Wd7de1p=Cndu}-=)IT@-@Ueq%FPmek
z8B}t;N$_4B6C6cZKYrm<;&kT(y0E8JBBgZ<@zZKn2`-HaFzwYku79MZ@sV=Q^u!-(
z_4Qp5(U`?6?hJ9|I`kxMv+97p`Gw?q8QwOv>+4l@@M4ekSjIrS9YOt~3JXp36YObe
zc|ha~Rm;Fqo%5Xpb%G#*xHuSl2l9ECkL?bftE{rE=Is3I1rf)pa7k_ZTyIqH?(&?{
z`_<({gjm`$F*nXSWohP{hzM0uu>pI<mD?*PSyPe%0eQ<3J>|F~Mjfw-;^84ugr3Y4
z#$%kj3R?#Sd5%F+NBdKfMRR$cFeRjvBH~NXfjqL7a%$WxUp-&#XS&DYsUt%LaStU3
z8Tb^v=Wn5~v8YpYp2V+b^WeCIU2(w={)lB{>g1Lug)n_jw>gPg><-qmbN|W7oCV!u
zb=mO^-`fl%My~N!8|M;dM7w^>+O0C&QmpY?r(3?oQl&hr*S2xY)@jIPw`T-N{DgrJ
z?us5PO6EA#+*cBA)gr3Ut*7~wXyX38;@;)4LT%|lcFF^$0S`uvdJ8KTwoa`(MR<4g
zq4f>Nokhx)nzPjeEtXEHHPqblTONFe+XlmBQk9zV6*F_+9ELdTqF50$^fAc6CbglG
zt2`Cx!ND!l@W~~Xf!A}6>&u}nYz@ePf(5bgJX52d$!3?1#~4NafcEa4`c=3lR3uSZ
z_O=|urUsKBM)BbH+01hdQ!GnvIm%t!F;!eq*di-P5sdC~6Z0C+FA$X8^3uM``BQ$#
z3ZR_gyT75kzn<?2&Qwjf=UMDBsF@dbz2Rv>!`)CVDNmIOJjKnx9!~h;&Gim%O>`S$
zZ+&vDuO{w8^E@5d9xnJkC#X+WMJSn(!0(RuYKZ;H;7IBv?3mmgU(cl-ADl`3v}S_Y
z_EjA$4BwT!A)}jzvs}Bj7@x?DsL8*L=`eTK0xzAsNPI^(@{MbSi&;Ww*H&WyN^P}P
zo77e1W0!XA5EOAzzItchrT#c0feFrxw*~w5#Sb&}txOGJr(~--*ib3gYQCEG%l9Mt
z5rg|0lSVoN(Ac|MhyBNU8(Yel#%%|hjDGcotbEh#pvO%X3VUP;JGq<gR-~h0J199g
zEmY(ZG?;)F!|k58@1dl~i_YSkL*#296pyqD^C0t<h11+BFTEHNcY==Vl~uiLnV$yy
zT!;u)0|BC}H0%rb#SgBFr%g8K`T|(U_vL!1@|*d(n)U+U$dQsXtS7eyTa=3FTwk^C
z%V!n4O}1%^Vi+d3jzn;lA#08UP<O6F){du^OfH4FqooxV%lB`-`IxQul>|f2+B>RX
znR?`S<LmCmBPWNCZOA(;7CaFBnb>!BP@Y<1t@>o7Ah9oucl9{Zs4&Bg=gP!LotLcR
z^<1pel5~cKo~Dw(dy8wcwc!=)^3!vT`JC9o5T1&}{N&pvoIAxmM?5U}#nf;6mpzll
z%zEz7s!|u^4Y!T1Kf0{6N0yf-%{`3T5|HGqTe8dfVYlu*#~&`O*nr40rE4j*63l4d
z(m-O6dBcIvwcG4Ir5!7<V_XJI3s1CaJQR6;CLD5|rn2{vo@xTz|MS$%7v}866HWT>
zIrN>`-MkvIZZ@winKMR9IhS$BL>OmV$LaXEZ^})+vF%9g=b%A`J{b)LWGD2EOe{lb
zB1<DvB5URDbulUqFU7e#9*a9&G%2<<xe_mEgMq(97u$6onBO~UY%GVYU&4}dw7ucj
z3%jvgO?20K?rvt55jy@O&V>20Y0q&d31bDb6Oz$kY~aATcYiYZp<P*qSt))6hFgAC
z4>gD1;NK>1hjtVTOnHWp-;bA5<c$vbv_B`qj;*t>t{F2zt*ma4F&t{Re|JI5$s;lF
zykQi_6531a$aT!UYt#$IT#;A-32?=qU6N+UYK@NX<Sih!6=!jNN`iiv0C0&f)P+L=
z{Gwl(stWlHJKOA8PSh6BDRH%H4lZ#mfY@@Q530L0W8ydUDzxatM9qfQx0~xm)M2SJ
zi#cP6T)es--n)SrG<`evt+rUXbDY<{E4pKCbYBphL>0HPjb`>T)|bz(-?^90rl@MW
zS^B~&CV{bv+0NdACBVEkTp6}IiCR@}>-5-$<70o^R?QDi`2spiGH*&Lu1qgr2i|P&
zkuf|OSLdn6dX#64(%7+C>IKZ{MVgtb398T8kJPP1H%&VJzN1{4%h%&PismdJj2mta
z^6H7h+~4f1MZ6f|cW_VYm0x<5cfp}QLm$%5!JcY+wRMZcc+<-q%0ZGExdqw3c=BuP
zv5O<=lq0+%P-Sq~S$i$|I7w@zvf=Zs1PKujn)6s`vVgTo)U3{n&1R!&F$o-PrSVtI
zEWWeRBpiO!Hx;ikc(ujmJin==m8`_ojg0Qm{)iW^EMZcgWI=Z;Eu?)mff`vU1~t`M
zetBcesiM<>w!`glY~dh_U44qS`+haZ8JE)&_XH+t@TtbLCmAO?kgcmn4{Mn19IRL_
zTU3U(43hePKtXL7?VtloYa7&-u_a2_In1j1{m>d2Mc()+REu3s!roYC!+}TnHYT}>
z!MLk??8L5kq;_s6cXmgW{8-?z%K%vm23epOhuOh4@?XYoWq;U`pBUd^Sdc~;HDG@#
z?s<y?SI-UOtX`r0(+0CPb5ftHQDZ2sl;X#fY<Rv&UE2n&C8Nhz4%<|FPEy^5ap;KP
zE06A2Tw^{Zd**!~xNH~?SfeWLla++!x330{_xm<=Qxi|*ZRfM1EwXl)502Xpa;G#4
zqZD6T3b5>}EO13Zg1=hB`I_aT!;B?EcJM+zJq}h1M6)uDi9AQ6mT^^n)HZ22+Fq93
zpQF<~d||2SAAaz{PqabAutC5vH=zWxrTW%sL!D_ZdsBWzshBy~vHa`Q;Ajg{6NrrD
z@TDkevc#%M)Gl}8&d$_>3r$~ZZ2~G%)lxU{8G?a3Sln^PUpcDc@{H>&f7FieXlctd
zE#HQL=Wr^P$(wrf9lDOq?3fN*$ChEO5ntSoat+5Aj}EjR4d~{IE&p7{O?eK`8TNz_
zI#jfY%sqH@OYPU@O<FBKp*lGGL<HCElE>HO3T{CSSwQieqY}qT0so=@;=DN18jU&Q
z-4c(r6>ASK?p%hOquO+g6Zw^{2&SAenCXqSya%YGLcOHmm;exx-FF?pg(<h=PkU8q
zdaLW9BL)V15!>-2?xKQ8;tls6*b!Sa+IT@&-m`hBl0dM<iSVy4j_bqnMY=o#>@6EL
zCw{b@!s)+W;l=F8b=^NPp1kLTk!D{iQL$p==aGdNzo}963U4Fa*Qi~CjI+cOBBVG2
zswMDUWmS!@e|T12U`Rx$(<=zBv=5De9iKWYki#8z#&dgPPfJEI@B$?~!2k(9B1*%t
z;C+R)1M{ouioCQ+TlIrjxk1Onx&#ufNJolEZj}r{MT8q62r9ntFcteke(vh)2a@v{
zTG&+1XdL^mE5^5<w_#AhlcEO;rsvyiyMiyM$L@4kgaU=v-9l_ROl#hPfrpLX!y2oK
zjIj9Vd7N|U4%%{>*zgJ8xZ{afG~4QjiHL6;QgE3UbB?8rk_UW8>H>yq?6QybwWRJz
z^Kv(HTRvF-%4EhH^o{Oyg@74@J-V7!hT`4c<EVDYj&on(>mB25*ga;Ww=}NYPp?@h
z+`uJK_E1C7nBPzc^t`Nzk$IANq6?;Tf3bFW;!wDV8-J`ykg%u&g=xQv$v6?HFp?Z=
ziCVoc&;)I|8_+vhR-DU+T2n7Y^-r2<Y%#$nQB;7<WWtCFDD*~07p^6+G%hVXaj;%D
z^uVE&J@>$FMgiF^F{QerI_3gf<yQFOZdE<%SdW-Ie1n>kX`7o&p7jVcBZB66LKTrx
zmk`B^1K4R|r7jHe!-~Q&850VM`pU?S3E#t%aUakA_}P&<rTKK_CX;D0GO*(L>bu+W
z?F;S-6lHP$s;zvUSoNgEYhe2#=;a~xbH^M`N|&$*GgQDW$UlgXj`)7Fyd`#d#rgb2
zwu}3e9Oe%R$;WxsUASEff&z&Q!Fl(DK?fl2C_B0qcvc8H&3?a8H%vRoa)i`;Aa>WF
z=l-jbibwjhjmh<`2t{^1l&MxE_3-Sh1-UIXG;5(b?I_n-Q(z>h-7Rze)=2)jev}uT
zS5FIdsKe5e;=<-&807;rfmrvB<jPogMRO2^8uy^<*yGNy;A1JQjhey3JpS7OGD<ak
zMM5_Mlz1RwUUIRyd62XtZ2?a~L@MsATjQr~yYV>}e8qK*k&{}?qC7Y`ZL2}J92;E+
z-Kwpk+w+1ceeb>?a5*?^DFT~Jt6p)uT#^hC`JbIoIAp*gW_ryo<uc)wQW&QN?RU_I
zP1%^Njgj0f-(@{X(AxZ}S`-_G%677h6>J-;m#Ur4H6BTz7NUB{x>q`H&Ka)I1a;X;
znIE%Ub_(_nh>L9+z+V9V+Jn-Tbav~h4O!|Aj)}hOF?m8_EQmSGcnjf84#dpbVpr)+
z@!M3j`G$D$_UySYDKSRW-)xZY&zmvHMpE-mW3MwZ*o59Z%C*#F-iLR)l`{ufq2Y9h
zZHH3)o6${aTU9Ht8+DbnDy3WB>B~5#goH~9ozNB0foN4CHR2N&N9S$k8^(bZXi24+
zIEAl)tB?vrY+h2v#VKi&a*tHn#4zFjA6qxAG${~_euyQ@Tdt}MaDkGpO#dFb<WAWY
z9Ac1dIUvNtT~^v4D@YSWBHXIRIUJUxt9rP8mI37g76YxiN17f>cp<yA&rfSO-E9KB
z`7=kPp$l|PvEMFJ7k7wkMt!4OifZZVC?RtG!YR;jtC#oOZ#A44Ajz<Fi6eFs1BJf2
z@Jo~_e{O8kI$l8!QwpI++J2YfmO3}Bz&W(**oX~Vg}ElHWf`U6C34}pqx}_yVJjlE
z_LhK{QD#G)wV8lh@sx@aZ=nbIiRX*XnYIK5)+6kvAz@?rx7HP&1<6PN#rE*M{pb~X
zO>kUvi)0eEMGZA|je|vx9>|YYcMkUPlPfL?NGZv_*K+n$BWg|9;>Xo2cqDSCY|B$?
zn{H$||JxAPj|dzMS{1qppBXo!mGV1^W$>v|flWK(-mWxk-QAJZ9h6~8AtE&o8tj&^
zqv@Wv>%nn+P2HzKns3v!`^e3q<EToV_rMMR&H|zlad6|X&aq{#xbG*h-g_UY0{2@<
zZ5oSvAG?s@wBf#;w)%ABs3gU|lw_j1O7C2<($}yDn}2csVgf>4-j`3&{f<`dcd^N+
zCQ_f9vN+4G+qv60d5yy~B)n3uOE%p$W=ssGlD6_sOiI`#4%rDl8C;q&)Qw;Frrrvx
zW~i9O()Y6N?U&S%^@UaEXVcEIk)UhxquFG7hNQA*-b}`#_sW0CPcds->98#<*4=e~
z66og(!W`Q{KG{o}(5JF#f{KM5?ad|XB1@}NBZchR{)54!G~_~(BP^*{23H1)UDJjH
zs|hw0snXe1sj&-mEHbeTbLVPYRI&)m4aUG?vuc=YA)n^Ht?7YwH^R^O<`Hw*aMaE?
z9MNPt=W+RulQP+5*uL}G05)bkzpCY9I^?nk{_MQ87*-1fVx&ds)rWReKV`dX^QTP!
zN4Et-&*8(Q=G4XY!?=oGeW16hS2ECet>fnRp|W#-VG*x2`<cbZiws2cn}I_U6=mwg
zOaiK8$fcLDORB3*lVVHT(pVzWjkTrCOD7V@l)Pr{h1UvdhogLV<Z^uKoH`Wc80^dh
z@Zbs5K8XmVvYskudl^gDy>w2ZJ_a)CtISetc`sl4JcZW<q@}Y+8BQdy6TYxDrJHjz
zlQG=oW&(}J>H8Nh9}iavA`3e%;Q2c2*c^MZH`c!I{;|}2pzCIkYN#?jSI<9ESH?CZ
zrZOw$tfUtS;FDPmvPJIOqh&60Zeth_A)U`>m2ETGAmbUaD_*O`{P=xSw+YIdh4J;f
z7BPe<r9dvb;9D+8D`K^fAQf4ZUU10yY0iXx^qi(53Ayg=7ZyMxF`TGaJ^=a16xZXG
zd$HhF7E{}gNs-x@tI{qHLLi@|K<phdJEZh*J#cG~(SYy{i*1Ehf=4b?o58)OdUK&W
zn&B71P`i<xZ+LJSd&#0NuV1V_mxZY7<rhSoEtfLeLO(j2Bp)PQ=3?D@IsYgYZBXOu
z5vDVDtWe3k!(Cr!VO1Sok(`8mJB>HauY9fzm2Q!5FN-u(2ZY{7w0S}wO^rsy@VCeq
zifXYQO4D+el10Q49(kItyNoww=ZzbI$Z*7DD@3I56mhaNnfn6uNj#88)hci9)V1%+
zds6=gPvtl7gm8Tt=q4*01CG8T-n<vX@xs2?%Vo3+@s6KEu?0)=CK)lG_v`b4L>JI`
zPUidH*3;~r!rrze8)ls7Dy60oGLILT;{&8*s)%U+_JVUk*P3lTtchym{s(Hs>N0JI
ztP<IoP|l9%m)oKgX1*?wF`2<k!k+o+Z!(VElFx_Cu6UM*HgC<Y@RwgRrqCO9{gIA(
zp4IM9_1Xd|IPOe2SHH&Ue!#|Gxy6@``)bk;GhnTz7uw+L7#GAA_#H72^eQm~T#AkC
zU}A>(#`DR?bQ3?0n6cRCEOOhY%;`<IjCcJ$Iq;5;g~@g~TS-T5W%KU`jy#jgu-_41
zx{h+q#~Akyv<!|O@>qoZtk^(N2#)=9$Z$6QCuHHx{khOC^)B<7)6#EYp*T0dE;TRS
zWck$<%Aqi+s&Ls<v;K8mDNCt?_=$X+Sd$toA60#?DpPT3<IQ|lxmu2467@|rg_n!I
z7B#b-h8ZXiL4r!!3fJ6zaG1{$2Y(TB#$H#qq@6A4$6L~jS@pNOqx(%srO*;?Ka7v2
zRTx3e%sQ@0mo3@C-i&<T-9F$lLhMt1Er>%^8+9J~VajoNFKbT)u86C}>at^F<nQwU
z7_wYroeGh<g7tWRAh2Uce{z4-dKw>FKV_Hm+nRx2P}=|KQ!v*w9w~98)wRCt`hD(4
z%&`I|26^ZKt3FmJxyk+?;O+U-T0Lu^v?orWv_aRSG@=i5Kn~?q1HzUNZy^9XzuVVI
z6i<vs`Vvj3E;eDJpx1u6=y=n(q3&wbydp~yWakMQbf+Zxa}U%SORti9tv@J0+!x*1
zKTQ2Jlj%{^Bg#@IMLMCseTQp!c!n8*OI)GQ#ub$s6Y{ompP5dwSKF81$!yT*@L({m
z<Zm_OC(vBaZA9Zn>XCIByUK^S4mp+ryVv%|J|EO0OSJ-`HN#`jFWu8l#K=8!mxrNw
zg9e@}L1CR<lvWKo8^nEAFoS#qX_tlL^rbizhXVJvEcavME)=dG@3rww_qvRaR_VP|
zTruAXPcDn*57^LnH0Ms2IJ_kQygE>i#lSuse&oC?g{{y39W%;KK~^{BtN#J9t!sxc
zIO8kzLviQoJ~UtyhoC_*X+MkMdfx+RCHKaa{v#Et^%A>BFG~48&zJ}MbeT>O#Rtl?
zO^+jHk(UgOj1-wzDKFwI(|=#~4~OUR)xj0wsE%)+FgZtRhQ8Tgs?_?Jk3&Qk8lCdY
z{>5h6@>3f@m=z;}>jBFL($FT!zUzL%&j%URTkj|4=_DBloU5mQNhxM6&=o~ZSR;mI
zl`wB0M9d9;*Yv%0Nw^t-3b{BwxPaw)qRu8@wQU}jyiV!lr3*1C$5PyaA)8<7Nv1wJ
zlIWhplK5V8T9MvbVuLxOrh>*>rnm((;flSz)mMA&>Gs8l_LNg#vb{KoFRLMx86Grw
zBT-m`a5KJDyIJQ4-Y8Tds=AgSk-}=qtt!Z|U20+Xa4}f~*|npm18^r7lOTbBjq*g7
z5sFz4CurU=1%Mec^>5KBS0v}}*QqJ;t}8hy@?FkfkoLoBeHq`OIL4GI7Amj&&nDw@
z=N$n5I(MmaUYXi^nr@*)YI$VLZxt^5+LDjUle?sdM#w?A=cacy?f2!eN9EM<{#OjC
z3&rU5JL-s{H7G|BdEufH0dTRI6dQFc(KhvTT{yf^kI_3KXRK}J$k>ivp9eD2j3R*E
zar<FjBpO-fJ`3#(^^6-S&$g}Dr5!MS4DFd2;F+ag_?Xa=N%hj4l7EVlOQG1358M8@
zr<uPZ-QtME-%2~{R#{<5s}CQ(;|d~qz(B8a3DfwEzdn`cHFC$MG$ocHs_Q~#psDEk
z6WuovG!)wIn63*JvP~J8I;J$cr5N^P?qo6gay#Dkot@;o;rMQkDi_!qw*t~Vyrpc(
zBgPX)0R+Q8Cgc`sV>bbqt_r~PZL)l8{uZxGDn|!BVGYWRCfQ%-bQX>kxG*!v^_-eq
zgxlHgcr|bRR8RjLc`AIjcX9Ff71fbfjFjiihPaM(Jwtc%4S79O$$Id#Y=5%M`)F|;
zLBQam*NDV%WGZ5-inSYc>&bqKNqa-YqOQD8qP*3L9w^t9LX%ir`-O?Kbcu@yy&(D}
zW{|~cs5kW#_cb5BWrfBvS1EQ-j5JS$6kv>yI&A!OcBGUQhc`VoG_<`|pN7bP_e6hG
zTF36v?i-ip%6(gAXk2rUX(G%weFG9B2TdjR($_1uYr_*q!}|&eN=PA{C*?9SlOwxL
z;}Q|3+kI{0ytt)h!OCo`<$wl=;a9)FJk{{LtK9d6Q<@BKO^9wI_e`>gEWc0Q951dv
z-!~8F3Ae({+6@=j=RYpr4_q#;Re#{bxr^K?HeL)#JDMl;6{Y$N%hG<5vhqJq;0@fT
z$ABNvgAhF7Tis`AIAlAX1005i%#&jv-ym^q1+*OC3j%h;Fvl?<I>@bHTsJ_^K*LgQ
z_Zh7ff3%cmo%aGC+8sYtj`WE;+-W%BZ*?#tIzo6IM^&FPA}H#CUCTQ31c)+Z?(Yn0
zdxauSKu<)=$sy2sj5&6jZE%hJm!{*Ned<5&segZ^|LcqYKO)Ef5jj9X<Nqy@gHP`-
z><G&B_ty&JgihRDJd(7o1+#xzoj=}lABCt}BjZfZkZVX80JvINa<ce9)i*rUjL>IO
zA)Sr!=sFw$rDi6WhE++x#Ntzngr)vBWxW{j`>a>4LAEG*BCekCC*OWPciOc79@Cq6
z2`~+#q_-uXsxVwkelJ93%7Yj6>ILWz4*zQWbgzDi1Nz=u_bfGw93?P^YSM)(A}LM}
z$Vv#5EpFx{eqOVyB!0z%tUkP}|7?-t+5XQ+*I$k%>k#n$TDZ)lixIM1q7xC>T<gt;
z85jMv8}AeK;=;7^u5V<_j_LeVX83D%xDCqjC7f#4=5Ef9bXNq$SrFTx+XUb{s|;7|
z*cYjQ9)+w9=s|z%s17~jui*59%4x<xANDElU_FIjr*-R(e4W-ljhkmn%7Wf?UeK$)
zj5Akygj+hU^*r%qfv3ln@sC$gEVcjOx+nBQ7GNrTc?<4oKEzsneb4VbEvZKwG|BAG
zEjUUUsSj;7?k%#<3aUHBhuAe+B>Cr8`)cHEbd)5zK>}!=JO<q*U5zFdpMxGf6t}wZ
zqM#uv_{-)G&_MBWq%VF4m5eF8wj-9@B5}eu6<@mLqFeTtY5$Wa_pi$$2Y`<muJVrr
zB0e8BEwzco)k#TdRy%Rv-!=D&<n?HCACTPfw7wyQdzsrGtT@ld?swSKLW&-Htb2SW
zYKq?LI!~?YXxF8+`;n2D%|`v=#XEhEflx;11y}y>C64ih=ix%Fvu<WPR6UzxqiY%q
zb%}mWy%30B0-II9Iy~csBL=NRcBaPi3ouzKx65wNd$r=YflMK`YqT28i@uE?sQnb?
z*2Y((MK(R;*ttAZSr^61;`u4JV?B71MmNCZJ1v~2y_QG3+l(khV~Hq0nB!MrT#frY
zn|*sR_2OE;6;af7(g9P2lf+MU6I4*pLV1MD7&<SG<N7840`&&FL@q=3WsCV&ExeV^
za1q61P>E6TS=dfD8|f~J@DCNC4wjLp8|mJME}~zCeNr2xlREhcKl|&74HE-EuZrQ~
zm8~a5`jOG>#&w?Yd$wGnuy?WApP#c>ow9Zau_2bD*@p*nE*B{G9#H4kWfFDfv&0Zk
zI1V9MTmz4pH3>2uTpFBH1wE-fDQ7VUoHv0eK}~IYuPT6hQkiSkrqyqR<*EJHvk%p*
zP*%4LSlX+j^s5q>W{`&)>+f=pyy_rmTH+e@v^PHB;mx_}mob|f(QQ$>3Tw38Nvo$_
z^?R)-p10k5hDF@xJ|JJ|GK}@w?J-jL+{!G}a|KhA&wjzs+aF2vspnG~!$nHvJ{%v|
zg3y;W27P@}VPj4IgKybKMA28vBMeGoUB8gksc2bXSakzRJR8^8%L1ea_}E2uEI%H7
z;BTtZct`{1Y6SG0n5*1}b#9+1N<}!gm|oat?XlG+XMU}BXS_p0;t8>m+?rI4+z@Sx
zP_WlFcpxz;@O<a%fk{&&{dJ|M6}GIlL}#%2xJ*HUoSs~t-Mh!d6oKzm3VU*%+U|qr
zZp3iM3;^D5(%<#0k8i+9hLQvbE0q@+J7VN?!<ddX?{KL;3!L9t17w42N~&cUKkeZZ
zqV8@yC6gCVd#md3+MJG8mYN2rqz%eQja0o2RqE<&D~8+!U{4it(puy)BP$rAg_VlN
zJlV%rXFC=zJaiH#Kck~uh^hhb9z7YwDTH-2s@`xjeHsb<O)=-*7Nm^7lgeH5ntz6*
zmT&ig<!lUl*XqF@-l%!dDdAv?PF98{-wS0RTaFiAk@LR72(<}uT8i1VH8>oeK$h-)
zk!zV#)RAgbOl_xttTDVXi`ZoE#a5Dc-w0Qu8g8cDyE?SB9mII83)j^b4E?1&X11Ms
zMa4w_)4q^vf0VxUzaz{4So8sana2IGcFFQi+$Aa{2B-Vdi_jMDh=N~UXpIz5i8J!C
zl=z5_Ng~%OH$17q`Pt3Llo7xM(&DJ^Qbn;#>`!|$6L1SIJ|p3!d)7N;rX4P9i<drz
zVsdt*Xv!&R@DCInn%ph;tcEgDdOasn@gM*H-$OHf1iH4C7F^Cl)RoUo@hI}>U3uf|
zK*CXv7lwXaKk9M4UAL89XoE_b*)_8LFbx;aDIIVbCSzx^o7w|zlYf|kz89)>RQ91N
z>^R6|;4!c|0vcTsg-a$|(7t?`oa^1U;)xp15Wo5tBY6N95MF}6Y)C6#c%c4{mUjZb
z!LMKHvE()OM(luT2gJI@VJUW(b~9_m)^TygKPqqA%zt%M-z@Pp%k*U;$^j*f99Q3A
zw+x_gv}Wjtp<CUnSruqMWE$9-7my`3s%`4D-2xOXBKb9?%G&XAr2OREfwL5UZ!Ra(
zPwgFlsXuv-f{?(m!frP8BHMWqi1GsNy(8(mNBrjgdj}(Xkv-dVlqH-Y^InxWj5Z&m
zx8cJ}eohYgA7$gU6P)BssE_NfLHffRe61uNku4Uv+#Vzcn`X>M_Lr%Z>O5gpb<t?D
z<4QIuw%vX_=!fvYS?ofLgwGn11Q-I?pE0OBFsQsc$gyV^T`@5gPJqh8Va5Jr#o$1Z
zr~bODQL0Tn8UDk*F~Ceij*;a8j|}#q1U==3t*B9aD;D_~dHfO%jm>qOt8;GbbvTFt
z!YjmpqL_F~gV(2YoS7lO{bg2C0^)0dVe4XDDYhx;tnHUV1I~#cDt7GK^MSFSu=!yX
zPR72?n+N9V#Sy5$6=mY+M`@JJ6A}F7oL0O};*6VxoiNJod+B|hLG%D#6NPmT)_20J
zofBMZ&v)%<y<W;kn8TLgU$VUj9U0f6aD>GWX`Je$3jz6sEqr4xPub3xmH>c`xTshu
z=ZmJ0m*9FZagtlG+r-OWyYF!1SXtj?r(v&`9Ys!~YWl<!<0-3{@?k=0>_xOEbqHhH
zec`83UV?b}s3g#m^T`q$-X4(iMf~A+_dVBogN~-Q1&Q}>?iNW+Njxk3K3t{JHE3;f
zvv9nVK|uEUqJB9<fvy(A9Lr?lDCn;mnY7LyiE7RWUq7<J(i^p=oU!>90o_opMYSip
z5a0{wQ0h>?@0u4t4|h(#-FB!PFJF1N#5SVc&_1XGCtWqAz|ZYx3HXiEP+0o{VUr+&
z!-OZgGtjbE#}ntvHJh3dWqref`quaX#^|7Wd9gyy+n9U#wqN%u?1``xC^FYT14Pok
z^~({aza)(k*#EhK^REM4ivaN_LGFqgA+BgN_w)1!=Ix#<6+KXGBBs|pr{y{Nbve$S
zKESI8S*=dxKD<*uP5z7wKXCu?@ZIb2n+_w6V~&ixMYs(sNTo@kR(g_jnHL7PcBV;5
z#`9Ho6v@VhC&skThYIT@uA<iAI$)3kW1oQ71l9wS?7Sg)_dm&xf4=hL%Ow&oKz*18
zVha@7yRq7y#3xv<lY{YIuanI_=}ew&05AZt#$8<t(o=_t+-)cRQ`yGxErmJ$XWkP?
z6E4-GO0PMNkf1D?<P-??&wWk*J{!S=tX2L_h4{tm6ok0C*#N{Jo)z)d%zGVUq5WGx
z=V51U)M-5Q<PfkT9w8eVj`z*nkAeFH*YO-sm@MBMe{zBh{^oL>P(-4KcdrfSDv;|6
z;iuw(;l@00Vbl5b=l+bJgHeZ5o^~VCe53BA{kha0u4~GT%a(wglxkyp<JWw_u<{~j
zMk3pxDm#b2-x<FJSwmp0>3Ltji+2?;Qg8oalF@*0MTtUoM!#qLBO$~T_>Ra;we^(k
z<Jwz_PpFke>`O)bliI^)72ql+OeOOo1q6+L!nl##XNb)GcIM)Pl*N|Sm8d9G=zu50
zk~guYulnjvy6oN1RpG(o$7S(6<o~2L*#(xZ5{|bD6@Ea752aZ>pw>`)ll!Mny#Z=!
z+~vf5+W#<zAT1D*0ta4_4E{gES2(}h`gFw|pOq>8k!je1Y-!rp_6+jxzt;cIsUDj}
z^X3`8R)5}L5%NN;_vt=1{&i>nM~d_N2u^$bZOxx#HT;j||6kt>*!1tHxl_sh7YZ6&
z9ALKIBtAa+2dcs83Z1@v{c78l8P<P(2A_*T&O?R{Sz!5V`taYsBvm$u52fh;qa*mg
ze9f@eApaOLeC2gkKK#f2<OWx;tuXihLhi%b{4|pXif^RCCw#z!YH!Dd@}IRhBY^aX
zo+jC=6t8+5r~5t>a4$ii`EbBdi<@m!mnn#WK>Q0t2sl`Y#_~U}E!sc4`?1V%<1k*R
zM=LvbvKfFM_S?1A4ay<;+<!lv-r}c5nyqw|o{j3YKQ!B%GOBq_bJM>3Pqzt(J+Jv}
zMoySL_s{TrGkEVjsD90R;Sep5dSz!Nouw1|Blk3WFC!M5cRrY?wUJxBWObl8pV9ms
z7m;|GT&0j%AorUs#quZle3PDd$fYz^RLu;-GhWUa(Z3(*x%1L8;MrV}+Sm0b1O5?s
zGuoK)#x3AvMEh$GNGe9@$gc)o;0(5KDOc3v?mVnv@Fu^cfQP!#ZSr59^S>6#gVV#}
zYa`CpQ$@x?DxL|)r?~0AD>R4+{-)4yTz$kUVjb;@1GEiux7bt#D~OT$C4<WDwGQ&(
zdm|&k^qWs#^EmJ%QsB0*-tjmi&ZV+G_1S2w6s*d}7aaEmhLS+dLVS>#aj>U8OnY-Y
zpo2&{to`j3APIC8HugI2s)J?Y79-PH!^c^s0T54cf*r++6yoZ^(X|YxKo=^LSZWzw
z?+Ha`yBjTSY7-lUB|>G1l;mez_FN=jWa;sF;zK=O#CE^4@Dv%F1p?G1rXJBaV7NcW
zI45e6q~$lUyFqNx?ZvS)9<yXv=2c&&9Mzmo^dmd>@#~h#)X)j!g8eI_s61RrZ6L{L
zZZ{yc>WSZo{KFmsd68oiamym()!<P0L7j2>JZ_tlyHW$`g#Ey}!aX!!`5~WOm|X$d
zMX+RGT!d?;ui!YR72DNR*)DThdX@-Klr9ka`vu}nciLa8pSAz#f`vfG*sUz5J9Q)7
zz%s%Fr;ljSXklLT)YcSuM)U~@DIL_ofoH_=4A_n~Y%b@L_t-7dZ){7HMlF>`Jy=y`
zih5%7ET}+6^6->(^U~j`ToX2rNSv5iQd-OaLIx%(#xvrLhzUc74?Hloif3vT_I!wV
zJH9KJ0)q7ZFS$8p>@7P8>8}|otp>aFgmTyNl>W8i{_}_A)2^&2$o^#t=L3t%R}BGB
zdp#0Q6@|5&JS!V6UClKe$53Ewx)Qf_wD;7_yKXx|%ekT)SM1oP`CP&q+<=i<ls*Zf
zW3%am;~iIRl&Xn7IuPwOwp>pDK{o!%Ie{%5ez^gL%gHzaaYrY*2j^865VX81Vy)y-
zeNwSyJ<P1SenVC<F;G?iut!ObaLF|6&zt7YTjbxDz>h1Z0u*0f3U)>$rXH-bxgu*O
z%rw5-8>2{Xy+gW$UV>sMc3X}5@#;c^@8{3qGYgob7PJ0Ti_9)`#TcrOPcMy5gpv4u
z8NNxszRkAavM}<X*{kN};QN85MBK0JCgG0G(Ng}ti3)7`cLiWEcqVoDEESeky?8`Z
zB}C{3SEB`XZOZJGBiQPD`m0Y~_YMhX@hCp}nep+Ljl*XF)^|4l2?6iEAtw-dr09jT
z!ke07iU?p|YYM(UFJ*7?pm}T4P!3Eg5_0ms9MSZDN-&8l-Jo^v$PvDg=1LeP)au|W
z`Jr`j%5?l!?bvc|6Gu#z?gzB}Ot1^OuU@kPi=R_HrBop9B)b(5;$osX7Ld7G25Vfb
zEf}55)VD%g^_@%VFJmi@G^z6>E}s?7@(6B;y?Ue%tJ2!-m%f^1C`B7@mrP;B^7Ps@
zl<<S>_%p9;b5LnVSx&!axCA)FxBXjhwZ5+y;u<ZM6Lnn*H@<EoLyb>&zxft0wAeHt
ze>S(xY=7%oISejL;<Ltn?{05>H;!*7OFsdn9P+`yrB``LDM7>SpTg8vy((2uA2M%^
z(VfeVwE|6gBa!UtwI5e4um;X`YR!f-Y71o_N9PLafzC)x^m>ySGo#QZZ6rk=MBZe6
z<r+A)eA_;RpO<IcS=fe?Kl{(+^Y2$a^8f{Uvni_cSW_Z(hWA&Q$9y$Qfa=h~BR(EX
ztOzySo3jS<gu!xJcfnUVSC~u{9c6CHILz~=)}wpTX@G+ZbuNmJ-(&twNnyYQIu@Dy
zDz7o4S#VTJ|KupFoXfSL8rn%!40+Ye!FHOov&55I_zjwECz@pMe7fS};+hjC<(3?H
z?7|iQYbv1FoR@c74VXRa+W%ABL7Y7UC`j}Szip+`aDTB{9BE{)$}*rn;WAbyxS^5u
z?#=$34HXUJFLKYOE?cB|4v=yW!{olC>^ZU#qg(BJO;Xsq8bHcjST&3Nq?R+CBJbE5
zERLQ{lJXJCweZ77v7DvfNVWC?#C{ZQq7+B0K#8)zLM1KIWA6@|qaODnH33Yju{rH7
z1kKt$Y&BgePR@o~)vqJEvbJqYoAr29>VX+){76*<M4Y1_x3Bxcu=OOXMxClT%WW&l
z=%VB&h4fDvbkjZ!wH35?y3mu5qFd-o&r(-U=?0glLo$SJup)$LlR%gC@QxgB((+dI
z(VA|xMe`w>&2{~!YVO+E+c_w+@ZM0&y`=9~5%LCXKxc`2wd}-`sM@Vyw-+SXneW7F
zEu>vZ<3Z}3gl;uYF0%h|-^JYnLg9R)`Yb`IbLR;`^P9rkoWPayHhv*kGRhT7B{{h?
z;$+}s-?#tBWS{a5AzpcS#=CoL@94o2+7#Sks2q~GrK%pcDUg}ZyiCg!#m-W<wwm|r
zmQGp_JBGJIsZN>_;Blp2mtw_wAJ(lswCl>gK(`)EWR}t_6%A`OoFAh-FPkVVjK$?C
zw005XovZ$kA~n<4OLayl>P-SdqJCpG3O8j}qo@^1slkiqKqFS?ilQ1!+n)wD^`>Pz
zKf2;@opQTd_zf+jWHo_+pXfIoikXiX<;c%sEJ=^5K-r_s6L^GR*~SF)HBEB>u9Mxt
zagdOxFz#CS>2?=5C;e=xr)URNu84}MXD225BHulhWx9XAA}1H#SASS`hU74yd3l1R
zwLO)Gymo%-H<OMdfexk!*;0wd&95uUJ^9-qFksVB>A20l!{^auM6LOKnkH#^1XfTe
zF05jke2L|>vA*At8OWw<bjMt{p=dju6uU>pKYg)m+`oe<abcGiQ{#6*Vm%iw)UW^Q
z)Y&wpJAbB~$iXqsmf!entH3(Yr?Ctfy3~$iZwWL|jjJNoFQF$~>$kqeP}uXJs6Vig
zk2_oP>JvUy6`&nvo??44{GrG8Np0sVH+=`1xnf91D0SedNt#Pl!&TA^q8d)k{m$1M
z9fbT6+6*Y6Q;elTIiUb9pP4>*b_V8lYE1Ry)2tKG{79JaqK8Z5?C{`(r~H-om4)k)
zd&**Jh0{aZTPw}1?OfNfOedKMqv61|Lp_{4v9{A|Jx!dWW}+x-BEoRTW4pFMX|t7m
zR;qH8r+YrGhCTX)>GDUjUHmg5H6ZhM2W-2tIRBRMK*Js8kmu<u&qC+R4lV38+|6@k
zT0h#`jvjP=7bW8(Zep1U82=i38Tu}VM)Ya3y=+w5Zg6-V(18Kg9o|x5<OZkK9b?k3
zwt;mA#iYyF-K4l8zkqp!do2p7!2?rbbe+CP5^mSHPpZjcMGYS|w}9A&jqCp9V*MGb
zxQIihkpdbpyh1!d<A#m6=iW^0IuMCyI02Fn(t<|{dFcQ!aRQ<glmq4Kpl9Txsn=i>
zP`NzNly(>clGIude^9L3c+XRztH1|Yf3J`{FLNq$H%-G-=wJD+eZaaMu+NiyXAEv%
zRxiIOm`o4XJp;bs6YxIuALYvdx|v&4J_rB*bSwm1z3Fk*4B2nryk<IwdqbRHqx3TC
zp*x%mH;@bL<JE?D?R|!vu74k-f)ipJfG{QE8m}o;Qo!~N?Xza@Topg5y+M+Xq@EN>
z$Gu_YG{Qao`JUq*&3Re+`8+5WwHiw<=&l-gj;V1QSIK?>BR_K+|KcqS7KmRZnY;UW
z9{^Hb5+Yf^z_qrGc`!8$qGaQunEt6m__yj-mFtBa70;d<)2Y#&5jp|2%3C0KN_gdK
z*)Nh}$BR4o;g_wr5Ro04JTk0oS%e7U-O?Ek0DN2y)KBlH^ic*2f$}+?A72cLi9d|~
zwyjsT?JE=UYyY`~{_={oHTd5?(%$&XuTwn8pI1P-x?0Y??V%5O?)1#&eO;F*KdGf-
zV@t<?#Q1}AsgW`-_~%~1{xih>%PaJ!KvrDm6>-|@0V2&`!r8~q|02!~QFJOt)v2qJ
z*8J+5km^=Z-CX3O8JL&+c;)P=0je_@IdM~G#SMRa8*z}S+1|gEnRw>z`R&c#Y2X2h
zHIbd|zxvy4!*vtP&%Jp1(X;Z-Kce^B033hFFbmj3f0>SdmAU`=!{<nFtCF>eE<8Bn
zO8etiDLDXLk$v29<{J2Y1i$;eKak-3Urd)6Kv#l-xRd`r6Ztcgw7w5!OPo!%`m9*x
zk2li;i(WZ}&h>ws0pLvwl#RGQ1opoE=jjrX1rH%j??3vk|I0N0?)&rVqvihs5DWsD
z)@?$&!+V7D0odP@aS=hYQXnNd)%}Ek;p<16mA-sdrrvMqJlo#<3{b>{*UfK;TfBD{
zJy7Qn*{%elnEx_@KQ|ZtsejBbo7s+Sz$oMg%|0f{BnTw%5-Rsjs@!ZSK-UF)Os)?o
zi&}5l%agh3j%D_AI>g}YCmFu(eG`vpVGA>!gs<*(R-p|dxr|=w=xJ{5MH9*eLf6gS
z*>|4tgz*97WV`mz`H<YWVKL(}>fj@2`kiT=7<{%k(w)CO@!elrq*~l(O_6n4$d2u*
za(2{@9tkZvB=k$uOXC71Jr^eIo=US#isI%bGw&5AAkYXkOk{d6kq`ew7Mcj@!7~EE
z8K1NjJMrVcTfH(~;DPNUde(P79Wi92Q=cmA=>~c3essNnx)RXo=i6Ca`V~97F4Z?}
zfO+gWEa+L~aTB*5t(Bb9!UhdDAZu|WC4Y%9LJAD{@eUB&D`I9N&<1FY@ly%+@own4
z%`cK%(=TFt{{AWd$(*LXJdD4PM(tybb&+JtIC*%~wmE>c9=iIRR|8lpD7}N9s(A;j
zD12$t9K+R9&kTJRD)@Z@D49;ORP;gIu40M97mGutykiizYC84YlAHMZOlhHdF3(Q2
zOno(AN)|x_<EL7t5&1L<WBEL1WcDdZU?X!28qM8q9hNc#4i4r){#P43UY3oy9&LR7
z5|Ja>Wmzfdt|qV*_B1=NQQ~*ZOp`T>r6@L!IOMBEv*mMazF^FrJJS?>F;h~4xQ=Z&
zkT-~&`|<5DEFD{vj?-HW1IqQ>c!`@|vpv7elAqxS^NABYqPiYa=a*Dw`N3aat7tz3
zSU~pJVFifG#T648X@;Wy5H|%r44z%VOWO{$D@`7iO#964(no_#-T_2$epwvg`RwGO
zRxEM+UUi$*yYs`cHVqE6bP1$?1pVzH;7tdPi49S@<B0%B9i(&6fmWo1LAX@wa#chC
zw5r9f3CNr}5op`YuD>N|i#!DeWm!!tgjyr7%AR$!aezZrg@WKgL>c6jRhQ=lRYK}=
z%X?1%o(p&f`W{f_GT1Z0r0iiq0(Er^)M%5j#YGhkpW+Ho&h8UP^3%#2)#8#2Gb>ac
z*nNZTvo15yPC+gyE<84K17fJ=koOAWd5MU={DpxR#LuzNuA&A5a)Ui{jYgM21LUCQ
zdgr1Ob!;A`xY*zlh@i5d)Y(gScAD1>Lo<!N^0vR9)y*OgaCw&?xM$8|BMZ8|gO9{{
zcRe*n>Gh8|*p9FZ!6Q+@o7*(-;_dF{)c5Th)K%BAS>7RfWkaqvJ(*;EJ|;l!m;@)9
zRZabH_sw-?sWg`tpyMGmZ{7G0oNkMn#dwwb6-8z0i7e|(hOy8CWI(RnfGaU<g1k{w
zy+v)i`oIyz^EUc|qb5vNF@6Wq-}EadG&>bKLwOCXQ1V1_9dwzXSc}Kd6p^<8+LPSz
zfd=GnZ;nqO0?-rVOA#7yWUGr{Cg~-BD%ss8w77Tc^5yLWQkC8i?HCxI925RB#6mD@
z{=On_w=)^tgdTf-6f&2KteAsLE>#>Lb>@Y#@&0ei0~CVtW*5B3B2XRzf)FdaRX-;`
z3HUVWo2sSNaoTZuL-A-0nCiLmFN45I6wt%lZs{<hpn5)nKYCt<18xcSt)|Txx|ZIw
z04Kqle0Hg%JZf*l!hqnzady8Foq9ziad_IFxEgR_ITXT-ns<aB;n#W9y9w#oAt)S^
zRHx=g9wb>QGcbYvK~CZcKU4m+c6`b{yP9c^q8~SuqjIy_pO+mW5+=0f4G3dYx$Ujj
zbq@x_{9+tW2cP*}M|f{5;mK!?Lo&Il2w;1pc}4UiM!I;Na&dkFndstN;IPM0N`SmE
zct&yO_wF<T#)x&3L!<@C{(>zvkiUIRDG0qpThzyLFY(m2rBrk_`-IW(u9lyZD$5>k
zMaP$Dq)bz@<wsH@ARAh@ZE-tQ^+@eXqK35gl3_@?gA1jhAVo!QJ^l`3b8aE$_QZ{@
z70u^sbg#KkC3B^(GD97XtUyPV=yelh>TaH?U&n#i`~x=^_bd6Td6R>x{BK&81mYyS
zZzz>&!Oxr5A$y-U!g34qLC!OIop6h8Zl1t#Xl?OnQl|v2*v_{Wq<!ZX*V(Usdt#hB
z4-D$wJFI;^PYi9Q9Pve9)2L5P4<usC&F}U7hPEZn2N2})%WSXfc~k*5DQ9kMGd2DV
zCR&CxyEK_5dLyps>r=}Bej^sAt3^03pxw9ih;>Y)M1}%dcHh}>-N!YYzM>DfiH`UI
z1uG|-ocHfZ+U!1%)*cwOKXr@=y0x-Ya2)}<ogS9RZ$B8@swSBE;N-4YI0%lL&R8o+
zbX&#+bI7Lzyxamomvi{m8Yi{Iw{feqtLX5*)5e|=KB}DRPu{1{pgJ-+{1&_#vO>IJ
zaj%bHZpuPLsR3SYmwVi_&oH^RL^U()(m+NNM;Wno({-hQZ<_0gFi+0|L7T16k66?!
z`08_yy%Us0P`^pQK3JCH%6M^-IJ!ejsJby?xS;dwBN;BNcSdvLsnU<QQP=@1vrB;7
zsB4$~_#K_4TD4pi1p}`Q6257hD5IXkfp8xyVQK>Ib47ozDcuVCnm#19dq-b+3Jn;L
zcmuZ}=_SNbQ!kIaLVf(rH9eB>m)wGuOQh|t)FZeEPS8*^g}X&+6ebl;fC?9%MP?I<
zJ~z8S<72&^3ayyxo1*x1a>>ncsFAWlvga3dQ_}cGscuggg+-)Yg7a)MS~ApEc-yS#
z?~Cw4SHP8a(^+a%HU+flNzsW2A65$}dh2v>umQE$Cb|K5bzfCionl8=x=TbK{*!Ld
zcICc7HTB3N(njdM8EH(;O!T8?655g%*l*-G*BL5os8Z^5<W<Yrc$ub=(XI<m>6bU1
z8Xbjy)ok9Db66<y{4?15FL9tRI0OmFgi?sLvZAOb<Qpgj3YTA$xRAzs?pha@7)X*`
zBo4hZKDcrr1ongW6h;WmCNoXyT61Ure9Pj4ZQ`cp0meyp&Z$YAe`CMA5#7=M%SLkT
zflc(5*A8?4MrU1(LY>x=^7RFe_N$+O(rJ<Ty;}$&<PrB_LG!t?W^+uO^HQ8_-~nKU
z^j!Gc82fV+SbZ*R@|rMj4()m=3p(sfUv~7{Z!s47Y+6r^EatvzzfN3+{08{dweCN9
zwNGgXt=H}=_6dDrMh0*_Qx%y{dg1en>v)S;GTyHl4Bu}r?@g~Q9yG{vnmWmiYUHWG
z@a8ui*+2|9Vfxl$)GlxTn9Tl)D7vLK{?huS%=^MO_&nsye;=yQgTziww4)e#Mc<t6
z$^6z=xuft$=vIA)EYN6u{|(*|wt2SDFpsoHPI7^$y(iqwD7E;5;ZT_uGW-eeS|ocI
zh-*#BuwPoxuacM%&ko@p&YRsNsXfNNeeBPo9m*5)zw5KS_t^B3mc%?uEKHPCTyhAD
z10mY=dQYv~HTVR#qKg-Wy<;p(InF0BMIT>be6Cx}um4Ps{$0BHGY10kx7<i4aWsy;
z1s!~3ZGdR^6wHg8qDd0f_2y!|?uBsV&&lWzBY9aTlblQzAQH3<+psaTu(|P-Ywht8
zn(6ZgJ2EVGz<bWzD0WY6aYqULNYQwpYn|diTVEBqI&|6g|6}hhqpIB6wqXmC5<!$k
zDQW2jL0U?>LAtw3ln_ZlIu<G2-6|j;CEeXDda<ZQymPs?``PbvySeW%zVZI~#{I{^
zkTqD>HLrQidCucJLY2MMO})?#jO%l4OUtM$=J*hKPLGNye*dJyEVZ`URW|L>@g;(q
zw*?oRaf`$Od*qlS2DwiMb}zViPoo!djn_=yj*eEx7#nIs=eP2QjwcLn*neGmoJ+L4
zFWdd<b1%mxgZ%gz_Kobmw8KFoqn~JDb;l8W<(!^(dW+M+F59%8en1H#|Mpo)L2t#f
z0{nDz%e}zF<IsV~&t=Cv6Muzd(oyaoXXGVs5Z(GN(wf6NXhVM~vAsI@1>)FIFY6V-
zHD||U(u%^SQv)+ti+c3z+40~Ix)N`<;ep=BP`OKH+@!U#Fh{yzXui(F8%PpOO?^jf
zza9F-ITpCG?4MWGJ;27B$+cB^BRFTX$J5Bp3|dN;5FQyibc*=it*Som_>Wc1-|$<F
zD^MC`^GOlIDbKxtlU}OyKs)=d7JJJXZ!T4TD>_R42^${7k_K^PG1fr++#!vHt_es7
z5(|uiPCwkni4Y!9{Hu@d!KCzZzU%c#C!NV46nfR#2G3_Jw=>?9+r5w)=*~!mbH%=e
z_hfhHCWxm=Anaby2x(t%>{}!GTZ|5niS2eA0@>E|dDIyq6XHodI1E6*3qo{ak+GH5
zwjU-efgsopU&LSf388aC6@l{=jeo`nij01uf9}2j{d4G1{%(2p|Bbwb^xeLNY^;~!
z-45_fs4Z#MYgyP;F&e7+%>w&t?F|tCyoH+-;<&dkv%Ce61dz;G)0jzMk@c8Gn*OUq
zei$Y=!B}(?ikdQhpVOQ{zMB^m8rO)BJc!H1n(r@p>)}2C*5*`~`oz2-@RHUcmua*v
zJ>vbLGrLiVg-icDg)d*Zfn*<J)^%W!Y#*W^<C{)na(&l1d^H?>>@J9fy5vm=dIXMt
zM9H$<Df_xuFDo|oE|A;*qIoHVv?MR9g5D*uP5>-N#+nWDO*a6!hl=R3)ZCeDZS?AF
ze$!!7U{rqr9o?A;z&tXBIcOg*dG}qhx%rCVL<QzCj3z^lQKH|TvDepk!6jVs_5l5t
zbxEb#i$?a3hv<D3DG9xBUj4PE{z|F)4~SUSI$-y|D)YMIKLE=10rjVZL3QIl0Ey7S
zVa9gmmbJ@8Py3IX{@j4<?~vze{s$lR2Jjm?&t>`xmgirCFcJ;u3k~`g_m=*6HXI--
zq|KZ1^Wp{T#IH9A0cPlEbe`jX@X;HfCBwOWt%~QL@Sb0nN+O`64Q3G{e31U%e{|+E
z_~?zKOVR(^PT|)T{%tC)14}J^?UFH%lPjmNAI2<8Ai^|32nnJ!yOgpmEpLrkc6Sh;
z6t(g-yuAv&XrhAaLiTr*nx+8RGjO|^N9+T$Fc36p-qsH4>2cZAx^ds1yW3SV8iWV>
z<<5S}MG|ZV&LaXDRh&koH#Qy82ieZveT%MUW4^-QzWrl$3FT!zytiTqV>vctnbd0E
z^mGG<U#4O*Q}j;e{NHZj*K+mO-7$eFKpRwlr%c<SZ+OMyJ3Ji3ZxE)e)R}J8_oy>4
zp2XeVeBe`v|AzDw7GYh?c9*Gs4t>LN!z>Zqd3`=N0)BVj0P7L=osJK=qXMq8w6}xS
z?-#`SNJ&>ry%v4<spF#Wu0TR1j}W-Vjki~g+kmH`o<nez`swx)xL?)1wXi$4V)aaY
zm%CUKdiS5upoo-U(2i}M85M5hP%s<}D>yk{o2NmY^U=6sgA#Sb+gFX22FS`D++Kd*
z{B+w#$Z$|}$XCkNq3hX2*ARj<49&{iQsJ8ZzaTnI&SW@GUWXP>-k%`dTq-g|NVC7%
zlWP`B5UgvITAtdWcT%v;4s=`VHcdO!z0A=+6U-m3rJS(10uJ>K@6+msSlYcc56PQI
ziP@A0)XZU}H+{;~+H2t^#(3lx%uR13qn67V(>rfNA3z{YpN!kK$D<XdLHB8h>;aZT
z{wSJLwvMQ0H&DCmt4LJDH{Q6xwfi)bL2>nwD*P4p<`B6*ItvcGW*rJTFoeQsLmuUz
zc2})R!{vj+_Cc6zwcGilty>`%kz2R3kQ{_T`yppWRrPnMmS2yNr`;pNBBo@J0Z~E(
z7kn>{A;dLbqB|b@DwsR&a~h_xV=cZQX#^=K;**qDk4hXEa!lYKf^{QApBZ6Z^c2_t
z2(ChcK^FEW5a$OG;=<kKA~2v|@b=O41JxMF6~Ps`LK=1TqG3ZG&waObuBeU!fOY)_
zGJ5qTT+sICK^CBI=?yYXgP%OiQl%^kq?LQr6Z-jOPS*FRxwxQQ%e@f#1`r6^@0s8e
zIQZpxS}ljF1v8(MTP>8r+@^l-u!r5E76i^_#v00T<4bF3Y|-w$OkDFV)sKfc?lU*^
zcSY1rmU|^>G2{2<)L6VPs7-CnL{yt3nmf^Yo#rf*U7!I4WMe+CZMaK^<Oq_OamP+&
zW-zv_Gc^?oSAK}CFY3Piq&Z*u?Spw)(GP{<VY9S}?o@qkTA_))O45C+5l0SgMja`U
zhc{qF9qq!@J`o%?1ToHGLCts>s$shQhe(O5j_7QN^sv;>wS(?dwth>u#7>ua;o-^s
z`2%Rx>9JxJ-4(sontTPE+hc!k5dH5JOct4T9TS}<c?+B=`tJZl`*hoc^<D2+S@4UK
zmt48jq9R5&aA(s6I2M+=YLdmDyn8R5<by}_sH~5h`#Fa`Q-hRu7`8sa5*1@3q`NXd
z9x&X>@x)Vc=NZM7TH+3ScKu&~f$M7Bnl3i>a;m-THw$z3$_D6}U8PdOKSKb(>h~8H
zb=$f0CxDjW2YhWz&BBNLEcAh#bX#QE5nCi}^}xc&Wk8N&L8>77^ev;9#brC4&&`Vn
zbs;nt#MrG$=G;;KEe0X8#l5N8)Ip_PEq+85K){0NoNdcu-8|h=qSLTCfzgtoVmtxw
z=uTKF)DpIXaH1WXo>U2+H`Z)G+n9{Axqs0VrKAL)^TMZ-&sV!gkodcciCeU1jfNPA
z6qRy$4T{dnUE4+gd=*4k1&<HUp4oCP6}ff=Qv-i(2&(jigHX~dl&;N5mIPa3C3<4b
z0zkRHHyfE?(T#|Gy4l{tBuJDtz9LiFVA!gasa?WeJ3DWhc|$vT$>eE6-oEm2F$*c@
zkPb@&yQ=zpUUv&s2iq72l~atK3y~7@^N1wRTe+hd1dpk_#Cjc~9ZueIev@>qM37-9
z)S-3P*}kw(44ve0(n*RUyl6K63a2R;y~$h=@$m0B89Ttq&aLl81-jaQMFd5E>oQ`9
z!q==>x}JJy;MDu$+tqg%{L^_s+%+qQE$$+1kKcP}7@fEvxS%7d%ZOPa>X;qt%K_!{
zl3l{g_FE+&14$h_gYpyTo`iQ~cqHQ30@r04VT*mf7BIQv=83=C)a~!vLjWOl{MN<}
zmm5SL_oDf2O@b`mzVI)0e5#BPuX82_YAKrW%Dib2ipS5fEClU_faD4Ikc99GF;Qf|
z__Q6u{1bb059{7zE0Y{mNopfzc{*}GOeIm~H0|hI4wxO@BjSTDKf3K-Co}wf)nm;n
zHcHw#ax9eWag~C;Eq7%gU64}cay#mVKD(CvWIp$qE<qX>t6Q}Ug_)fv^tLayYCy;Z
zm@CO2zTre#$wxfzpVE4DY0YKQ5R?sBJuW>+s{9I5+f;dqx;oJuxSgk?JuiV8+<B>O
zO1Dyjgl1cQxO&82vA4K@`z(bZaG%{@wG5@(<dwy@aiQRSg%4z+Rs{dsO6l*V!%P+^
z8$w)<L&{)X(X$R*53%Ns(X(&gz_0ia5Yl~9j3B%Hs*{_uLrqq5n8QZZZi_|D?bfSK
z{fkMd$g`2Oq55;-Nb60}S$aLUtV}Vz&Wkn&M*t3u3U_gmqr}Y`fUn|%BWC-*hcG}Z
zKLpeQt{Kn~rrfiXS9cC#syL{+(~2nIG@AfGkM5KS(khKcy*$s-+ct4bkKAe=hhP}B
zM=Ou5)CE6&wvr(mTCt|OnQ;YDCq)3!BTzBz+z$z;40%Wh^N4dwBDhE|qtl42G2w&9
zc-~7L!`U194erO-QQBKp<02H$7AJ<f+V6>B9DRVwHS4uQT2LK6Z+2+W!s*kUYmb@U
z7}wX{Yp>|f(jNd}9Ji$M2nGgzrC9a>z$Dh*DlvykJIyiV`_nPLr7qecY=1#>Lix1F
zbeaoBsTFxb=qz>W^ymTW$`7b-#xMdOY#*o%r_}Y6z#Wc^rF+<iY|esOx-eDBI0Qjs
zHj(0VA1@fT6U8H`-FxStADGh<47gRA{~69qqh0-4TFKg&r(s|Mt!Z#oT!rp6mawLv
z$dG|qA@TU-)`gLC#&JH1oa4vXyCYGlJAa=b{|lEQK%Qn_AIc#5z}8F~Xg(!k=xUBo
z#J=2ii04lRm@A`fIISVmp7`|g<15W?!L~YR1L@SNlDRSIe!q{qT*D`#*`+0>q@v=M
zF2Rr3@@o35QcEHb1<z;p>PE+@IZKHkDQOw~wBK8Ezf#M|E(_*2+z5@p*0~41(Nj{D
zAGk&)HtdMX{uwR<TgYqVL7>@dExJ3;kWqBBBDiz?GmsNDzOayl9a_YvxH-iWz8~c}
zbZnz4E3s9g(a<s!v1C%4CfXex%LuwUHhf_Al|fw%I^kDqX%{WY_uVe!s}0CJqHDV^
z5Ni7n5Bs0Dg+C1`&KDRGixWF1$XeN$V0vjeH=Sgd2(Wx#iPZWEjSa{5K!3VGozRqx
zo>r;9)0-!s+wP#6SnA4rZcz?G?pKaU$_01zcn?3cE{<?_WbH*Lo>Cr{rurHaB}}1Q
zbix_{;6?iNh;94YqK3Zb1s3|@)<B{MG!h`S2qYbaRzv+-<z<kO^m=31m?og*(hL7S
zL>&R^O9>2++c9q;bGL@nH%eubPc?+JR&tW`RVNapy=-$e4atZ~iMZ&i3GxL%p3vEY
zQ;<V6e;MFK4D%oa+3Orc9z#5jvj;8#(%2RVUFOfTm<JI^PX^BlD3M~k+N3p}e|y5!
zq231K!I1L}U>U^wt{o{Je5>K)*n57m%%2TK{^i-)tp@z_BY;Y&=XfEde}^Z;UMDsu
zJ=2~Di`7P>vs~N&7zwrC$5bb#e|~<y3Z>)*Fo)p(4fpwPxR1yGvv8janQDJPApbv)
z-ZmFcCho=${-JWrhv6Y{!JhcXuRg1R)_UOl>@^^8`VumjEc(q00z^(t@E?&kF|&L>
z|D;LWSPs`Ik0DIFpgiQD2i4(x978>*$Udjt2OL(B%O%JpAdFI{`~JcTw_OMBe4hCW
zSozl<sDYXzJ3-+s^0JB|1QZlk^rLS6TuiBgK20A)=bJ>-TYn1wAzdeZ0X5h;4y-XU
zc2mJ|VAWy02S{V3Q|U554FE8H!&LvSP0bj8ArOx9*22J)&8y~uLS0rF+)zz-r~In&
z$rTPc91{2z4TC@AcAyQGvnc@LopiD8nD};7ZgkE9k%o}bal}+@E~C4t7%~az9~VQN
z8{n@J{z&*)J}TZuCj5L!{{mPAQc<^6YhG~I#gPjExl*aVSY$*p-9Ink-l9l)ju_=o
z5g0COmMcv?x<Dets~vy)Ax37sn4eD}-~%$Za9yCQw&nnr(llDT+kgVd#bv!WgY&jv
zp2fKbJ^dRA-4!KZ>;}y`y`pSl^D35>A^vZ8Y1q(3?`5TZ-ZqOFx^s&m$pYQaX9;Fp
z8rwb`Z52-HkRa`G!K29n7^ztOl8_ZO<_biniG&gt7TuL?=w>vZ+`8}H#<FJvOoYsV
zi4f=wP;b?)s*;f9=DR@ax5b&#-zX*r=wUtZL@;ew(wIMafF%f1b$-h0nylaURI0S$
z0*shI4AfQv+w|%f-czHWti=d`Z1UlUu;<G+X6N+BpZ3n$Q0eQDq!SUjKAS1J!tk}?
z4XOVIB=;hKnga<(0Qzw2;JnFVNau#udxiNng;k$%K*<dUGZkh*Wth1)1uO?uEz`Y{
z9&djzV*{>8np|3aHFesX<12g`-TQ5Ag9UGI@}PUq4v&g3xqRzK?U|%>NhY{pMhfU4
zNjs!Gg5Ds3nX61$bQoBN=B@^Q84epmGjzsbDj@(>UX#ZoV_OJKJ2=}MOeJnNjBBiF
zg5#jbEZ5+wD2K4$MWR*Y#Ki!u++C7R`rR<lrU(*ftGjx-J^QMh3z@1y{*Va?8nL3z
z$+iLZ#XJFcpW1NIRdH5)OJQe1B~=$4?vd{V&oeM|lpL!vdTpoHQ^r1f_gPiPn^3<F
z59)}08@iu((2)`rt5=HPvu8`K05Q5(m&R9svz0=7c;-_{5%J_I0VR~AxqObd|NMr%
z{w$Adms2xq4%;|dHc=I`cI-Az`wm#raDMCM54}pNdO3`MG8E$>u;^3@weVfe<!)TC
zpyw($-DfHrBH~B7%U}jRdW0fNcx(*J%8i^vYg~IiJ*)UW@iA1SN8n#quK)QTa{$5@
z3lc>FEiy|2oDKB}dg_E_!B#PD7*O0H(<F}V+YU?WOGP*o`Scm&lY5VEvq0+GrmI1!
z?RSes{_zhNt=CC_oY)o-zuU?)1NaF~RfuLxg~Oqa@JrR&3hclZiKQT{<Vide2pKva
zJa`#+ZH?xKJ70cQ#MID}!PVJe#_A4rKsv%Qa9_(!F}moBsFD7vALaFK;I!Q|w%5vd
zOL8g`FY&(lv9X{1<+sMQ(HNsP!Ds$~tAT4LX;#`YS01JHT8IrZJgG<&Im_h=7mz~v
zX`CXq)xV@NVBOHuAGrO3KK;|Z9Q6yn)&Ut)-*3Jmxrof3)r~PO_nI218|>U0+0PBy
zF#Kuga?;0T<p#Ymgl<*2!60A#{`#!}sbs>XN{y|4zxSMhIRb#quZscqTDzWhaV$1y
zZ+)Z~5U{w0rFdh>0}q^_0J-?nw9)u`-%e@s#_w4RcTXA7{jn{9O-q`cbYb}2$WdRW
zipBs_$}At*c*Tsz7-T<wg~cjeQ7NSdx<B7`I&=Kk8*%reFK}9Lz6N%vP#r8ZU5c<Q
zuA=)HIP?t6Io|0Z$VNU-t1zV_Qppp^24buwQ^LhRFPI;vy4e&-+*I0&z%~Xve^q!w
z&>GLrPVmzQ{blt0e&9%ww7~S#_=4?X4t!}#SAv|LH&T`pCW2H$LKX>t!Ni2s_)-QC
zVHavInp-1ufq#+pa`1s8l_-ydH)xV~!c=GmUGAq~9<-$;xWBz%eIJPj({sw0)%}5Y
zR$r@enR7MI)^o}U5iie4`k~xIVYsn9amg-e;<(&{Ne3ajLpt}-k@fwx$H;V8xC~YL
z$O*^s4#>7hL#%mL<iD_Wk8m5|-922Ic=taq*uNa2_d#5EiMDn=B}(dT0-HnKRc@!3
zdRT`leCJ$w9WFuI^bCX$4z@Jn_}X67$=bpF`=k-G%khk(GmmzFEttyK>LastAb=d*
zP$CV(d{+@!O=I0ydJ*m~pi>WE^ucGzL7%s&>#D_C1O=BBzx0tA9M5R{^Z5T!4-|o@
zsOCPBBI&<WFMP>fQ#XSn0`1GgKm<Gu?kmlIQ@{$KfwqGw<E<K5BX49F;uVtMy#rN-
z+G*fmvS^{d#>3-r;nf49b5TGE+s(=xo*`2EDP_s=<zcA>ed+&c5dNlq`3%JIn38V=
z$gcpo9|QKwTNxr3JQd`xl9|9#|DB3;Z{^z9u&(|1C{NyyK^1ZES7UqJnl4dF9f1qh
z0_3l(7r>kq<@2s-H1Y;!TIim6z;g1sOBipD_k|i&@ZCB_;JXu7FSKm>^Cq(@kyXjE
z=tVMtUw6ul)Ze{WzR;oJkDC&x2MFLAFTd+W7}=j!Fro_jrbb+p7ZfqSru`byrEKe{
zm;2w%G*E*hg{j>AoF6XODgXSHtQ8n7*PhU+e=`S=A9qA5|6;oX{>`%kbIIEkjMjjg
z=iUW$`(G2Ss1z(6-S*NKFfe~j&jED+#!SJ|oc@C=NCXeT@sr)7f2_uTeZN5R6c{ad
z5^?>%d3lh3X&qEyCCrKUh@=0OBdhv$9l}89l;rYbzE2geOP=`ragy3ax!C|x+d(>n
zG;ro`y;Hh^(m@(DC@b<9xW7W#qh=L3c%gLgTqj4owUI#=$~!geAPrXSNRPnlROthe
z1$NtQla?NT)@S*_765!SIUWt??u<lCwU1YZpBCHxny<ebqIDp7DY+UaPb8vaZNrq^
z`2j(<d3De1kQMc1H0Teob{4JYJ*~P)Isg61Lxx(&*Fz^iyH~0p)TM5-`>XAq>5wTy
zf-scHO2-`7<CQyL(f6^NuOx2Zv5b27I6!+gAKP4@m-^*c!`pJU-@SGZ-K6n$;s60s
zW}=r6b0~Zw!I9p4NXc*tQ&MscO8QnNPJ%Ao8Mp&t#r{y0Y}IlwR<IIaDIRmgk_!UH
z5MS>QV495u8+%yggxn)!1)+hi=9ClkaLUoj!|6gHxBeOGwNRXkYF-^&F#9zJ5@6d`
z<T%oa0G2p=4AND#=vpz6Ep3mFU&5U2>$fdUAPJA=wWqN34Q?d)YYP>CeZ2qDH@Io%
zBQ>WqeU1g8l|n+PvQ5K4I`kOOh}zvZcij5Q1Fp68sHh>O1xKwXdW`CNwf`A5^mW<=
zm|s#Aco*(zU%El;nZxv%YT}cmZBXr~n-h*{v7RLGKf@Zl`f{rXBP1^EDvcuc+!`u$
z;s!e;dXl*5&<>MxAq7QCRFRWSamv`gGQgA=GIWg#8S|;$3wTQ7>s&;@`_Tm@+=E|v
zZ3yC@q&R%Rgy*OOS2DXSfT09da5KT%ZwujI!uCB>hn|VGnyJ9CKtnseQZJxp9LU$T
z@|Qa*^I}E-x&Psd>q9P$Dd95UG>h^BX}%HHJh}}n%TLVC+34w>w7%el{2T!m7?-|&
z?ddO-)AUxuOslKWVMp{;4NV+1Nvse`_V!rE^OjPqabp5PZ*<~PU?v>1D5%!MzO^-=
zMJDuh*dpVdWBrZ&L5N<`V~-11E6zw!<qb-wFCMp03#En9dfQI;>c{q%*sThWXL%fg
zVMT_@ff*v~@GbYLpCCwUQNy`v>oQcvwK-tzI*ho$vbEUbB+w>Fs&Y?ED;u{v+%wRd
z0euZpnAj?!H(b1!sNG6fjyx+59y;%s+cA={K&<llb~hx&gC!91B@EIRU0n%Sk7OLz
zh<iR8J@bhOgpcz9+6IO0+dPu5Nl%WKBa&M`ox!^ez5NZHkGM3;^?+2#4L|X@@S7t>
zuEGk-_76n11dN=wa((hULh&o+vmRL9zsU);Fs{PoTNIyFm|*Q16w*07GQ>ME_8n&E
z{}MXO)82bq{kGq8L?6!`hEGj+=5!BB#t)%GkV%o*i>x8_ka-vT58cyGx4f!iymr0#
znunl8C-lxQ>Gb4h9<}sy-vL%i>tVu+Q4wbrot*j_rK29iT)AF+Rkt9_?~`b?KK4kf
z<Zl-n%DxS>E>SolBfPyj5%N{jNpjFPr*lqLOfD;@AV2Z(T`{FHm%D7Z*GBhYZ-hc1
z__>j9Zu5##Z_0ex<WBhKZEnT{Y(zX8M}><k^SAL;A9@c#qe&migWM8v#i};eWGd{P
zPbK*VL)yh&N$BbeYuXB1^NOI6X8E!`EGS?5<!r3GvIbWU(x)iRdU9%ZB2hZv3d>fX
zB3OV9bg|)jJ08UJ{VfWPHK`FHG9)gImGskwN-YmPHMLo(c;^hA8*F&dn!YU=&gP&g
zz5{Q-PFF0^1^B{%5ZK{}VB7X?A9ln~*1z6O+~!lQf8~rbrEfvVjK*qy=N>9OpHKa!
z7#5u2F%+}Q4lH=SgmW`Z7CC}qhz$c352M5}X$n33*um{i={q!XQu@(}PH~g9CNYnB
z3kD8bS0nOpw`pL!L}CCKAYv*iiAajrC&9GBWi3R-o}4EpP7jyj*2vr(G?86p`!Mky
zqFXyb<!0SScELvKO$!P{=-ka~sT*>eh0)a4(ko>H{O<Y-Zq`UD3RCF5$&<KOzikrQ
z9#(#ePZz59hPd&y))8!}W1A}xRTW&WM{pjaaP{g&BJ0=Hs|w2E2PL@Ob><B0E};wS
zRc~aOu)`Z#F&KaBJ79ZC@F=HRzgu*D?P4wd&y|q326%_6V+iaSy=_p!YKzoJNX!EL
zx)Fo2ZF$3h<=|mz74>6Worz2@Fgok3b+Ogqw4<+U4ffM8g%#;(G~AX@t6&hh{+)cM
z`fVV)ZsTZJUcO!Gou1tGgw3Pl8|stvb#h3wHNYZ+>8-ZG%}R5e((=_6qSLCZb@?-w
zmlgc#-0K%`P=AT+8uptuC!{MLiz{9VaN|RrZpaHs#z|s_GUepq)-il7O+7Vhl(2Zp
zJpJ>jcIP^)M=@#JEQaT8Xoq`$WZEd?XE%c;wDbb0d*97qDzaqiCeIVIVbe04ev^6H
zy-$Q@np1@?_h}F6j@*?Dmn9F`I{9;k3NS+T4Im8Dsg(WRhzPH?kPFH$XQZB9#<;|c
zb3pYH8M-%FV_}CMfhp(Mn?z)W5)Gmq)$-eTyS~L^c`jV0O-)C5$d}<OR-<=9Y~7u~
zt`)9smuE6>tv<faM76w5_Jbb-oO&1^KnScJv)*>fC4W1_GU2}e=p3jl1gW*7&evBz
zbTKwA%$RXK*qu3j!gGo8R}K7|;)drkSj#CH+e5A11w<FazMy^mwEmS*^A*{;2DuK6
zF>~h~+|E!sr7t>;YOqD<%AoTu4Uy3wPAezCX=UR)1^r#cQdRslAIpC3b6UgWIiVHe
zoWO!wWu#B0ae@@oCvQ~5RPRPyPv$|#((;$8;Mrl9!v%Op>Y}?X(?C8yXYIxXhJD_x
zfXljDwFGMqGAuS|e$`el1D(6FN+Rq&6!_Jxc44s#y+Ff#gtQw|vCp{?D}2S{7_&k8
z`;!-qYAH3i<A6p~;UzjXyE$9656^q^VrYo1*4KRhhm@4k6HE(Y*wU+-qIp@dCAOF9
z^ds)~4OxYT_%SFfXurPVHixlniM&$J9fF0ukLGdq%1OYqxS-1Cxeo@il_^5ToM2S~
z@2<cWEsJ!aQia_Ezuf)^Mz`rYoi!iR3axfOtH$qCE_V+KZITKc@781TcOAn_`m-y5
z0n5ip<9hT+Y@P=P^XAnXCd6Eky6~^HxsS&C^vyG2%|plX4=vA|%n>ob@Pizi$xp)E
zcK}hAQu2b|J%$fkLUDZ6D~4YkQ29Q+CB>M8WR|D|Mf~&Ho*V{FZ>01$hDAuy!oO8n
zfgPmJ`1$3aQ70uTGM|?WZ($^5z;|VlSLc%v{Ojn;^Hk5IPOW!^Ce9Y>5%a)`<sn0Q
zr9IPPSqiZn+^=$j=dBhmg_&fc^Ly$0Fgqe;IS_)?w!p&7SmNy6Xk7oo*I)D7Y(o8=
z=PBt<Fhc$B7J&mlK_H5n;crlyQ`S0Hb~J&=?23E&<D(VqDfgzFN-NV`s?OFuqBQ<G
zZ2apFGh#@>i2a;BcMh7hM<a!Mv2dmx{^n3!bAER@uqsg<PhPk6MQ-)X23V{W)88rO
zd?++LCrF){h?YKiW)enSc?{crQS+vKN{F}i#Rt3Zw@@4XMmNPWDxKd8>Jb}d=T%Ac
zNO0(bnq7KnP>|2hA@t2*l|4%8DkEZ9uF9mCjk|JK&LWIe8wZ|AP*i$ReOdylLiwcA
zG-5Y`h6ldmL7M7AX!(GXB{Iw%**Nknm#{!|&_^h4@<8qy*?ca{^z_aup=+JHL|I1b
ziseQijHipeme}deR-Oq@Qsb$=>uylzQv}vZB00^O`Pl(0$}_=Iw@PRFph|1CveKKr
z3o4STkq&beOOb-9GXtko=5FZ<LlBP?vkUm<Gjhl+e{IzR?=3I||7u+JN6#I$o$`i*
z0886VNPuiCXVJ4PW$v>x-uSGd2va)Dl$bP{0~71OMIEx6S19hh%;%<^Xma&KZ<Kux
z#}B)(qYh?~)&V)46OAf}1x>{ItiFep+kNvptWrr&j^4@}Aml~$E^2>ppnHD<&GV<n
zAONVf{&X=~`x|h}JwL15o8~{=lh5uwIX##LmN1?w<KKW?i+s+hrpy`W!8`E|x?Cet
z(s9O-mZ4u7w+Lb&x*@UYIJvZ_Tf1fYyCdFTD<zNRAI2}Ae;U7B1qIr<TNt#P{upw8
zLg{b{ta^Ff4<?=Ffj7;xmn3|vu<;BJat;UwA?HWqR*k@|rqc`l$cE^7OW4ajX^L$|
z&}L!>2>nV4h}{)}>C$geU-<n1!$}9*hA5X!&FMRo)HM?2)8@nD<=KT-MNBi&&eJ$|
zT$*z~|M<;{{?{!4>l7e05+e`7BbCkn+@<=M1+O0%x#a8sm#iNJ`{8OAoL`WTfww5I
zn%TWcIT%J%4IGZ#73dZ|$dt@pum*y!PDVOGni7-?&gfoCm2ErKWFL9Hq+6wVQECcU
zqgs)s4(rTW=b<vmqiDno>NN96(XHHrTfRIEM{JM&xm5WHE64#DD6}e$qA2$#n>UT>
zCewMt9mmj7#eSEIhuOIXxj8#+247GG|GDTmBSE!L_cv&v|GcRF`sjcE>VHSz*9e@5
zgIofaw7Ync)5|FkgI<1Zu1y|T@}qYThxzJnH$9RXSRDbVm6R%*pi3qf+Dq*VUuq6V
z@Pg?<zC2z#2d=&3VVF0tLBK?kzQ8xh!+s4)J_6ZucUJ4Wr%v4;1wKi2+Z`}{9YN$(
z4%lzeE^9<?{E#3q;A{@pJ(-ye*RA3TK1P~=8?>&SpnB(RzvS66yYd1bEz_<XYvzfg
znc^TMXKd7<_oIEAhs-9EsLMCI&u7a-Zr@6us5!X|jV&BCHo;h#6DowbW94PLT)WQd
zA?HqdNrT0%o!v><f#k!QI0fXxJ9S=TqjmJ?&{D@Pqif=&XPyzuvBe!8vjo3=tpQ>G
z>W%wAnZ_=v!TKm=*mF=^eV@-jd0vIn7AQ!b0tE@NrKO)Xvmgd=qm+5KoZ`ldMBQ-d
z5w1__d6LhL#H+$?j&{(>d{s2k<qT)3RRFjfEP)-9&4n|XSGm5_9h#AI2148ER}?wc
zZ6|ZOIrq=39AkVKq;K=feo6`Mv{u{WhLfpHlV7om%o{c_HrN<(1-*9Ta)vKXa1Cb3
zQ;bMnXs%l8*r>bcU{~h0U6CDr0mh+n<JVJ%E5AGGiGnKDR-qp*#*JS;;w4|YMjW3`
z$<W0lcymLUlo0I*tHA<Iey=HWAbwk#L!X{ZKO_Trh^f0iKl3@MiBt~$I#Q6@;W}qd
zLkq*+Qblh^aj)^m!-m9ZbrAizF&k!_w8W4OG^2ljdTUtu(P#`kxoa|t8|y5wI2_F&
zHUhy^?+#A8U6QsTb6$<;kq!NMLg(YdG-ftzO9)172^urnYR6LT-R>NlygSb<PSCJ@
z#qTdWSVk|;IPObQp?7YC)nvKX8;*8zKNMt*%=+$JP#TgWUDpwkh0}mbqt^P2J065l
z2FQRCWGS}zxGw12ZKsy*dE=sGhT!dKE$Lq{^xrn9zp__0<#eofD5j&B+}4|pKSfKf
z6=Ga36RI(8BbjiY3P)Y_l28^i=Ed;u0(teov^l0;Fw}yp(kaDlM0zpi6tMkU!{qoA
zXKv{(wqzb~aegw{Anl)dcKfMXXaKJ9+dvF_>Ye8Y&~=L7s}xR?8E#KJP1rFo>(dD?
zT{_<rfBsCt|2abs{~kNM^8H!RR+4yf>Oj@|8l_dn`u(?j(INHct4C_)Pm6Cl0*y`P
z`ab6-q^H{gxj*I92q0X`RHo~lxX-lm4eJ|1glK3Erk#CkMhrjb+`^5w`dUt<=v-h?
zS7J)4n6J0t6Wjx>IWljIo_~D*!0tpjpmOj!bl2gF-0!w29#Z7tjAax~v^GETk^%@g
zfO&8*#8%TC&+DlWC?qflPy>$p*8OUqJG_2-orsCgA?fhPQD5KGk|x~a2e4D%$*MWc
z?4N>C@f2szJ?E~IQa~J*QT%v{EVk8z8M>zphYO7zr+a9^_NMa3zvslA`G8>279~Lk
z^p*nk!QR%X^9}Tf?UqRd?l?vw;a!U!CWcqNE{$wi!|R?2O3VSCh4;}l70R^Irimw|
z7WF_%JC1UL`?$ufN6|mflg!37eNed)gXrdL;YPNyicl5qdp!=w5m-=r)Q;dh=I(Ai
zrnIs{>-epd>dzcG*q&<zydNPd5MGYbF+-8ZfX9RivARxk)ePWoX4-M{GZA;am^?K(
z^!XF<{f<KLV0Q*Q+!9a4*3$+JD{JBXeO=Lo%Zla=`kTEUs~~K39HA2TX>$;H)%+kY
zHK8!)m4<LjuHCyro|Bs6AnGwlYAdnZIeV~E1z`{R_$D|Gw7<y1;FT(vKxNRDq4}`K
zXOUG9vANuoKWymC*3pdG5CvM|+ZxPLu&`$eHY>-9z2)&d4LJ^Zi7u=aoy!iB?z?%h
z#<{8NxPgeHwAUs?tgU~434R@FWTgRml>jNFxevs7xUK<;JBu{N^lsd-g;2)`5U{eU
z(FP^K4Y#6>>tU|Yb>3Ou21*i#X*tC^WSf~ou&&u0VF$=F6*n)X$wq%uD{XWP2P;Ci
z^Wjdry5L@8J;j8sJ7l>v12xQXuz{B7u-FvWtn!#;E^bRXg(2orGdUc8c3hhiL-j+7
z*3UU$al3^N8FqlRm$DR0`Rp(SDvvF;J|6kR(3<>P2EV`tIEb0@3j?>x-oWUNL8gs*
zYsUt|(07DSfcgpe5$JnDwDKj*o5^R4mJ_8aKZ!Y#tQnPbJ%<2c&1(MW!7G5N9tZRa
zj{|R-04<Hgf`>9`Oto1bJ=gF!1-VaQsLKS)8!VNhgGxgd#7x!ChpOhvZSaQZd|S9U
zVjJ63?b*k2X32^xq=zje!!=}9%d1QXr3-L8Y7Xt;b;1zD^7yf=`vkXCdx}h)vck>T
zmQp%Jr?{R<1!B%U9SM!bm;QMYoaDz*%L95_UP(_k5iv){-ROK>kcW|{-Beu3o`(bR
z38kw}Q%(DJaxE$0(QxDo{ao0Zji(U0RJx%Q;~zSAm3y|HPQN1Hi1T;b01jwdDO}5r
zB}CEE%B;M)n&?YCrP!sl0_o(7itTOr($Y@WCfkByv;lmQN<Srdxd!^d$J;u!!xB5c
zhZ><$l?1lRFIw+*t+O~=vw8Ga+V_z?m$!h-B|qoNDn2uqqE-2Tvm3z8jpl5A({aI0
zjJSN-fy1UppV(>9dVXrqtluS&L~-AvBr7XSFA%a+3e0+6c?jga0LCch_{vj`hONA1
zLcM1e+-D<*Mhkb0U08F+?m&fPZ{Vs^si?!&<e2P4ji*wv*7A6{x$9G{5{PgjV!40%
zNq)z6@tZ#fgt>awMUx$30WCP!-Epew-auEEu&8|v`7Lg%6AUN;88+75`{Nx)lm|wM
ztM%&IF1l|1lnhPmD1t97n!VqD7rczr-3fy2VD4T&?5r#Y#G^YYIbiBVxDrUK;8v+5
z40Dfrc8=wu(tmA#i4tK?l@5$1onjeab7uyMh_)&<_r&i*U(SYSyW*uj`QshzbK6%w
z4##<=<<o`otm4$Yl86?fn9d(xpsdKPI-E74i^rp$^I2i^boT*5yM;@=tQWLtj%#f(
zE%~g_nc+r@961|;18Spiu3M#2p8TSUO`B%BuXu7CS#OO9dmNACJ9C%hYzl3dYjuMc
zXl27aQJ5dl_o0r9>{-`;3lJ26xX0!>j^xi}%^s!rd|DMzh`aU4UZuM6(Nc*-6#JG8
zELB*;8uik^%pzOH;($M+B5SlJxbsjj(V82C>+K>M)~uyGtIu2lK8v1p<nc2d+aGx7
z7jL3SDxJ?^wohz18gQq*|2YUGsB=!aW)0}9o7A6Ja)Z;2pt}}ru8^pL&!ySyz@cTa
zSU!Er<v1d<K4(l^D_6~5_pnAc(O1<t_iMNS*b#VO4gF7nItOmwg-$<}SGe~fuk3?E
z%8Jt_VpOjX#)thRM9#e4(88Pb$fLKWE;Q+jQ+%OjDx}3dt>}B%`b%>4wigUqgIq(>
zs5NKEse;xRxePTwIpD|+dsUhJ+YTQUvV9*XdsPwGr4b8p;g`&|4A%tGZ%ig}7~>JC
z_&nK^9}Wy9(r~|dx@v-yvGG{rpK2fGYSYXH4W7T{*ZaA5u9OZ17Vc5j3|l>B<}`Ec
z3X)MV@-u6o*DQSRB2f+oOMg#%BxB~g>0#>kZnB(!^eHK$JqAzGY8K56sC8q>VYpqn
z$_-UBinC_7NBXwxr|B-fP-~jOwXqO{?3b!at%J)L?<(hGl`rKO$NMu)7Uu9PmdhK`
zj`vvjLkCI5)*B-Z95kfTzgoBLdoJ?MjUXTdM$Gp7-GZ+pHVT#6Th*0Y#)E<Csj>3D
zMR{RnPyQ8#%v_Dad5a0#ylBniSSN!QA%RUa{nmPDNpvm8n=5))Vt%X^q;@ZuGYfxH
zLJ)-l#A!aZ<1w-LuJ5opRc~M+drQT~hn@|$vN0-K8M=)a)|VxE;hQB|dqx&VC3h^o
zIWoPCFUmUOM?&dkwFdaH`|wZU2;j-B5yyW7CwCvO8~;pyRh`Qy--(*aj!*=F>i@zG
z$124xE{moA9J8K8bIk@=P#rqE!$t!Q0yC<qyZ3aUjCL0O)>$^V(PN$>=RC!9193Z+
zRv9&qbC5Nv0(%Le+IvC8G`TrWJYON(I_UJQpc~iX0|c?}r7f(UzQfq)i7_Lr<oAL;
zRuKO|?WYFVPU?j_TceR{N^)7oQ>Qya&oiMkkdLd@-FCP*vX4p!rtjIZ%`sjXzZS0E
z_PnumYD~~DKIXS;P!W<>%$sa#E9!l_;$u7YlPMSe{JF3-rM*5=Eg7$!rm0NTt}w#Z
zr@VAPL~IXDI9x_%H;}h}u)>ecTJX?25}sMe&>3>14}eDEe;+Ho<6@*B*FKrA&=P%U
zpr=G0UA5Mc*Y`r?kYcQPhPK11CRkwe%$&0*Oj6;I*RVrOeFX;lX3h!4#*3k2cT;K%
zU-QvN<g76{$EA|os_M3RJU65ReOK-`(X18SE+ts&@bn~dJI~b|%}~d`p@wxi@cG*a
zI<+VvABH4WNe$a*c+HV*1T{(NvXjQqg1c6B?sL&V2wr_2MDY=qJBokF!L0cqIFDhX
z&)(xbpK8IUYSEU9EDnX9NvpZv;{H87R2WdF-Wzi|Ze0OQaD^kp!an`@8OFH+PRPo+
zkC)a`qDt&tc8I95_E}s#i<I)mk&56KdvQED31Nhnp7ggfEgPa>67_LUJ$gh#z;u&6
zu#eW@dewY2#^P?+5ckV<SG6*nZj(prES{r@^Zh4X%ca}}D&+}775>d3r{ZXhIgS-o
zn_aq-4)MSuob$A@PhABRHcp!R!aea;rQsuM%a%%aO%5H@=(3ybUKK)FT|F5j{C%7P
zBxHmM9l7|3##tPq#<a{culG|bmWPy=n%5rJ6~y<fNvJ4f1iT`RCKeLuEqSk$VEEg!
zcM+f&HQ&yT71%ZC%`=mW^k-*hg&Kuyl4(bE`|p~Zw67=#2LR6|&<)3pyjMa$S?v*)
zuVx!`?2XYrQbM`*WyY+|Us@4@>N!Ii*)Z`Tl=~Rl3%G5e$nLGKA>?8j*QZ`ZjA0q~
z?=)E*Rg6*fLNYp{O)1?ZL#j-hPq^<Uj0QG|APi%+zOfv}-32Y<v*?B=#C6`YJmg1@
z))g4j2VA>2C!XVEw=*MB8d7hgTiqWILZg?Cs+bqI?COt+rhQKn-<h+wkZb*N&?77H
zaQNsLS(Qd9*<cH}GLJ7Y<ha7+s25T!ZHIqHza#-|)#j2ch=2lx*V(f<)vfDqK{h+P
z1N)Axt>?(nhQfV@p8Fe?`9xvrc@MR^`9=7-vw<G~5L4#m9PWj(TLHf}Vnc@ehF#6i
z!WJZFp^rz3__hKMCmP1l&HY?12OOm&TF2X~1H_h`Z_sVU!8yyuDn4`rP>y9`xW)4u
zZ*O-u)k(;NSbW67!O?2$q^D7+;qNC^9_)7fvU(SXd!fNn@domx05N8Xx`#aDxp^>Z
z?9+{HYbYyJwH%fVb$W$7eAvV}YF(y;BOkpxImK16im>cyv>egjESyP6VBzeKhowER
zL2#J`hHYqSf5g@%;2v)v_i&tBRGsr@a6EQ)aGZ`~(9T2(!&mzyGTtD4yRK1l74{V#
zALp7xY-o^&wxJ7XxW6+?O>YEQ0+1i{F0;+6t6^Pp{;H=?-nJ+de@%aXe5Y&|%_Dud
zM@YWj%V9G<KqBy}I%|Ls6qTn6;+#IzHa@yH&mEjgWgdxMU644!mksCnI8_e?+ee3a
z=nXV}e_{G`9omIw!_br*{KYIC<~wNJ@;MP}!Vv;X4h=<8$a{}R7W1)FW9@YMg3BHO
zMXN**oVec^=FEsA$yM2_e4oA;T0AMOKUaMg^y4QJA#wvPRmL_6!~zHsklG81EIpe4
z%6awr!|`@h*ZRdZN??uGjt8p5U1yL@(52pGo;kkyZa-K0xNZdD&Ph-beJ0GnD1&dL
zn{oKPiobN`h0^)A@#}eeR($WA5k3QIPo!biP{vv-e>^9f?3RatGqMVU2GO!@RoTr$
zg7xhcQlr{|)I5Nv9LwMWPHs2B-r8Bg<*zZk0UBSD?8^M#2h}oQG0^vs2mHf|2lle5
z63-MImMy+$w7o4DKFd6Uanr0<Q6}FougF2ja+l_qj3UpX&62dLt8~YSj;M;0MBClg
zPkskWp@VoJ+Xqg{U5|eNF{!!>`U`^ob-#m$s=kZ>d;%U2osFeHDyrXT-$w7mkN%)@
zOdXfy9UnJjO4`ung}Qb+1s@tWznuY(k?QKZH}>3wQ=T}&CQJ<=f8}ef{rO86Zr5Ua
z+-<V<=oC%_`<B^ih&0`P3HqJRA1U87lLICFMMxn|{j7ELSsyA_L9uKSnWV*`Zl{e7
zqMo$H3bTjg6}@syDYs_swJOeqL2FK}`5LXbW<4tH>%(>wL+j70SN5#|Hn>xp4{NBc
zaFrw&!skB-KM*s3mJ=5g_^FFTtFYr=p^ZJAc&k22F$^z7o?o5)hLn|a<7Lj>@2YJ~
zEafrEJKp7j{1*QP$<#u$AMoxxU!3Ca*4ka#GDI9VI46@?Hh^{<leVcPhLic4rXl>@
z(Je4f9uh|%vaFBY5jNOlV1A5uH0#J!B47|LP09Vdq~BpU5u4NfMFVQ^v6HqtnqqIp
z+OX~iEker)VOLImM<9I_&fHUymZMspr<IG6t2adU=00V-QHv%n?La91L@iOuZ~L#*
z6c3M4bJ_SNJ|9ey(0&b82&dRmp5?rJQ*0Ev)Z|v$wEmhp46{INvMVGhfUwO>fKxDB
z*gvCh$Yy3Tna5Xp?<Vv(wsn;>babHS{gBNMY3vD2SY60+jWl2Hv6lX#<?ysWMzx6M
z@53iPfU}K(td;k|`6#3|Q!aVI65I050@+-&aT;1iL;PfDt*_KK23jq@VJJ0ZVM64S
zhez#Gg`aU`M%CUqyhR>_o0XA{0ep8ofz!tr^pjfP_wvw3{)2B&dhu$w#W>QB9aL^^
z>&(*+bPRl{F9no@uJeWhStJBkb*`K<Oe;uwVD?6*Lo+9p-zE^eF3&5O{PW)P+LQ+z
zjrXi9o}Fgx;wFQV{*j&H%1Gytm=e{4MYZwx0@Xp+E^{N3NqwHuJGuksGdV-Wj%>=0
zbNppW-t--QX;k2)Qx&H}O!u&xdn=un7x@2X3BCCj-}J-hf|Q_rIB?yMzxpU~y#48D
zq+s|-MD&UJRm@oCiiWwiAq)Mb4PhJ-rdBL}(i|^Rb^F;C27QsVbqPAX`C7O-9(KLb
z@nOIh<FXVDH-hkYp`#!pv_jrSJ6F>mr5v4O^9^tQ$#${ZlDo{33xZeMB^td?N7dh=
zXS$u)-izS?%>PK4V?Vl~Z<kwn8ZpAvH65mml)Ih`?zC^^!W$VVpQYwQ4Yy8dS=(CL
zIgeEx347>2C3e|48beyx3~=)4x_$@P2qX*stuZNe_AeS^^8ad#1v~&Ow8qWu`X6LH
zQUR3w<@=uY-%Y0fd;GnRfv?YiljYuj5T7V30bn(3$c19@KmR%$sowdo#`wP)<Nt>f
z_A}A7<JmeO8O_*&{phKAdG5Yi1?znK-u~(QSf;YBN_qfwC?Rlu`zZYQBe79r;=sQV
z27U+C+DDk3<7Gg&T9qInMW+I)Kc4p2LD7eq)zY*-zJ&Yl11A&QUa#dB5B0|ucq;WP
zOJzdqdt4>?p^1wLx%Ku`J};&@M&vj&kZ}pUE|j>sMVSqz6+r?@&QBUDhpxr2X_;~j
z(_Bt|RjI^!+U|L_=q2*;E}GnlY2A{OgUYRd{EE`UEzKpWo;HbnuMP6>jRKd3MbIaN
z@$Yt*4pErt`7fIpR$2HvGI@kJO>V8n+O`$*?b1#kJw-yO=7#)vJ!3{5BAB39k6VtF
zGamhipkH~Ul4kZZ$fem?dad}Fn!p30NI9vtCGW@@68YF)yZ^3lcdnyvJ<Z6#wwZ|W
zE6j$aTRYfw3Jp!*EMhBdU^6yD;ZFaf@Q)T@d+XU}QK_%|Mx<^zZnLzm#ZiB@2!}z7
z@L7b!F|&t@SBYgWy!)GXutz;=-q%_0=r4VX`(x*4{#W_$P|OCFo9WS=u#|mxXc_34
znY4}-qpq>;JbYS^WR^^$LHzUPJn@hn!qU?JxI@TYb<@gJ=~ORbZy`hV8|D0Xp&%C?
zND>^!Q)|1;YyXwhj+E4nHh;U$C7E^Pyo`bt^S}txa+g9VRpz`9Td<usxg3^Mi*myf
z>z(#W*D{4GCmUWc)^sJz&CJ@SgqHxT3wC0F^v|Rmt7$Zss=bRM#ikISUB<tIqkR07
zXnJEVpg8(H59k_d5`(TGE7WH^!$rJX?qq8?rOzo22hQ&{DXfSxl`k1j-fgU1nAb8I
zv(@DO#Gq?q;0c0!D-W-=26N!sw18ZUzKzzhqYL_yB=vE<Yl+a<3dgX=!ybnr&SBA{
zR@a}Wl7DO&?oP;s{O&NSBMRUe!r26+{LeFUQVnzlIrZk<Ls7_<;eBMwP%Pw!pwdbT
zoQHt=?bBx_{!l~*qnj_$xj0g{htZe4!LS0H@7Nm|<GStnbJyFxOHQ`9#n!=+>>hH`
z`hR9|4s+$apWoVir|e6MKU$=7s!RN2y3OZ>f?9iq7KV+b*|3$xBmc8cmWsU)Os!Ui
zEih=+U8z65%t?7xjZDN6c(x1W*vC{Ll6x|E_q+m@XLEgND`Hfxaf4(pc}E2HL66aL
z#n;7CDn-p?4_>vrt*Kf<uR@~Mn!>Mk`OXG|g8$Qd8TDjn6{X!==HNc87}L>gpyzo1
zo7&r(k_-@ad?;$Cgggk;zawp#>B@=@S<YVh0Wu&F#{(>Q2JrO@Si5usK?2>jt5O|3
zCWkYX&p0x*yQRQ9IXPsv5DQNaHXRg#U&*%wI6B8??eCaKCF?oEE!8wBTy4(SYCVNZ
z5uRG!=?9jRN=k!!lntRZ@!yThrs=6=+>fGYW<DC>C@hC9n+_6}PM<MoJ#ylDsQy}!
zKOyKo<!oT>0mH5~-B^^d)<QbW(?Ygz^przWzISWzt8SW}<^i{JL1dw&hXO!mm}B$)
z=nvLpM;zE;%bq&NELap2aJ~E8eYcW=`{r2Mu?czw%{&OziBVNAGDoEY&H#f0LJFDl
z@Q$}1m$JyWw_#FcsxNkFc3tX^nOH>)qE;di?xI01b~h%7GNZ=)p$etrlgB2jz-|df
z&8E$CU@S2qgRhm)ies}h=rJ?_0rwkf#LN><xBO-J{TtFj&gRD;!9v_{@u5<-Ue3n3
zsqzxThqU)h!-WzK_Wlt@<2&m`8{ON`J=H3{J(g8j<~n!Y{O5gutXU&ngJ`YXlyokL
ztzR1w{p(=f4pVtYol;+|GSNefq5#X{^!wcn+X4pC;z@#LvB1`P-4DsU_YB(4>_*4i
z-3bfau0|I4-Bl}mtI^g;^O)lv!d|<JhOaYZLMb-mP5a>UNffL>10eSB&%HnBab0)g
z^ytTYzG-fh2WOr0K4WCi{@}SYUz*HnWA(eY^y6P~24y^dbq$9*bLh)AgO+$K_Q>@O
zvvP>1Ht9C2HalDm9jm^><&Z%B$RWT~WJ0)go#7Ng#6mj}E4%aF6{{V+a{m8!;r2&Y
z?3V*1(YQ`3u3dDl!HL`Kx_cMVU2b$MaF)Xh7Fjx29js{<IXSa-oEo(^d#`^Z)stfU
z#U3Zp#W2o;p>L2eHTv2(a0UBKr|`Vg>7XVUUpK8))F3WhJeEF8msU#$|6%o;{x(MR
zqQprFWfEL^G-dBQN4L|5Ht%0X&E{0bRO!0H5ajD?|3seb<{Jg??rk?Q^mbAsF}Wcx
zZ(+VDg6@+gA+??+BbM&#2RQKj%?A&sMen_q53`|IZH;h#OyQEiV><i%A-)mD+&Sy|
zf&D#u&ndg^=j~w;!floBdP?+ItBrW2hRdDz*b->{J=GKBp1ljr#8GwfBc?71wf8N)
z4~hO#O1<1*5}ClY!n6^ils@Yq4J{lZb&))uwEFgKUY+<5yO6w_k9lpse6(t-A}OTR
zKiB33C(|wIcGpRENKQ894PqBu>1IOFHidwl<(nk0FJ1YUe`ds9f5sFI!|s=zc}1#J
zJrZU&`>K%o_Dzlet&RZ&8#@oIYfM$nItmS&9I<cg&yF7By$}5mz}_aEx;Gzpov!C}
zzsfvBwa3pJb9olsY3&oqyHDbYWvy*Ks|st^W@5^}v?$8y_|wO<(eR@_|8SWK{)X#{
zHeF$$DY4kYcIO{G5oBp^zTAD*B>y2{=4B!Kqk^2{n4)j3N*og;>tkQi6CDana?hY9
z4+z-e0$UFn9_E@yEr)1^<M&tgzO1jyzp2!5pkXvWRg&cJEx{=tx-)A^ARn@x5Du@g
z;!~Wr^nkeg$LHY@JW+&SIwQDz4O8IKzy3poNy6xpQtaft)5YUy$Dh-=Te11AdMrrC
zu7Q?>Y}l9~Id$LA<8C4tf{ZpwH1VmJ5J_A6pw8VoRT7cXFEc1~*eHTz<n%qch2s2P
zbepBmcynZeFC`dm<hVsICwEAsJ`pu!=gfXOl~k}cHkgkf)hHyQ*^~Q7c`f_c4tFD8
zo_G@WMhBvk7(N;?H8w(Gzm9o5DT9e|@IfnlkZ?%bkooqN+;sSSUi@R5HTJ5#kl7Z4
zL)GfLGChl5UO=hPg6FxMRfCftUzr*8jTIGNC7sOIJ~%+bn_N3Io=Z2oy7=+HeA=C*
zJh(OXq_kav_8Zza>dN0v2QWp@P;R1{+-$X=zxEaTpefclA+!(WdoV0_mzn)GO>)wt
zR&Lb&o=!f|=&nZxL;J^eoA2;S)5s`Zm5&D`9wWLOtb?m3T*qGi5X|V2b#Ft(Cl$UU
zz46pawu#08JtDGCW^{n#+q}hNwq8E-rkZ;H@c|d!xaqbgpWVjYhtA*C3h?=tUQ)ot
zCHe{PVt2;(o=9~s;?6R8`>OlrJJaENX@y11=Sf;Zx8QG3MQ-+Q5bWJ$YPw_du)rlA
znmhM`*z^<HWLOlW+DYzHLAz#t@$hO@Wme|V3rj2aD!kT@^KiKx<l8Y<9GxdLb(e`I
zRd7v8zCh$R(*jHtv&&b6@@_r(?EBezpK7<5lpJ4M7(*&?vOt3@6x~@8MZRt^X<4(r
zx*=Nq-Iv1Ib#l}Om3HD;BQJwD%q9FY!}_HoJiM79810R{n(jd_w)a+I<2tX5&BP7I
zwMMe6w5Otp9Z{H5Ta!C!$pVbc!*A}<7`ftmb;CzO;hqEV>geoex2Bw91J3)?r&-ab
z{Jcz6f^g^PnA=MAQWeO#{R}ky2ZOfeZf~h%aa@(f2)S&dN_@_dOR-GrFjT5n+;%-x
z_&mScj3Hi(VSE;4(dUa9?*nefNjB`#R;rtf98uJgo5U$ggzRjw#(b6GnIJ)^Mp@6!
zm3Y2EoEQ4AF>^<*a8YA2|1}=Z_q$A!V=$KAzd$#y-9*(T+j}lBx&1zejJ=^?jqpjS
zhbLBb^msiQe1f9JeJYS%_Os%*TU|Cx@suC*&!^uPYBTNOw6+D|8i)d)K+U__&BMF>
z*YgnnhrO>1%W~V+MkS;{x>LHlL%Kn_yE~;3kdW?{PALKDmTu|p?navLVXeK^S=*!R
z{r@|E*2U|4t@oL8%#ruF$9$T;bE1(|Ak?e15+vz6F?FF5i%^nDsd|R_x)ouWsI**b
zS+(bud<x{0f(l&T?sE88KreSfw~x+JH0P~dl}gd|=Da0C)uZ8@Bzj#0T)AET8*k=%
z5!(wv?HgHe&V8p|4vN{~>Zu6gHb0mmH~3ZshL=Y|suGR*ZDUy;J|Gm+6Up!=NG<cF
zKR6B+=Pzw0*JIY+@^QZr_6(c1`4A$Z+56_#x*`DR3QR^#(TisgBE4I0gJceZ7%003
zX4uj^N17};Kju;o;gKTYep*GT@j#VHe2H42Z(u-ScR1xgXFYFA(|el4lDX2Pwva?c
z;n!gv7Ks=wbG0fElZ6t4yLZWkAr%qMMZBglDYI;g>R6xU3^Pf+9Z>?`=_<LwMV7r1
z7=s;qa}7F;kQpMV1s-V1FB^S8mekK-qeL4>W2&VYKqbkMFVpOKP;hU@$kNMnTC(u{
z#|yid7Q!3}pRA7~{2%aSEbXB8?dPf+w9d`krv}@)gY0@m26)`puHWtAU~k+-srKTA
zlg=vlF(#}a{>qQ?rRRcp6EL^dG-!G+@6p8HYjH2+>_FVtQemG29N}49v|A)`-r}dF
z-lJG1Z7^CY;1Cgg_|bWxlMW41R**f=Soi)V>%tWv7Vf(usOj_sq~&IO?InxRy8F4^
z&ab@t^!XpTl7PZ>_ui<Qzbarkz@&4$FOKoE8ZqWXS9;FLD;EWcC=S6no~gVm(}9e9
zezW%z@ud?YD(nT#lg7FVatA7;6=B<VipTVny>h&?a=DrN<_R6$dUtGJ0Q9hp107Gg
zv&;f{J==|?UhBsIDJNWX5fcNI!95vMPrDhcCe3gB1ZWZz0{VzT*p1pNSyr(uk?uWc
zWf^Mj(hfbxX{vAf(sqd~6k(CmJSndeksK6Li_CDxNA&6~gX6HAj{7R5`qUPjoT&l|
zStF8JE<VkZF0SCE2#TC`R~Ifi5iabNn3x^pr<U(lYY&9Ye8~^D9U_}{U@5I@LAaA+
z(wYdotbWBd8YEz<?@!3{+Vu1@B+Pc*{R!+{;hJ;a!1+g#d@2}*VEGYe4E4;Gip+lM
zPVTxN(ABmvYa+vBx}vn59_k_UA@Itl5q4{AWU8e%8_}4RCpZ0y$c+>gTHLQtMkcaz
zHGXaRbU^5A2l*($ff`|YvWm8qC1TC8JUe9QD91v&+SeN{FUB$yWk*>7fo>1e(P2nq
z9LTj{K+Pkf+R;|t8y=||d}E;oLyI6dkF15=;(hLqb$n$((Ye&?hjn~rk>=96*CT*P
z`Z>@#Aux7^*YDx}+iV+DIT{FaAj?i;mcA3S#|jlUco!Kt25|YynW<mVu0G5AHN`r5
z19$uTH(hY3%%)De8I#Sbg*Xe9C_}@lhIK?W6sZnhRu?kTqcb%^^?M_|3B<rt<{o2$
z^HKgYQEY-$18KRJ|2tE9%$`&r5zzHIx&|yEL(mH6A{j`A#NP&yDvNYguN^A048`!?
zPHml=dF=b6#n-L^SGC@!^eD*MhJ=u$>z$C}z0BnH>;Nr3X1?Z2*}bW(YCrcl0rxs4
zI`<gK4oc25-X)^$Pc5`p;b4E&zIS!F_PIZK+!|b@YfX)Z3k9$3L6z&!7n*{Rq6Scb
zNwz_b)sfbG*xs_YS?~<~9VhXQcd!gGf~{({$a)c<NM6>ccfat2yPUjGCAKACR=4Y3
zU8w2fz{HzaWwSt7k13t>IEAd20vwy<!OQ2&sc9O4zeo>(O<Mwc9*Lt`SA*ILiz%Ra
zixx-_x2b1y5drxs!rCtNQ=kPQ96_5L6FpiI1eVpUd06x`Rs8lIDd60<)EXP4s*SmE
zV(^&dr6#w6j`PIsd4}AQ;Na*>(#kUuk&CRRC`63&RoNCcYC*8eTwWbS`)}Q7ZZ6?z
zN7@F?uHlSEU`2=4EzQrxfWq}yP)hl{asOBr7+~OR5sgdM^NlfS(Zm;IZmjEz+eDgB
zjG!pmnW0LMT_Pt$mT~FfYUNk1n@BlR>6_uRkB6HauO+<u>+IzjY1Y1Uc`UjPk8@?G
zkeMfWHXbC0v%-x_TAwiPBb3*jTVBiJ{aW8`X!vvj?cYK<kkB<Dp6-cJDf+=1uSg>m
z;<HSy7|<d3URKkP3BJ6`^}SDk@LJ`iC?x~oYvN4fl_r@F><v{|x172hlyu7+W&P}&
z@^Ez-%~KJKhMno0JR##25+b$~LINVveS}rNYG8I&pCMqO2es1B=Bk$7|JDXeSQr`1
zEMdak9SIDQy2GWlVUB0c-y0ol+BId|m>L)Na~P9aaDkn>^nB<oAsQ*1@Rs=9x|t1Y
z#UR=WZ)N>87W0V?jhamKP*u--5uIBwTG3{y$PV`Qa?RvKML?sRf{gNNf?b0&?O@3S
zYufo47vzOHjx%^B?jY;u55Lxp0U+?3ZggsXdfDx87@j1FfHH(jyRZWh<7_Ccv?5er
zpo%jmr}WwqHTu#&NZ;UgH>O$_8jrZbtltrl-twJ7Xg^J~SjREnwY~wx3*%dootthT
z$>zAD!EsQPnAz~6UANX=rQ(<nVeeV`(nXdj8Qo}fV?!eSO@Tk_DvPJFx$U~a|CzxI
zIts0QKmH6~jQwSqGf}gXa=lFi{CNXZ#ccM@A$0~ED<95ybCvp{HCaCk@e2oobdgv3
zXCzS3$Yjs(^;{@drgEA>Z!%pkio<(%wjV19m^o^d(z{X+xCsyC^=@{|F3;Y>SYqhy
z*$+89|Eq?2^bFXgK<Mk5{Sh#1cOG!p$sG6WH7#e^XGBu^q~?#BJu-&@6<tQHB=^E?
zel=9R?s`$M0;u#_MdH2`B!y`7oXp^MZp+RD3!mTCcN4)bpr-Yv6=I7-YM8uYL((XQ
zZ7JiD&Q)seE4zMU6L>zQmRgwT(fiOyCO2er5!L@7d67g+wpNUfKs67Fc77~A7Ke0*
z>)Q3YhkcJ^T6hk`7_K%%Lbo}4r`f*g*-p{@L{_;mn8}U6fb17W%vr-?jy2oGiiIe8
zXsZdLUUF^xo8>Gc*%P#Tg$pL;=%o9_yb}aWPlCs7{-S8ue+l@9Fv=Vb<ortZQm%Im
zQy=F`xcCgpp-P60q2#a-L6a50`AlXtQ(V4LVficP_lss&26NSG-9LCVNA6g5?>Svd
zQa2q-IFfug-#ns19RE&d)7hM}#Fn`0mTVc9bawz2(0xA@3mypSVWhWWgNdUlcYiy1
zA+V&)y{Q=ic3R~;fAsuK19P{Btf+#Udcfy%RuzF8buYBWsX_+vFqP96*it<3V?>iA
z?*?B)We!p9+Ag|s<D3`qb6aj^6kbWP8x6mcx}jvx?H``XME|wr^R;BOECKJBpSuGZ
zd!CWa_t%9FL%`j^<mZdPlwrj<(Zkgy-Z3zGh!%Hz*!-XtyLh&7*mP5}T|5`?Yr*{_
z%#6qB!u1DWUhu98E&B0#VA`Qj-0K0>#kJIjE<CS5;ERce2jEiTG{rk$pwar_9?$c#
z^<fiuTI%&-H}4GsE$)X90;RLLkpJp|FVB?Uw?y1uz%mQ`I-~tr5JiBsm#wTC{rvC0
zEUNj^o1cUFpH*AuWBgKWe%k#@e4W>TYem6hCHjq?{q#TFq2SYHH+u*S{QBwtYe$ri
zrQBr=#{Vw=f0fE^J(}~~K9-sPe<#Yn5`&)>`J0b?UO<h#ZM`VV_}_`LMH~QWD0!@Y
zmwo;uf@?}X9Z|0v|D@lU>`%*50uD;$*p~6XJE!m3fF!SHS;t`hJ5hdl1*C{U;mN-)
z8Gb$|@B7D0da)_P=%+>g=HvTV;GmS;|Nl~X4wR{&fC_JPn6X9qGAoUM%7onBlU`~v
zYi=p-cQdycNi!4qBCAz)M9*I)K+@q2q|`t?c~&hsfDmbz$qO~`kw7BhzIB5e!n9Af
zUEBp*;k8d+F^mtcUnR2n=T7d=?YF6t*mPkr`YWZ{lgMt8bt-Ebth;_<H9}42u3_F9
z-C@s4GrwZysP<3e4kS{kbo(By@a(CF=aT};%1v8xAgl8THa@SB${5y#hQY1$KuMl6
z#5(Rh`1~yOU5~Jab{U3cV27ayC4vD3d+lH;i?kR|YEZ`LbMmJZvBmFkbI9abn%?VI
zH?VLRUaz847DU~3-i^CUT9$O6kSp~!)|4xHpMPDO%2!G&qU7SJ+tA29eHE*0z~+Wn
zKR>wjW7ZuRmF3lGvh61In)h#1@n4=|9Iz$@EL$NwPy?Ip8%b;i)Zpscz$zu~ot_<`
z{+BQX%sVWT%Gk~F5+T9!kb<pft#Xu!(HV2xxx!*Sa&%&R-6q*349rlJjSkcYSyaT)
zoD<Z_MKQilIU+Vxz{cpwI>wO`itMa&N>9j{Zr{XLAD(qbEK4?!S#Q!hZ#Qk=pU`ZI
zCW4#H*&#niDvR3f>zfzZES?9l$VAa@)D`Ub=TF*b0I)H(_G~iN=c^skCcXkJrFy#?
zh%qO)U~7>KKX!ji(an6|L-NMQH>g$*bkZB>Mjgpku7P;!@TUTRv$>JoOpJZLntXOl
z(F&{Gu1qLEu^)Ejvwo$3fMwTD^uEgNdE2x^@G}B$`sp|5=1)n#Wf@3D?ASbnq=4g8
zfC2YCJ1n3f)}h25WSE4-1ckT2YgfH+k?QR^Us03XjVm;F(-3Z~vcwy-3p0jy%(Qkm
z|Isic=t5uTDR!VL6U)O%$?--MSDSt)mGdj|=8WxkookaDt|H}iMv7}i`Kprc7=fv-
z*l=m)O4A3XBZ|fxQ*H|E&`EEf-tB|%uH=pBUKPoWK^NzgplcX*xN#TDDbtJ7VaH~a
zSdprTl57{ar(EvR8^G(M1;reffZYyUMVpuPR5DE67Nd#k@}pSlrO`@2sRj)RlQa6X
zghcPU7qU!}>dB&qAaZj+?R~cla+|bhKmX`ZNJTmuqr=$r_2UjTTJUX|K%c#C4ScC%
zh%fzD58MU9v}G_7W*6yUXSGy`(wY{%fHOxSfsEq&0#47_&mt-%R_T`>@+kNy;2v8C
z@glE2DS)$#JLcCdIPoaO9$pOfpsq|rkNgyW{_Uf8)gzv)o^XN%S#-$kjh-c8OK+i|
zv6|e}8-l6G52b}KwA)IcB`c~ZWcKys^i0r1?@iRJwT(+f-ClTW`Noy|d}8b9Mq!)o
zQAN3QG22y#E;wrI;PQ|$K8Bhx=#hLR>=RXRjM%PoXMXBbYd-<gBMG-VeZEYM5iM?t
zuG0QxTXhc4!p=mrDFsI<?$Gi=%2|01y!r9AqU>U4PpB8YB=7Vlj*~2uL`r^x?ENc9
z%K{tG<vNpY>B~=_<-*g{3bguxAHPz^<Vu(^tFZ{3C5RLH)sV$|);%r)fUWnOIM;t9
zCxlDlenIXl&nD7E1WNo2P6Z?G0qX=AC2?-0#8u4@)=E~rXc?WiBk7^e=M-!yAG<8t
zLeo??m=OzON-b7rH4Huu_{#Rr#cvutgY5GequW0Z@0k)WF)hV43KOz_t6b_zZSPU3
z>jt%vwL7B_SKSou+e?zx85?i^>?!4X-*OLZXW9!7`yK2zBK8J-_RPiW5GW+u>OAGq
zif8E4H38`_q{3}XN9NU!lb{p6yTEkp8Iqz3yHyg=drA1Pf3=+9`nYLf(0##gps&D{
zHpbWmeH;flMh3+&Y!<SyA_d#+oTvy63Tqr*o1QRm9!n;PDK`Tv$JhO4jjWQNtaJth
z^NvX2M>!v^?{1U(0B?2hJw3*^;>k9h+aTJN!q&_4<Y)~0>ElB46Pt@y;D*J5B*@}g
zsgM+(Q)0mPhX+KWn{3<%uI<qkNd~M!CNR5D(%GI&r@UtX2R25s>VE*%ASFLQ;sJqj
z?1QVt@QfVrXIsz7o7S8%W{Z~IrcAQ85zEK+?7VgaZFkO?og19w^=c32(J^+uruV4W
z&aJBEw?=pwRhkGB<kD|+8qwvgG0ywesDTX2+}t*;k1z|8k8JDuYkkRJYpC#~<;gSh
z;veD55mxoMMyss-WLaY_H@C!g^h!zen_wOZpaH-zxR%jGYOmf*GauyTHjl6T&A=+;
zlYY(($bQ!vFZSF_;~z-8I07^3b5V@RF}!*=Urt?aCVf3Nr(z0^784(AqoOosX4IDy
zya#<b&sdJNtA2bgQRTtFC)9KC%Gh%_&!eC{aZb?~f}E;-JCebie!S8=opa+g-uv{@
ztWFPS3I+nE6Q$AJav9TRFAC1@&FTBD31N%wmep5doS7#5u*UC_B=L=&pO-LLhHtYK
z{y5`MCiP|}vUM5WZ`E?#>8X5bA0W?7fn*XL@eYVvKKhuLhT&W3Vr}qxW3Bp`A|cl0
z({y72ef{X9t#VwbVuBnNQo~uoE57Sm6;_O1_8zno%xcxCu5ooB5tx29rtn}6&nPeS
zO9Egm3&horZ;?0DF*Ko8-l*y2syw9_>0rPb)cA6`F`vtU1fqdv-fM-JBin(-_gbLS
z*0a)=1`4aD!naQgs3%HPy@|HTFunv@E1yn@Dv~s~F~;oyKteqFlk=+LyRZnkZA<O3
z`1@@M?wJdo@{{Tz!jI6k2yyfpBK{)wPeoVnJ0R~Z*Y-+XsN>^I9_xvODrV(#X_4*M
z@&QRIpZZXT!O*Wxhm2?EO^#I73x00$P~W!tzB9OC$cX5h2E^+D&ET8ee#PmQ94!c{
z^Bk}1xA3Qt#f^41ifhu+<y0pT)|=>w0tehXVNc`{T>!e(T^9acz_R&(EPj3SHj+Ro
zxnAN})eZckUAE5(>(!WMT=X$v@0apd(HeN3h}!C6m<-5ycop#KL9-JKF-&+VtA4=S
zoVf;6hR?UJPs?38)EX;j??&TY4aywPqq^wkci}PB7PYZJkt%00xG7Tf4P3`C6u_QJ
z67s2m4AGLoYOC};7lXlPtCNzBvvw={NzSC#irJ5eFjAxx6@h`XaDXj=I9f=D)c6$x
z9H+%CIi7!cEf1nE)7z7FAQ>3M%~qRib`a?uD{VVr(fo1lAnQ3Mc_+fwnDyrZZ5_{F
z^_|XLRvvD8f=e>vT3{26CWK)<d1^e5;75Q~I@~#!KiUezyP}U&od9YH^KEhSn~)U*
zEgLbpJQ^}#8s`=9OdlHI3k`$h!LNzzOkHV#;VTX*X=7Vq$D~sJQAPDDjt7|#A!c#S
zChkOL9sMveIT{<28)_--s|Abv1fB!x2Y9?MMUT7h+>r6d?6@(*Uh1d0wkf@H2tyz*
z%xo#>gx$XE+&53*Ue`Admgurvv3<($S`YzL*G}-$T~iVVGTKacgd`>DscY-A&<LQB
zYeGv!{5i@~o(J!iA!+d|dNv`WZNq>c4M`rNW+5wV$6lGVX4ji&gxB(IkqJYms`6@<
z!o}ZiMtD66L{LkGNfLVm@jzpD;oB<nm3S|9SJp1GBQL)zeOGNxlC=D{<lv`c_kIUp
z0NwRFgR5r!HWw<mXY@(I)g69dK`@v3Fg_8Jd#KdldSiw6Cif&-M%0IMaK<Y+BRN`)
z>h)?9=Vih(5yyIpm@sszje*mq=9P}}Hrm&DwCCNQ!_ZcW%_J|)yGU2>^EHA)Bz9K)
z9{r$7>2OYsiHpm27Kr1Mu^&zoKuQD-TeC`<`(GZHBh@SN`1+#Zm$@ZE?s7|7+q?b9
zh2={uTC3oMgen-cTdICnZO%(ZjA`8zY~f}4J`jzGsMK~C9(A>0A-C~soZ}#TK{_=K
zv45FKft~rEi_C{JrnPH|={L9Tw`vX|!_BOd_o>WhSjw(T$JHuBDNV*z3Z{6vpht&>
zxd+~FH4nTHeP!`zx3u~C;T9Opdi!v9I>d{GmS2AayxIy8xUI@V7X#p;mnvRKS>GSj
zA0{pIdi<d*hblUc=xPZgB4Tvx6pp0Bcg_Rsq^BT|M&wK2Ik&EN7qixG1&hEdwrb)x
zh2ifulCABA9&f;EuU_=r1yHN|o1xF1z#Fxyy&m9sZ<iiUft#{q?%u7Xc?6=tzv)Dv
zbo~?EaDMlE7Q!|b7Ai6{#T~P`K6eEFDc=p^{eu=znVUm>wLjVy2#`g2dUR|^@ao(>
zt{e!y(dLny+=fhOtnGeuVNa>vGf+5L;EZ4FF@636J<}ojf;dUa0AdjF;L$V|&sm%N
zF=K$J7VRgE{pq7OH(*xfq|Ug(k6zXW{dx4bG*vgM9r`CB>Zkn3Gf+DqH=!f@bA{ib
zLfUUb(-FWSp3dNOp#dA7x)a&|<EM9ChM?(HC&es28qK`)o)fKJ=M}x9LoMo0i~RSG
z>5paI*%$fzSC0?l3x2L;6Nq;ycXVS&5(r^BoR<0Yx;Y+UIC(4Fr<CL$j>zG$+J85}
z1^Mrb_!$NI>)R~_;7p`zUC^Ht#NQF^`zN5BoL4<1eo|%r`f<K=c_8p}tZ(T4V}ZW_
zxc~Z=?;Rj12jhY0r}gNsZ@r}-LB5#efTxZ2?+4C5_Srr$%RK3b{`&D}p#LZM-yQPb
zf<IS&to*_C=w!WQI_hlwCiRji`Y5Z@8_t=|=S)un%*@oYa6@N%Lmw4iO@~{mG|w1b
zJ#gmL6i;Bq(P`)YriePq?>gUqpvGHjfPR*AgkQNNf&@As2(yss<A>=H4bOh()Xo*|
zIJuSl5|ETeHXBeOxfI4~1XCOnI%+b9({ag>e@=qbZcy9y370l0oyt&>4pjp#CLNEl
zFR20||ITdAdgqoEN4a-Xafdww%h*GV|1T~4TiO2yCjU$Avy+}D??&Szv^Wrz8eKKk
zxZhB))CO6!Q_@aiISl~_8u!Z@m|D2)^7Ue&_hV{v+MC94Gq?Mv@?1YyWQIZrNcG$L
z8XRbRWUC_+n)lnS&~7~wVLx%{I@^*<z<F9qqKP|x()48M1+Bct2HOj5Ul)4&t}`^+
zDjVT<M**1HmI@%EuvQn17ykplVfTo-+f)S1fZTvsPiq8IzAeJm=~7g5Axcff^1m(O
z4QPez7?OPfBOH(BL#{lI2kzAbP-b+w22JkC#P#`aL$G1Pb}_XA`^XrwogxAz{b^Us
z*T2jFoTAJNPvpGbC7n6+kQX%kzjG^mAl?g))>coG@kZ?#2KEULQb0(@iY0FIv%^Y{
za#!+2S;N3JPynVwoqi3npWI@CymxC|au{09nY~L}p){8pZah+D&4xr9R-t+}P<DFV
zp2$9;%2IxQ6z*&4KG83$K^#f2a$5H})*O-a;ia&mV@u?#B|?(4b`=lM)m*3)UXdr(
zhWiMCw@I^qrjSxPmU}TA`J&Jr3O3Ea<wiOjMveuO+gHd8?Id5=S4f}zZRhh+uWHX*
zbZ`l3SeARnaqY$6CFI1&1j)>?S9j(sZbic^Vim(?r~Y|(t0&D0IS+vqT_J+#)(Re=
zp>}8eYe>*`g`dQhpHi=nfLHxQcN)R*H}IEv0{Wf<er4vzYy9w-+R}d9qo$-=EA`W5
zd3O!b`S)KOV{r8x$ay@RtKW3Z)2+WO85p(S-h6{yMA+44h%EEg7F3GM-@pd3%N6H`
zY}WbjAKrilxab85nWhS-5bKeyLePO5!p~Z8UdAv?dATho?lVhUkxB5&Cvc!Kt8aEd
zZ!Pcy9fJDTtVr4m(>Ok8A4=;`@dzd6u*j^`(&^by0u)L5qhp2smE>NAVKR}SZk?#$
z<@&a)r>x871K{?tb@Q5oNlJm-0zKPH#&MglYGs+qem<T5=>41xPajXI7(4rIWdeZI
zPF~c6xLVHgq^x5P;qI&%4v#OM@*u5uY+b(w7{7|wdqrC>Gk~<YViS(Kqt*$V3H^MA
z2Yy%aDkR8rJf@hEVIASZc0Eg8%5sJmwgG#QA!Yt!{=4|Jfw!$ihowRY;B<(wr0>a2
zySu;IEaYrzFy!roZGy<MlHOI8*x(v0Npu#AahmgLyDW&=_=n%V4tL_{>DTR`t(6{}
z9J^Mov?8{|@eB-uoC%!Fd~JS1m05%EAeyioa1=<0VWfg=SaU}qfZ(g0)dw9J3|)Z9
zdYndSS$2Q>eQ4Fy+_B;~2WzOVz{*K;B<x$AdYE=sA413P<J*xH&@psj)f5w$d3D6P
zDU%6nd`{k)YZN_DE9@A`f;|-fx;nlQvUC9z)QA}CYfqYGi3|)&MpjFheMYHN4ZTHO
zA`UOl6dRRg=1fSi(EU`#dM({F2<@AHp_i}ImMte(|3okQY*Eov_9B`}@=+|$WwIh?
zk8;au5(APS`euXphz=3Oas!5Mg}doMSeq#}=iknu3iE^A=`f^bg*wisoM90%=A}6E
zBm4Q%?43s0syk7I-<{6eB*!r{)P(qQLA?m5D&6MGSQc^@lp985n%&Gh!X@BIoymhP
zxW3I-6Yx0~Z63Tfuhf07H+nCX!n#sG#~d7$D71qDz61EPG&CaHM2QYPR!^xe*va1u
z%%<p3*UX20G|cxTKZpzch?saN?9Z30EZDUiti;7$v6NO;%oa}bOic~ET=$&!utU23
zY*R4{t(ITIOEEgzUxJ8z;-H9Z@^+4GzD&RnYl%65g7(~p=`)KHa9eSo)WS&(E^U6t
zX|W9%tfy(I7X?4IwoVl}4wu7?4VD#$O#6Jlr@$gD6XPLC;iswnk><tBB^0Sy?ZeVr
zm)wQwx_<2~%Nf#V1Pn-n>KE*VY;HkEK2dh|y|W538`&kP^@=R@(r@7lHvv-2YbG%&
z21|gvy6lWN`+8EUonrlpFr;1@@+4xL_XCY-HvrvLv0Nh<-OGlPjo|TDgofiWbaTkl
zFK8e74uucjQZrkP(aSsC#-brd6``pXetOv(`7Fqg-{OAm3%a%$os?XAKvZG}5joV@
zv?r{6*&0vZerM^bVZh4&WJy2&<s1(PxS`LAdrvrrwJoa3Wc0dvW-O<MCNxzPw+Z0!
zUO~-Vzh)h<I(1<$PY$i0PbQnrQlhB-1HoO66|x>H&AUqX8xwYLdQr#JEyz3@DCO|V
z57F?_sBSL7v!7+|GSLve*Sh^+VZ%1gXG{7NADQvTdabIB<nV?$fJ={&ThT^&xS@42
z#tfBJ)`V~DtVJhV5G+KZ9+$Y&p`s=+5w}eTI}ZypTC8!+Uh)&{c&sMEM9Ib)9Eo8g
zGpP1}JlC{oSD{)vT`h>kS?uj>sHWN4A#Z4bq2(i*6`)ByteS+CD1<tZW#}do`357y
zD@>U}QXym){smV=?7_GzfYm5!DZ+<Jrd&H}c{4Ov$V$U)JqGOd61MU{yTj#5^@bhI
zP!%Ke8w~FZ-zVZi(SwRPqg%`{RGQzj1eT_NRG0k%@yp>wfQX%Qmz`kqIR*;0(X;&N
z4GR$e`wq8JA`LU1xn_6DmH4UESw~y}dbeR~t<AI~&n)fP+|Z3s*IL!oP`MsU!9Lh6
z3sk>Me5B$|6PkrFs^@hBd;Otp)A}@IM)n?tHn)K#;BtJTo<vF}zOq`C(@<yJ#dYyu
zC+He^v+nzuUP&;z!ER9@bgxCK$V3$St>>@_qYbD}uHP`CO3o0!;Qq>wdE99BJs$hr
zI$GaU7_q&mnRJIp?ilxd`|zn0m0FE3>`6C{efb@Q&n<GIzC>r*${uCy(&tNDmq`c+
zRb%n%=3BB9%sax#S%C1x+#C5;XqD1-!fQ}SRf%U|9;|9+D9rd68T@`dY|E6(QypCa
z`QtBgwm-AC7S2Z;_mk7!jaghrXVL2qXlD@~vu+Kt3v<f74=0N661)w;pseG&AjTds
z=|O|oLGg5}mvQ54e*n^?)1ojEqn5}!xNBg3=%7Ap*0KEb;nNnlShgPLvP33CWR4AF
z(9dNV<lAE}2_@@!_Dc%wW%Gv}lim5mckf0gY-lKzxqDZ(RY%i$H-4-Q-jYR)ROKfU
zCB?H}DIjJ?^~TufM{FBVS!M3A?WACO1~N`37=MWbDM@V(w_TQ*Anw+WX5S$0)gurv
zY&WIo)CZz%-j0D!VU!y~D>3Y>^2~#w$nw};yzN}Nq>y<W5&!wBgzX?8Ec*^lS7S1s
zOECc!LcIJ_iigtXx}IHza|;entPAMsCtPI6ql?rp#e184w})7lg;HlCXdCxxURc9P
ze?${DHdM0mJKJop>OenwQYd>ZLBgUsOt{&{v|1ExU*)4%?SCTQ#EEmJVRiWplnpKa
z#J+bG6m;kPw+iN}2JaafY237L?(}C+tV*MwG4;4Gtnj!Qjb3XJ=XKZgpc1aY5ZhtZ
zQ`BUADI=0gbjak-1>Kh;>y6}mgUe`7*i|Aomr%G_zkh_8L%yrDlMuZ&^=dwnt_|On
zAby&#*PTE(e&rj7ZXo{yTIE-(W-@P-0>a%mBI^mf%4oLDa$Z1Ayso6|P9!(L<@eaB
z+PR#WdE1x8^lxjB|1M*H&Lq9{(Ez2I65-RHrIkNAY*-ci16P+5!m_32=3ti=_yLlL
zu}aJq)Mdh0lfyBCW?mMF$>Yuj9nK(2QBm83Hm%}QURRQrnnMH9-sBhaT~@~(2@fTP
z`<`gQCXU}AOga*AmhE}3r(|4Z&9Hq;rO3cS#DKw9uJEwUB-Ajk_#x}5iizqDe%zC#
z1Y&y`yW2RLFQn|9LIV~V1|P4SDFm=DeiX_zn|z+lPsuz+5rQ)UHhM~H7iP)m%`qH9
z0rl04!SlzY0N3xyI^Jzaz#fmT_dLegpg@j&_{J8YMXc|e(WtM4&-)Ij7qDr~;;J#+
zFTPJivh*04d#QHml?4rc3^XJE1GQIl`3tpYR&J6T#?f$ic{dtE&?AT+S1snBvhQ0H
z`U-K%AlX!{ICXy0vgFWiS1@6Gv*^A|oZCFLiem;poNZNtUnks^OU?l_G@6P&0Dt03
z*s(2xnLqJ4dg7Nk-54-aavl*xm*Ys5b#J9EHbAezpU`Vrb)Zg~F_^PadA@HEXPuVT
zo@@WoCA(7sflnSaS(a76--Xeiki(mx)|gOfIvsc4>zy<9cjw3-(-tt-<^WTGQ7jYO
z=taCM&KC##JAIy|x5^~bItKnJM_h^LcaBq~b*sQBi!S8yN@uya2)$!*m0mx_@8KwO
zOAbEzj_hI)^sZf!!%dWP=-r`$S|;Y&@flUamm1<=$>B&k0b9&Z%g9DmqUGi_I1)JK
z*_)DcqNA%NYx{nyl&ab*Mci_916#gPx~~CM?KMI2(!#_U*5~p3VcJ*md;Exv2}thY
zio5cy@zXhbU&q$*e3<c!g@9qY%V{`Hq0j@;^%GqJA@Y-Cp2oeVr2(_UAL0h5`hjDS
zP&8>J7P*}rG#!@a7~)Bj9u41X6=L!*DC>AaSwAH!m*#N7=XoVP3+Wi(g0Vl^bhSI{
zGVvrz*+8dYlg?6YlsGUuN>S_by-f5U<16n^nz%Uq<hu=}P~KyqWvCO#Ktn?d75)K3
zL?r8SH>W%|&j*{sl<$DRtYvW2-Vr?i8=p|#U7^wb@kUw*0pw5shG7cPtQ2~Fg$FDT
zZN;SGj#B7i@AI0U4fCHC3%t5Z03G^Jln*zNF4S()Z9pw}TP#K{U6rvhOZBZ#uVvTY
zeT`1iJkHVFb48XuDeJNtnrTTXsA-L~Kz>Z}t2Usoabfqt??5#18diHDH+)e=24Y=g
zV9e{oC?^~s0cK8i7C~?}N!~w-!kPwj7RoPMG|bQ)=Z(#f3%#W?Lvk<BgUWT+%sHCG
z7y<-Uv2P1GTs<kB#52V3{jkyC#pss0Mx$&qutQJIZmGUa`CYd{TQbp<Buk#X0#`=n
z6~@b-5`G{#m4VG2?r+Y&PbNKX2z~CDG&K6{c-EiWknn$Cil6>Edc?<E@^Eerl5;Ff
za%bwe(0p6*Z#{6WuxCx3TM5Jx>(UWa@7JPdL%<3s`asa8a~Um-;0BIKSF*@v;VVaE
zS*U{NQA$sBc0FmEJ6Q?E>2%L-mkVP0ZcoA&MQ198Hqa}VBd)vh`4fW;z`g6~ga+*}
z!isx7C9sD<M<OEWp>m6s5N^M(AVHz6%UiIY7&W*{oEwO;K;MNJrm_vs+GHg;eh!1V
zm@=0iaziUKOs}oj>e@3*hUFp?q59e7$j4WSOo+Iv%vl6PGuGkYVp$w1A01`A#%pzG
zKGeCc8O?KrYX6unvY6}J20P3cIj3;$@ug#-wCNM|uJL2NYk%0ZTSacV-#5daI0+4B
zV!(n}D0H*^=C&VOJmSsK;nfn_W|vvEqyb4-HSrA}QOTfHRB~px<IZP`PSgoo;*HbW
zW$sVR1t<IgW4y7U!&(u8L4-G}xjD70T7imV<DM<ki7c0TH#SNLUk#^tvNl0mb>(zM
zfVRqr#9(0!PvovQ3ukx|yD8y8xg3*ps`b>wQ91ExI{+b(tGZx9yd<`NR{<G*^%-VD
zK0JLoaH#~<cV`C?@|=yzLy3geZJaNq`%E#bN6`N(@~z!W^T%mna3e5Vg1S}LsNJ|p
z-HDR$Jio5%m%8+x=5==LzXx}_C>|S<7q^@yKmO4V5|S`%5ivyg&|p+;La#2`xZ{S^
zNqaC#noUVi!P1~mH&*!0T)D4~XF?P!)2ef4hw1Nz&=JA8Of+g?qE2r)0uwo>{g88+
zgpa@)OAVfTB;?=;%Z8<w%aBWOSHS_h7>LR?_K-o17({pveiG}Q+WOvAE`s<58ZD7<
zO6=xs&({xgj&1PU-vfsOc9<B%-ixbf7}ANY?l9NTBdx{u`mcw!;k$+K;#%><#2uD<
zMeDmYh@cv)^vp<04yu_0;b6%Q`u95*0f6%EVaF>svoC*koGvTxvn>~lrVoVJ%`!|Y
z8l^7glUYCv%cF)4h{*)45X@%sS$eDwttLHXMbBgxg{qpF_}Zb9A}4FM0&?$24+~-N
z#bc?94L_aE@vC!)!srjbU7vWdlXeX&9o8j^llQh6KMS}L{9LmYa|vaM0^OX=?Re8>
zSb_G_Dg&k9v<A!s1;&`dD@xsSccPv%q3!hKt)V32Jy8fkbX>@2cAj1`=L~*zti@M@
ztHdUv)Z{ABk}sZpIxltAP*l}X>aAK)!Gl<>E~97ty+^Pie(no!sqKIC(KcTW+?`Kq
z-+A4ijmi`}+yn1=DP{xy`+p4Uf3TJRk751W!s`DR*8fa4{tX5BKZf=1z3xAU3cQJs
zRD!p4@WBfJk~I$lSkfOo-Jg<}e|&r|0fcT1v$skGEf>pF70a9mKr?9!8*<AX!k1B3
zu)zbtI1$$6I=4X|eJBk4AT?-s2n{2Kp%_kpynz*MEDF+&-3_70*=@(>&+hR*e)`|k
z9J>sF<3;AKnC{R)Syrxt2DbFKOlM5U5Wx9AX;`1JQVrdKu=rjgv_VkBdvKw&UB9z^
zx{nO<{O<t(2>dU#sLH~o0&wZn3dc)e6Y{jd!th}M7y})%R-{flhvUQ-nyF~UvlxR~
zBR>rL<nC`Qd7%2RKVA)7F5QHK|J}^|Wrl;D3amU}(s&FVpyDO(QdSTdn#K3SzEprL
z>QG?UTX$D=^tkcztc`j`KwIH{5qA7$Z)FJ~(Q>otS|#yhrli9oCegr-)F>O;wAtR}
z`R|VrcsidnK%NB$doDuI63HMkJit`0ro)C*QQnTTiiJpeb$Oy_Q7A#x0OUZFK5Xda
zekyc!lu!QP`$vv^-21t(me!ZuM21C3_}G&A1!T{q!2DOv^qmhk#tG>@SP)3Ly}$W4
zbNgR*I0tlh{vge6RRRqR3JdtIEyouH*w1Oegz-+g2GHYVst^Roo<Q3k%L<c6LdwKP
z7e4(zdCoqIub;s=9*k;oj{8YlbhN2f(U9<?0&KpjWl64>RJjZ{ExRGt&tvO*8Tf_X
zTupjBJx8=1wN)OluBJEmgF)AMCm0-P9rAy2npNU^Me>qnzItIg$1aR~#YGA0T&+*H
ztGih}&UL9`K&^&1UY_HI50{rqBk0QDaDw5aCTGNWFkVM0;1?<G*j&0rqpxc)K}Ua6
z6#;%U=kss+`?HRGj{*cs-TJo3kMApn2kyb3S+H8r(DY?!?hjRk%F79|F9Ox%2lJHx
z9mCGPo-RKte+}R>#|Sr`|Lek%M?Q10Aa;nY9ksgLk-5tO1Q?S`n08a{-g@orgROT5
z-1cq|#gx*+7>=anI1!aHtL$x40hAe(FOS2IKBAA(;ELW-jyRu7;AiaZKH=E{Jyh`1
ze1nb0=}IajTUIP3Mai2@18CFsPN`q&_1`<9erzhfqUvBlKJwuV$-<2>W@;?eW$v>+
zWf_<GU<A+Um0aDUMZ~tY{h920c8&0AaxJ>yy|asYjA1)<AX>H@Dcf2F3>0}d#EFj@
z*CG@I#;xq_+{JZXs+QaNC08+~mxQf)f@xdJB)r9EUew(yVrAtjk-;p=-F^aoI!Od~
z!ixO{>h>Brzv`7Mau}V&xsU#3uR~M&|HHapZarS$pm8S3X9QL=U<`>du-I-@E$`X<
z(S>3pW7}h&$>U$7<+}=Uu0J@-@(Gy&lW_oNIjj(4uw5Thl7z~(ERqMYP@%b-rD+;8
zgQ}yPN=$O99l*Z%zA?nVB_T_1yf0u)ohb}RT-~_V+JciB886i8)6lk@O3mB!A&PZ4
zAI2F+4k^@WbTP&KUIq}EzmcRR`Nh?sW^+B!U<R7GtHAifTFp(faq(i%q{fo(0b4*u
zLgQXL;ex%Tt2Xq&B2S=&MR4_S%9tXLeFK7ZB44P~C#n5mjfR3}7_^LXj!PXj7YUHL
z$9e)Kf)&Kja(sa#Sw1W;*DE{y8{-QIpfY>FK??2+ZRX=kuQr{Ac}dznpS$Ms)Zf~^
z@x*BkEY(_yxR#KoeF$gNr{VN;l)@d<`leG7+ns7ey!IdlhLS@PSi<CcVUgNyU&T%0
z5n0>Go0Kb^l-z%}JEZFn%~Vf7lg$rr^F%!WDBk<W+ekEm-=^w&=df9S6`MWdsoyC*
zEL|tS+M(6d36@;3y{5mzAC<DS_Fce7AYO#RkUUKo*dPdhQTy2|yWd&Psl8KeZgcSa
zFepAUos5!MF1Y3=U#!rQ*|isM)eiC6mPehqM|iZTqG;HN{>4*{!Dv2#XVxEtzNUkO
zqhHH!=r7`q?I1$~Z8hAM6ch&u<q9&PV=KgC%K@DTp`oRCQMEIcVE%i|=a2N&1Sso7
z<=GF+`GNNAx;*sDW$O_*aTc@Wh0Qw1KM2Z_80jmM+^08lOZ~`F=OpjOr}?4O*Uv-~
zD-(8Rn7`wkM#1xapR^^kBejN+5hD2@ykO?4c|pGaBYZm0tR5E=PmWH60cBxB{vt4w
zo;79Ol)*aza;(1hD|hZ{(dG849~#vwu;K2Og6M*anopUpqFRz7YZ~%<SLJ2A3;)~I
z3+cE=513`}bk63(KBp=d6HHo|6em)nbRgzYIbhypIc1&vQOVLgDPIcj@C?70ImL$)
z@jF=2RCulQ=Yul>{W29HL^BCnbN7W2B`#jSD<9!_pBjX`PjCJMAqf>gz*UxP&7q$&
z6n69-NcD@X8`2IztVqs(v2;xvC9&`$S@szvokGjCauvzxDI!sp5f-w>8x%AxkM0rQ
zTaj|iBIIny|AY1FAnIijj_DOtkzt`#ZB)6)6HH9=LEoVN`+pc2ONR!Ou}*dagBi?U
z?_vdK`wNmGJ@}O*n$#g<L23`s)N}6!`zqNkUe#tUadn7BU(pY)Hv;vLbWC_yHyubf
z$uCB4ZtL}_wig;yZng>?OF8QX`VR_efFZm^bI@FmSe($srjsUK>|~g}!S$%y80h~B
zrT+}H_y9}zB~j+&^Hm{a*|MO;B^ioaA$Mx$#Kp^|Wr)b&brsJ+ykfntkUWok<rK%T
z%&ij2PUug@9jDCTz*Q@J5$BtR?_dkgvzyLjw09yqM#m*^7af`>C;$_K_4#P#C>u`0
z0tqT#*hkO6y~FkS>8KWg2;3<}V2l4;-&WqSDWvMP)IqdJq2&0$QDs7Ef~8M5uasTo
z)FX`dnQJ}j4|?*4WnC1w8}WD9l6Ncd)!TKYdA=uEMmxOUwsAbR)0)PJf(r}dRZ=%Q
zOFejhFzQfTsCc2uIY-l6lCzSr3wLgF<<LFpCZAOUdQ)?r%|!VO<2^lkU<HI`!iNoX
zq+_|1>#kC!MwtbU288(97=n`rx8&t=n%2Wp=jfVpmsOdhev;{vOuKd7p&tpF`j7nN
z8GxVc{3kzI`VJ22*nGk6;gX*(NaSEK3nU|MSB_men1-%Mxly-}H}18eA~M@}4S^7A
zNr$hKhg@m=uGm=1u*O_MO4wJA(26{F7}VFloiG1a$o-B5D4gpkiURSg@75)ozKp`B
zSQ!V?EcMo8G+!eL67LiGVSULS5iys0=OitsL)m`Z-7!ZhCP+C3YOIe}TxrZXyaR_4
z4`(^J)2RiKVnz(Z5d7;Lvo>LlOrlzCOE{KPLGi7maG=rpSGFXQ-?*Yyqk&<A9$1{p
z*si}r{I3&$B_QyBV`CHb2IhVm`gaanb`G!xar=CE3?|+K1m@aN8xk$J*KC46vy=<i
z$F)lK{#=tZI&Hi9c*4<UJL&2{VTyj|>)Lu7mlA`6kL3;R1+oUR-O1Q}!V>*T?su;y
z%pJ&SLJn*v;l%#~T`(OO9gd(NxNi{f-mw7F(&@6Q?gRB>YNRzw>QDKT$vo=!(12D^
z^o*R$dQ^MDUKtag0g>`BiDaE~FV;2rVnl6%T?XZ=p|0JYe_I_Z&F4Sa^7sK2XzW7^
zU!TcGE3z3?YYQR6%gw{LVi&@&70`5_1nJzOPPRe6jNG411ov|upAMP~HLR?`dD4bK
zyivixy#Sc!AYR+^81MKe3bVT6@{<JS7CC4OyutP!M-oE4@>lh~AK^H54ziAaePn-@
zSMTk;fl2;8+Eak0Y_C-%=FNM5nbl)hta<u4ci(&e?+oUh>Ho}N4wKcn!7nN2Cy3HL
z*_M6ViLIM9Z1ALAdS^X0flcaD{U1l)G5<*DjaPIFCsk!2^la>??eg+~c`E-J1b^fw
zD-@9DjX+Z@`<><+Kfp11dq6)90K$M^ta+u;o;xPb4Yb=Vj&EE&C632LJp%ZV5B%Pb
zf9kxZQ{8X(u^>?L|4#$feCmL6`TAO-7Wny=dNlNpS6KW6hfT?*_)o66h5wPm{C!?z
z{W0ivJzw>kDkfR?3)@(+tVXJz4^FW43|WQy4})FLK>x0(fPJ^29r*~{wuJjE(lYXM
zbuYhTr2YqH_KThj8yw(S!m`p#Uq89jzls>_jK}(WYMbfz-N}C{d6)oTfU8@^YQJXz
z{PoL^PDX?bz<m*&IHdloS%2?U;QpmGw(CTt-=nJkz!6#yf!fpV!zbzJ|B&MRDX=9r
zpe$ey^URI?Pdf9*GyWpVjXtgJe+lRR#Qqzv@Uz$*NWP@Pwd+LO^0-YoUF>DKeZSyO
z@tYVuAFfOV7kM7?qVu;<2;U=h6DE8Rv<lw1AoPv(XvDyqcefmitxJ;V`&|@R;=@KX
z9;+qRWIcj9)VbpLtu1x|oZNW1gw@(5AugSDVh;&gNN1~8BWKsHlLdd!lCO<8N+w1x
zPbto^JEa=oW^cw59fdUYUuw*_9j;Lv9c(DytkPnA$OB&!da$b7`#AQFe_%8BJdpgv
z<fN$BnN0!$-*una%A8-_X9&IRaPT#5NpBfR9>_0+fectCI^4?!bMMfaCRc=p!iN&h
zD-RYc7jx9HY|A@<!fY+BSv4d>Sf_V-){kw=5Y!M_XOGza0T`gLBz3A^`q5{xwFcQ1
zETL+5WPWN^Q*Nof+JxFSbcIhKH87Eu)g1?<{h~XAHMS$6jg$uV9xD*fF(9zcOTZ4Z
z-gI#^?}RrKw|p~1NZp}b6ZbSnR<&Tc@BxY2Iwf!$0tQ7By!gL&eEjawPdn7O$ppy+
zDJetI#Hmm{p~yZivjX+YJ?#KC_*OY&7m<z0d!Vw$?y~Jpz?|otTfsZj*%jcA4YAnX
zvBOA{S=D3e(A6~{Sbal<8=sMDtR7k+52?Z!z!Ng13QUX4YTcMWdZQs6Nl@v_)!+oo
z;!y^SKjsFB?te0%*)S>H$c&i0f?vdDzJGm~W_@bH*P}y(f&a!vH29M|{o&&2tsTp~
zyTI!fJtj13U653ck~=T2<SuWA@y0sfvb5*8T6+{GBhYJsFH}eh`?)keik)#qUy;t@
zL0B8ir1l$PnAjO%BIAHfBZCzy^noeYP;{NSX#DcF8$J)<BzKYlBoc!3OKnqmcax3H
zK+ZP^8ahlctjgqFx2!$5?Ty|dlxpzJ1Q_F$4qKMs7sl14o+*h$pA3oAzdTgETb-N>
zSRwofgP3M-3~HEGg=%{euA`s`fldC5M(;!{WSkI#^<p*K_%#eLNtLBGpJG*ha8@M8
zT@*Il!29h=(fBq8mQ-)u!@sdV=mnO*kdPT7B|5g5j`k%66^l%!sk_lVxvqzOEJm>3
z@ojV~+OTl|nog8yy)gzvKzI7qP1I1pno2n_KJoQ|obh!HMcyFeuV-t#bAedM6uZg;
z3Mc-a$Pn&xeOO~T9<RSOJMAMyTV?l#uJKk>l0=N;y*}xF=G`pufN)_rR;p)6-^1J3
zd!j*H##hH$#^Z=gy~B*rG9;Xzi&^5oaU!AzC$rfH&Jr<k6!5^a+dT6<uJ%As9;PSt
z%ncFZFd2BO<KcyaTg#02E_^sr6WrTDc&IUkpUUuDs=AqM$@<178C%gQOFKEBqMq$V
z&&dRnxhTTd6T5i#Ds*Pbcaep5N!*|6|5;Q09W3*KJ6y8G19?T38eb|ja9?R9iE%D?
zw*<%>+Y)SGaq`zs%DDy(=UkpG<EVW9(9m)zZ+F%*T0zE%K?0`~xw_0Sb6UveLxL;7
zz_tCt7zStHr9wFUv;r7BPAC-YzIeL(ZI7give;7RXDSKNEGWvv*aj-G-bl>>hIcuX
z^eF=rzA9rEyD#ozvaCqny%vcL?Z~^dNctQ?s*8%Wi;tze&a}g2^~+4S1sFd-(5Ijg
zTsi`a+Z+WKvB&nTH*L*;B<u1UgEWb<RuIYSmOL<e(_jTxygW83+TyS(Gc9`SOks3v
zrK?JUY3Qo}9<2df`!_~(xRSYC@MQq)hz8rF-4nF8Q#%DxB5?RNm!Uh;>BUOF_?y(!
zb;Ff>Hv{E;(urn%?wwphJ?j)f|G-T2(xsPpH${{sy#?^!aDEw1#{kw=b`!=shu2?H
zgIaZDkLrnAG6p^B%=795de&!?jHl}oKvla>zgJoU^KFKuwSDiFPKP8O@2RLuLCNXG
z1!^2uONO1VIc$?vrTlrlQkNB(_XY0$gF?q+e-g_la!!T|a#{A%z_sSyO5n%BHIbFN
z=L#~Tc&<a@_s+3mGWzX`yW&jor1+UD&0k?Mk<{{5EFce_!o2BeU@|q{-=rMk{20a_
z0r5&B&0vD;kyTzIQox*TrYSkYaf^V1^p$+>5~)`>vw52R76Dg|Sa2C2OP8)lTqX>!
z`_17Fz?HAri|t}m%bNyQ$w>0>W*YBK7F3+TBksEw&NkN_7g0{_)n()OIaXsgSE43j
zq8)l@-8fouz{MOQ#qI|3;}uvb?&{6EXxnR+aHg()u4a%ihsjrq@4XKu#5F9*u1~x%
zsU(&d5fn`OWCk9dvutcrY&71e!oIS*YU=0Rqo)1iN+bNA3D;j|(ZczdO5r%H)SJIK
zdvSAWC^pJu?ata*iqc|2w86y%&wUeNv-;I8n#4`}i>bVL)`DFbLZOC5H^4~8r_uZ9
zOD~=Ibt8!~e)E3AIePPQ-Mm*TweJD%AEb0j-)&K7oZw`anyY5u>gw#1z$i(0>BamK
z4du9%DjQ!ObYqfJ=9wi)9}<Rnntu_}qbaaQU!Rumso>shzT=b(WuaaTZMUhA=f=%g
zdYQC;8VzF(>8WVNgUM8D!i{ti-3lF4pho0-uJphTOg~3@8KLToeDy-w1cD1qkdXpI
zg=ph9d6ktS(7zbzuyvW&ub9d5nTYt~PdW0d3T<UWb)5ai>r5^~qWY4;Hb)MbXDUZ6
zQfI0~<7C<HtHe$y4-?Qx;pL&^7%X#mI0G1M(LB7Eu3@SQRmv}RCLqE|;ie0DRwR0w
zzLm*3-F=(?OUD0{`=JDo7ylSf3s}Uou4pwtW1bz!{ZUD{0Y;qyP}{G{jh&MlnSBIO
zOM;$D1>rF?C3ac&h$zQeBGeNfKl0gm#y36UlGE3Z`Ltw%H`SN%U&sfg&1yZ=e9fXt
zTv}dXz^*q;9`PQ#SZ0CwW_Ky<Xr!4~<iv39e*Hroxgm4=%j6BE7mn<qy5<J$84G*#
zdxXU8P3oJJSa%t&+jTI_^$8g3EDlwBhx560!uBXv6>e=S+@=pCABA#ZX&LFUY4z&Y
z>OQLEaA|)y?mH5X2#|aLUc|BP)nVNl&hsIWcZ?_~^#jeIE*2hdOauF(15MLH+STr~
z$$cCq>rMhW=RzMexadS%(YQ3|dUxn<IX<_Sl}ZRLb3!iJia<~QiYkgBS|F>Fy~x>A
z=wj|&^bMvh9vJ5iYi`zVeez^0l4j@&W$E%a1&5|NyP3N#)|{!8yI<$I9M_W!8hS%`
z*AwF9IuI$OcHW{!WZ?F^#YUf4E0}g0TPhFF<RTCqPpi*|H~b~4am4e;%SyX*O)q{s
zYDg;8ZS{HI$(pbcZT76mDPdyN{relURpNSnN?(DJkTB4xK&dl|db#m7*6Q`neSN3X
znLiou3I_`oKC*Fos&T|5MZG6;RBX8>_T`QD^gGBjpNY~N${GN+Jv)DpXK{xI^2ha^
zP_skPU}t3>^j+wI!kNE0@XibW!+}pGU{zgBkLVExN7(Wq>eM4h!=uHSzACinciYV=
zN&PmPe*T=P`~yv@cAm^9O?8yD41)-{un!oio-pR=eHM{(L`7Y4BM;NZ%b|(HY=Y5u
zy@eTj@dlSJt9p@r$V;*Es7I@;V|89Ao9o8=*dZ)&B3X28;ViPG)0YDPosrQ~Gc+&e
zho;#3w*jX!>ufgb28}doO6{&(#%b2<GStaPi&kv+8V2;@%Bqmv-C!0ylwH8vxZ9=p
z<6fhI&IaHIj@&5598*HhFuJVBw&#T=Y78>}$~0bLKc?*>Bf|m1lCL$LG<4@@9{|F<
z9IJZr!lX}7R1_x#ceNZPt4W0_xY=Ec2avt(s9)3#EJ%*}S9D3zg(3jWRo_*12jNGe
zeAe4Pi1OB_yXWJQFQ!58&*6M`9g?Fp&t#z6b`pXm85Ux&r!%qT=$mb$O|(7S-0uG$
zdv6sL*S4*V#()SC5`t?I+zIXk3m)7d!QEX01PShL!L=Z`6c9pi3tD&qg+t+m6m}<j
zpRBX?+3T#o-F9DYYyW;rT0K-T#~fqy{`F4^2)3y*UjF9FzfVh7|AQ+(7!oC0?0NYm
zcRfv`#x8<zCB`#NKroTw=%l4;B;^U|8$s!xm8_Ik`aU@F5k4_l)SbN_EaG3Ksj#;`
zGxdHdQ}glSV3%o1Y{9JR8%;Y|;~=~X2B{>IW_}V?sTlB`ZVkwW+cMGXR~QPOrO~P~
z@TMU_V@mgDOD_wHC{^yrHR4|<g}P;O+Jrb5BF<zY-`gL60Ym7E*W{v)vSmPoVG4>(
zbn{@B_xUOkug<SdM!2ox1A>(w{AFt|Nd+|9G0ta89O?zV6^^)4bKeV2ryo(KQ7Q5u
z4H;u2>h^iZ$QnFFC{X>#&((T9q;^|zM%}g|Mc6gi@w|HR*0J;{M9b1%*!s@v{ANYe
z^c>p$fbEOiAGR;^`%5+%pFH9NPa=$stL>Cd3VccQI2^@}*r>DU{8f}vp4m7MP#kiQ
zhNaP5L^YY93;paCpWvnHn>gD3)dW`aP7`n(kaFOEdop#`IQPwSel?f8w{aFpC%)5)
z+#DB_Ji8Ri{i&-x6S_jJIP1)fo&2fv3nP3Z+Q`)0tmQ?lL2LoJZrefmTgGVnhv@Ti
z;)^vjT{Sd6XU+=C6a6LbqD>XA#x&<|_Rba_IFakJD1^gfsTlSg*A{|x$A@PPjOULW
z+++HwUwEy{yc7j2i|rRcREWb!sn9nj9M?XxE4_1nX-)Rs{uXOUzgiemqbG8)z(`tO
zk{Hqy2?{GXZ8Vtzq?%R6eRmS(B;x0iL!t5@_2Ax&HJXQGFVjhBt8tZen^Bt#^_(O*
zH|WY|S@>U!v}5&>6hMr#Mtp9PT~Hts*wJ_2x-QZ8A3jW&YmGnba$F56-!z1wzh-+_
ze9Oikh&juKn#$~&MbnCS;)FV^M9QMPmS34;4=r>=cqyx|Luf61x00W)x;+>K`1l*)
zezL-PUMhaO?*eC>xi)Tc*tSo?o@vC;RoU<ynp`RJeQ{)JR%KWBT3?w;k)wJ~z3^$0
zWMs_ga&kA$pD2exM?xeC^=hlH#fC>5_B|mk&Uqw<%~{}aceNH;z;#Vg)kygZ7&G2G
zE0v;N@gP4zSlVltPP@Glm4b}^bFbj=w#R%}k4KE3mFdgu{v}+s*aBe8hYKFZ-)G~9
ziN0Ef4A|K}1H;qikF7kQAMK}YKcJg_Eb+}>0-7nsb>L#d82015vr@@k48Qw`hDdoD
zCbW!U+W2i{1BW0cZ?`_n(YP-nGuP_6WSXceOn2*D%&L1l!AC9bHeEqq{ajki!>1M|
zIY!Fw@uuR4VL2vs?>VJ}GW(teUtL*@GpBBG(iNI{iEG|xYiA$13`;khmCcsNVb{bl
zn=rbZgj4Kk)Mt30Yaj1P+@)Aka9mv|B0jR1Y;}Ml%#Sbq4|JLjFm25EuV*X*o^8BZ
zzO!Q`L9*ADP{#Y#H(iC1)IATHa!4}j%9<R2tZha1=Jq`t++u6E_ZvI<^AqwreF^Mh
z&&}S`QOxtTeSrM$&i5@_ccEZ?I>13tYV0DtiR1@S=<T!(txGZ@NmCA#8U7kvy(klx
zA**JPL=P?6z+~e6e7*T;iJUCP=;hP?+1HNIb03;?Q8B9e3LK-U&ZRxmwwvdW1SX8U
zrM_0<6qRNH{L2`_{@+OvZaFm7ovqar$0U4$@)Co0@=0Gk=lp<g?5@Na4SOZrcfUN+
z{_><{wpbtQ!7>k}7?Ys_Y>QU1a)Kdu(%yKw3Zl%)-H1zca}#w7S?HOVd~~a2E3|6s
zdoS|8j6{UhfR?693=3st1e<vQ)f9<wW+i@<!j!sT`u4*!6&9S4M<`NXo_`x{`I>&=
z%lu>C6h@W6*k%HLXN<egykPZ%Y&>bc3HKDz9(4rM*CP*^N$i|z^(jxVBflEcy1;5)
zd_5a6K#Y?~UELbRnatk(M3Y_JH$6z)52gNAHDLd^m$$()t-ri}KgsvsH3N3-ufqoN
z8-DHbV0M~2NvI}IzwDJ*bYXBVi}6UGy_TCC=C)M8k$r>AHqwxa%=p4KW0jTVKa7|A
z%448=PtdwQ6F%7jQ%kfe;<8BU*y8f=S@qbg^e=yrPn?p_J2iF|V_%ubKye`;f03d3
zXv#(djk%IrP+~+#uyE~kf!i^({ou2GTh!0|Ytd|0lE0>#+Vub(I<dnZiO75aS4az#
zK4#F7LP-)Wk2QQxS;?uJa%1Q{m&e8XX)D>s&+9Er;xdn?-M$``6{U9xyD|uaX=mf=
zs3y46uQy3_nd#VZxsF%{+Ou+dN62!|BkTxc$JMs3%M1h7$9d)3hx77Kr;H=-nq8b{
zgcDJw4Xml62GPKl4|De4CEGi(hXRHAi(!S2zqILkzQ&=hkmlHY5)z<K`S!TvIhtM#
zZ|iuOz{2J8gBY3Ia7QB|W3H*zp!2)ZNYUAvl7r@~-D01TT=!Kg;vUVXXm3>^t!JUA
z@G5s59|NzD`}5<5HGP?imMu<Nn)QK{+X?95;Hu&4JP?6+H($PX_JA+JnsF6V{%+EA
z3n=Hi0W;0d#SQ$yA2hLUt%vuY#`)aP$PYe?ZGf{#|E2mbyAXJe$2EpUYHGsMIH16>
z6+!poA1YU0kF;cA<B(M>1s}I8o%&lBCKY#S0zEBw3-LiVpHcyCnXf%({+S0ajgUpb
z^{ey+d+sY(&GcSD<;v7kf<=}q27hHEEw@)1gKzD<_iX*^4@*xR$L|E?SmB?iM%u;>
zP!wZKL}o%mGnCA#{Fu5sMIAnW@2(;dSv89<TsOt;V(Q7m?QDN-UH^(n2$a@4g58(g
zqxQ@GPf7(J6F-{wh3EW?#BCYQ?*`Et9b7pu$G6mtJZaF`4*QDcL8&&XNe~~OYD85D
zq35|H$5`6HwUhA+yD}5sH^b5KMsPOGq)}-LmkQOm?5Azql#ZcHpZI)?Mg`YJay>V_
zNJIbJ@BA+GKJfua*qo+PZ0#rX@A&9HQ%=wpQVnHSngiNf^~Ww&%KIclOOXAJtkKSo
ze6oUxexYKha5{wchxH}g@MG20ogP|xy~=rjE-|b=)EHH98ddl&QU^(wm;rJ-yaG%u
zrjEupjh0LJKophuF*(o0n4baD;I@FNfB^Q03?!~uGZw?}iaZtm9MF3hK4bo#eK6P?
z(FeXh#39vw=_u<>C-*9jIHD@%)ayXTk`%m{{X!ahYXo~W?fYzSshjM|_TsJ3K_-QD
z@mlXpO0A~5L#*zwCwQIZec=v%3Q*ORH#LvyG&U2WImieMMJva`MFzLBJBuJ7gW-as
z)`g=d5E)mJd2=a?g8I=<FspK-I}W^)JdaD_$LiJU%8%X96`V?eGjxmdvH^4o_8O6j
z);L%{JXxx1$sXC7bU^vblCA}y0_8#G9n%wzd>6|f5aFPh8u@;o+Y#gtaQSj-WP>k8
z0hn1)+OD5Aqpec)8)h`orQHj}xE&DtZYcN?V;1`&b0-T^^Qv2W4qRZzPgC-Ww}@tZ
zvZsD4CI(E3OpepZ&ln$r2?3te%ZVLzd+(R`Yig#0$HOH7zF7atgzKSKM_o`7WePQ0
z_e*xnr|%{U2C4X;nH&}`yHOw>rbh4+w_i+T8KRYN`PDBkS&_>d<^3{a`w}(PgZK;x
z$OkytSm;BZj2LT3fwcAX(dx()o<t$Ae;8a&5_!z)!h7cDx!>IrsTD!dJ7HsflS(X;
zpS36fkL^Y`pA@G)TG%*O-8OdZ_zsU-ImJV0bh3QXB$H*#+Cdbb>heDSmPUN4F7#CX
z>Jo7C7|5^n#(=2X5>)a-#8HC<yCnO1hgW4e1#RctEptvS*?p}j%*L&wlnDRwdFul6
zyU|+iVaJz?*5R#2T-+Galk;5Z0*PqeZtGu}nb4)Nm}7(*e0bs)pCW>HP#IOYik*@a
z)R+xiEZ+YTWai1co-S0@&nh=*qV0dXn0*a+F_tasDiQo#MA0|$pUjb?N$bAVWQ?6|
zWCB87I^7F40<TdKXSR?v>#rDzb|+rS4=9hq-fw$d8)?1WZCVOe+`5SnRIwGNBAQq#
zPiTJ~Q3_e?l6|U87nZ<<8L-28?bdMqUaPhLS}qcPK&lD;mR_3?UugSi3u<@C`5nH3
z%e4#Y5}|s^&X);ZynE9;R4AR+wVjjezSmV-l_Jpc{RyU`P!iZY_elX$-#a`K_==qV
z5v<1m9dT5D%#9}iJ><V3NX2@91)}Bkv*-4d5=?pn<9_tm{KWNhrVH=HU*nW1K+88o
zL))V#eEpqoI&cDa-P#|%g4H=DLLs*oMoPgYtLI`+=w5dNrdt2%*^X9~**tnD=8J|q
zgq;>j%E$DTjfDzPc3B{{-z}m&s)<glHtMX1HVzzqK4+_x-H-AjmCcJkE>Nx5oT}mT
zPqM#b)Yi4F?$@3TO%%SG!ApDz&0*HIq@u6DU^6Ryt@dN<9AjrJtzYr(;2W2```GBv
z&%?w~#yH?#+2s+ok08bW6nQwx-G6;6@*q~9?sE7;<YC{>#cL0ork4)KmYVZ>ymAn6
z^`nI^mi^vPlLNmt!uLg<T4yB6=QfGN)k^X3!jegg#FqR9YnLF+2~oP6Ior0A3+EQ+
zZ-*i}f0|zY_i6f_?>YV@APH&K_c`yhovdiP-nuy|%<_@GIt3j1ttNH=4uPZ>;FKR|
ze0j0grnbt}a^AexYUx3L`o9Z{|MX45H2V;J-}4*5)T|BOxdNE)&-FXz2KxY{fX4Nk
zgKn~A-~+_X4ZsF4Rc&j#xt?vi2`2N|zc~lKt?-)fa9HqX7#f9P$P0o0*xCR45bQs8
z_W%7V|BrwDUukFmmm{Y?w|M_-`{;qf>Hl{L4%PA~fEADxIqH4HsY)3U<RfE2aTVC%
zNuRcY@^A*HZ&5)V$JR(g`CN!_f^by#$I_#UzQDh8f4co!vu~%RGhAzrVuVfZbCP_H
z!RQ0%dcp9E`dPr4?8vwzqyOlQJ-Qs%KmGVWPz$M*bj6;o+kclEwCCpbeCjN*?4hOC
z_QSrsG)XZ&nyE<2yn^=FPao2AMKaj-!`*;AXnY8QauENZj^wQ2EAn@7`aj;rfBg45
z>#e6cdW%=K^_))DgS&TYxj3<k+Go|j^{TqQ(%Tk$N&MastEwc;(tg?0m$sig?t!V%
zve#kDcEomSI~CgIq*OlRJhbET$X|Qqj303Bf9-<@h*X@%jR-LOEr-N;RT#H=^0|{%
ziN(L`Q5z-&|0OK_`*{9slV?G<Xl<3cW5LPjn{^r?^hIj-{MEt7hGFRgtCmmote_{D
z2W$-KAvxae?6c487Oykcpn#u<3*R?o--_6Ye7ff`N%pTXEmF%yS9jD7cvn$&u!%<}
zlmFK4O*ot6c46%ERUr4+xL3Tpf^J>Im?T0WMu?Xt0J)M>B(e{1!X4)k((4M%L4OiS
zD#c28SABQS@LCsSB;3<4yOJ334_QkzfFkOvhZg`BxF2Ph{TlCP{A0{UJXK0otH0;w
zAYTF8X<y_rw`Hv78*l3Pq&a1({#mpGCIt<Eh#z*C=xd{J!YwH=w*|ye#<h_5g+?2(
zz6<#g0k>Lva1PA}rCL1^huIw+r-ygItKCL37r$0WDyB#-bRyFBMz4OYXO-PB5OseI
zjkNvAAIg7mSZjm<Opz&`DC&%B%>6`R>@<BTx)r7U*C^HRiSfy60F%jFbhrBU-A(Z+
zah1Dw7C=M^(tC^(DVkq5yG{+5OC1Er9uw{8r2r;7$-X<raaaXP4Uo-}uiOz`+P#Fl
z>4Vb#Z~fOXn3-TZ68f#J{VXlKl{$Yb!Xgd_iYT-()o#_1139EyLN-GGfoDuN2j<EA
z%n}+RI;)bCOyNk<WxQnL{Qz#Np^!yFdnW?L4lfrg(XhUi*Y$7TyoWpbz{u+A^e%_l
z%YTe$qpt-fGOR0KV40?Dqbe(2;CzM$aR0*#tg#N%S!2`KRM%}hZaE9c!PebQ-cvvS
z1iH>VO`&0yfH3z8Y!{E3nqKg}HKWgTT>l9WRtk3JFsIvrZKUt{i6i9!#@<Ne>Mw1+
z;K!L`rS?<f^G4U3T^25Ky*I8r#$)bddBc$9Ben)xCwGw#@1DQi{TsJCz}!>^`04le
zgiD~UpUCp;95RI1#27jo(R+%3H~~ed*{f^*xz!2WTAZv1|7ZS#yK&odA~bBEB{6g$
zH$7+Y(6KoC;#Pq(T3(gD)6yQ~ZvLF{;h-&I#`R?tKM=*0j1i|4bU;9|8Jo0T1$Xvm
z7@(g#>*Jo1;7jZ<NLu&Fes4bE$%2X1D=`1jdN6JI<2UaHjP(t%x#EEO_IJ{e`vhP5
zpBTSnrwP;k``e)Dmg2}~nW-ZB!MozoPkh}_(CN#zKSv2Hn0NtE0%ty%YXPK6_5Edd
z>VdRE;Khj0i`*YZJk-BuiWcmk-h4d)<rM8hcv_juGG+5O!B%X?LGw30FMg1RA=_D{
z@8_^NXc~{BzX<YH?C5-AHG&#^Y)o7S*X!uJ96ec!XvGwXR(*O&`DPx>C?*a{3oR%j
za1snvUVb~!oJs$8+t^P4Xq&3mF&7Wq?=n~WF`?#M7(Pv0){0XUg_x#oUm&~3@LgL6
z*zD4V`)>op=4}cuedsZj-U(RJCK^jg{;=dy7=G(oG~khnwXp9`wcJ!jwV9ZJno^Wx
z^OGv;`%jJH+9#5Z2UHn&GrEYc$pS;Gb)LNy+#7idtU~3rlCnSPIBbldEvvJY;6c)*
zu|oSPM^_$`Dr(GHE?aO+4&N?Sa$!5~L2RGXn30t=8E6@u7eKa*qov{q?Xdo`5&V6H
z2;Z8jruNxq5#5!Oc;Ib-4*X@QYTQJhVj?^r_HhXO$d_WQTjs!H`Fa$cw#qDi7kzr&
zgWy5z2TbcUz^0Ffh@i^*=`{X}Vd@v`ta>5!vV;-0W>6CNA=qfC;DMidanEU{#cDL!
zgWeqEJSyv{FNfs@JG=<F_m(~7l@SqXb+H0xMauVV(g@KC>x@RUBRZ1LFRttBp!tq2
z11_w#j}vik%xL-zBkI^3mArQ1)3c%yB}dscQ5yd?sYE!t5ja~0;SJSq?&5WmvzL|u
zR!steM&PMOy5yZn6-}3fgPGdiN$6~qQ#%=DqXZAS!V(5vDPGb45gnkL%+w=x%FRq;
z1ob1QL|?$BpD_#olcS^rz9M>>OJ5R~8_bSH%G?+E42Z?laY<*+@p!jqO58O#TiVQD
zvijO{CBdiM!h50T7p?BTG+6%puA6DjzEe>w>z=WlQovgzzfh?<3+Ueqr$1HTk;=e1
z0NXk3Ft5!L_;HQ@*#v`WNQvz_9xHbWT=xQ>4L7yB_ci5$$zFDQ(4LrAA4yn_XO~1?
zTFndnHY3Ua27D2Lcqp=lIboiqaaP$S+A8tcP0<VQ%7Hb&h%UgJ+w&2djEd1yTKZRk
z?3$ZzRM~mo_RwphzS%%pMhlU?3$eO6H6~sQj&VHgi`gQX&*4*&s#mKOvJEZSM)^hw
zb9)6+*djK?2~TjNJLNYkt?K_<7nP^n2Ef}E*>L1Je{3cSu9$umME0{t^!vdec*T7o
z$o6Uc#~87^j!7H=i`RlXh=F9QmM(*@7?{%`g>wXaDV`m&xSe-jRt@h$GEzNL$WUkQ
zJUy~F_91pzX$2hito#$^Vx-r~81-qp?Qe5sQ}ZxlB%$fFhMhw4r4^R;{T?`f$tC$+
zMuE|QU$-F2OzJ=s%J!1MftC@oG2z7dlnV^~34TeKzhCtHg0SaV-Lf+*FZ({7SQcdm
zH(xl^7Nz^x>zq!!`MlPfTZT<&gLHFHbpHI^w52C2CdPo46GW@eiZH4=r>KB*Anl;=
ztf;8(TXSZph?iKTEBg?WYkDFeCVTYv+cXN`_HHVgzE9wMFf$!LFDTR-z}a-ofm4mQ
zXBLt{Gur{xf%e}QojK$9uh0Q$63b`f%r~C;-FIu3-q#O&YbXxgDAqPA--av;rY*cA
zidLn6Y6*q?sySe6=+FKVSC)_7sF7eYw$T9|nV{I)KxskGsWv?E2v0I6b0qoOU-#*D
z08S;XGbVI*UXcl)YkmrWs~_as!;_Y)Ie+|@F;JYsyfF^}bI#%uT}~h|#FD<4=2nV}
z>uB!6E)El%I*qVAaM#p9vwbzca+V1fR4zAL`(#rF>L=6^uFSHhafIx2%=76{K28l0
z0EZJkQ4~D7V6jENw_<bw%E`uKrum#}c+zsV@Aaqs^KX~a_y59e%x><<*k{h<>xY?p
zy?$Fg<1Sg9$8`;0dplw)v8X*|cS*VeX(G%i=-)n?I2(I?T9~%|oRuataz8Sk+jC>5
zC*Gt*$1VvE2<66WYIw>~`Ge?HK)Z0dz(%h9<e1+HeiFc+qT%)WY0k$U$Y?v}t)wD(
z<l)4J+2Y~6&9r_s;mjoS%g8wKk?G!%$rTT2xA<MF?TaFBRf6{ek|^qb&kjGnrKtNH
z->)sAXSr1X8OmMG8~DZvo|Qw#D=v!6?(@>zh8W1CdzJJMzCSJALa=?$XW18alnptf
zk)I9a#`le-U`f@dJ?+uIev|aEz3XeICl_S-H7VD}t1$miBhEk~xzL9~!c^Kpm$m}!
z?{xHPCZq@omx_t8Q}k0#Qk|8fy1tI4GtEJiufPfw7<~=HLy*a}K`nlq2d^o`s-W?(
zk4}c_1s|~MKRy^Y^BG&#np`F>F#EfOx#Ra1*nIfJXml+93^;J4a%6>|L~~o$dUg1W
zT(hzvG4{RoWtxea4Zpdig-uFjoJ95iSQ(*+db2G{R**t9H}1v2{zZ>Xyx(Q8mO`kJ
z?%0r+GtPW@mqgnTms?q_@MLY!5<famZU$z&^X2}Ebl2_)$57DWx7wmA6YnnF-#6m#
z)8Jo=%M)O7GDW2HBl7{k**MI`N||1=w*RQeN3gF*@PMLXn$hDZ=<1(A2c|jrLqBEm
z!%#eJZ4t<sosH-!Dp@tY5fNg=lE<)4>8wpka35AOw=){Fm%B`JzF>D2A~#6=LTBL+
zJYvH9<(1a0cxZZxvEM&-FhtqOKc0w1`ftm{r*^ktjPz1{(*d^;BrXQ^eWtwooCU7T
zCn+SK>r<LN$56A~hz6VG{ofkZ-IXI!wQFl>*1Zs+7!mcxo4y{sgUuZMRu7g#cEZvW
zD;Wg;b&Rk(S#EAqEy(}Uw;@RL+ANq@v?}xbBhGj~!~1+8*uLG|oBNP+@FQfc+ok(m
ziUnR{T%0P1c~{5Z)lqjJX#EKZ^!@%nkw8_y{~&?CTe5#1UH=KT{0$`h+xGlVu;stL
zDt{^@|Kl|D*M~Up4*lUY^#2A4yaTJeWz+w!&-))AWHSO6*i3Bx99Wp@&dWccfa-Jq
zUr<2LmZ3C5`{+cuO7({;Ibaon5jWQK(-}{M;gH!G{;?+u8pif|f+>HuEK(FtMdg`U
zlBL4P70MBNn8}K62bH!E9!!d{8nXHV5x7usFk=fgfs`twHZD5$I*rx}fG*87t~AZH
z=09j@Cz@98nnQ}$uGaBPmC4kv)=Sc3oxzhxYZbDNVFn`T501h8>HI89PFUCBQBja>
zMq{xpNRID{pyH8T#p!&N9Y(!vI+tI<r|Y$>_TBYh5nU}JG+i&~qqPs!OgjeG_-FM8
z?y-bXy{7poamH==GloL8j{KlD^`<ky5r7M__{9GlsbnY!K{l%>yKW;Jh@%uGId1qJ
zkUYy<o>D%s$x%sXdi{vXV^8^r1MPiH{j+M0YH`Lg-3*T+j4I9U8T_{VsY{CArK(-!
zEo;OI(sC1O3sUg^^hwM2E)Po*ymV@%1dLtb{1O|ptQSpvez2DN;Qo_7&TnyTXD0td
zLM>qt{Q+ZJx`Fk>3Vp=dq1ydL^v#Dq$kftxEZ46PUx-aHySongkxMmFcY;9M{>V(7
zb@gH<Uf!t?LA=dhjT^l(_DtK8QFnesn9aDlz-XaQt{9lL$ik2gKxhJq&j#T1BbrN=
z%vq#xCc65A=No_h6nno~Q*VQ`54jdX(}*)zH-6n?zM4b<w5|MlI`78Gn1j(&f4iPu
zUwu`qzy(&YJ)FCi1$BWR*YwR0j+ZX;iQ{drAoZraIm|76*fT1S&UxqDEZR$HdaCt$
z^MhGU*C$7mQw@S6k&?ORqczXjPBn*T{XH5k^fs3-#4ezoSJWC6%qJOJL-VangEE!L
z`tm}OI=)#w@~s|OlI0b_0{Crm>x$aj8b_=H8NW~C?-#dX*sBxxg?UQ-$e~_<Xjj(H
z*AV4b2VcF^x37-jBDFtfLng0S<}N-4T%-A;O@LiBr-2|xX*3S2%uGw;Pg2!W@#_(B
zMz1`oX1>fbowtPI-eZ2+Yu7?F2vssJT7@s)Yr%aWf)mu~A%u+q#bKJ^W+r2pt<eAR
zgvublhE-MQ=7#xaLpIGG8vLN^#3;dholcLd<<48!Vzds=rr`c|Jxxi>Q;)qorW^?<
z%3vLV0&jz0Vv-)2bCB&(j0+ARKk9_>y#d9tNf`Jj&jq(n$xm+cBBWFu0HW^nxAK8T
z-jufV2znvqC^l1P=kTpdPCO6i`~>+v$ClmclPusx)y7MYxZjW9BfOiR#eB`}fn7c4
zs;b@!>ieQ)$YnEg#&5BHGz-eOE{sJ^r)i4DI;;5<vOF?yZjd)=3lo^z5|t=z>znaz
zqs<~iv|-h}!8BsjK5u>QV_I^4Rn>g141xNzx)B^M3oFi^FJpj$uGX9u3aDao_Y&k=
z6`T%QxXx@AoV?9X8mIM|%eKet_)!@hSlYk_W&d2k6ZMvZ(JqgTouiSGHn>i@?@gtK
zLTQ_%-5;EceL<kTbSJwyyVj-%5FOy+!1`jyfSZDm+ADq9aUyCl<_Q9}{pV9E+3LZg
z)3WijI_oTP96UC{z}f6H>Je@pKXLbMb9VWaF2t<75e%y<EF*+VH?jVtTPgyty}-kw
zx{06rwG<>Rd~>Q?sxVSe#mJ_Jjvbw$7say2*|88cc&?vJXm>kFJ&6mun{#}VFYF-C
z+Ip`~8Pfe>u5HCNHW2Sl&c)4|06>HrDTT%H4VpNs#HJy2JVbPvt1qWc)^wgNQG)iY
zC5&6_SBK|c$I?CQ8J%FgEycsY1vHp_s_r%rfs1QL?W`(nt%{pa88+tbbELK4T^POY
zc@rIVQSw#8qrT1kqoVfp`Z$+9u9}LR+VR=&{xXUMEfQaa7{6#^8J*H?qk#Ia%_(GS
zM-yfq9E4~Rl(V|yMS8jeS-jUwlPHZ##NN9eL?yUKoh72gL$f*p#9kFn2=AP@y_N-0
z!ZK#HtHS1Kzvd&}3A$gMm(PB5u7}L-JtzDu0n6`1R4RH~ID@7;owrBUcumv{|2yF{
z67a{0&fPxD<j{DYlIejhRlIw6(!MNrlUb`>F5e*XyhTp`@P|hf(TLteD3nlr0X>XN
zKmBX=xatw7^a!`Car%27yExomkldnyljF$d6@<5wQNP%nfL@So50_9~j=lR~Fv&rG
zIVBMUFmK2IK(72z+nSF4YWM1n{v$!{%rsK^=iy69%~76&Vo8VRodn{a2RIz!#0*1*
zIX(9$8Hq!~`e|<b&lNvJbSsN^U#KmdEYZoAFPMCX0g?`Wn<9SgkT_(|@V2Jr+t>rS
zXRnV}OIKZSJM0s#K3Z&oS@Cy3eU9K=&C@IxQbmUFMBi9Mu5Y>n3Gaib@_a2tG#vC#
zkF6_44BO(tRic=Z=gj?~c|Yx3@Jx5KaJ~2In&hd{4&tN)*9}&k4w=myeb`efUetnE
zF$ZS$Ht1j;&OE*Yml*?i0ehsy=cA*;fJ#k!u(I-6Z*%KHOcFT#81Oz;DjXp?eS9>V
zXVu$F9^f6x_)JatLR~JsUq+1@fomE`Ig6uI)$s-gW{!#moy#I{m8gE-HT$Hu8wjiA
zY-nb&g{NX(7z)<1sRF;DNgXQ@UgB2COclK0y1XycBi8m6p3rzy^<>AgqDA#v>x)+0
ztXx@GoPq&A`02>P)moEO(4(-!x{8<FzY4aJpRA(I^bhY=edr+r3DAk)tmkhg<zyFB
zWrrWOF0>Xz?U}Q&1yyS<vA$7s?+Bxrk_=(iua_f*?PM;Q&r4aeX4cg1YP(zDMyY-@
zd3=G%GKf2>>K*iw^f6{@wMrEIx!RiQvpe;4{m%?O!z=j<w=)B-9ks|_$tuqKg8IMd
zw+&k4HTES`lsa6}@#1q;#kcs75_kiOJk!Hz0qm^D_ZPdCm2sj*xX;SZc?r<&_2E6i
z&Dx5bv{?%-b<eWM7~wA3URv}B@NgFJExFPiz*`MT7?m~d^ZM4Sp)sloAJm@ROTcVX
za5`*(@JZ97v)k0PawjV+ttZa5wKbI_ne#BMCG}RL3reQ@Wc5Ibd)>?(1+0|Fo^Lim
z*o!4Sw>9Qx90h(af*t?ug|DDbrXthLb+ixnsh!dPnR$AR*%#e6^8{T;O!H2Bm0+e8
zX%s6?b>Ov}>;<9nTZYPOViWA>y&xnX@s{@Iek1`EL*J~=mBAcqFILSw$aPCQEQfsK
zb<fZkKly9OyX{7Ufx6Qt+sF3%j?n9H1;$M4tL2MQ|F1huL+sk`mgjA}mCC;fN=w-&
zsg#pQm#p0i4wFliW<R<oIIGhsH}3M_E68svKO)cpg0zjrQ{!P?SDaRcPAO6(xt9IN
zSyi4*=eiDe{jtH7!@gl#w4;vF;1j+IDHLl^akYHcG}_jwY0^>d5I#s$od<IZXKjC`
zb)s|>+Ucbjg*;<nm>}+sQCTBc-EvZ}Jeov$E_$bP4E3JIF@#!QRjq24F*_qm549lh
z60dC76P<yICRMsK;$odATV7c3ZMQFNpT#BHCvLpT`gJ|LJKV=-c-Ly|asJ4Q12Y3v
z?t;26se<LCGAlm%Xj`pqyQgWo35Y0}G(X#}uWcpWI17@Ou7lMZALZOXQ7gcdt2Z0_
zrv7<ubuh2(!uHl)f-_ZL*a$-A*5dAXdb&08snP;!*u~%?^X!Xt(4Kd!MYqF-ZmQHv
z<s-d_4)7MQ`#hb`k?J6eV)DI~>;Ro4b#BZcvgKE{dfT#{eSZ1iTADf3j6AZI7pk7q
z3916$pA0NGNfWMl@FU8>4T3;~wPLHO!N_dE^jk1@I*a%FQp7=OEchc|6SxxnWxOAX
z{RzoD(dD5dJ5R3k9AJB|o1~s=Nk7@Li)1dV&UJ3sZF>KDtt6dLV01S>(#!a@=;pfd
zI;?=B_Hfu%9WHy%rO)3qf#F_6fKXaloYV<mE2F5v>{^acooKQ?S_HLrPm~+BZK>Ak
z@uo1_Q{4lSXw<w;y0%sLrr|TG^)68Q*&D%+>TNstd&9`(I$h`Wsw;&2T9P71s#jz@
zj?T8Hly8^JubkHLLU(}~t?uxkXLx@Qqa*=yuAUed{y|Q>{Qw;K92NMMH&A@uXWK$i
zN*3aBHLk%X%k(Z~?qz@e_Gz*`FiJf9=;-|tHK83}@k6(JdIE)RRs`T7ZIiHSq>cR`
zHJ)?C|JS8jg*Wv<n*50OG?@fmK0P3ftb;tNVyV!8(ZfCv!8I_$bTcp7)$&#MCb$_E
z-w)x)x8zeP>p{h7e<jtwXqS<m2KCc#i?0R`f}$i9p;}%ZE`-jbZaOn_$;7Md&ywKc
zWGd>4Lto4W**xe+5pG+$?$UPeVG$h`E-)*KL$m_>N~JKwfkpbbxdB;`A`htU<rkuu
zZe!IrRh^|KFyRY2-P5M+wuUaI$)&#QH^=s>kxMY%#(}^Jp`{$d87Cspd}LakP*kW;
z8%dqxrPOQvm}8OYwQZY&cNSIhpu#0r2X`HqVOH*2t;`DVD^gQ!X49j>QRtwT6dQK9
znD~#UDWU5sV!;?Ta}r)?ab*$imRBuRt9#EU5i%7DEt>ko^`&vcN8_S%1I%$AT<65J
zjP+fov31=t^N30~GWj^zH9}QjMx$Gne#rTcVmankW0OY$JvFJg%~mgO+e}kGN7|_o
z<Sn8o)!gO<b@7EKo)KStsx>3;`C}C7_3LvTjpmS4#A0+|X^wDQqGXx+u*zDZ*9DOJ
z<JNo4;^FmbEp^P~awbRw7ZG3>UngO_Qq@<aX@`E1gZdS3DhC5|6Idsk_tRJ^sh9gR
zb>P>^y%H)YMz3u{CpK8dWD@Fe0kirhc`hHzGPKoUwKqsF993p3t=ilb6QOOT8qWSV
zy^fZj*Ysu&;u))aS1F0^<(hSir4<*^RjX)L&|V2Omb!U@!;lX|B19_l2N)10uCL=p
z8k9yOx`#OL&)d82P6}{ct%C$7dL*vYb;HrwOWIoTac27{L0-BEuoe*_6#3eEO!0UU
zFVYu2KFwC^8Vn0Ra``!+(3S&ylz6WGnGw5;aITBh8RQf+7oRVsLf1FyjV@!^)~d;M
z@_BPQGwINEt1p!<%x6K%x5DYtJ7;3AML<ixY+i2N(h|~`soxZu>KoZ`A^3GX7jd8j
z+#@Z5K>?jjq`MH-j#Nj2KW>ql+grpMa$3KnXL4T`{c~8&4nnI12a+02*u=&OIc4+n
z(rz1fD(eM2t+>9;!sDT~og$BmOBg%Z21@kRV1r}Tm)|_DA^$z>%{j&B@RSLV9Y6d>
zdi*GEiF@NA{3q8Y_*ZMB08VxHe(;7kWtRvwBJ!NI;=?>WwLt<QSJhrl#GU-2RqGS$
z5ub>TWi@)C_ai8Aw6=LT5eH7wn0-V*q#nyBGe>XL^kOl0<uaR!$(B}NDX*ky0D3H5
zKl#Icw%nnUrIPFE)dWAaRmbt+g7`<H()aGJ@Q*S-BS1le(W)9?_0Rew1izqc3$3;Z
zOvz6T4|H~Lxmr;c2cfS67LS3rUQDQ2{miwIJa()gI^}7I4taX~y2ZTXgfD0-?wiwy
zuU-tGlb@alOxoVc1^G69GP`Yk>^W@Eg^9dL3F5WSYLy0g7n?HJs%OFoiF3Tx#6>7(
zgg14Jb<5)%p0ixae60R}^JF7d`+`MZrmb7k2l`F1^x~?j_tJc4&#d)z_eAnLjLzVk
zq=!}YTyQSaBhE9@n@gPQz`1s4Zn{^N8QimC7Lk9lZej_4{J5?(iXnT~&56D38Q>g(
ztq!GLe%wgH+%%E9;IYvl=zK9-8#d-#)_%sJIn;>yTcYG939LFecZk2I!0h^7jzahn
zIisg&w$&X8&Rq(c$>WDfR0+SVYqt1}qJPLJ-Vr@%Tp${hVhOI3OQVkAvwmA`4?oX4
z5$%3*kSLY=vF<L}BrE#Qko$6aCzmeSv2tR~zQxy+bv2%Rf*v&LNi^hQM^w#L9fq8U
z-ZhTr_~W_u8f#@hl0iUkeDyD9Lw@bLxWn-~IUnBe^Cbewk}ZZlRB_x1o^cZfH>W*Z
zK2?5_Bfh0iBI-}L9zBf4P=RVC@*N1gqt}ORFi^v!Hdh4`3-b)G&pgN;c$h#C^K=C3
z7+r52g3fj3R5HGfig@Rc9{4_l+UcyX+nhH@D@`}2AVB?b=SK<OrNW$tHE(!IqF7xc
zoWIt{s;}a!gO>t9UL*-HtGRf`ovWjwKo^T@PCE2{$7W&EBj?ds9Q1$@&jU?cHV#bV
z*3_E(E6cgztj9OFYcdzoCJJ_(wj@9kbmN^90qjU^ed30+h<MzJEjynS??`T>;8I+z
zklt2#FdWitmDf-nT<tticBm8h8^R;51%``~^H;&6ZWlE>a@t!c0!C4&_{=VE@!lP*
zmNK<Tj8Uu4QwN|kaAr}J9up110;{Cd4>vCLCy(#)b&PGWuU4|eVYuxn*&f;5j`HEB
zks2eUL@Ox4J%f8z!r`DI`AE`Hem5`;-^>TbUB_wr){rfVmMnV>PQKV&4T<GLgQ6A{
z0r@p#D?cQv`Vh>T!$7>Cp#*KkT=<#L&c{WjG>u!L<{yA`Bw(+brA>)25*D5}9_Sau
zZmHGrY>Ad^$*X24CP)JNG7DY5%F3s05XwCDd8&DSKr_^(JaypBY`d9XcsS>{-GnEc
z7a2IaEXzAB0?KUnai{3O8t`o_R(Se3g+%7y_~gFcU{tR?D`)_Pw{`TO$#mW~a{IZL
zb+3tSX&X}mL$@jxUM)T0>5O5u&TUisvyzkxrARGH62vP_+ufScK0B@W$;Sr$=kzLA
zc)f&U$R|T~Aw3Zq;c?=6U;U^x@Z(b)^K<XQS`S*3*#R;<05i%*$(OiVb69x1g!Ig}
zq*O;(8hV=_H%^b9o>%R?$j^dV1alBZiQKhWOS)PQu{#D<`5;FLqKl<ntPpVRqK;L+
zJ@wTKvq_JP7VGzBE4n4ckuZYbdf$Ef8}zhXToV|Elwz$Is1-`ncp>0S>7e_F0`6Jq
z2`tlUh13wQHShU1oNou!;4QQVssd!>XO?Z3OLiUsv(TN%LhoX$!xbBaX%Pq8YEL3Q
z<cE~1T;ZVVqz~2a9ofTX&PHKk7FWVurG=Z=Z}r;S8^O~s7Sw>t17Wti)&(~gY?%E)
zBU)aOky5F1FUZzeTBRa&wS1U(Q2XrNeLj2^tYkR*Xu!+T?v6BGl>?0g^UiK2DA#wP
zY{HTfv*fUr9(UP*YmR9`2C_~M(vxgU^^BuFhPn|)QS&%>3M>R<^?gxY!sc^em=l+b
zvi_;eB%a`-k&w}@C-8J0LhVt2$DZnC<7Ue^+oGz^0dlyTJQ2a%^26Evpd%gRiHRIG
z_YRdRMGn_A>m(Q=`M0-k*R?Rg*$gX7QUbvLjtm6^9z~fwsd~KT?|VtUvC(WlZK``f
z!=^_K8RLHFR7Hn1Q$t#f`NYh-l`!IdFa{fAiCW7{nh@d=z7|F+w~8IMhGJgf#AiG2
zRbd6c_*}Zz(xR<D*Px9_*<D}H)fO%!8Oyxk;(KG`3})BB(k@qs__$a}Y6JO3XuYWP
zd!)M<avLePJhbOLmK%b|Y@xtS!w`Bn2J_eDj<Q{&9DXvk)+aaCWD9LBN^1syHe1h$
z83{Mrnr(kkbWWBI^q2qOb<nY?HaKEPA1;WEpnXafDn5nTU1<i<1-3~K_eO9Efh}bs
z{Ty`lG-?;ov^Jp!sIr$G&ZkEra_}Agjh|llz0awbej3+&@;OiCsd}dzJ@C}N-~scw
z2)p-%)%z&J*c8#4v00$jv~=HEhpoiX2y7Z((h4edF*G;;*+t+T-b2WS63%NBX{;Qz
z?KqN(L&sNABrk2q7~XtIh@j8cm1j$AWMUQ_bDOs;z9EDZPHGhrkEzu#CC8gqwI;`p
zEpdRnh?2%e8)8gT;HyVP`$w~?d=t4Z`|nw<hLTp;M|3-N@@^6YD`q#s==g{`BFH9|
zz2JkV4d{{fEltTnL0M@(mM?nuMK38Q$(s%QSNUmX5nyLTOI7*abEYjwH=<L#nUGln
z)7A;$Zlscrgw_*zXPG&I*)_3d%c5dD-D3JZ8uYriY6AYS^!0mnYqlK1*M=v@EUl?=
z7G%$CG4D-zDIBmh@H9{|gS+@Z4IFe~FCWSm^7dGhZGe--_`b5Ox(T6G6~%5(4_|d1
z`<E~-Ea&xC##zuXdyUU8m7^EBK2p@KB-S^fV}bhLlqwx|AflGX?Ukae`Td+V0|vI%
z*Gj&ID5TAR6VZZt>SIu;A#A=8r=^RGCR_<sOyb_6Y;B5rKzr5#{#5Pp+=wRj>O~y+
zSJRlEf#X2xP6Bd6LJs~R>F}#MHz=s^C2x)O(XkH62UU(AKxc;FUmcc%2&}`3vm*--
ztmX#iO&^rr+C`K)3}j6$B!Il+`t3PwPR`to4$rN}hF(998#szrpid@6?;|wLM9{y<
zd<>B~pLTiSz1BbH453bCaQ(Q}d=_T?j9dtR%GknzV{10Gf(rIsm1ry8P^AKMJ?cx_
zpjUAMw&6u>?W>pbL)yVmdhK(;r5qn`9etge(jhDOnpWDmv5sgkv>pMa)*@z(nC!sa
zHVog@-Ke|WDq0vz27hdoqT8*qwJQ|VRsVb-`x>QyuX81RqDtU$5aHcBg3np2%DKO6
zV3hhxb}hh)>hogTsWWl3oTu(QA0S+1I_fvtZUNN5DIu9w!fNHhW!_O8{yx)GL|qf6
zrKXXK)BIoNXmNpMA(WTq{9M9C5Yea1B;69B9Mk#LW|~oV4~4z6TM3TPVC_InG>&x;
z$VBR7Hc><iMh!fzI;)cC?y1or^OkeYO2Cz4CRUeT%(1~Jy?O^(O;O7>nBNB95La}7
z*ajNux@)wxnuii>>tQApS(3oZ5xFK=^-cecwkC|+w0qmg5?1@M-Fg7h>J#;*NPYdN
zum?Kgg>8R6ZOFv|6YqWCW*)yb;5ERLQ7_-7UbpZ4!~AL>Lc8ryptgVFl1;)DaXa<-
zqS?u(k2P3QTVI+EGW4`W!TQ5!5mNzxL_4<MSnNF7@L8<BOvehT^pGjs2zj*193^e5
z()w||ay?chxhYq^bzIugQjc+!@#d@`-@C-?=<&{y^y+~A{4jE*tG4$*pjY4R^w)zy
z;$IOHh;`&N=gAvPL{RMl=Rp{LXxJHl9B^3xPjt(DH8=nSi9@u+I>QQ%?XYr7W^`|v
zcAqK31$#1o$urr%0KDu)D7^W2CA8NeEY(uiSh`V#K1qdE4^?ak>DtrC6cC0KYgTsQ
z;l8%o2-;MX$oon#x%|tct}Lphn|Rv+{Y^HqiL_$i+dMp0n;`Z#s*~MCs=eZrSL&s&
z)mO(o%%0#iAC@z8FEzvvK`$=(>25Av#)ekR&;ufDs5^4ZGGzUu5PoZYtX}r<UeR(4
z4L*uKUMX=+L^z{Ayx@@2hM(D0dKbw;f!8)`VX{j&raL8lsfMZ3Js(t7ne2INb%EyT
z%KL}h6|%my!CXCVWUNadaxKYzg4i3%bSXIU!|j_EmUdCpw_1;{vmOmP-Gm&$X}@_^
zey?uFLGSpky*WK;hm@O-Em<R?$jv4V_RJEGyV_(k++1E(J;FCyHdah<Z`8yn+1=tK
z5<e8p%+vEpUC-Hg$Sk*(a%G~L@Rr^;ljjtGDx1vrB4XM<kPng8%~+Hb-iNa?<@O`H
z$r~(8Pd4IncvFQcX6=(Jl2TuEdNE;|x;m_(wv9@%HZTo~DM|Iy-KWs$vMG{$6tNa%
zuyz(g7&n;@(u8(fnvL+k<0Ldv%MpF}I0i%3zf|Jom0HpE!T9N+5sd^+<@<!*w>;`C
zZ1~dW?bh>%>I5VX#wD*cTQYwqOnQM|FT~B($&nHCSTGo!^tsM*6Sxm8t=w}Sk)`QP
zmzJ;de#V#Mv4g67gk+svF};4ZgHA-6w-0HGmrt`<Vebgh!Ke3=4NaEcK;eD0ZGkaU
zE-|3>(q3+}X1S(Axvko$bLF)?gVwxz^3Kc!KnUv440kG&8%xW9>%W#KClCoY{IQaG
zem%2l;zQsP8MilU0;NW`RB@jcob2e6hM(Va-JZ%M`T_gR$ML&=8^QRUH+(DTUdI#c
zww;O`hT(+jqG9nX;)m`_W-#dNB^kPt2*n{Oq+2krgyO!=<NH|b-Jg40ljUb;&QymS
z<WyN#Ni(nD?w#wtr(P?47`4yad=sGJBH}1%C*teb+mEV<x*3r)wzZuKy)}@sG!J&n
zYMm`A@p3Y7NpWOF=M^u*l(RePd~+t1W&eteS`1Hnw(!j}=4fkj`J8v0?w^14U+2F4
z$xdqb+`h0hDmD=uL6(=cHPIw5moM0aQ*5;a>Q;vKA1wm$aoi%M3~_-Dpe8An_(RnF
z?j|w^`K@YPtOP$ihm7#9da1M$RL$vz$9p8qu>&9T{Zbp99ZLq?R-3?8RD>0t^2mzE
z+NiFLdchdTiYB!MrE7AVT;`f-L}$?_ADxvxNCPn*%)~ZJl0&dfw?_Hgr>(K|S*J`!
zRoA0=*J**WxGVexDaQ062q7$68Lh(uZg{P7-ki*Q4M}fIzq?Se6GprBz5&A*cVrZL
zp);rrfzs>x3Yi!CWXKcDcPtn-rw>%@3QC5zDKy|STxekFjyJ>Ebjl5_A#sO)ESc-A
z;SJyRFPM3x2fCP4DfN+^V~HHWxx_`zRW8A?AKLk1k_(qox4{AK6?vK5SZgBVn5xi>
z?F=B;B{8vn?@#tv)3|v}aW~xI!Y91LiNtzgK&5(7Y%^OoX&q9>;wk^sE^ddi?a{^R
z>oY%Zx@bAnz@42Zp!DSH#$ItvfBpcGDib+16k4eDy*qT48`t;R2JOi;eIo3DTSHHe
zoM8+d8fY0x7Q#75j981fpuz96(p8<k`s%Wun}!5?5LB&rO;GhpN7z<#CPZ|V*eA@<
z3njVseRKGjZK8-v@5@MsG3TU_S?xS5cjMfMnRcpwp1M*(d`h2HAf|o=FCoU;e!re2
zDF>{<02a?)+_C5~QmlH&m~HcgG5NMb#*UE=#4V)xe8z})yvPhDV>ww0J2$-DJ8t@p
zCd;fLpAx=N9CpSJ;N7oaQvBfJIgOkf_`MbtJ`vRZaYRtlW&p%9&3ZM|s=&Q*7zq(Y
z<Jc{F$hEB@nXt<G2X@yCIK;2aJFOmY7;$?tU?HPzw_6#R7(N*NGuy6!d0n$VF>=io
zZu%fv=%Ht^)3*<M@Nzx<Su`hr{D($#gNPpI`tIzC^rI_8^f5Fy#o6Ple_#}x1xt~%
zO|M*iIIW%oyXa=V%<q?tdmKMCk=iD%X)&4-v4V=21;u4YH{{Q_ln{LO=S}%pocD&)
zxC&`hb%~Q<wrXL7=iW`Axza9n&hY~%Z#~^Z>-ZCm@NC)pxGa>fUZ6a5H*7c3od-;O
zepIEI$l7U;!5hNgEG5^`nkiJ<Cy-3&v2-)>s1@YtRLkmN_B+<@Hf{;2BOWz>m%C{s
zL<6ZcFC+8VN;h$J{|ndwS3F!A@uLl}s%zYDD;11N_q{#W)PoMM1R;8qahbiR{7Kt+
z%`xzTyt?(P*0ydQvMiFptiwIS-L@=X-rl=zL*;4m3}^HZI#|A5zP*<KYRjt872>jd
zJAKM?wQh0&r_1c_gBF$umZk1Dobf--+Fo(|IdS@h3K!+H;Zks^QtN`g&x2%Ef5M&Z
z58$ro7Pzw*R<xxhhrV-*A<8`HQubfI`tERQkTu=zNwi^nT7V&Zz<K7H@gT5B@faC-
zI!n(L$je9d!!-uZjPdk<Q)-oi3Hh-CCSVm@P|-s6&|}wjgvc-u5#Gl#i|z`YyQI?J
z56{-4B064hpXr^=6Cen#BAgATk*h`z2O@Or9)zWOo6*`_@5y;RNC-Q$$@SW?xFa3J
zoZ4n`^?{ogj83s|>G*WO=uGUUs^nA4hk5o#4~mY)uk^K#-G7}POwYJQHT}F0(Wm-A
zfz16dmlhdV?l#Z8VOolOux)nWL5BK~puV_Cz`4yd9B<*W1S!jQ!(YWTjA$~Q@Ex6X
z_NHs9w7Gfl0-)|}VVk-K-m*ow^@AC_Wo>Pd=hl2e{#XZ#7cFahYVDA&#b)sXC|8p{
zwVY;i)6ldRVB0ujW2V3TqHcBym?j+vs)2`f;n3iK;TidB8yi;O?oo)iS%@PDmIEes
zs%>?Ja&?!dGoXeHwWI!}^^ono=ek(&h8~%nye_h`H7|a5`*xHpXGg<Au5FixVfqXI
zlk<rH|A+JWuf($da6bRT`Mf1_mI0K4Z_6-~-;LwHz9oO6d;XJt*an<_$Mv>Fe+)AI
z*QfZ84?f&d#$S;A-)4BgP3TvfjEQOxjTCsXEm-3#AU9z-6DEzg8^rssg#X_c|8E$Y
z+z$WtdXW%n3DdG68)74Z-nT!g^v1KEHGSm-+Po8B_1*8f4Tf<eOD=4zX^NF2&kQPD
zMbHvIZ}K1zr@ak%yH1g)->o(z5o(UP06gI{n3Xv+Gqb*krq=}?<(&xsLOF1Ql~Vih
zM|NX${xRSEx8HHQdc>^&CLRn8uDRoP_1Fs3`6X*J$I6iZ(NND%f|ae-TLULR%YA{e
zaWuv_UteJmw?}cHMg7bS%CBb^Mw~?rIZr%O)y}-QYe{uLA!0Y!_%66l3_~Z>Q4_P>
z=3>__^KW%h<k3Kv_n8&QoQQk?j<DCY3rYI8B!&a;=kwt1TzNp;5C!PFL31%@Ed0W|
zKx!8pa6-A(qbx7&`@C#S{3Rfjs?>?6S#@Uxg%g|D;S(%??lwu|FaOZnHQ56^p`%^r
z8rd=Yc2N?SIh}_>lD_58bi6&S<;$dQav%%qoYe`(Y3SV&AHZZ_S#hAe|5nfBr8@ji
z%5C&p>y>|1Zj%ga<mLabU;2*^E&%Mz2rBUX2)hyoe@KsQ`bkdNLn+*V73`%h7fwh2
z%e^_hdM#$TIuy$3w<RcPg{Ih9>{Z^l3Nz37j}bI<W3d}&Hm;k3>0j`S!SRuCg3|rS
z;VOG#3xRGf15)u;uk+OKc^z#g<M%ypaqu{Bx$H$`4pMre1tU?nKL5=Vc}RSlZYVho
zXD7Vt>33j2U2>1-)>a=6Zy7CRgKMgV&9#|}^~OxU&5-HtDQ}AqPT`2#EEpFx2;H<g
zHamI|;0pC~H}@q~*t@A@^w}}~?+^bU&tV8atnB5b{T>oWecuo8=y^A_8&!Dziq9ej
zz0>L|&q=NtfsT&;9amQ52OgL0Qpf*OfTi`V3sD`*Di@xHLgxn-nlphHfz%x1jS8-C
z74<_k{&eGQC8gkoiQj>UR5-r`m>W$6RJR;X-aA~1J6><`)i3k7$`8C7u<aXyN9WrB
zX_Hw|(^CM`I>)|{ga}2+x$7g!2_WU>!W!yBd*Av~Vz=oajpVfHn-;rm+>O5cw9|r0
z)Xe1zKy*fM2_0EQ@uQG?_<s_WLT=C4CeO$khmjzpdxLhVu?CQRxabd9A^#w@PRx4Z
zO%G&zirK_MFt;9Z4#=2mnJd)22e=f=ypHk%X4f<(9V;^*y(A=&*Q<?Io*Cp}m@_zN
zv*|kPQEgu`+xSoKvrCumIuWD7HvXUX-aD$vtos+YAfVE0pme2*6zRQ*R0RbDq@(oS
zI|PA2kgC$82I)0O?;stdL~4Klp(6wc5CViy?!$~T@B4jc-qH12zq{7GcMX4Kk>ts9
z_H*{$=j^jTpAX|@4rE!4#9eC1;DywUiOMDAtuqsV#-X#zosHpUxKS^Y{C;@bVi3<2
z%9wVJzn{m1)c_%UTP)*Z^_5M5k)(&>d<{_LBHk>IW-4sj#q|sm^5AI7=G#xSWc`_o
z_!#dF7nrk!$u;^$kEqm}2#x}i6(Vfg!6iggnoCEWQO?hnalb4){$tB0E-NxGe~yV6
zvd;NUbb0zlsUgHAL1x0O_=PFR(i<&j7);;AMp*kU!ETy7{SHi7R(+UAgs%NAKtrz&
z{eetL5zs6#$i@`}yY_bcoE;j=|Ho;2f>B`h-bg{p$_Ua@!lU(aVhH?GVrCfI#3WSQ
zfk7aFh$h?B3R4S2p6+993-^)Wm%Bpo@C~M>xwLE18J;?}iqH2S76Ns*-6`Eh;vV?g
z6$wb^tQvdI`=wthro_apBd@O3)KT+}Ukjc{5~PjUs7^9U#Ygr$VjEJ9R;~1{4(0t8
zz9bkY&8%$oS^Nj4{|5NZ3zHoMqk9I<{-m|@Gz-~#VU!_XcN)nP8v*F_7`gqt@bB1Z
z;-e*y^ihjcxX{-HQ|8^oWT|fE^uBa%Ab=<v$u_zIjXk_V$tyfY<zF?hcQRg)DK8O@
zzwWeIjqbB%rq76Q{AOCJ5D;3*EeoOo(Ak~^XIFd0KSZs}6m2$D9C4<U8CQmRs^5Qo
z$l%Ey#XljD%+z_*g~eKUGAgsQru;pV2O)LDY0w!O37&X*i~Xy`Q00oRn+g(V{VvjW
z;6f!Kx7g7K(9?k>P^E~$)2_zz(n=xq44UQsGzM=2dRyKRhYZ|Uv>iq<2$=u}tx6^w
z8%GTC!-j@!TKZCQtCV$)LfTop+Tj%U-gOJAOBn5~az<GRclQ$<z2hi?Qr!~Cx@_>~
zyzL>woBoH<A2Km~B9U@#ve4z6snw3ZBrN~eV+lU(kovegSy#CC+-Gpz3zt+G_&x#-
z5ZlU4{z`0%uYEt@;9e7yxSw#~nY~k0&KmtVJJYf1y#xB7K8(gJKF(qHs!3dK7rmOM
zT&QX3pm{#4xL0l=!t{P1qzNB8?{AV%vXyv=$WfexWlnv=gLaCy6w_4&t?^zQ-iovv
zpvlV=EzLUeRDU+L^?;_6%F$PCSt!G(uuVN7?d=!U<_rJ2*}r;)14<7jk{e<bQbs<!
z6d4a_?B@jtAzjQ@ECDK6*ER*8F=PU_c2UW5i$EEHIYsZvH%@*Zy3>WE9`0g}YKJzq
zcqEC+&(bfAd^-|a>+%H{1;_F3)iA{NYU?(tMb0z2hE($_Qr(Ga6jtvDg;nZD@nXw~
z6#iC->&!XvQ~iTw8W)!lv>*h)M+=Fxv2@dD5AI0heAeAc6t`^y4wBg)gPDw@RkBp|
z9GeiABIU8$8qZRP=R!<y4sj-+udyqp%x?k-lxQcy94%fArq_+CnGJa)-;m|U7)^&u
zw#)B4i<|<)_U0Iz>N6bO=CVH7;`=r;{gsXW?SJL$!0B?&=j(`vMyzIB(^p7ERVyig
z@*TxW^3_wh!;J1F%y+p%HrGPMuaHCgsVh{>7%x&-c)PL&<I{pZy)c}OSJ>JW{;<ge
zP9}aUXX@HtESmN4m6J_4OuO3i`I6-5mLeb|p4MF7OvzGc=IM%EdeNhc&okNocD3#=
z07L^z_4v}F3msvsArIm;=EC-M-m0|#qKCnU1N=SEgjd(b!%xA}rTj90KB)J=;F?9~
zmr|TpvyP7eIjj$^0Hwuc)OpoGpWRDrO!4_b5KwrEkTwz{p>anUOg7AGq^G^97B`TK
z2x28ISZS^2COmw<UKbi*P@hH?8R;lyb(iG#o%w(6A%5FPe8(~Ab)Hi$qvETv2MYNE
zM5l%PNLKq%01WNkymau8C^Vg+-uP}mt%xX3yJe1t|CvDNk71Wp&)=&z_QMbK7xMlp
zzx8{){<5mee#nrU#U<V8Y+Pn;<Pye$hotWjOn<xxrzxhVAGW5b6dkKA7tsJs!Yq4G
zBLf1&5E$R##(W}Hx1%5VH(@ofOlzxPUDPJ*IuqV<=3Jj6-CTwchJhe)n#G<5Xp)-T
z;@Uppf*u*Yo~e@9mxh1cV)1l%y`+_2pR0$3>b<^jxlzD=N-r#WjG@p^^;39nwnK*E
zm05x=lb*LHMJzYp^n^vWJb0bs#ApgKov<ENCZGS*-iT~Db)}kXCWn@p;h4vWoO3}s
zNrKi}Ps!fKyzK$0M+Of>=-&=Zvuh>H1)6~GoL34<Q5^WUiTYO?4n9EEBJ(U|Rr$R%
zL{~q7xrv}f(v;wDkZ3BFUm?*8tQ{}61fX<JhB&pOl;Y)s#rg|*eLt8bIt*==d}Z|N
zzRm&XhrK>r$p30XU2FNq_O9||gRyn*IrA@8u<3eF;`8sz6}{`j#T{p~y2qv(JI0?%
z;15_F{w2}jzc!sSM!<el_yZ(8J^%BsKxd4gh3g)%dDNmb9nbj=_*_f<d4S}@DW>`M
zc1T3Z_`q$`55NL~o$r=>uV~tF>~F|t_EY3@ks%Nhl{<^;C>I`Ctv34h(b5lnisOJ%
z+3vm<N|(hCs!xcRDrILK4;PYUQQ*HmC-Apkbrz5ERLMCcB5C5vTkZ3ji`uv9i7``l
z@c@aVm*H^euj0ZgXqyvHE@B=dkEF?8$ryiyJP&0ax{0K{$a^8`7B+c>3eYh?7~03K
zXr}Yjl3uz<$<g_?&>TdFhvB*Wtb`_*7|UNp6X~73-M_5-wYYsA3J4}Tf0dSsuA9za
z{J||wULra^L_?>znhxjU5B^gsQ5^HPQi*@J7x--!kzG2(zzmO@jsOxwZ*D9=dbqbe
z`RyaZ2d%t;^*h`O-Ur?|Iypi3ooJ7sP)#ShsFT@Xx<kL?V;m~)B=WF~bZbt!>*h;Y
zXx|T}==W*+2a=Na2P6M}IQS2Z;D3FJ|Ii5j_l)#^7>(e+^iHk!|I>*pX8wP1VtL!G
zQ#I3x6M)Dx#J=fh^yCEKMg_-00pDFmoV1ck?w=eU?IF}p^cPU=fp59nLQ|7|KQsLA
zhCKCB|Krn56{7K@+0Xg-|M!XMpK;}R*oqN7ejY--L?Ur_=;@E5gvF`CP^HOTL6%Rx
zLOnJ<q;2D^<aZyPO|cgFOi$&Ic7n3J9`q@7=^(GXzKlRMhXOXVeQ-VUqJG1iQv7YZ
z@AWmEUE->`t50#8k7GEg-~^6wmrL(bI^Qtu{+jIbxnF9SPL$mEYp%G)`r9L;XDSOO
zPg4ggnkk>5QfGF}I3r+Uoz}5coN-YXwB}h_M&r%x5WS+`*wCID)}Ue5s@jyu`U+Po
zp2l@tkwYQu0cWv%M!MRgIwWR%a$=&>>+nWjcK|dQ;2b+DWe9I7OTbUkDZDma{Y}^R
zQWHQoSS1aHLvzwvG!U^pU=2P9QKwXd=ZlHyUCAn2Njh~ys~FU~*Jd{i-I2TIID^@$
zPqhd{G8Dz9SA>e@2p@9TwQRys9P3vbU48B+5gVSTqY?y$buY)Ph;i<fB;U(BE@!`I
z=N#eM=t2Tx@5G9g9P0H~6k)wAc_E_Ou;g$CZ+og77k6z?YE@~Z$>kzpN$SYX&?tlB
zn}1B3w1<FN!E2y^Gj{Q`uGn<Na91XIfh&BuXS>rD@}w<o2_K?=zPfJj9MapdVWl#z
znRE*pWC!$H6m)p2!Da|#SSAi&cXM8jh9IwL=KzUvvo${&KV>N5k=*)x-c3!Cj0FM*
z4QmZ;RY=E^&2WpO;VAjr0&^=hVq(RQP)2%5(05-rxvM`%xR33zz|{C~)<Z^-+B>@Y
zf$J?b6=KB|7uP#-(ioD9q4=YbzC^FbRP_cIMP8hnu<}igf~U#4A;Cw>Psa7)E3Pd&
z*}C0|v4<H1sy@Zm*p~E@i-B;5nLhaJ?Y8srH`j1OQmnp;Sz0chXq0^g(!@ok4rA$?
zoNsG`LFd&(hhfV5Fzr+I>LRTpBB*@ojGDKNU9wGg{q7MP##wIez0vG+y%4@t%Y4#d
zQUlWU7Im?*Z{#<WFBc#209BtH+TCxjzVN$Yg>(SiRAeR6Qs^AyLOq=j(D+#2<g+T+
zp$~htJ)QCD@ME*BET5`$nf$Mq0wqvWNCLCkXWYl9)YtDPh6!ecS7BLw5~)!d{x`QH
zN<55V*~y!44t5LM7_FKpGEFxp4AtX*5uR9MJ!pQ}E>!MvtKWd_fPV#@*#y9vc{z(e
zoV*4PW<LgJbqvDw9x~k4%`MxSr${!CboGrdFG=%^n;utt)Cpyyjo7X<x;AK}a1do7
z!a3#P-LHsvqPgPAU>7$_?L26IR>|sUt26Coy;yNSWVR#6Vzt@;Yz;9d@kx*4r|~Q4
zHPL9`<WL$-d%b7h1iDyo|4P9iv@VEM|13?>HQ$0L&_XS3)vVWxlH&^rnrjk%01!hk
z^?l9a1*0VV;A$Nd96RZ@iTyxDue)^^Lqa?$CJy@&e$&SVjxiTC7;q1r`@EdrBrBAJ
z*a~ECdJ+ecbi2<*1?icMr$j<gjXtQ|)q#$K_vO%m`bWewOGqCt+F`EFaWTi88tU@S
z0WZs~hJprHj#cg+$Av+7OI`zZ$*iFwg-)f@cqEwIFY=EZ{S;94B@8@&7LWRp38D}^
zjb~Bqx%Nr(y6fk25r_wtV`kWFs7B1$R@}$_9`;z%7Tib8`YT+5Z%`QwADp71C4Jtc
zKdPr=7v#*zr!g)WYk0$GuvmGRo031LbS$PAmejj4kjpBTo|^{I3!n>_miHB|8Nxr?
zE~&J`Q`a^iHH&YZ4OQcy1mMe)zx1u6MW`f?qb|f^)bT6p*W1FF-*;0**PhUw%oG8A
z1gqf`%}X9^9?fDxnY)`V3k|7q#v%^=yGW0cM@vVgR*^N|1aEUT%v_(kxf33(aKll*
zo)9a4rbZij$*Ti<VAGf?yp<<D<K@%(El^r6lLWTdI3jObi*~fGI>v&FI3@fJt$qO;
z){wH;+vPRi-rK%5xUF>$*|4%)ndB+}#A|X@J%z&~Gc+UHd#9{WM>tr+*JNpN374cs
zQGlhvyM>p~ZqxWgb9}7tQR`que9eK6)BM7=xBDYxSfFP-l28j-uPm&IZZmDF(dN>R
zK(5x9Rzhm@o2ESLoSk?PlZ6bNC$uwWVwzD5|3;X{dMbUr<^S3L^7SU)kM*8ZRVDio
zgQXPOuJ#-`2I0?$)a^&_N`6!1MIu$7E&01&8L?-7d-&FjN0s*qALplSIsOal3!F69
zuTF_2Pqk}{#DOuo_u#?s&6|mHk8k8T+0m^wy`!u$W98(`I1>@!!6B)UIrw=kz=))2
z(wDDJtUmt{MYK6~<cnP@ify`(%d(_k>)JCUn?!&GP$R0!YZ2sj5G0A6@Su9Fq#3(d
zQ-Gcu;&7Yez)7koJ-aH!mn{DJ?DOs1==VlM6i3V^GXsU}4Xyjk7x4iWSBG_nId!3~
z2^}!;D6hPP273AVv5!6S;aLYDMp;h^=$%l5j=LOqur+$SSm5M9X|yb$m<to!(2AMP
zMCtoVtWwrCMnzst3aRVtxzGC?<7n%st%577z4y4m#g71h*A&$XC>LAo`j+kvQAZ8|
z_q&T7?(H@S|KLk%WA9s%>Rv<QSkYg{ma}US>qp?Qx7Q`%%f<ihz9o?E;0p<I=(h1g
zd+SDiUHP4(Q5%rZttjU6Z>)ds1U!qUbXxd)1u(8KoJA3@=1WEH2p7*99}XuT(CK-b
zZq%<4V0II!M!-o2Tx2J2<;*6Z`>bX+!eOjI`wxBCCO^;s+F;3{Zt9wfrn-rF5ANnH
zQRQhz%mOWm%$HWJu8Iw0g{{ENwu`a~Oc*RQ;+Wcu2y1UiP6rMj^lTYAUW#nA()Y5q
zqW2Rz$fa#C@yZVOcXoMm4YgiCXy!ZOD5LbbW!t$KzRP*ghiAk(celxtgM`SjH1$R}
z#9}Bt2r~{6=S6eB+raU6Q(Ne$S0NuFR--jm*1UrT4wiS(=0ZuabQFx-uPIbN1(F#y
ziiF?cx3V9($$vCyXPu%S1|8@Q`VG{r+Pl6q!PpuKKQ0{1kG{dd+OveyeHw6dsHtme
z2)4@Ty`j=!xt?Qo@5K%_WzuAR!Oqtnuz!j>_Sm7KUy!2{lv<4x6!Zh%zlDZ0x+j20
zOpqqLk$PTQ+6lrnV0!^%NKX?%IR>l0*bn~KL7K^_`5y!3H};<;=;OXh_k?3G!CT{2
z==cM0-bY8-nypQ|xhl>A0qZFNWzlS;!~^9whcBLc?FmKRFX`ENmu#+IRk{Qt7=M$9
z_scKPZ(rLN`nZ}jl|sJ(wG1cqBBh@0{VgP>hG+h<hW^9gX<1iQ1ms#!^YvJcyY-)g
z+*4|z@z{N?Oo(ex9BIa9Fly9Xrn7a`F#scX6q({R*!I2*;+&<2PzJWYrUjTfM-+U`
zC>NO5e#dLx_cbf4(gT*ja1seRSJyW%`&$oY<?#!~!{X9;T9rDFEY}t*+IDfeqXjF6
zBt4D>V9G#*Tk@#KGfdVE@RLy$+alBm2X9l0+q5Zo!79aFRb|L?t`y<5+fZ(0G^`C%
zGaV0Sh@aLVes)ryfyx<0hCq~+mpdgoj8i0Lb$(x}&V-znJkt9ms<Q#eD7JO_R@*p&
z$#MlbnNz2U(=2l*H;WKy8{=tz3E40ZHlO>rBP%|Ie(yc1p2cY{ApdkM{L<ojX!XrN
z<-@)T*6tR2_1l7bUz)z9TH+oj!aV02`h^N}J)Hz>22tjV=er`>r<D|^YpMI_+6%=h
zTP!)EBM_y^XBLYXr$~?Hi0~fxh!y1?ZpwVfpWIm2FYCRilDA4RnsDj{PRUH>At9m!
z=li<%-<2Z2RV)r<Ra=N0i=sKHE-7hJtCBrd^<!*zuih4bJP<R)`0J@0^yTt&Q}Wf;
zvl4aKbmkm=pYiD%7+KvdOql6~6v%15wi-IF?%R7fez1Iu?sQ@ls-7}y5ImZ6+rj2q
z+SY@5dMQ;qg!o&P1_u14RrU9BYT^SUiNhT3H%)1Dq%$TtT5XN(kCI4&lOZV1iBzsu
zyJ=IP!>k`3GjEhCv{u#V%f&$_+Xv$>a9sFW=N0E7bW(6{Xft#Pol&<n_Q`Vc59B%Z
zyVK)`;c<eYVGEffu`kO71vO@;hY&@dANtcQ&*~z^gKgR{ZzdOtX@*aM%!B2Fw0)!o
z{VHv)E~|3;o#V=f=`Nc+=tOC9n)16OmBMc#W50^Icy18fjqL~)q6uym66t=>lMgI&
zDZ{}e^fY2G#fdxP#N56OG@JPru|-IBbNJ7|wl(QoG%y0{+m$$lXN*MeiXBr!zma|D
zvu-WlaO#z{4hSoxsHnHnn~Z&=al)uE9lDT7oFLFBr+bOZ^**ScINPJFY6bqfG(g`|
zt0Yg`F*TJcaw|PpXbWQHzrFm0Gz#5$zj{S5dV<l|M~(LDaKIBJvMdnOJJyMZOEDaZ
zcfIq{u0WzF3LfC7R)1Wvi8a2j8O=Z|KUeBF{9-FG5whnhQKj!Av7|#E*peYMFucd=
zxznY;o%M+^w+VjCx5snyy1a+tkmG7Veh)OKa&+iU@B}gpQ~wCocDl|@&Yo}AZ^CSP
zTV7O}ckOecu0caK9OKbVyFLYw)PWm)%ku8?1G%^L{y3qgKIPh#mpJ1E^RZWNP#l&S
z!s(pd3=rIwzBVD>y>{yl5@#Jt1+`oNx=bGN9lC5c7iHh3=R6T^=y20SRZ>XK()yX4
z>TA-I6RKTV;s;!xWT~j<Jg7mD=NLm*nQ@D&4W=Y-1TUEGCUp8z-{m6@tMYu?F2gI?
zu*RX9rs66P9hJ`ZLLuTsPQx&i`C3szv<8S|LLw~|2Y2BXXVDROtSBm$A3nn!<iHJj
zPn=zCF!5MUBOxbUq-w=>Cf%f+ySjFXX?MDtYL-g%M)mvpcew@GNYIct10f0VD1D7w
zqXx~o2`V~Ywg*{u<fRGAS#m(47i&>6{EdcR4mIs0iw~ZG<2r3uKC$YY=wJ`?DATO6
zB|DF3#A^q<4CkG7@m1u`rr1f)1%}4ke!6wxipvDpwLZV&VXI_SDuNh{T&<Lw2Q+YT
zhdx%8jX4Ud#ayFk72n1J*J%x5gQ>#hH?~a`Wd_;i0R@gzKKjmrkv0uIql8*21H7wH
zLHLc{CWIBpg_|~|{QZO9GqHchsZug)E%qs8UiPf=s@U%Y)jfDrd=14k@fbe3`q>N0
zZMM&4i&KN3g42_T5M^c=c~OpB?fl-=O=g_=N8c$Bt69`6v$txA<5$J*Eh+v26L;)y
zhp773S<|j3Lz!p2s5#q9*)3K0d;nqXsBT0L7gi?ve%D8lZ|SvtAkEnKX&+nWJr=0a
zxvU&Q)a0&TPbdE6Qb7!L;8T5h6cLV8wpl#^?z*lh5V9yV@}xzNiL&kkU(P~erJh=p
z9-=cLoLQCABhX8W7Hj-e&gaeI{<}Phg^%~Txg?X`2}G-Y@XV(VQe~NT)mx}A)pn$e
zdZde*4XP$uo&m^?_aht@BOcn8(O`7dDmN5rW^l5b4d2?=K5*!Qs~@ZvLouhztSzmQ
z*I<fwPfXLS+TD}o_U>t4atY))0BO8m>RlHZs5<aqwd=I)W8!l41Xck%=$tj){aLnS
zpS3%69~{ZcMZoZWm^SI-aibv`M7D{+#7&=Ny9P<5$2ig0WWz2RZs|&WLsLYBs;H;=
z!xuVf_zW6e8es?9+x}u>UChO~oB}*(S>auDn|711A(t*SECR-lb6n^ZO})b*5(Lea
zM6gp_J8|p5&iaVeT3q{=B5>zD;EZ!?*Oycmf(t9>RIViw@K8N}C2<;d&fjdl3;tPg
z9TrJ3#}O^px<C-&XxsYR5i_0kjq9RJNg-}1>8ThtCc{wYnzM%0+K314Sz+M-MYp|C
zkARq&I@rd5_v|g(a2Zs@CSxw3PPqW{Lo@1u`@f1*?4F$_Rc%Sj_ocoaoi}vQxS(*`
zbA7v>%m48)y@dzg2*|6pFNfKj0@|+JK7L<u)o72ulu~k48&<s6%q>0c>Q@ySCAN)F
zU>8Sx@x>izrpHzh^(&pb8CVmuxWlXM(JUOTIF~B>?GxgVK9SPbZh4-+yyrAm6(EPI
zwrmXO60R^)bx|Hw9Rz(W<4?E8tT;_3?j=fQ%%PvIPQiAp_~8kAo`YC!U#1(y=o*fR
z=jO4*-2grB;lr-uQ~lY;e$DP1oVc<$t)a6S4aN4rQ<@jKw<Zpf;MXyv?yXB3(kntk
zzN`$0SsFL6f4EyYU%OSiWJB#*hBqdHWiaSAn3!6w3B(S}daPv&dS3e8OEX5uPJTHF
zUa?oHnvGW4&6PSQ<28KinJf!^-~}ri5F-=Ng8`w~PU5QlOrF3nvtxW9ot=c6UYhy$
zlXHiV$-*xDwr`=^$1U|yGjB@{rP!wB4Z^%7U7HS&z|mnseybg|isp)7OXp=%-Z8t}
z-HnZfK8jmu^A_RDWyE<2!F=*`Shi+eiGdaN8lJf|ZUg%06;)ch>adAx(0h^!1+^-D
zdXwcJN7ROSvn!HBizLL^C)fA2y)1z)C+WJ$<W10Kp$SxHn%unhTlzRj>VS=&$o8&8
zMofeYs_b!}z;%<-x7I^_!OsNZ)6MEus^|#?Qn+nd=By6vd9?c61ts($&?RKTWpE}z
zQiP-_o(H;|RiX9d<VNT5*ff|XoQKdeUWcI{BR?bjp-xVA?W2TkxNb(}?%EwL<g=Ld
zUQ!;H9hx3RUJi+>slu}9JSSDJ#&^~AUBN*f01;GlO{1ZxrB}uS_IgTj=uWnHul-QI
zwm!^5-wlT~8F?LNZ&%w`o#+l3_0(F7aY8w!R%>(VQo_iQiNJ!xEwOxo@!q&g<9H<$
zbLhZJYpdIS^u03r>52cz5#r<q=Xv4!(s~}ODJRe`S#v|Hk~6LTU6#Z>m3f`=v%qOL
zjCdmS@bW8Z^6*JV@&Sl*AKT-N-546iy~^6E?vJEutdH6ylN<1;SQ0a|pM?&(9Ipn&
zN`6AGCIB4-MB+jx{C<ZD#~$=tk6NwS?zdrtl0yy^Z`PWdAXS~8VrHE@4Q!nrK5Adm
z?!o9kdD8L>DP0*CuWc6nnbaw?qtU1AXtjBp6&xDViocFo))33l8}6R@SY)V%$XW}x
z)OU40>qRoL06Oe4`lW>-V1bktH3$399<8yOb}-$c_l4?Z2I+ya;Cv|$g$QQX&!`yB
zfE9Wv0DsV09qV{@9Rv6H2s-u}=MOET5Z+qx@U7H`uI}^ExCc8M9tbrpn!|~0;jZbe
z2QFfEmpdOeAHX`6pEQy*yHD&FQ|sde4eOzhAiEs+x0k?<NQl$KNy|qJw$Ciw;eyp>
z9)5DNnk{MiZ5thZ2oK&X5DGE%Lq;R9Q!gJ`MXGD@uk0<WPhqCad>wgF3!F7cO_H^2
zofc`;sVvz?OD`LS1;4uK2^zwvBN#G3VVpdeehRB)6JCTB|5LO^%YfLU*vV;+avP4S
z?^`0N;B$}w0PSTtYKixn&v_mahu0zKjLm?g8@}*z#LD#BTzv<$aSeyZh0<K?^tOt_
z>`Xt0T?n?x7i9g8Pc9Y(F+jb~8{hwW;nfFTnoc3Uz5BIljZ7}&8#)V-`aEo(XJuDa
zpPEwP@l^HR@v=2ETj?ShnGLqM!Q0IiJ&dp#(i7iMP-h8NiU_lUWz7K(s3@3j4w}R@
zvf`HyU$;0U%rbbnoyQpcu5fT)-KV^pnI?}pY`j%ym^JV2ZcpId{5R@a)!Y4I0{hLj
z(rzC;coor}Yq^Nt>oNQa?CtA;%)YUg!M;V%QDlOD)UBOaLw<lDd`oSUpQ39FD>5MK
zyUTBfEcAm&`jtX=iDFRYAO~H7ga@lddv0L3062;pc2K4#-D<cMMp%1hi`8PR&h4%f
zx2El0j$u2#fqt>k4RjrH^}2ZRw2-Slazg^Fql>VGQBa`!e_c6>v}T4urHdteaR&MP
zrO#n{;SAuso+d8-4=0uAqW-aA-*^X%bD~OThH^#?#rM)^?e$N@B)3^JJ?*dD9Gr|4
zg_CWb$Is^#TZm-0^a2kF@c9LPw&WM#09r{H>ZG-wXFb~u>eVpZrn+g%-zQp70l<^v
z6CMhirPYfQci8I^BYkVOKLi#aH`nD80%d6#VxXf}k6%e_q%lg_+-C);H!2QA3&t&c
zyn=P%Sh*8Rj9t?mtC*&q0`ZF^wq%O0I;Y@?d=M+|;4iAR0k^ArObm7H+)S9w3n9Tw
zh>7c(fm9I-6;zUJmad<^K4p}IJ}you@`8QaTeo&0is!tn77@S`Uz=F$YW3EJ+4p)5
zQ}+{_gT87BCTVGdTe}iCeQ*)1>=K>va$u7K>)g;~!D8&^w`&8hP1jwwJxAPpcSY^W
ze1eeRc_?_;c@d5ZjQ&=qA-!7`*Wp@(Y3yFERI|sqYDUJwh1fIWy0!(PIUs$<;Z|lV
z8U_9lT%2G;M3}3OagpQd{y4~y##f?ZTl}k+uOm0=*DRJNsxWa(-3#jkHSk#&M>|e=
z=sR;q1_)H}Jo!?+Dx?h+3<TY)&uqXBbbFLritK%7qL<1!ryK}4PYIIwoXpx`b=?jB
z1-<^#hJ66C%p7Y!gnLZ+;_A*vo3HJ%U-;f+nfJ@vGc{e$;S$K3mNw)CV9Rr2-0On2
z92><M5j~rh;|x}pqMW{tK>8fV8aucpZ)2q$`_{z9>9hAEZU!2IVu<i$&EZsgZw{Cv
zx0GoN#?l{^@wF)#!Iu=Dr?lO<H5GB&bFbpe874->htkjJn2eaBFJx-kSA4V8i+VO1
z8oI{P5rj`6f))Tlwly<2qr+;sEr#qnFay5J3U(XQoz-(@6gtJ`ixOtBLIDK_pHy;t
zft_w28LR%uB<T3z$j-SG0#*7VKO&Q0zoy)pX~Ba@x0-%7s`u#|12HuyqV=5|kwZ$)
z@o>bRmwlh(1c{71_(>#8odp>-<Ox$jtu;K;0yr}o_#Wg*La2(ZIXmCovu9vH-Qi_n
zLHAXw(CCd}J=W5c#eP@FPQEyN>H}@5sh`QbWt1#b=@nNXqNSPpAModKE>xt6Wf?&O
zy6?Zh=}Hu(L-)x0YB_X-;TmWo6aZN?_H)5J68KbG)NsP5j94v|Eu5F>>O)$Hk@SW6
zm}@ah^NnXvIi1kRzqw%FgzwkLDruIHt@&PQls+w^&}NZ<ZrtY1IQ%g$*-d^~Vcw~4
z2M{i+zAR75xvd<<TzcLCJ=5tkkd=9x!!A`CtpXnB_gBmJx1Js6s$xeHtAu+G3;=E{
zGaFDwbL>VvG3}C{CZo3H&aEJ7OwtS2dgBXoChUpcYrebn61v6a%x4=q#t3|7HGPh*
zYWnTmZjkdhsYAP_uOF;=PO>p%SsgiJvDbXSzGPaeX=N1G2b%}DSKD%}?7gl6l{L4j
z{?RY_3tAvn&N=6V?M^ch6!iLY^<qdoBosU4>dFT#5LAKZI{;6E6Xq_D3`_D{28ur#
zDpQVwyURw;=-iQ6+Lw`$$R%WAlH>KtFN<Q_0Xz;)e2DOTb&q#Q>;T52+*;iI_mr`B
zF1z_QUQqQ46`%nuq^5)fI-->Rts_dECti>b`_afL#ZOF5)#aCX+U;ID-cr|tbOMup
zQ4KD2!9JiHs(xPj6utcZS78W>`FVPsGhNvsocVwbQ&PALda!0NLaHd^a*T5X+E@eI
z9L)KZ9b)&s$c(S4gv3cPAYQIT1Q$Xz`1meI4WEh(dx4-qh|rS7Df)Qy?lltk`OY35
zTKvLiraY=0FC?CSWU{|T<Qd`h5N2`wP3&IWBh)JM-IbWd*Vd}xVM(9@NQ9rPB_c=N
zSc{fJqc-){Xy=ycC{jBpYJPRMsv6S}Vtk>z)5f)4Wv57j1CtDFb2ibPhF9mL#1e`=
z&8LxN?B<V>gW-0g+Wfj{SZ?#y@syBO#WMM?!W+=xujQLomLbTnqGUwMDD&Q@iTU!P
zRkvL%P}6iTYb?Kynpn*c=qXBO**NIy^Rf(4b=MO#faygsxKGQe;j7p!C8^qqG~^C#
zjal}1-2A?h9=@>;KEcwhb7(Z*HkH0DYdTs4FVTBq)K#*xBVDeJZ*(1>%pwv;M%SKq
z;^lIx$$W}$KFp%z__gC}ujamlzm703pKK}{7n{~GuhQP+-tjxCY?c!F=O^h#2?5Hy
zziVAc2UEen=-zP@H2L1;g*x(M$EZUO8vyVx_qo#IdFhXI1@lQYgd_@I@DrIn0H*~G
zwvP9wM~24$n!$HUGy`A~n|9f5_D$~nr@0vGdIcV}Sp03%N3s6Cc^@Q$=jFrgA3C&X
zYBOJ3^jQyZt-66y($_97^A~#KmSGxt9It%@%JT_-gbEEV%3;}BI#{ragVvHwp)wJp
zb02x66tx3G&uNJ4<gFFdQp7;aBYjp!SLlniBnz15AV#!qRi}^5*2Ss;107!m_=@%L
z5)*rdt?l(7ean?$uA0QJ3vPTUpuOeHu>rHZYkrileujz*-CtfmXamxf$edj#?gVPl
z7!<m@`(VS$*V1x&WFxy_+DPC@@=g*=g#wv%sGSsz%7TnmkaxVJvX@tZEWr&rJ)2uo
z!aF4d!bQI0R;2X(S6tXu@q?dT2=Xx9?g8}7$eiy%))b`Zq~4PDcOB1^jr&^Z%)G}}
zS(;_mztIBFy`>Y+<^zH>;2vWM+D8I?L`h=Wt{%*_UN$l>j!f#721ElEBP;|+h+k9}
znw}N*i{801cVO~X^3vVtyE*r-wKy=-2B!GlqPlawk4HPOzKT2}!WnLJ>G)QgV_IC2
z@EE1bWlk$If6|CKQj;cB%>0)Ysm646`IerYg$p%{cRHve>27)5uL~=E?cwjKjy2ZC
z#8ZTjU$_^u<9T_y-I!s_<5nByz1Eksw^J?aS9rS7G+q>Ds7vRL(;>8dh=-oelRI$h
zn+kc#0!vX%-$Yf%ecZndO$5B<8Z!}ho*#OVq2m=}uMy+Q$*)qM_uOeGF~b$uty;cm
zNE^#Wf-|7t{__Nhm4Y*6xXDUGb6cLPdE>Xyofkw_p}nkSXeZul$$j>MBi!umcFB|y
zjIP=!39w!vDsnV_cS%1w)oPj69Ni|{gjFs#<Z4ixxCv8+RcLm+W3XpYiCoeZWtgmd
zCOAJ(Nj~{IwC9K{_Zszsry)2AhWl*|cbVMiXKefVJkM*pBOG?0)9%cs3^i2Ww~svx
zTkKKA5AGTs5yicV?6%S>*)p5Hk*$?)zrV7vbzVb7`B6b5WM#jIGvVGd|8#c#yk7qC
z6s?3yJ~_RJZ>*X7v`p$M8j>Uc?3bG<p-@`!X$V$Fb2wFqH}J889S;FjjS#hto&K<M
ztu0TMN0M+|W|N8c<&-aKgu>L4)7*k}LQfUVQn4rNQzdqHw8`;}#At+@-^fe{5;#;2
zN_>{+d;KuUtsH%cA>EgtJgIPa!T^)~3yBn=@B<=^50;;rIbq^eC{rAj<u8+Ssotxi
zva`32IaM~QU9J=D@9w$^j^c>p=cT$fK*D~w%A=>OnJ~{=E4~~3&*j~Ttf!Mij;62h
zRV^{?tsXdERj>+2ctRs~F4p7oW!-_8cT3234kHgQ3#@2tta*A<>%p7I5k2NX`Ycw+
z9E#ON*?4F)%KZkV&;9|$&M|s&cO2H9AiB%n1k*dn?g^AiohSA{sMPi!8*jpAHQ)Mf
zeA?|qc-V0cHZ>613OJRZCw;l$GfgL;R0S}I!SK9vF{&$W+DlUSVm@f!HDT0r0jI9R
zQfDDG;}^Bl)VKhe%3`|!A@xf6rH^C9%X9UryTM)qWKlG#rJe!g2i*kGdc4kwy(C6A
zL|Kw}=Il8<Lb6=xv`0b@Ss9_3crx47`4f+3_U)@uxxV_4)lK<&xF5_uMz{uxyLDsy
zHY7eD%%87Dc~{{u*whVX>QW?n|NIh6e%L3Z&RYe1(BR|D;Uy8dj%<pUI3#f6Ew&F9
zWzn;leL8<c%C$}1jy!o&hcHLLyy<e+z)4=TOTs)F-h|W!P3Dk`xS^Ns6u)S}KB94l
zE2wzLd7N{>5J4Xe$w%y0FYhJ(u@{!_a@uMR?Ki=G?KBVIusT?wJ4DNW`3V(?=auKe
z)a%DbpLB0>_2X!e%P=`u;{#@jS>HoxL|8USle>#Iorgg(U)2$AU~#W+`Kxm0I7;Hm
z#EHaJ2l2}ZTETbh4WR+PB0K6x_36t3D4IHbh6%*WtB7JN<Z>{SW9xuo`xwnYTD!M}
z-(bI2-w!&WY|{T_nai*7aKwm$BMK#eMa~pcG#=cuOO-Zwvn;oR6fH^F=<x>UOjYe4
z_j)0~YQ-pDzDU?%E==DFoQKRXWO?C?^lX^)UJxqA>BF4B@|M%W$!gFpB^XOeR4i?D
zB_SET)T=Z8)8|k@G5}P}snQLt!Ph8}Er^>jD|v2{Gi0gzLLjLkYJO{fVY%C6&@XuE
z3&u;lx~Zw@`TWYt-8>MY-QC^YH(p2n)o;)G^m@NO^gq22yUZTn(@$<cb!)-&o%O|_
z$?54vk>k$J&SnQ8n-ib1ahF};y|xjnk>f23J}bIqG`1TWf0!f|BKn$fK=<)~yX>zc
zIQ>PRhciW@!PKytxTjt6kqvFm7i5%j;nDx)ZvOb%VcY58e|a#cLel(J=uzx%Ci&|j
z{AR7lbMY;=AKa!nD=MLUKa(LQ=gObP`p4D3zbHA!)e3y2q*0l_`K^cgjf?;J0l-WC
z$3^@j&jmY#JXMhYL<;=KLZDHq$`1|Dc8PEH?ULb1+hxMnZAtkGKl}n&?gOd&nW5Yk
z0Y5Sl89f;n{mrZP`FH-tFyG%wyL7hsEn7$0#Z%Y+AA|bScctoI87b7~h5qn^XZ+dl
z@MQ9D1~UKXlE6r|&IR1w%4WOz_rHBQ<a{zRqP&+xi9h}%;Xg+G$Eg3z)PLOnhmkV(
z!SAUP-fJUZP1iZU)eVjAX3QJ^ABnTE{U?H++PSK#s^UtJj}J9baO*BqFiBa>x?m(<
zUy?Fnq7&-_+D1Foi0L+U2UZ&^Ty6N7OL|?vlUYrP=>Lg0stCkUMIZ8OKaP&8H-I?m
zE+E42Uz7hIiGcAU;cLb%?H{LevRo}7IZcm$3;&_X>EANa-+bR@&i$tZ^QW(-834)2
z%RGbkCz8{9AURzH|6|l2n(7~;{xehmH@N>Fadh_I<LC<EC=xSsd@Pao`e$6z`ijSI
z(X(=@&n$X)*Q&w_7A2Rl>nH&RAJ*$}LPzbl={Ih^e`x>zTJ)&aW+#WQxJ<YSCG|~o
zZh81@qfK}eMFKEhDdp2If9TY&K37}>l1}B~so4(x(rl89H@8=Yax%}CfA~|N{nO^d
zq3GPnUh`XPn()RS?tadm%etVpadZ38%F_CiKV9k1N#?D*)P2UNg8ZLIsdGS5YnM;^
zai(}BMGK?~F-ZPT>?1;f9oKa_fBc_Fs-D0;2B?83{diQYob)%<eDElLoPG%xu8<LR
z&*!uKcvNZCKvLVfV)5gjr~k*Ozk84-xX)~T-b2iej*gagd+lfJ{OWTso?M11?hxxU
zEkO%1;EXp%@_CZE6Jg0pSbkzf1(BawqmhyDJN6NmPgDO1XMMsr6M0*5;1kVHOoEyB
zpSx*fXlZE`eq6c0Bh>T%4Af)l^nfAMrKsct8bW4-%73D`K>t-Ht--i!YDzyUEAEf=
z-`~85A+L7ne9KHa7kN7?$Jp=3gO+0UPbxNSvf~}mjQeo_l1fXH!fEha*sJ3Iv7fw>
zVm@og6n#-s`zLP05(pH7*FH)9__FlTfcr5&H~pyyh$o};<n!@Q#I(miOiM6|W%_eq
z{LlZykdqPJ6+esni5bWPEYwW`G=9RcPj!Ih&ko+&Pekgj(}ns!M*YXAKg>V>%+!C}
h|DTxpe@9FO5h&^rvWN(@ww(d~6lGN&LLL|e{4c@%U|0YE

literal 0
HcmV?d00001

diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index b75277fee1..575a1ebad9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -150,7 +150,20 @@ Here is a screenshot showing the detailed EventData from a typical WDAC enforcem
 | ProductName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel ProductName`. |
 | FileVersion | The VersionEx value defined by the WDAC policy XML file. This is the internal version number for the policy and used to enforce version control over signed policies. |
 | PolicyGUID | The PolicyId of the WDAC policy that caused the block event. |
-| UserWriteable | A boolean value indicating if the file was in a user-writeable location. This is useful when including |
+| UserWriteable | A boolean value indicating if the file was in a user-writeable location. This is useful for diagnosing issues allowing by FilePath rules. |
+| PackageFamilyName | For files that are part of a packaged app (MSIX), this is the Package Family Name for the app. |
+
+**Event 3089** - WDAC signature information event
+
+![Example 3089 signature information event for PowerShell.exe.](../images/event-3089.png)
+
+| Element name | Description |
+| ----- | ----- |
+| System - Correlation - \[ActivityID\] | Use the correlation ActivityID to match a WDAC signature event with its block event. |
+| TotalSignatureCount | The total number of signatures detected for the blocked file. |
+| Signature | The index count of the current signature shown in this 3089 event. If the file had multiple signatures, you will find other 3089 events for the other signatures. |
+| Hash | The hash value that WDAC used to match the file. This should match one of the four hashes shown on the 3077 or 3076 block event. If no signatures were found for the file (TotalSignatureCount = 0), then this is the hash value you want to add to your policy to allow by hash. |
+| SignatureType | 
 
 ## 3 - Resolve common problems
 

From 4ff8f9944b29c559cc3236092239029ec41e957d Mon Sep 17 00:00:00 2001
From: tiaraquan <tiaraquan@microsoft.com>
Date: Thu, 30 Mar 2023 08:27:31 -0700
Subject: [PATCH 20/64] Opt out of standard communication emails

---
 ...tch-windows-quality-update-communications.md | 17 +++++++++++++++--
 .../windows-autopatch-whats-new-2023.md         |  3 ++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
index ddf26cae19..3cb42c5d27 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
@@ -1,7 +1,7 @@
 ---
 title: Windows quality update communications
 description: This article explains Windows quality update communications
-ms.date: 05/30/2022
+ms.date: 03/30/2023
 ms.prod: windows-client
 ms.technology: itpro-updates
 ms.topic: conceptual
@@ -32,10 +32,23 @@ Communications are posted to, as appropriate for the type of communication, to t
 
 | Communication | Location | Timing | Description |
 | ----- | ----- |  ----- | ----- |
-| Release schedule | <ul><li>Message center</li><li>Messages blade</li><li>Email sent to your specified [admin contacts](../deploy/windows-autopatch-admin-contacts.md)</li><ul> | At least seven days prior to the second Tuesday of the month| Notification of the planned release window for each ring. |
+| Release schedule | <ul><li>Messages blade</li><li>Email sent to your specified [admin contacts](../deploy/windows-autopatch-admin-contacts.md)</li><ul> | At least seven days prior to the second Tuesday of the month| Notification of the planned release window for each ring. |
 | Release start | Same as release schedule | The second Tuesday of every month. | Notification that the update is now being released into your environment. |
 | Release summary | Same as release schedule | The fourth Tuesday of every month. | Informs you of the percentage of eligible devices that were patched during the release. |
 
+### Opt out of receiving emails for standard communications
+
+If you don't want to receive standard communications for Windows Updates releases via email, you can choose to opt out.
+
+**To opt out of receiving emails for standard communications:**
+
+1. Go to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+2. Go to **Windows Autopatch** > **Tenant administration** > select **Admin contacts**.
+3. Select the admin contact you want to opt out for.
+4. Select **Edit Contact**.
+5. Clear the **Send me emails for Windows update releases and status** checkbox in the fly-in pane.
+6. Select **Save** to apply the changes.
+
 ## Communications during release
 
 The most common type of communication during a release is a customer advisory. Customer advisories are posted to both Message center and the Messages blade of the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) shortly after Autopatch becomes aware of the new information.
diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
index 03a4316178..2b7cc59345 100644
--- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
+++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
@@ -1,7 +1,7 @@
 ---
 title: What's new 2023
 description: This article lists the 2023 feature releases and any corresponding Message center post numbers.
-ms.date: 03/21/2023
+ms.date: 03/30/2023
 ms.prod: windows-client
 ms.technology: itpro-updates
 ms.topic: whats-new
@@ -24,6 +24,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed.
 
 | Article | Description |
 | ----- | ----- |
+| [Windows quality update communications](../operate/windows-autopatch-windows-quality-update-communications.md#standard-communications) | Added guidance on how to [opt out of receiving emails for standard communications](../operate/windows-autopatch-windows-quality-update-communications.md#opt-out-of-receiving-emails-for-standard-communications) |
 | [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md) | <ul><li>Added support for subscription versions of Microsoft Project and Visio desktop apps</li><li>Updated device eligibility criteria</li><li>Clarified update controls</li></ul> |
 | [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | New [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) feature. This feature is in public preview<li>[MC524715](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li> |
 

From fe330f4142d46e06f325b39773dcc851d1ad9908 Mon Sep 17 00:00:00 2001
From: tiaraquan <tiaraquan@microsoft.com>
Date: Thu, 30 Mar 2023 09:00:07 -0700
Subject: [PATCH 21/64] added public preview note

---
 .../windows-autopatch-windows-quality-update-communications.md | 3 +++
 .../whats-new/windows-autopatch-whats-new-2023.md              | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
index 3cb42c5d27..815341f805 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
@@ -38,6 +38,9 @@ Communications are posted to, as appropriate for the type of communication, to t
 
 ### Opt out of receiving emails for standard communications
 
+> [!IMPORTANT]
+> This feature is in **public preview**. This feature is being actively developed and may not be complete. You can test and use these features in production environments and provide feedback.
+
 If you don't want to receive standard communications for Windows Updates releases via email, you can choose to opt out.
 
 **To opt out of receiving emails for standard communications:**
diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
index 2b7cc59345..cd78ed1670 100644
--- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
+++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
@@ -24,7 +24,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed.
 
 | Article | Description |
 | ----- | ----- |
-| [Windows quality update communications](../operate/windows-autopatch-windows-quality-update-communications.md#standard-communications) | Added guidance on how to [opt out of receiving emails for standard communications](../operate/windows-autopatch-windows-quality-update-communications.md#opt-out-of-receiving-emails-for-standard-communications) |
+| [Windows quality update communications](../operate/windows-autopatch-windows-quality-update-communications.md#standard-communications) | Added guidance on how to [opt out of receiving emails for standard communications](../operate/windows-autopatch-windows-quality-update-communications.md#opt-out-of-receiving-emails-for-standard-communications) (public preview) |
 | [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md) | <ul><li>Added support for subscription versions of Microsoft Project and Visio desktop apps</li><li>Updated device eligibility criteria</li><li>Clarified update controls</li></ul> |
 | [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | New [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) feature. This feature is in public preview<li>[MC524715](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li> |
 

From 17ab69832102af44b24a9605d3fb15927d40dc6e Mon Sep 17 00:00:00 2001
From: tiaraquan <tiaraquan@microsoft.com>
Date: Thu, 30 Mar 2023 09:01:25 -0700
Subject: [PATCH 22/64] added public preview note

---
 .../windows-autopatch-windows-quality-update-communications.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
index 815341f805..aeace4a343 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
@@ -50,7 +50,7 @@ If you don't want to receive standard communications for Windows Updates release
 3. Select the admin contact you want to opt out for.
 4. Select **Edit Contact**.
 5. Clear the **Send me emails for Windows update releases and status** checkbox in the fly-in pane.
-6. Select **Save** to apply the changes.
+6. Select **Save** to apply the changes. 
 
 ## Communications during release
 

From 6591baa4ad8478da032e60bbce70d753e96acc73 Mon Sep 17 00:00:00 2001
From: tiaraquan <tiaraquan@microsoft.com>
Date: Thu, 30 Mar 2023 09:08:43 -0700
Subject: [PATCH 23/64] nitpicky

---
 ...windows-autopatch-windows-quality-update-communications.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
index aeace4a343..f715f1bba8 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md
@@ -45,12 +45,12 @@ If you don't want to receive standard communications for Windows Updates release
 
 **To opt out of receiving emails for standard communications:**
 
-1. Go to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+1. Go to the **[Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)**.
 2. Go to **Windows Autopatch** > **Tenant administration** > select **Admin contacts**.
 3. Select the admin contact you want to opt out for.
 4. Select **Edit Contact**.
 5. Clear the **Send me emails for Windows update releases and status** checkbox in the fly-in pane.
-6. Select **Save** to apply the changes. 
+6. Select **Save** to apply the changes.
 
 ## Communications during release
 

From cb0c60c6b800a564ca9bb35ffda875f8a088ddf3 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 30 Mar 2023 14:29:14 -0400
Subject: [PATCH 24/64] Update MDAG Intune steps

---
 .../images/MDAG-EndpointMgr-newprofile.jpg    | Bin 93564 -> 0 bytes
 .../install-md-app-guard.md                   | 106 +++++++-----------
 2 files changed, 43 insertions(+), 63 deletions(-)
 delete mode 100644 windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg b/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg
deleted file mode 100644
index 428f96e9b55e4a71bc9514bf9b27e39bb6e02795..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 93564
zcmeFZ2RK}P*Dt&oJw$KO86`v)B5EYc5K*G{=)$Pc%OD~mN{kkrsEHPJ^b)-XK^UDO
zy6APBx$paVp7(j)?>*<d=ew?Ro$q|ty9YDd-v6~%`K|SDYt7Bin?-<3RSBX5U}0YS
zm=|z^23VddK6=8cV`F9S?Be8N=V0T(3URg)VAT^A5E2G%kU$uKi;GKuOF)c|PfScm
zNJvaVj5$dD7Y;030s<m@qCW_b5EK0`HT~-;H=S6Y000XY>(2xD+ku4*!okJECm<xc
zg$02Ax`z4t*VTWzNCseIfk4<eAY5D=91NL2%ryXq9G8Mk_z@nZ)(d=gH!6{kxEulw
zg^G4+?a_U(sHJ--ArTEN9sM0nE^eN?ykhsoB_2pVeEdXFNm&J=`dmj>Pv5}M$jaKr
z*3RDHrN=8zFK-`Tzt>@J!rw-`i-gA~Bqk+)OiBHeo0nfuSoHZzWmR=eEuyZz;af*%
zS9ecuU;o(nkBP~tpVKo-%PXs>we?>co4*eZkB(1H&(1H%F)U-_;DB)O|6myl+Z*!>
zBFDjH6UL)>q=o;&jgnm?gn&vRE~lcMkV8~^pW4!Wl!yi_w#51S53c`Y`aj2W=>IFG
z|H1P=SiWfk$O*9eKsq2S4EN+%Aabmm8Gsmsg*gF{19HIOd*oJFU80^LK=A+&27n&G
zLt6xK5<PWw9FM+q`JMgZI@j|Ckg>i2T98-v0D83H2FR?0EkMy?0L*?4Hex8ZS9=58
z0pzNkTh~jnPLZ%^fMrI){BTm^a;LRBm~@As{Ctc1`eb269{-;RgD#b}(0+Y4Kp^7m
zJJx?a<-aucUl{w};V%LW=annhYyTq`rMy&HFU<JMMQ{CkPptnpe}AoAzay4)I{gPN
z^M7^gk-x_a9Q5cPEyn(e5Uu|d2ry4sg$+31Uy)#<0xjmmZLP28@_!abIM7CaixD^r
z_ALiN<7;Xt-%P!ob!OW+q~E%f??!CEceeNbUcF<4)-!3|L5D0pAL?)`Jz|&enV#W-
z?#*PV9#Mi+H^cZ?L|=wGEqP1v?ml>+=}ku1jf>4}HKD`CzDQW$=yPB|lR*?7LA*YQ
z`-7U5<)i<1oKlApE-cE`ev7t%IG%gNP9TcX1XvRwMHi|NFHf$TnoiE})&WO#O$6;8
z*97e~kra&Hf`=qH(~AL@j)6u8g0c%ka3KYhjY;TmMR{K<Y>0ywguwl1@f~FSUgzzg
zfDJY=A!%y9&Ic9K_Wmj|!k=%l0F+NQeoa|9%ST2H`Va~TPAn<`LRD@3)<*7OsIHPh
zuxm9I$<H50`{Ao21PRXSgF!FaWeD4`5)z$+i1UI8dT|B+$udJ~e1WP*crg$_Mr0Ur
zN+ja8XVgtnyxlZ7oA7FDRne#6O{@rn&18iQ`TEzRcKj_>P1gnI#k~Aa4_Qcuz$e>d
zRgx6sN#Jy-ndHR}8n>w%;P;{6wI}SFV2pn3jPKdkAI@czIxKZ+5V{BVT6CiC34<5z
z(v#DBQ%h=N^@?H5Ko*U4sv-w{wKmB)JN4sx4RdL4iD%YngLNJ`3-r@=fNBo%KJ<55
zb}g#;nmiewGnSgaj=W!2Z7@A;>1(9k;^ozlV*vEQl@z6vj6Psr$r|R0C`uRYFj7R6
zv64v>ic)zs^0TQ7KH;MqP1Sohsrd8`@ICh1L$7ETZ#Uodz6e7O$PQf6k}r@XcbMJb
ztKK6nXr5KDba%V8$ydJVGuv(^n9g{V$N+8_Eh)A-<CyF!oKr~{*`O}6<Nn+V#Qx!o
z=`I#EBG~c=@yldVoJ0PmJxY09j+iyyB|_$nrv<w9t`)sh6*dZ&A!1mC+`;_iNmG57
zy0yQYa$TX1k_Q|7E1d<#hp?%m6h3JaVhJgcQnig#@840P(N7-ge7Vy?d1BbKCH4Nz
z<-KCw>NOS~LLd3kLyI>&y@Wf`xR#X<2ksB`B*b$lGxC(#-Em*&LRl(UYZ7Yb-SyTK
zB7X<a&ok{0W!C4SBErw+RrG8v@u#6HA-f+wOG$vWo3^@FP}IY>c|ac8XMs?dOxI*q
zOaG`IEkdEiGSME&EI(}0(0cJ~sScO>P493UQBo@jM@zjy>8`CkalHH(9hrza$!HA<
zr{w7~rTu{<5ZgCbHEaf0__AlTdS}G$WP5rWZsYs+zGVcp$%BK#p@KZ0b@6PGagp*C
zXKy=bW~j64jZ?VbhN(O&2VMXL4`=+4twsOV`t~;tKI&Nphujw##H}Ri)oRj}!)^@K
zAC$5CTuqs$-6%>L!Liq1(K?R`@>uXy!8fkSCdxuZPtUuV#s*_*DS8Ci`cJ|cP?bNU
z#_!G>DOwQBPzl|8CIY~(WI~wv{NKN(B($m_C1!|%55at2!XYg$f?Mr~yMXiC-`^yA
z2ubqub+EY9CN0g&TQ(TWv%eqI@zRqG9H24h`eB9lRCuZG-1qUr6j{a@<gi83f!4dy
zowM5WFa)iLF^7-?b-*W06?*zK2OAC_dK?v5<{6U`b*e-8Vh7OR5bei14qU0UKHq8s
zK1L}I>Egz}k|!Bs1YBF###l!=Bj@j$`7+Pbqqu}33Vh(Y2E%K1SjI^<&wetw61Qbz
z2NMB2!2gyv92uz~895dg^OwM>+OIOCW^|Inatw7;2{~V2s!G&2pO9VBgR7$Cf%)u4
zUu7R$s&VpVO0b(sALzV-PY5EuJs<p`yc(|W+CBr}cpw(8Fx}o`wqOJt-MZ%574;@g
z8cd?umy$=T=#r8tlvF{9htFW50?31D7M>Y`MSJ?v9AuY=Puw8rt|5W8SGZ?%3O=ry
zP1`xB;09={vkjKwL(qPGn#{k(s|=2AyoDO9KqQBL3FkU&Lb@?rXEzvkr-cT$k+1zA
zP9=<Pde1}DEly0`jRG?U56s#XNi)BV1b$AGWg1w-EI)Sh7#w0-{q(e`4{x_Lik>d;
z=k%ccgO|X!?Auu#zrV&fWNVKXD+L#`OS?4;BuB3j7Y*@t(OfxWT~*uo>U_sZP4{RH
z_CJO_<a(zKF*H-MJA7IJ$J-B~k;HLN_UW7ZP{sS5BO&{RJQGWJP2H=znGT<P-xui;
zTq=op7k@rCHL(b2+vy?l_<&W7zE9|E8NwZ-P+E2RzH+vjtfO`ompCq#r`2>iz>c*F
z8!Rh{r<ajq#ht>(;r#TI=-}_{b02cwI!z(Gg#<tzxMj6MM+M94Vf}!yid0n8*LKDN
z1)^FTdl2RDF|?9dq>Xy%cf~vLj}jtMLxc<HF9C{-q5?{WD{rjzxc3^1e^*ffNEl6r
z{Q-ng#MVEh(COo&C{+Y`7Jrz3o@@M7OVE*$Mx4C6JczbSh>zwVk7FoCW&D(g!&)dg
zh3*NxT^%{Okcq;RGB0r;+lH^4EN`q&jJ&x@!xOiIZrX#<m6g2xwmug7hpMhRGHOd=
zLIoAvz9wVm$%B~)p)v;g1N;;|WC_XrZzb~gLK1B?I0mj4&)@Y~VyOy}cZQ|Jtv+@n
zX;kRuiqsFMiI8p_O^4bZl6C7TN-~5<0wfdnk?NW+a#JMK`3II&M)uYW62GAyL=c3?
z2L)8jy5a&agb`j^q#tP?1fn$D#_j1=Bu8qc#ua2bzWtgs-er~`Yj^{p_K0HsNDnP6
zknf?M78odeob>SJU>1#Wbt&h-lhJl|3sGY0H=D}3-1PMAD`I@^buEMU)$h-uq(yH4
z=Aj$FloTDB*d0^g{_r(v^-%8(U~~gqkmrdMxjtmHd;R){AB)zGJdq8U%wTby!);y0
zV??rT*l*D;AK-g7a++Q%Jn?R0{PPZSyaphV5@O4U@JPaaH><2LEho(MZkPvfcptdV
z%?e85W_^Xv{Xy#X>l%Qk&J()yQ$oGH*U8ULvZvM_i+I~t0CH;ebJcs>m-%gGHI}ER
zV^}SGP$eKG4`M=@BzUK{_;B58uCfI+Jjo5F;K5E#mnWhNuAh-$6u>Y8lKCBVnhiYb
zcV`O0mn8N`w~`z&am%b*$p^$BA;CWxe`lGI2Ccl_d?2j}LVs_wkOKUo*YQCh=@UlM
zM?I<l&UQ1?TeBGD=kec9rL&&*tp$s%O_kYJo5~6II7h`s#Btd9wCngX1=-mUcQVGN
zq(t2Fkf(<V2bsS2$Vz#)dMuq;SikAYgBA3B1%J?~sO@|NMAx<+5+n4WhlvM^xbxT@
zwx~QM+tQR3<o6wG9dU}B+GDOC_B-z5md(q|`;JYhx{Al)+VP?y?$=N0SgSbs+Y-cn
zjf__G?rt#|mtIFZkpOOo;G7p-FP*y(!yeY_(Z-nTLwRDs%tD!Z$;DSJkC0=*l&;5A
zfHU)_V3Lj>npkyyk$?oLmOS3lCJ!(xqX;m(Ey@P{|K%3!o!ZYH)@sHhVC!7vj;y*B
z;yOuyyuEE>Ech;-RvY`DIsgrBYgr0BwO8Y%k<!V`*MER>%4&U@jrTVl1--%w+R|@m
z)(}|p<&<x)ZCrH*0V_X9f5cC`W2O4L?y!cqb|H*_)NP<`W9J5#S_@|QL$#UnyK2f5
zZEM^>bib>s59<l9vaTe49cF}Fd|s|1K|wE$O+|rS#0};xqjvX|lJ8qx3+CPZ&l?Bd
z*I{`;%`@6-gt<3czM{0=AeAO+07Z*RI&}=puA6VHNTKDG=ZCDMncNNiX{_?mbkx^^
zE@{kOm!OAB5=FsxY(EML_*D>s^*jIdE-6k7{9bSwn|9<D4bt95y)0?-ce21^(c(%m
zb5UVnJwUM(xkW<%#xS5tn4k5X!M!qiRxL769|9<Oa@8rkq=XB4m_>S}c*nEB$gI<b
zoa8guDW^6jWa29!%RG)<-N^lyroE_b&ELu~G4-TBcXAI{!L$Nxy=T83oa+Yqf{%Kc
zlm#NFoD`SfBvn>uzpQIqUM=MbBiUpZfvlH1RMs_3V0a{i>;7uGXZEdypOXuR{c@K}
zuy4Vn+m0^hD3<F>^Zjhl<sBs2SNR4An!4fv(A}8znM|!4V4>y)AOhqnN?X?xV5d9(
z#~Kk(YE;Gz+Q*3sxZ^l>6X0_@KTP-BBw#GIz+QbQQ>$|D=>}+ZKvQ+9%cj^lQmTWs
z!lKp0Ika76Ds<`UYY2Ad;wa!@Ca6k%Ynave#EiHBd15C_q`Tfr*R?qAkWpx3cDZ=E
zzaJu=>Z0fmo@w0qVtuK?wLGIPR^!#^ASG}iM(9w`=wx1*M8D|!Bs!PB=j-YPas1fZ
zXAY*_5Qh_U(*{pmZIWqKi5q}oqtz?}GNoGe>d-3kE-g-IM07gL8x)TOwNjHjXuNOR
zAVdGjp}4D{u~exn&3e>#i&04^zmmf&n8F8{9!2(Om6>3O&@>O>yx=3zpXSdAt1EP2
z&Un!Gj*XSAa};d-PP8K2$Kt1j5Cm6+mE2f0YUz`z@s;dJ#hmPyDdVy)-Q=Z&-Z3+3
zb7RK$N9RZEMw9LgXgsxnw(**KvCmM!$Ynx)kt#e|%Xyxx(!Ap+wNQ&pmF)5~Hapc*
zYq=yfm2F2rjXf&7YjNye#%1(?-t<UHTPA}O%V~=%M>kI@4_Tx=tCJ%4bU)4S^_EjN
zhea}dQqk=tu#M(8lpqcbsb{?)WB5UYP}PF+K}yX9n+KqKHif7)g<_icpiO@de?-e<
z>y=y_(>DjNv;H<z)&Ld_`(vmr>jCgBml94&2W0Z*D!Dg*nn=Ds<EWNjkUCfWv{->=
zLaNbF?6}HrtKeNyQiq1EaEP<14=;{!$Pq`8G)wP=o(Wtnr3;x`g_yT5q&e3~oKh<;
z{}4Lxj2kevWAjs-2$#Qz>t$-kZ<e#We`2#>S2-)Wgb?$0M)(J=3U%cVhw9LvjiEDL
zR=SqcZ6=HBuiJr%hobLMZr=J0RZwGp<c~K->B%DSs+x?kXV)#uww2=(VArn?5PA;S
z_ni8vC>{aUED2GJ?gX2>x{_wRLmpzep4NNLtzyQXsq)4(5+(SgY8;PDUs;oN74+vN
zgtLc*L$t*_kx?iOCy}eRxL*1ZYUijG>%{Szbm#F_I~VSP3-UYPy{8h3=hT!+QApjg
znK;RD@)==9XDfn1EshtL!_OI4R|BSjDDolg9P#*?vKjq`Gw+Q;s3+T0L0Y7DrTWZ}
zKhkrmCDowmp4fp`h%>}87>i!&tuCl+Y1WfE7M#>nHrX=bj1Is0?RS@dr(pq6bTYQX
z;TioYigtLmyAJHB=@$KSRZts?<H3F053@g~k<^c|d-vd<8F`1^bgy*-MD+k%8H@#Y
zGg7*(?~s>Rwz^$*VpcY?>(u{Tv(lk<&xYFDrtwJM-0yKx&oeL&%`|5)-Fr#%CgIK2
zPATtPxSE;at6vv8r$@W8K2G_}&HC!--R6j}J7&wTx2Flf(#p|qBJqZWqua_&)+5Vp
z#LD~l&%OL-PHHb-YSa|^dnh|YC#P!mYA^iaTQXiS@QNUdA*Wd6q0<}HFdBa=$s)~o
z^`b`pBR{_r{^7fMtMUGPrGZk3t8dlb5Wn3<>fU*V^CUrDjSL@5%$ylss$Db_8C5nD
z^SRWl?_~C^Ui$N7F{k*XXc?Lv@1NGf4r5X0Zc5m>6dM$=>6JyZgr?I<i+3<~8@s5<
zpYM~%kFPD#D#f3i;Vw<u$uFI0iE0#2wsQtSs9xs18A+<cIlAX|5cRumpOBv8en>sj
ze3qSc$UF{oxQLovp(}k!9v@WhE>E4ux^}Lc7!PfxQ1g%+damz12TnTm_oCePbDfKG
z$`@`TC%YRT%m^bKVLV-qwUgneEt}LZSHC}QE`Rc2YCf{|)KTqp>e+mr-u^~10r-(K
zmWC)XJ254&`{Jj?>&%a=>v&&u3i11wPf?>%=9OOT_g`>&aw6`hLGqhtTGC=K1yUv1
zf8IsbL`3j84~u8s0I$|>fD+f{^b;-b$<5)-$vI>7{*w>p4xITJ6B&E8E%LPuj!L%J
zvr1*7Nqlsgo2r#?`BgF{sgt4G>El``ZwIkbZ`-oWjC(|Rch=VQ)Qji)H>OMdV#NJk
z9$yNflx6kx=rO$xHe;+-?@FrKa3F_3GmHAgD?d5mOBKNy<_vvPeY0X+RMF2;vFWoY
zW4P&el8R6xk;g?i*s5{EvdwoJJYs%3J~`Roe}4W>=k<)57h;QPs@L*yfeKp3at=wP
zq8k-l+DfePG$1;iGRj?8eJovH^u3ztxKXjG-)7jC_7;OaiGm@gz4C&n#Cu0mGnCss
zgG<6FrcOq(mZsl5LA<7t#q%P13(AFMsZ?Jc&5Xq~zN|T#(l!)pd|;@%9POR)C7`Bz
zHwV&<CHIYVo&%H)O3BgQC3*PG(cfVu+PXRJ)7w*3od&iK;Z83^z9__Zh*P;M0=m^%
z%1ug1!bIIMqkC~2(Q4pw!ds0v;c)SvZf{LQ;(ub#bmWWj@)^;%x62EmA_MnxTV|Pl
zZoJM64`xfL_V*bao=l_RPK)J<r+V?ep$HXBG+QJ?nv+fRea=CGCfXmzL4>0RGd1r%
zxK}CmvVt1l`KmXiBaxol4fu}pUOeW7!|Y>%D79wJXpY3EKy`L^hnJSp3c{85@m=0W
ztfV1F@3M_Up_WQ2tL%@lEAJK8O9Xe`wOJ)jKj8{yx;yqF1DduyZ^hB?%FafPE$l$L
z&qqj=BQ5SDBZ39JceEklL^Fgc@}6OrA}d=Qids^=YRe=#5aGd2OxvKXcq|>Ha4Y8{
zTqowPF+9)L85B-Tl-T{4q}d+J+ktZ>h7G4%yT5?*-4ANvQ2LNI?jZ$yJ^WywUeM|t
zX&xK9YJyJ+D#Fa{xOv?o&)NtrM3f$CVt;FRx<tg_^t9b_Btd#i*TmPV*v8bS+ZV(b
z70kz#@Kt8!I@7?CRrJYc!9mqG@*Ko!^)>{r*DMD@db9D{9j!!AIci>DQURZ32%fPe
zyxy6qMTa$`CuCR=5L3=u6u*?o69s*AtGUfo^{X&k25a%a9^3eq6q71$JtBtd-2kqv
zkw?WeAsr5xDm;%_iPR53T)&6j0MeF!4OIY`B@#A5*Sa?YdjqiitX(+l7Q8&k!Z`m4
zKjP~5d-QeTnI_hMHTnOf#z4u6wJZmJGZ?erZ{BHsPaZg@4vWp>H&{vm)Aenj%!l9c
z%g+K~%Z3g&fZ12rulzhwWBY8-f8qxhDNoJzHFA1-8CUHX$Y}OB^&_U}^mB1?b(5!A
zo+*38>MC{Z5K-X?rCud<Vf&_<&wyix|9Xn!kU9^%(f3TMYc3#a9amd`)V2g|Ym&)Q
zBQQdK@TC5B1le6BgAN{sAd_=dZvh6$^@4{q><*lQen|1T@n`BX#|Y8Ujf+ERF@f1Y
z<SraySX59773{AuLPy1Sc)535+CuYnpAo%&Ly0xKaN*o}jqkLU#N`&yKh+rMSJ!d_
z%$iSx?SF-%yldbaqYy9jCAvJ&SWRU+`+&nj_V+AyY|1;%uMdWw1&)|Z-CNsKOF0)f
zff#apA=6puZ(4vFH(Di)QN782eo$x8!{H{FF{t5X3E^h)w~9<SH-i5fzl?NDdC>B?
zyr~ODf*kz3-app#LPyl8C+SNcYMY4G;dUonf<|&!)@aAzv(i<Z*0bII8-UW`(CoB%
z>;REjNcpW>Z!I2b$hEVdH^mRHDOt$4ss_t4)!<Z0@!>m=g@&=+i}`|O;-vKS3uZN<
z>W5`e6@RL_A$LoI7;?%hv(!s5&`7FaywMSQU!Aj{uaq{88!^hC?Q3m&NYZ9;S-XDv
z@lZ$}2cMNGHv}0hEK+`#r^}&tT(5Qd?A1XFN-4~8b-t;u&_A%)13Hg{wb5Ph_I`nz
zNWD>d4_1u7wLKfQz3C;mhsRPzDmD?MH~WIxE5A^pv)ryVZT!VUT8OH<*RzKQR{~SU
zzWm;I0^}T{bAFOUrBna<wn#Z%exZhD3p@z4G@f?OGE2{d&6>w1CQszn%n!ZV8bRFv
z8Z1leep)^O?@|UcP2ARdXS9Ag$IZQ)qob4R?Qr3coNME@i!k|Yv~#83@T`xsI?Lt@
zqM$&H_&lu{eg?IjSVhkBHI6P!sXN^O-z1?G>=X|S=B&G)ukoQQ5Cc)MoUY2Ov><xA
zku8zN#9Xh`txo|{wXO4hz5?A@y3q;G6XP`sO5JBJV4jX^mv65)zFJ}H(?2GcYg}U&
zPe8d6nvkrltw^q}UJSM-x(rP%&tINyAQoBlVh?5N{Q{(no#(u-)F7XbN^tfHY=gY8
zgQk12;INp7uQ`BcKHcu_&zzgm-aGhLMkQT#DGD_D7maF0YDYHb(<>K@xyNrbuXYAf
zOvUm<sFu7C$H98)POn?L)6O|;z|62UMAVerwdcsSJKr>ldU?8oa8bwl9y@*Nl<UY@
zc&|Rbrg3j!N}GJ?(gK*DC7aWSWA!b$ia@}`Sl=y(b+0W=lQFprD71B;5uaMiwZvt^
z!c|z!{&7tj#}m|3jXLtL!kPeiRY+X{9-ZA9lP?fzkfMGcT%%W8tI?oe8QA!WU?~?b
z-Pok;niBD3u52pkTKye#C1oO`vLd5hM0}UUGuB=IOj$n2$r}4X%os!3{mdt+l21jt
z=^qPpBv|Grz7D7B|BPc1`rrYWDMwakaXFvX&d$@e+&0y*@c`x)wQ+d=0fL^dxY%ju
z)wo7w;MBZL>sx-q#MhOHdM2Uu44Dwn-Jbqm2ld1<Rpa-+SBOB0`Ny|L6~&Gx?o+?=
zXcCi9FXn3SbayBfbLgAS$=Z)X;v96Aw$EMBEv!{%ueivYcF%{AXMMygJpOEURg5sL
z*MYWLXIz#If4eBrMu_f>2ifuM%&Qw$?Ut#_zGEC$eoN>=#YfXMa|<WVRC(@P$H}}-
z=j4dp$~;MA?9ko4u_akuqNQBFxj*r?gR-%LuvTSlE!+Y6X%zZ`p<}Y^Nstu|L6MHr
zYMv5xz)mk4-BtD*?)1P#jgmg8X|tUL)AWSYd1UD+!nCBNl)-&&rq5XYhY2OJ3h8(>
zzf-qAm*0MGc>10(JU_@q!j)HvfL)LA(jV1B`2Y+zHvZ!0jx^q|qxxoG0GUHHUl^M?
zZa9BYXLye6k+x(<S}lr%;-Nqcq@OaQqbOue7E_m`YDcM$83<|!o)EVyG(1?Mv$-wL
zyZD*8Gf>!AyJ$l##mmtPp*JTs8m;=W#Mdmfu+m>@d;DqM3>Ce;A-%P-FLn4x({9<b
zu|}11S1d+Q4=Z_P=lxe>4tb?zePT7u7dL?Fnw)-2w0J6JS$e17sHVXfO%mzqV++O;
zPdK;l9mPVeiae&WRFaZ($~l*e3KeM%uk4br{ZuxtJwNH5kZSa+W?}hIB!-%=t8ZFt
zrDj|!>bc*`BfkJy#jG=BXw35P;20r@B|e_LzpM?48E07ni*9@A=qgTYIK*hc^waX#
z!e!C;=IG?k-29~rCwP7);3<3sGDq>4xY5hxd@0R=FUgiINSk5JQfVojxrs=tBq2SY
zX{pb~Gmt`ktKhwHU`HZte=ecX_<Cb)YVFv#saf)6@7uTha5-K{di+7cehNL6G4AJy
z9BT$Yc0s%zvB{_}7lY+P;LN$nFV7&qE+l2d13iCa6)OrD)FO7OBHtT(LL3`53SL|9
zPvphc&sHu?Iq-dJ6kTMrruMchJ*@}ggY6AIcNu~+V=i{#Mi+VU#(|6bU!8XvUzQdO
zAqp}Wpfc!X!)hMqaPGu~RUIc^$Ba<TLX;-fExy}$r1Xp)!krHS$kp^Fcc)M-drkVw
zk}rOsB_%#-*dXrL8aZ$yJ{)~tylvx4k8+P1Iw1bI8l$+RgM}{DS#%c(`aQ&rnH}Ec
z$s02|j{0;8n|DFuy*BV!NU2?&f&OZtS5kXYeWrZ_y#8D$)8vi&7|~nk_B2YEj<2zv
zNNMpQWvEA#KHE>*tvj48)nBTlx~&YctDUG5(*dwvJMZtr+ffgNR>`{nyTY&?{x#$G
z4rcW1(9x9v-r$sXnk8XmdUo;}gV}fSC1-(!vnNpO5=TCQL=I&IcANM<IK+~_o{+&h
zaRB#QudF_fb1%-V#YSBX{xU9WzHppw_kOrC10IhdjaXtL2gz4l`9}<hV2761EOBDw
zgTJ^krQTq=Nq41Dp&6p3#8g%lSHG_~#1^3YP1M$hfdvpVNQQ~(9x9%r_DV%ov!cN_
zjH```N4IAn6@V|aPl`{mI1sB5>b+=u!4`ZTzEeN5ipTdeBoveO_gofK$y4EbaPCIj
z-P-W2b@%px0-jS%lbw}#dy*#blMG}gNIczcBc8!P6~1L3Z~H^)iPpE?M){etxW$#Y
z=GwS!K!l;)wRC_k-@4kSFQVl{z!uVf9#hWVJ(e9;!L>8ENJg{+c*ce<#?UFw4uMCN
ziG;Ny>%tUksCWhYi37wzA9}zq6oNIlUze^O&^W%!iy8G&%4z^u^%YroiG`GThXK29
zt4pr(jM6O7j3MbLbGr<5k#COlr`)jXg(0E};T`UKqNn1)Mz1?)l1}!V;1A!b=@OSj
z_D)8AqNlu7{eY*;Js(2Hhd^Z$K^A{f?Oi_oGQ12?C7>MiOn4fG8%1zZH*7Uy05^yq
z0yqmpckYdbYOp2t%Y6(ec?)4rG-ePA^7-)9;;~1j3M(jg?C7kz*rq0W;0vu(mh-ad
zj1srKE{iB5kc|~0e}~>&>-;-b;xS7G@PGS9{NO8Hj!V6J9_Way3-Oo0F^u#E=oJ}9
zH(T5QqiQNPfw0b`OvY%l^;d9JH%4+`td7Mu6b?LLtP;MJ&cpc;H2t<irwh^zM|vGa
z?s(4~ndkJGlM{<PE7-FyT?mvCC_fh47Th^jq1YYm{Msv0B2&luy1z1$-T+UVfc4IL
zI;ZNhj3+Cc4Y0|%tmi(@?z0!F&kNeNmR^><Nr+>?qBrKHvv{2-Lud6RbLjiUr0wh9
z^7yL%&kcH<XsTWau>UY*@9AUfAKTD*g97V!r7IMDO-{_1HISr86|4^|iIMR&Eqd)7
ztdz7dKH56k#a!K3A95`|D4{IqpFJ!FlohbDZ_R7NUIi%x-+d{O<fmSpj3{SnZXz;+
zun-mHe&#*`eFg)BtXf~Gj-a*!rqKn}hPvdnX!MM~tu!8Su^ZLX{zttwxc+vmn62<>
zx{+HwX826!S3KA$%~i%Z7G}b)M(M*$T!i^>M4;$jwzsmLD{o*rq7J-;spHxDN@=@W
zvDw+60S(2gH-N}vV&36PYArS42W^@nkdrp)F{IWxM{LdS+B8on?ytyYDgQoxD+FB4
zRxx>}iViwW$l@7s+ap{hgXxDec2?2|8U%xLL;Yc?=4n!L{8G3pKQ)B|^3cC9#F_t+
zlJu@zgB+VYenQq9%ZF@Gzs7ECuO=3X`&4<A2RMko%srq2d?DAP=R|<?zc%FmvmxE@
zEpdvHr%{BNkBOAX&NDHy@e-w2=ObZ@6mNh7bWgrpUNB;6xEp^~2D7PmOZKm)O3qnz
zrh2_~BgyFRKc!XU=whU)niW=wa^#4^(T3`Zbl(!kALKFm)mj|hzy26iXwmv1n|L7b
z+1T1eposA0rOIN`(*jy(`$y%P2H`;pXVC7VT`A|}oY<8B1I(O5!#dElPUZpAMu;Ba
zatbPT!1{oZ%`WOwi<bGTr%GUX1_ztPhn2_A<$VbdNztz+iGHUQtw2%*Bubozi&nk#
z>}Nr<pR>ikBT(H^f*3ta(`{oIAo7|@@{SdAm3F^hlBv_~`qbSCA}*Kf^vcOkD0c`y
z4%(>|I!G;#19yD@0;56kN^Q0Vn@Op0kL`)S4`I*txJIZqcCQoBm_P-ThpP6R*eYHt
zUy*joEu!%XdM}pTrn0kf|A!j?k4%LtwN(ri7nEHgB;%z&K|OctUT0-0B0NuD(hL|>
z2$jcH_J)cb81;n1sh@Mv@}`~Z+ID|O1wm70$%@IS6Fv|^SF{;e15dVjuzUW(z->%|
z(;dYD^E?l(9lE#xB9U{tsDb!IhGYwFcV`wp;#G3h3y)V5fymf$K~p)3Kn9bFspXjE
zHtD3pcBanfbf)aD66!QdHd~t*2z`2qBYO>iZ^bTKEqOP9xmzuT=y$=@yTszkQA=(|
zOuw)hQlQ(PeAn+XYUV;X$b^crldQU30q*_$+FYYwQBcZGqoAg^G#5A|+c-a5=V0wp
zI%b2aTlA1uRV$J*R9W-3e6caAH4d{)6l^CEBlcjA`5WYpBzqlAGzaoo?J_EqI(YVD
z%P{x_JM=kgpQlz5tG1cBV6sb{KNDVYk>RhT_?NW#mWZ0@{KVSTFFfES9U5-X8z4y<
zfaHJeD=COMz{wi059lOC^@o5p{U09IymgC@EUo6Gsa28^Wd8PHaER}D^&|y^|Lp*7
z=SgY3c$WCQUZgzMrbNyREW(}VR~GEd<-2qvtOH$;m6Z7&<49fOH9MlZ4UJ!`<G^*}
zrW_6OdA?BgJuP^SF)NuW4N-q@r^tuf$s34S2B`q_q2piCz{1=obhvx(QYJUaIJWBj
zhY#PZxi}sguR`%T&EySW#4pnK3u0<_T)I!LK0?pXG&g`K%-X8*ci*Bb4~X|vud>1`
zBm$1&pI<fZY+U!rWi!lur?h?^p$kf~1ai^%%W_-0ViQ&tx4(;sh61eqF}Vw4(P0mi
z-e#NkYT}EsycbI;k4d>DJ)Rd%YhPLjCs+e<-4)R0LO_7a-m%a^l#>LNAS?1>_Z5=k
z$lUC8VJX0X`OvG0XVX&X;1MXBLU#kGR7Vn8_rLHmp-+-2{hr>=wJ5ub=Qp~(?(%J^
zHdFtaMB_gK`F|=N{m&a>DWNx+B&p}<PaC?6?>O7q4g-u{IB*rrmTc&_R^*yX)kn@Z
z{bH|&qIhidbe+gldIjnknSJ);?@;=>DvgO)vnR1V_aMV_{gPe9q6ol!Kw?-5OxoQ`
zOEGv5BNTDmHbbjdv$YdxoM_m<&cKJ)Ys<mX&zHZvnXm+~&=DDOTO~(Wn`o9B;Db%!
zwO{)U@G0rTFlpyJZQyg`h|bC$>P}+2dZIDjChLfm^R$=Pz&C-3KK{_o)C(tO;TNt|
zE{VgUCe=tSXMrg{zDC)y>)4F07p4JEDb}Jm@rT6HAjQ)!x67xE{dXM$<i@g|RmAPG
z!{?VBvi$n$y?FyFT9clAS52n{L;(<GwN<=m>7AP7sstNcg6Zzzp)1ubeY?@^SEwKP
zs_`dr3AU@d853jENE^=y{(wIA{jP~GU6ocsG4piR(Q7^(zCpHHoRLDmyXi-NVAAux
z)nX0#ysdni$<$&ZH77MFxv(}!_0`cb%4&Ed(W(wtrNehYd>fv9X9h3Jqu|?yFP{d7
ztT(N|1I=3kT138KwASaL@g16YI{+1+i6xKwZ*LWWhes@vAETnpJEF^;RcQz&@e}yV
zL=wgXc!)LDC4de}xKEAUcN#SKKLJP=F@?;a1&P&#Dk%wT=NX0%^}h(gxATs(ZyjOv
zpN%|9>ol@5GLm+i1y4>1oo9bEQZtSy)0Paqn%9XYQ|2YqL<U;|TtoLq7cS6<+tJ>7
zlBJJ3E@Iz1R}VzL9G)S#CtwG+r$LobPn4RnyBw2+ceOu9eUR6^{VYg+GG<GisVQT5
zYV`)dIzpsgW!wN_ZV$aX0v(@KXNn)}I_C@ZxE_q$>VlCqi1tY&op9SsN<svNrcFoa
z`nN3_ILFn>pG-^*%^f=qK16J}q!|SwUupD4E-cxWQ#bJx%t*E8zkKN0NKuhAfvSfa
zE5~SnrMRb&+nt38`?<AUd<SEbL$agi2fHnS$4JfTLSz~$Fsl!3XZm8PzDZ^&+K4-P
z5xzXX`3QS}syEEY7gle;54BQ9iD+34$XZ*P{=_yGYq|l*!r^8`t77GE^&9dtnqpmC
z92`V`WqMYQa0KS?Gocz9(u8v;)u`Uz?r2cfVRs;y!Hb1RVPwrJY~(zvEnjVh7zti_
z3YucZ0ytUoP{EG(BM8}FQ0X{NU*X0>lL0pynWpa@`F&WiFWU*=;2CRsJ*ihdD-;#T
zwCU68<YI4!R&|yy;|jG7rRB8063bfruF~q6GxirW$5$#N!H9Rz(yND+Uu0>A$II61
zT3oRKwey^~2t0jmulXA9i5nntYaFh1^)s_iVByjo1{X&&`EXr!&{Ap?RY9bbEPW?m
z`Rw+k<kON8Ar)EE;txl}b{psKTZX8sjv9~eo0rdDY?Jz5paor$uf*3&{}qmZp1F&+
zFs4o(UK*$tT)5M0p*jTtX~jF&zh>A%;j7homKOR0WWld;uf4B;8$ei|#vU{nV7IiR
ztU0lLUyUHuXM3?BQZWXtMkt}qnVYk4M;I<GzqAa#%Ly6gF%rL)!w=NgYA$I+oEe~Y
zgYIl<fTw6&sPj=1!wp6o)-a(*Fsg5Z6xqV${i7<Qp*T<TS2)i(W(LkNePth7-%Ov=
z1-8e1fO0%Ud>(lzOVTu^(EsYv*uGq_nhxGS?+cDjol(n?%V2%u1<rhFb0TEn!2@ow
zxq=+6K?UYlu7ec$sT=YVFE0nox1Q^nhtK37h`t-nc7gpO6<=_6zQ_A`ioiDDM7R;o
zL%%y&zN74Z#;=;gUfkzmT|VK+eUX0yIOjl18|LSZ)Q()%hKkTkrXzurFN1WCKbf5$
zrWnLOBq3sw^Y4D7J>t!v(rXZ%C&^it+p2bmM9;f9?mu-@blFD}>0gaHwg(Y3?O$J)
z9&d{u^f%lujhezbeVR-&BEEb}xj`rCE_>|Yd<hO95{IA;ygG;B+MR9M#_JulWW;-$
zuezt2hwat)Uk;@Cu)Xe^IQEu^1;3Xb?IS+fvgZ(9>GidNsQHHTSG?5`Nsn+;mrGKc
z+|_Hvq{4bOq;fm>sS1wu^CPERno`%7Y_`SqPLjSFsXmKm%G}^iBni(Awf&L9E+Nvt
zZN>ScOBTAU>l%ZEHk&pU%YNpXYw>PPn>D2!-fG@C4>G3lG!MUc-RB3jMBH`zj9jSK
zkCbSMFeCtndctSy6LT9#d_L)<(lhn3v8<C-A2n4UH@EDxvR-Z19Mzz&F&(-7(|z2o
z#97OOc_!7-lI)syySvgG)i(e?mth<hg7D#>wfQ`2$VY)bTFU~4$*orNOHaPQ(;#mb
zS0h6-i#X;+=~64~@uh-N+%TGA>JmBIai>zw5H8QijU7)cH`kaxib`b|QI>GODBg#>
z$gM`V$s1s4d_46Ac(3m5{}zruX=$pxN)0lm<v6qP^!j~Wc1x#f;Y)w*Exso4EJs95
z<UHL$WQp`oo4UX+ab4iT{^!;AneMbSl?v*Er)C?X<&r*MB^bf{W&At5yzh7=+Bo<j
zcT0Epms1e5bG%R9bGSU<PsZ70rP=fqn=h@I4J&~Ml6+D8M?awTBPVkiFMMK>JD$ii
zIp~M9q>db)?Ckb!BIkBb8(agBsKWQRZ?#Hx3>e4{pG3#sbB2h3*ucF}K{kTP3WnZv
zC%k|Y@|DZ!Oz=HT{7AL^O?05DW5#|DwCE)z!zyuC;rOA88<8t;D1F9E^SlkwkhaE+
z4Ik^<DGq8HbGte|V%SBD2BfN*Cxx4~c0}9q(Loos59pk#i)<0154${1q>#w>Y5JZ~
ziIMi}v7{A=(*gCA19Neh-75IT20lxBW7!F<zH`&$d7oUD!=YF?nsIiM>tc<EzoZ~@
zL?d*VGx4fUj~?tlU^>d~t7X!u*f?;<`Cu;Cv^ZR^$_3^tr<3sNa{NkwB|LU@LA*6~
z-SSOO$DI0#2-4WdSkyeQV5V~r{I&AA3o+^1w@DN?rI`CuJ=~B*ZxZ6P86~l5N6glZ
zhr_h*uk8y7=<C*jJ;)~dx{+@eBG?hAwCo#JVN_u|VWu`NT0IlyT`|jFQ}UZ`KMpDO
zAuDB71wB9>qO^t-9~-DLE88f%cJ%(~UDcX#O<gjzvC&facnO9r@z&E=ZK9@HNBz!B
zzahs=rJ~0zm9dAhJT8WvA!^}z=dw1eQ7`8!5qhN?Wm(Cyw(+VGze;WZ5|~_5j_2aF
z?d7G0iqFo<cnwtD#cX?ch_?;5;8!k!99C}Sq|m5JE`i@cO=RORa6JVx_w5VvOS(W}
zwo{U9Nk+cSDQ%J%F?>j-rTw}97M1>eu8+62sNu5S$&b^%6Z)z9z~m__k76CcnV}K5
zwF4I42$Kmq3EAB#I5{uoy!LuJQFrFyci%tlW9W6p#8AAlm>Yi+%tHK~_5O8YzW5fK
z9U*o9qr-Pk&D;Zelp0!GGEOdA{P{?~_;b1>A}((LJ<JNj8@nRIc1FDl<0d|rPie)X
zqIvq`Kd<vlOG+z34snvU!JaQ9L$qyXM0HMG3Pl}!AJm*l$tAl}IB+5w;*Ztkx=aK5
z-LC{DI906Ttc*RAwTEhI`g=}XYR#@c-HPB$9foD{z`W}@B7GvB6Njjka^{zh3MS?)
ztazTje7@y;>D{2VUv+sTBlxX_Hojxz^MbTi^Um?kkI_1J!$sRU7lwM4M*2P*O<lv3
zdhob&|3F}%pzr-N;o~VN?PC0u7Ru;t@Nw(y4SoGX6V8>{Uo#~}VGhjQhGp8u-+w>E
zKIM|?NfMhU?|e>?O<tSxD|N%ZJk>AoG_kwJVS9I>uQX_jkK{)Hx34w-y13r&4*$;^
zFB<}$tM2zgcgh2{-mM-4D>WRFv%GSmd(1LJKk$_X%?I;)Hb=4ga>1`Y6^Wt_DxX&>
zI)fIMuu&Noys$CQv%BleV*FOi*x+aPEk)cfbctWHzY-KxtWZ=t4oqL2+i=|gc<`gU
z$F*53=%;Y=Na#hX%VMb>gX6%fn##=Owcq(k7ZB>T<{J3^$ZF*fl=m^1+$lzwH4|4D
z>kiOiWz0D<bvU|px^<fW{UPGi7g{*?>0IJRoB5lD5<N!-MTh&Nqcx^Ns$=kdna+bg
z>pr$H8pSv0VXufm)j?{nfa==IoYNjy>(P(AvD!3Mjn$LO*5|o5Kp5$B^u(p!PZ7bS
z{g=!h*ZEMrp9-(qX_I4lzVe|FeZs;CJ?qCVW{#fg=Z79f=w$P=+hL{rm|pX$)Dby3
zviD<bpEgt=;I1@<NEZbRGhm$~m`fXK37KswAz(l&%~WQ6Ebj~ck}Z4PywJ>*wUAwk
zxNbhHarrS)x&JmotPd)NbfA!t9llszD%0M4B0-ZZIv|~NDjxL6keh^Sl;`7JptXN^
z;5qc(h0?-n$oVU$;?0@Oy_uPUYrj0pnKRl>P2(O=m+gYhSjkayfs2?4fAeymSg^X&
zXy>@`XQA_o!HQlt_OENDjaRd;Fe$Ccn^OaWm~N)8m8SIxI!NJX0RNAsIHnFos>utl
z&n|X6iFx7(TK%yBJ9cOc+vR(2qOyo^j>LCVR`kd{RODrS`DsDoDbvJN*<7<P^i*uY
z>gzt~8-V~he{WCz{IWEXq0+FsxFthE6vlx?s@p~ny3L0a2yhVkQm2&prwIL5jePvX
zJGM=U<#P)jKX_ID!vY?W8b?T(9*4`<KH@$Bu&u5|P6$Jy$?NdmbB(8%QbWCyQ@9!b
zM1RMf9^$wV##lBk<#(0digW<Mbsu*v56B26I^e?Xl2X0BkkMFiu-hZ$5w(*3D*Lt_
zWPimTLE?ea@}iM*&%21(sZPo!LXd3ns(}1sKV}lJh3MnKPYBS%%==2rkAGp-S^a=x
zmw#Pnwe2PWQPO2U`sbO?zYRQZ(Jsh6!lWpS83E-Ur^=TDH$V;%Q1u_*{Et5KZ!;-9
zmaW!B{PRf6{d9h*FPSaV*u|j(*g64ii9K@j6tvtG!GgaJVCGW=OV=>-I3ukuB~B4k
zaC+VFxfK8!P#prX<(BMj6Ty-u6K7f590;!H_HCb)Z`%uH+@)*Bd1L8qqf9SXzIE}7
zW$O6a^PW&E9EXGOVdE~yUeC0QEbh?4?nN7PKJS1B8xN{Vmuo=jPZRH*s##emYhYP|
z<@|^f!f0_k1knA+R3d$&8)>86C~qhA<XMpWW0sGJ-4iQo;6*^*dQwF76BhhS>DS-&
zvR-WMV3I|wU}Z2~xBSnA>cggNXRq_H^fz>%_+UxNwjRlKWIkZ{AJ%Zm@L)G1lrTl_
zMc7?{2bYYlEi{iVL<-BMk7(Lt1^@It8_76}o%!A$8d<|gbWXHW?EH+D$XzuID@1Ad
zQM^=Q#LrgG2;2;NtZt}@-Km=e@Ce5`y-exW5`<XEm&nTM5YGsxC{pw@N%Mk+aREHy
zUn$m$@NM@n1%==;g;OdgkX`)q!*qoRHWMoTP-9HNsfD~%j7tAudp3dc$;XHm!sH=K
zsszxBFdn+wN)yRo668nXbUUhGC-vf8qHjWla20&#HF_fIZUq6a_yMN2BW?5JGYq_#
z`2TI*{BP*__kj5KGweU_47mPnj8>?CO?`s>n*IfvXp*}DSO+vNj$hvZiu`OJ5wu=$
zv%TE*S6z*)C2%Tc{pm{4s3nON7J*xf-ld7#rO0FHJ26Cg^*cj5UJ2=e3pR)2X;29P
zdxV>*iR$DMH8ELjr~8s&R9L7AT~J8EZ6V2gPU~jF(KqmfwMBR=m?<G04(&f}&`X+9
zzJI&f-{z$No2a=nBC0Nvn@wPU@HZcC=T95$eAi`3;+I&0)vJEp$tP<$VB|^!ZtzHp
z3_QV;#N{jg<~Y=Dr2muny#fi$w<#1mF7qqUDX4@h)RRbcxgFGrQim&Q(&xonzc3Yg
zzeXI+B`1Wv8pP3>x|AI=g{5-2!D{pE*$936j7hahMT@RVqCo-CE-=1-eBGUM^3Iu*
zVfo-&UPL4@dDWM9@>aD9{p&dvKF<>YCZ>PUJjs*6Fw|R64ruD<IC(a^+`P*mCM`|B
z{yh*dbedd;-ao;tg=?V?gRC&+0SB?CX@@MBOf^ht^TNkJDg>l+uh*`6F!^dImOY6z
zIZSN<&kf+)DvZV~#w%YAoyTG-4Ep~@l==T487u?E%WY?u`b`<-8o==XVmabDmpiv^
zsntS6D<GOfF?Dq7RKO)cs<oGhik#0%Xp_6#^vT``_x^MZRr5q;py$HK!T1yRE=fuM
z1HFXA_?R?@{S8OY#)*ae^1zR==MLO!f2?<VFR;k-`nEQ-vIxp;ZjZ-da_?Gi@0=VW
zKACxIRA!xT39hvS!@QAl+V*Sa11vpPXoV9OXWtuOwHb~!=ewvCoQ}OZia#_r!O+^j
z&>Fg)I6FB$zli-ON~WHa+l7T`7)l?}dn?DeDX@Dm=F`1{Bibr|kC7XIbH@dBesOLu
zI30o61%n4UZe{JFSu}=YTz1QQY8tPul`*w+ndWc(PtN^(H@T-ZG{nt^0)?*^dbZBB
z23wQlV*O9g{ccS+*JF~E;U|cLtLuPj+U*{+ALP8e4AyuSDECkjBO>$U-r+F|2iiA?
zX%C6oSTD-5;fVbQDP<9~0a|8n0rgAJ_GCS4fq4>bo>iU{dX0hm2t@Aw@yIERG@o%{
z&OFw|JgexO<#1qsH_IhCH}DVf(0&8w<vA>Krz1azB$E$%e(!Dln|#|-2j>eDf{%g*
zm9MHXy3&L-?!@MZdB8k_<kqhZ0%FfmXWkl!#AXK4N{rt4t*@pQuCrj@{}L`a>)1=s
z7NY^!Tie#;Vf1I;*~`0_Q;ec^&?AUV7%1(s`1j%A;T73+8b&x~^SOg7^TgOctcNl3
z4X}NQe*IgrwUMP~U}WI8<%!Gr`WeQ8-Xr^F-m?8L%=fXRUc#z&F0!2dlrAePYw_*&
z0!F+8^j`AvRY_n1MgxX&_fKyCyM-g>^FMTnfs0_*+bY<IV8_U13oP`o{zO|2^$$vI
zYv^qli=3QX`>pBL^{ge-^@3p6xxwH0-b0VH{*pQPLjkg8LFVsS{vtH+?>S2Slk1U@
zk$nv6FkE|KL~AV$(vuy8t><N>Uc_H71Ox)Pf5?Auh%W2-3nyNezQ|F*)W6t<-9G|d
zwoG5d|7G9nAhXba0Wjj%|2l%NivIM4=F6*Q-0k_<!^@SKg@ME4gYV{5Eaw{-o!6uH
zmX5A|t)Vxs{Eb^je*9(OR+r?$%uj&{G1Ai*u6j;kEaj;G6zU4sl_gH~S7zqWLAk4c
zsJ!_ypjrBuay!p$4FkIZxyG~Wzufa5EMW$^{>JA)K`lnNPOLCr%>%xgnv$Elk`0e>
z3{3oI58XI9K>T+gd;`cO51I|_jL2OjSD6p2!*rT)FNOa?-X<p6^nAzI2LlB;xy{~x
z!tg=G-=S~=RP9~-<qijj2UiBo7<i(YvQ7i`Hj^_(F!=mKR}0&hL52H&BP7>Oior|r
zzu=`Z$nj6S$Wf+UR$K)%UA5Bu%^fh5ZUEeMkL^6z00y5Y7<?j+Wq<znXt5kjY77P5
z0Mn<}_{;ym9_b&hW&ZXbv@ovRcV3RTlwJ6Ib=zgP=P%Ftll6ai)*nua(deH}8pQpF
zZBXl|vx-ZJtAi`4RzWF0&h=M+V!aamhmY36DF3vxY!GbX!(U4HGk78n{tlSGMPi;m
z5Ca=oKm037A$QhYo`n6K&_?Vo`tM=*U+m0z)uMmwQt%%|Do5{sgyPekgQLSA`x=p2
zA8S-XY+a6YP!(CnRkz#x>^9ZayniL<xW)3;AdeB&4V*LR(#)Er8{izz2sTy1a&h-1
z35g$oNwMFRakmHhj<Z2-OhW*@3=aU#tOgSPWjo}adB8RPaRCR!9=myDj%7~}9maz_
z1bCpiTN}qqn&zaHoQ)jqb1BvbxQru~d66m{u9hIu1{Ehpi(q%M07XT)=2)-GlpF#%
zZ!jO7F7^|r@E77|>EU#Ib$qu~aKq1Dud?~Smx!{!?JPR?QZv*MpXe`4_NMn0@}hRD
z3D&c?9rp5J^pTgoxF)-z6v(|woSCPWV|B)LT{<R3E0b`>X3jX-xlr-GT2jzNA4Jf7
zK<Vm|qu`6=x8VP9PWI<Ni8}siq5Q+t@$@UlI`6MEZ|EvNmBdTGmU{le(=`f@dIciP
zP2r@G8Z1m2gEDyvO>>F}eej50V2ID<(CwRua?PVhmkY_e8An)E_>tg-x=@}^(d?Pa
zDhz`k3F8N1^rSxNu$eSH;iZ*|U+WzKNMpP9r51RiBR48iZgGItcpP#qu!yu0mpmo=
zS2E6q0nz&`3^lpFWL?DZ5wGJ<qP~^f5$PWzc-zk&xU7f+I{2z}sEMt<f{If8HXZz~
zfM`s$f+GT_;8FeC0k(sf&i45d2KS|JfDyCkA=n@XF+bLa>L%`|Bj@d$_uJvZN}6MS
zoI*x{os|%5h*>kpSg&+M+Uq#gArLRb(x}AXT~v!-_1Z&L?fbfk;}9=;LC`C6#_uL3
zA0v$I^<1eZ`jj20^`2Th<`Ir(7iPaN$=`tslzXo{vZ)i}V~ciu@;sN4Eo@jE`->4t
z?u+yt?5Aaed_q9JT$BL+?j4BL!GB}#y~CRN)@|XHP=!bbX-a_5iv*A&2%&{gqzOn<
zdXo+sKv6>P5JE3f1Ox$*UIghKq$<)o*yt#N6z}@&ea?6GzGt8BKKK54@A)TB$g|2^
zFUg$mJKizI+<yI`pf|Q+Tm0Q>1JB)Gezk*@g6M;LekZ8wDr-*ZZ?#wpqqusZIt1a^
zNj2JoIm$MVOctCTS`3BIBZ=egi7<StrCTHaWJSaDSGeIJmnr_*74KxLq7T_x$rOej
zd9cm>aT~7ikD1;)Jkt9tDq*k=vAz^%V*3<Z&cqEKL!1hAoV(aHC!2u-WrPITqC@ba
zc8$1b549{syO>pR<2rQcc%7TPr`|%MyPq#sF*C|@9bJAUKy|J<N<*osszGoWcr<&z
zfT_$i4avy)fsQtY1VL20W9S+SYDNY6<j_t;%71<9h;X^45yL!r#t#vsa$1)Q*N7|B
zOFl;f-y~%NPCcaAe4E+5y^?m%#cm01Or8lfeEt2+mb&gjdg<r6<d(|^wrkFcG1p%-
zOTkrH99%?t*kWGU)0yqJ?L5Uv9#9oUF9-Di!q1RRPH;MSv?EhRw_D<U*~~d%pyRGR
z0Y&3Ji#>afVtX7IV{kNds<iCKCDB2%I7m7(%VT;;X0GP_HJijP0g7R<ZX%I0|7)W+
zY&fx(49Seei&KO{U-h;(#qzG6{-V*grf3Gt!SBha>x)GU6jP(dQ0k}yn^dP`uFiX(
zASRC^nU)!1vcTzmJTrP?eQUd1i}v9|Cc82kTF!9uHaVEMjj8lYshvYwSwRh8Jf^4U
zpsE{TPmrmcD0Cl{T;&mBHs<AlQEGi-VKfbDCl*>uKWNUMW0SXP%Pi;CxTZ>KWaOyf
ztDb-mqA~S-3v2)qZ_Zq>`{ngWRVhSLqjLypoSQ?A%uK2j?Z8{bCG}qgY}h91M!@A;
z4rgZX5f6gW%aP|p3`g?DpikYs^|<I|Yi<1|8zrkU6wAKf$|^xMQzqB-OUO_o8Y+D%
zY=xdvpGDAV4-e*3RD9fs-T@ZJ&oDQ#Ox=xn8>Wj2sFXyr7`q@HY`!Fkn9c@BI*k)i
zYVCf?R@s9Z;Ri!B<`dEWO@W*RG~uqqPKAg4JpCFk^n8i%mvfJ`4`Sd!n)1(_6rFSv
z%}nxRwGLLLMEE73m@vjD2X1G;@r?HiGuoPB7*L+%k6RiQlQo4h(r|XMn7fGC&Ct6q
zL$50KNT)UIm&7A#8~s-GCeFUyuC1wop;f~&urE1W&_pF9@qp0i>dcR?cB$&|o5)+k
z=-C_Hm4%`M>_uG-J43D-T6rCbrV2Y#fZ~c|Q@HoU95P;sLIqm6$X-~jInv`rpdr5t
zm+9~j-kF8)EX8N?=ej}#C@_1qNnH7cr<nPzyA&t&HdSYHA=DYz)-g)6z}Wi-stx82
z4$cPD$aHkkQBz_xUUO~8Ar5{1O=<8)9(kQ2OMS-Eo8lg|4N>^3<@puk#9O&e9`k^;
zTeHSuHTq;N530Ks%%qA*ynh2;`JCOunKz7;vE6yxOk{$##%5=fUk$kJu|`vJ@!+Mk
z^3KSrJYkzv7*o0p7Y&v0+6cGULEs=d*RR%uc<zOU3W}HZzZT$SOZ8mFm9Y-Eqmq%#
zC+Yk!fb@Ao%<!SG0%{f!FMu#j`DkWp9|bef-+cMy!r??}J(fwi7J^>ud1LRztuwUI
zC%hM9Z%FlmomO~4GUx*)BZH#b<{&!Usv8MB`joJ}JzwbMKR?eu!*zaqf5p%)uGyYx
zrz1pa9yhdzyKZ`%s`XCobv>6F!xim8#9jP=ha{4{1n6yYoXI|kHrgu&8KX3Qd%7H%
zBF8jY;X*fWmOtUNXT$YnWPHH12y4P(H!%G~_WQ$lIrj#%nxWB*)WPJ9Zv68?^$>Sx
zusxBdH#c&J8(`9n*}(UXwMWN!!V?{y8`z(B6B>5f1<OsLYOSd1&sZZ<6Wsl4g8KF(
zyUCa)he*Lz>^yXc9Z@YHd>{}bhb>QMvFD5=_1a&jg-&$S$~UB#k0?u(`}EVP;JBZ+
zgp+b<ScDLal7UC83NL5NZ!4y4a19B&q{2*8w^=}jiT9wVxQ>_(H3OvVKY+pi1+0^3
z@y)wSII$#wyaR2#p3PwVc_=JRmT!lEjQ6#J74Qk@h)%_5I8A-M<xY4E=4GFrYUpfN
zEWT@d9rO6nd|FmWD08n=`Ov3Z0bkbs0DV5Y@j?di5B+)txcxa}W#SzZplY(Hu(h-e
zGN)vLPL2#u9~7JK?9ZI%h(w(YGwSQUgO7(UUf+GW>7GXgkRfPLK#=@xYdFu<NTLl7
zk<O;`u{oBx!%7Ktd>)=nv2z-*J$}*4ta?x*7*ODe=C>$L?~hg9Mdk?~6FCucq%-DS
zHovNTRn2sJz%Fi(30@-n4*Qun=o{)MI}L_p_McdztOP-f3Jn#RWp8>ML_ToQas&r&
zOd$uv_`LUXkHUa^d9e2eKg$V7c4gm8qd3D#rN;25J<;{Z%0!%wSAy9Tt--qm!rjM~
z)pI(V_~?|KEkf(3iw1rc50mv7lnMPnqebxa=vn2rX_lYur5nX(yC5y(53n7*5pk$^
zMs`7-`=Hs|_Vj9#jI3qtD>)2>w|smkP%KXa6r|=Jww;mv0qUtt0zvzm_Q2(Y(?>tZ
z700bqne{J{8P%=Gc2Gxv{*dm;(go2UV2(^!G2;)gthlG~Z01$qXkp+n{U2b~=|657
zlFBjs2iW5{<~(|@b@7xNylC#lq`HXW=fGnSh<0VKyl@05bbo*j>iP$khhI4^i2ndb
znX+K_5@dF?2cBB}`>3DRfb9BQ40tiVKS1sHe;$I$c4peyZ}mSwkmC8vc(cHfzwUc6
zEo*%Sq7h&Kf;n72w0)jXJi7!2L(+Tl!uM}CKI#~v-UJ78Msw-_5(pH)Dqvan58(VS
zf)O!y<NC>u1W?!<czT;1Y=eUs`?BJBrFYj!?qA^`R``D)2$7j76S@pnq`uRQ3`c(#
z3lQ%;@NPBpRHnuI$*jg>4w{s2AI!}3&eb-zt_-kAv)rGZomwbb_$4hwL{|ygDg6Ne
z#bG^?Odu{F?Zs&%3Qnq*hjJQkp`Wb12Goyap#JyGTrYNd=05pq+wS^IzPaTDS#pf=
zdK%M+@7`wNK{F)9u2Vt2kwJ0nl`rT9ON&ly0Fs1PKhK<?H)?`NnPl4MY9I_?Mfpx)
zmoGj$M>dbb_xFv80+w)l&Z`YF%C?6xLJ<PN?XUXy6hie#HtM6qjTkk0F#t!hwSVt3
z{m$Q1$q>f6P$@j6okg!S9ebLvX$+{uNp-X_jj>BbWCG8vRTt`vd<o{j<?f#%-*mnG
zC4rv0Fl4=?g=j~Ze&`4`UdH0E;pG!OXbbtbyKKHt@irmYXM7hpQ!K|TA;w6Au3r13
z6RSo66Oz~oeEzFdT55A(pq<_7?_SBRoN*>HMpRdvTw!6~Yp><|fIS7IoAvExTct`u
zqn=diX^-D>&ibQW6h-|w--0SL0OMyS%KJKIw~XCJF*uCBb{A#(W+b{F%&4JYBFtji
z()QM*tPv6NE2`H&?=m9Jh8e}+)ebxasB&<?EgS>z?XMY%8s7K^F!=-QHe7@{5sd}h
z01dFT5_YAF-!%OEJXM=E10uw`zb`VG@0?;U{ITaZe}A7}EPp@ZZb|P<)Bk0XlfcK>
zS<viZl!PEbi&WX*B}A27?QO_=0D8X|Eu2sW_e|Y%J@sIsKMoHic#ew!-q=(<R37B#
zHZRRyjbQM!-GSZ7!gKwUyF=$&!Rm&Ih7tvprqBik2;Fg#+EN`NL6klvsvll%@7;N;
z(J)7RMkdaV?I;Aruv6zodgQc0@O)1kTKXod<}rf@^5b1+RXJwOrMJshL7EiPj{I$>
z)bV@e-r^P(b#0^c`37NArU<r6<Yko4r@MdxZdrhigXSw`lve2q5t&%Of&mjMKQ=HR
z+>{t~5{5}~n0$*vgqTjabEiIZ>NI!oH!ZN6Hhh~w^~1na+nZZ#NQj%;I*0*6<QH?h
z4&MVmNJ-VuI?-W(u#0Y5;{DxMA3`iV0)jpU<0-LkUuKj%pX%Y2s@f&7v9Y<29>WGC
z93*Z)5zHO;`H6BOjK}N3m4^@l?sR?y0>TfLyRP>0-q4fI>mnbq2o+{5*u-6b6Zx>?
z^1{!;XI3>h?VTzHQ##edRt*Z=N#DrLaAxa7)Ro-s$A;FFgC*>5E50l|bBdx9fQ7j5
zcBQyVeO!nukc6<ea*n^w!Q3}VX$?eTuj#B-P|?GN4LAH9fl3npJdy<C%2bm)lPL4{
zebrU^x=_y8#KyVwP*nyYe#=}zGEy9uCH>b26`x3~#I(5F>|B#zZ%DuF<+k*8>ZUaI
z7E{;b7>*NE(Rkr12`S<n3)jutgMD$4z4~ERbG~66#vQ9T#D_=EZ+6Ngmum7#ZAz*R
zZV^mY<CQx!(b0A!EQ2AzG@Cg7fz@~7{#@bnJcF7#pJ!FQww#nxdBvsWEP8E5h{ET~
zy_<0&#Zk5TQQcMfDTyi!_97_;vEI0oCs(n9fmk9)TQ;b^FDm}-^5}u#yB1_0BChI#
z41Ul%#L0m<GLg%jifx@Q6L=c7ndC2IF|(Dj)}Wmn7l{eNmj*RFKrZpxGABmB3L!XB
z^WzYW);PO<mYCsg{M%#=&chjVZ!2V|huw(gVK8|=aKSxc^@xQHlMygZ>5mcl^f13@
zn$gIY_Cs7x(ypBz(Vgy0hf_ZhsX@m?8@)(W!nrfsL6EIIQi0p%4IXp97Wn=&@OD$i
z#JwsVMCQ`3$Y)-ZZ^h^sX9ux6_AsowQGf&hx>>#YYCMR*MvHOBB`42CZqSL_ZuA=;
ztjlcI?m%&@Z%5Mj6T3>2!qWJ^tob9u@Zx2!c*r3*IPmPN0g5|Bf1-8{BVWzkK#=b`
zZIX>7Aw{!E3;XfkHwEq+HV3rhiCGupPvIoww(I-{7RBNxN)j7eM*jF0>!H5N3{@&P
z^1jH2{yMa4j?ctwtOpf(=;%3i_IVlQ-?t(4nuNt64708HAvT>}M9qN%WwlWltaMR}
zK!g4wHXJv|2~Pe3z!=fmK53d@mHl+{bc&PZus@wffdftCP(6&Q6Gc5(NPuPo52n9M
zNl(<hD~#UB&!Q-2z}@vSo~7NhyFJHJ_0HGUv!7J;Lad=7d9K#`BwEy)bg7M~6yZO*
z)O5KOvS8HU#)U)F@5g5$C?zK-y)h*0Qc7|sWbQ0L+(3#C^X!au2#WRhvp3GASC|O?
z;qvY$rhYsh#O4dUQ`Pl`QiNkA@J>XUe=FfX??x{jFveWG1M?d6DC*klf5gw6VKuzZ
zVdW!>4i>>)!lmNCeP|<KMFsSFKPEh2Ff=E;Tc3Q~8a>PRVzRC|da8Lx<8rc|kf3{4
ztkhS8yO=u3O!S`aLdO}Zj79YetAF1PHyf=jo05K&3JI|Quq*-ei3I!SU2^~NMC&W;
z6YVY@N92KL>>|B(f9jg)d>$c73-o9OWWGv8I3op+{gVPbQFP+WGY2}}dY~6!t2E#Q
zrQV{Xk&3Lx8R1NM^vcUB#c^x43@7)}NYz$`?8ZpGyYRcQs)u1~w^-4_!zMvt12z~6
z86##Rc7PxH@t-=2{~r~A0doKIPQtIWKY%g=!~uuAk<bRFaF$@k_TuI1uiJ`yiX*&Z
zvw<stnX<cd$Bz$wf8Ul;xX;9sPHNNCQseLh?n%9~P~;_nH5qer-4BXN&S7q?IdOxB
zTBz=iUR}ExE?i&LyT8|JO*hOj3{!QG5*D8}148|D4XPrx#*5y~dltTO!ROofw=~JG
zG4^Fg&_x+**C?j`0p9kSqR7g4QEXM&u(g*@)@E@`{~G<{%pRmkS59Nc%>ch+W493x
zUD>Z;ZqRLN&DWjYqCaTUHCIIQJqzdQHc<Dmvv=G1L`R?Sw(U#JiXK)^F2`ge!Q!%0
zF|*-k-z1IJp~d(ptmTu1%nmb&)+5W`hS-~|N#g&M>1;lF&P(|<l#tOue&yHQyJ8g(
zzLapM4>`~F*&^FVfX-<L-81gg+{I=v;{{1w7aE0PAmHLXdHN~vm?IDb{Uym2SJ-PW
zelA^*E&TxwZUY>9@n+PkAZ7aR$LA4U&<^SDf<Le2r++}^FJcVLcgZ)3f4x!MQ~2ux
zf)n`iPgev2J7t~Ezqg%Hw}EZHOb`wDPd5mBeE0_-+64h)UL5r?n6tkFGv*+$Uv!p)
zBKzk7|Ca-(0F&_lvk_of11R0x6M0ul8`&1tJ$lw1unJq<AIY0g*Oa_2sz6UWk8|=d
zvb<xD7@pq^Z{D>1SevN0r`Xy2EVtsN*s0|j7zxWso!*~HRlzx|l~Ido%JO~w<S^7_
z!9fCTJV?a2sf@<V&j40dkciG%EVI9ze{A`Z+)tB$pfihSyYevT)`<6(2~GnH<<GR|
zM}!I!j04KfJFy9`xy|ZGxrxbN2dooZ>BvbW$9|My)JbLTS*H3Dx%4ru_9P6-H~XEq
z+B)y_!KtpXOp0*XO&fDn^Abr9Cb`058lJZahJ7=92-hR&o)E4O>DI`AAM#{)aayrj
ziYZKy?OYt8uE<y{+Y$i`*K3~&PM<Ug>wCVg96a@f$J6r1N-t4vbdQiNz^|DQAcYT`
z<s?%M*UKZn?bvZs9B2q#9rkRKAMu%kKLqqhsE<`8$H^PW7flQr4>|AybnJ&C^6Ae5
z-+n1?%%eQYy!tx%#R?G%69=5G4=S!A*4{oO2GhB@ULh@olA!PUZCK)Jn2HpW3)mEW
zDMR3qug74HuFKvJs`kN?R8Kt2w}<0$t45)PVTGRIVqqaW-eTI`0TWR1JiD_NK>LDm
z^1ctYU#rR&BrhhxQ%q7u6t*S+GG_M-BRKS3aYStfv4?wMdFs9^XD&6nwS0rH|Mj>g
zn~v<K+w+;g?8QLCW%?3(C!SP0&h&uEG-svHo5teESwAv&WUU^l#UkD04y8nStacpN
zrn-l~BATE=W25XJKWqUB7HgaZ0J^@FZG|bfFJWe;FdTGFH4H(8zUfZ2)&9IF9!16g
zxq1}w@`dUzHUd8rIf@R$_>o7&oj{`4LMgh?Tr(slYixxg54iEtT+pm^nctSx10H4y
z_XdcW44tf4WZ}T2lXw)%^@xX!MGd0O_9R>p!rhh8T&e-<j0dYjj=Qd8vfm&!iZGKN
zSp71_wox@IM2p)ko~sw3Y_etY>v<k_r9lt+HIp$c>13+OCUP&ZT$F)@a<Dk*kVV|&
zno%`iQ3<EfSh=mZ^#^d^Qes_RzYTXKR~T*ZbDPuVXy%r$pk9QOK(jM><Ak-mI7Ju_
zMW@6yqEz=!oYIK{%EPehc8q8~{zhON^yJplV(&*RT{0#bwkrQ})o6hs)RAH<FXanb
zX|@?9XnCwWwSCX<?a9HFr=#3qcQYK*m5bV=UMAl40Z>=3u<H^3Vl{f%;QP7X7_+^a
z`Jp#IIU>n1qbY>CF-Y|Zir)@PoyrUt?-j-1-*479ifT_d7?XL|wn^_&uy2i0$Pj_m
zO^x$!w?j3@#?*$WHA?pQOQ8($CWV5}?1W3Ix!KoYzw#*Vw$g=fVnW?E%+ZE}K}8Gv
z8u#s$Rr95y5Z;%R2U&s>@rF<r#mmn6WgX<gI-Se?r)|EX>j*mXYjzei(E15dv=gM-
zPeLbyRX~0-E(_Zwna=U{0K>jc#6-`sf|`r31@3>Dy_b0C;0$;09^x7jtiF;sBq*MX
zmzeLD`i=4GjLTyxca@x8k8&MAn+%Va$^~s`jwkhc>c?sv<P61Hfx7p=%g(>(>*f=a
zgholaq<#^-uP3o~B?U-`gY(=xR!MQ(Nu6&4!g=|9&BH*GZ-gKV)uKkff^GPyMf|ry
zz}eIp``iEh+Y}xq#TMQE1n!dcoH(KEpX*dOE9meiq<J!(nB|R5-oU6x1mq`h>V={o
zgP=GR|NohM_H#qilE=fJM61w6N{F>otC*7-$ng}uSg?BiW!B>_ElD1G+JlccHRXS@
zMjL-TsZCoQf`?4z7Ap?cOn(|Hd|Q+i`?{OhzE^cTF@1j%w(~73&F@=Q_!gMD&gs>m
z4`!W=+I?yVgQ~6tbk){-U86dT<)zxP8Y31dH{mK{E3>M$wU+26+UaMbI+Mb{ZDrv>
zV`IdX-=xxDuV8!qqs>klwl;GzPxDPur~O<Voxeu|P5%KH{*4^Q(lCT@5$QG<V2S4H
zxH}}M8E)Muj+Fi4*%hBIKgM0Cf~PKFXb=9!{6p~mv{DH?e#KX?@==#KzDtG^Uq%$H
zPL|JAA@1oLpK1PbNqmiu%<t>u@21?pP36Dr!F4kx;X=;riRnq;GT8g(IxlQ#+hYca
zY=ND(?9XQc_qae*F@Aj85j5Mu^__tRbRhE)l5hepdsCJRVCn-ERXpClHucQ%7#7%n
z>%Y(bzcgxeb6>Ej6XjoCZ>m2pDoQy@CDDK^gliHcVwZExbP6-Q+)Q`v(sETpziCw5
zt=S@+CB8PvV2t>^dknd-!3mF%+V3uL?EC@lV4Mzx(r>KDm7`V2=B};i{3II?9v69|
z*Lk(soeX~10FO0b@s^7Vw9;oSk7g76QbewWb;6~Mh`yKXFgCV=*`=^>wB(V-ECkrn
z>=?Wmh`xb`aIGvV%I7ByU9Tp_liC|>5rJCuniz9w=SQCR3^YV0Fdw-EIcY6C<g{bC
zdGAna-|;C!QjA1J1M$|c=ibZLJIf`C^cwpb2dz5Om}fZ+CAG@@sz<VByFMKr!V$+@
z&@qd`nhlh^5atKPc20PelsNg}7m{&aP5X_QvSvXi2wz(F9W;J`nJpGJO80_&b4r8T
zW9iv8O;)J5=+V<4?DE+%>+c)Ab@GFc5b@0QgCn%0+snOlVsoQ|5<)^a-_i<<EP^Qa
zG%(WjnR;Z#bq8lo4#b6t7>L|DbU3M6v-0}}jFi6NylWc^2sb?5c^PY)5cx8lTG(IZ
zp~DV5y3^{Q*NfJ{nuX3yC~*+?;N50(vT6kE6RZNOzR^eZ(@1d9*<TUcYbjQG_H8`5
zmjP#3m)ngLwtlhre*Gkl>!oS8=Ov<&bYbL<H1Pn9jVb-Q+{iN3lu(F}+d)yRRdyrl
zra;H+mbWkMB+K2;0Mp-@&k)TgKk9R2cwoVSsj^h^HGEDQBgSYBNoyRPRViW38Tk78
z5AgBLL<!*ma6p;xGvVSi@CzDui>%ASR8+BLF{gFuQ?A*BrQ?}U+s|K4*1FqsCmVA^
z4VL$wWPQwN>b&Qtxw?w>sO25!mPd7WzdTKA;_1K_7HNkuno2POcs3FgykU<&#w*oB
zCP{YaBo~>&!Z=3<t*$tLMTK*_Q>5I>V|~ApmP(1S%gWL-FsKSO&6lxd`Y1@_pV;XO
z87vSbOZSAtUJ(1+5?J`q8hS#ck@ZKXh}60H8Up&Bg<7r%HXz7!0ARbB7J+EX5tvd9
z849!UEWvPED10EPVqJfPVoyjMdI`nZT*oQ1U%E16Vi(1&gupas+K|&?+5&E8M4%Ii
zmiI~_#U;m>Z(?&jLfxYt?nk?vK}z=6pr}}G{)BXB3WsQ)bsqyH!+%+-*}+l)Njel7
z&rPK)ye%iJN(OlmSA?ceCxz2n^#YQ0OBC;4-)0Yf6vQ3&VmdJ~c>gwinEfL;w)c1H
zY8nRFJWVQrkPDi~_mjg1WMP{c#A-TABAU6JNuKC9Y|yp48wPioMH-3jcXch<<jgKt
zV~(aQ?HujS*R1lX-ZZ8Vm$~0*mL-!VgR`II5Ib|xNPZbwAELYx^UOfYWcw)8k-tsS
z=H4I(@(<mbGcAFvb%+ZSwC&?&H5ktt)SW0++8*v-VvzJqC7sLer6uFWq9hS}_)Iw&
zM6x_quZuEYrQVvpb4I8QkWPs!_U!V;^uuW^{M?;MQZoBj;0;dhe8i$Z)$Wi3RbKGt
z+$lQb<kdpbBM>0?I_bPp$klHBa6yD>)Rb81(P(<wh@2gM?qWZ^l2_SNbE93-VXx!~
zxhrjFBopd0?1eFbFSdr!vpv;qea8mV(a($HS6?0oDSOw+bcfA9hN{mdM|WphXzSq0
zzyiaAJnl-xPG6kCHAtGRd!vfbNr7Kv@C&25dHT;M#0jne8x}%{1AgFa81kyvPj&j9
zlGi4B$ki8CP+K5%fU?#wQ>mYq3^%$RaTzbuJ4SK$8PQ?KC587pqg=Q_9ubkDP31R@
z)gtY*m9oZBnD$u)$ieZ|>Ltf)^G%IHHg0%L%S+6n1xC8X#you}a7c+u!m95OxJ?}#
z>Lb(=Ij%0c*J`>T7@nB4P25B$Z{CTXLy;HS;%Ok9dk^u>USA#Tvb*FZF7ZY-WNk3W
z@j;c^<gfz7B$4PMbLV+*S4H`fd?qkAcx9^Xwi#|{WTNHYw*Q4iCGy#xOxL<QoI0sP
zTz6B0r`<ftbnZQ7nt_h3di<pw0)4xm*qtrZmQPL-Fb;$aANO?YReW8t6HEUH+i!8L
zTD92X{D9XH$CbWvEg>CAdNFGK1W_f}^PtE!T56fZsiTo_0}c1D?xPwz=5~FZkZlLe
z&LLON)JR#2tgY5!Q)il?Eous1S@LvcQN)f%0Cceux#?m=d3!$QUk#jt^(Hj96f;k!
z-F1b@kZFP@TU1|s*yDB6UpGYoW&X>KO`?n59?2ox%!3)wQ6K)e3`+%LQ9q^57Nq!|
z6z;M~01`oSZ>~?O%UgftY56Ea)pB9Q&ZdTLdPxt<QCy*bkvBm4*pIze>UD?UB?=ae
zZW|0jRrZ-C^ZLo#T<N^Iev+)EOE>0IcX$m?Z?))MIT+1sHH_iQAlijWyERi8RTlna
zF$T00$#3LjPeHAA9O4b^sP>08w%F`r+ZK{}?J3%sc;eTdx3f?#KZ$~kOLj7}n|xMN
z@S(0DAGSIvwy$)sUQcWcwahKhBWc)Uc8W%9vY29{XpnYy7`}`bT<MR?v6>?V3@Lz4
z1|W5`!_C>tLoqYVZNaWX-O=EMm2KFp?n39LTaOf;Vj0Fr4p{=#1pg^TwxmutPW?Bw
zn=`C<)sk}d_$5O_^I*BVg*XY_(+R1vO1ZlT34m%l&ui)(j92s}sZNoQ)W`DOp|`%y
zW;?T@pIi_3O*H+cdl?_<gHpFFhw?0)!JXZAiFL)ZFP{?|kCRYB1%XnUt9h_(_RD<)
zGH(|`;ezR4;TwOcpT3XZRs5>&yC);47so%tUs!8w_NaRHG@Ij0$XsHB$jj51IE7JX
zBFvrjjwiWQw|^PG9&O^CK{SPq3%6d<%DdXC6I~x6kJwAug$^2ymu{ZtwTg$$ZmOs9
zoFH6brD-sTukPN}itM{~72ny%w1dXM-llr$rjfBvs`vK8m35EoFaz(NDBvDt2l9*f
z+-=6LhUpbQF>cV}J%-UV>&cGE%upT#+p5W++>eqA(1S#Ss&P_&pa)>iBVqt-a4<d6
z`$dmnVx#nLh2w~}mD`bnmCP3F>w99d@)W?=f)&&e$6$J-`?D{gP9X3H=U<X@Y2y#!
zDIT9s+>qjGbiH9pj+us0r1w%#^J|F2pxh$BUS;)MvO?63$-7K5fnmd_z{%GGHfSbq
zt;J0y#B~t5jDy&p>Avh0pDaC#{4BT}mJ+Pq=r&jzJ4nk$HA7+;?*y&!>(Y+WNVSSD
z<36z!p3@tewBq(5x8u)P)T|C_!T{6}J(;fgrbQ;*<z?5-!rk_J;KGdy%;!HIXa@lf
zde08liL`X4Tz`T-zBVZi2a(hb^6n$la65J}nD`}QU;_iN8vYai@o&}1zv)^2b$-{I
zWl+~Z$Knu0(z+xq+Sa`Eizs$O3oJNfM5b9)M7b|9+@u+77qgco0jK_Wa`-xJ2Lphl
zJzu>N><{-uCXHGrCXLxSmgEt~b>ouPxfxv@!|#NX&0o6=Xw=5{eJTQYCu7&50lQev
zd%FiEaJ$bS_ktq|{!9`=J-b3f`TG01)VxM6e#fdTWOCDn;W2>(&_vwf#L;fP2)Da{
zmzxODe$lKX`>0z4DEtE~N+hH|Id{iC*x*IK^+v2?z(_d@ZGvhThU!%3gjvvDPil|q
z?fm8qzJHO<1n#fr8vp$H>mu7|sQCD<$K=lsy&NuQ9&O)$J5Mi`NXg9k)kW_7a&)U~
zRBVP`eNF!!dvAJec%FW1SZvT+M}=+~xJm!|y;nfoX=Fgnk(7r3E?FK&bC(bw%xBFN
zT$G_gcPS4x;P&XW&Zp_M*(#asMmkX+x0*mSg!A&ns~MVpvf)7!smV;>$><v{<`?lc
z&`LUF{ZfR~qUkpkE!OjbVFO0f2-q_f6iu9>krZT8gJk?&@TwA}N(+B9r$DS6bED_6
zGG-@lAAgB_pS7!LC_|%nI_%A$S_`<DQ(QCa`k*MeO&0|hCC4y|N%vSI(62De=<e*7
z${MD)Rs)8_p7vy0`JN*K4Dam<VE<Z6)`qq+`V%cOC~>9`b>R{QQ&xKy!<R-7CsT#f
zIA_McDslehZ9agg?i1D`VytuUSU^p3)vEWy`zK10L~Tc~O}7gnr)OwH;`G%Qc5@Wu
zVz%>s^hqfvQYYm$Hg?2tRaYEo>GzIb{nf4{DeJN3muBQUm7>_wCy$lXofS|!>`i*W
zjavJusTFg5D_eWdFE8Mcs@M${%>=Pj{5<Ip;}-xBfYW@@chMVSez$tLh*e&h5!&IZ
zpPaX-k+n_n%%<7v0LOrbL8$8T`$)Ruc^);y6UR_UYavQo@6Ze9*p_%m59_t4wx5-^
z1GkTIX|$`KCKlq=CCBC7n!^fxNpHB=GxHn?u>|bg^tbiZqY4(fY;ZK|^5iQ@B7>$9
zLcy0x>_MICT|7LLi(H5RuE_$q%E8|-b~g*v_*&)<Iqm$`AjXWLj6NS}WM`!|a{0VE
zfX@#X6phDLjOyb;`R|DF;kB-qCm?^xK}{5AYBB)YGB>hB6uIp_TbQ@qp$%s;X^@Sh
zi|k#y$foNIz6z#})Ts-}st4}@!MX1ZBCZYhU0#fO2ng2i<6e21>3bbA30H+8PnfBs
z-3@$D^e#-Z3zPGGWa%_l#5BXn7a$GE#4&P_9@18a_gdXfv1rD0oaipCaQtT<v?v2Y
z32rd98$ge=twH)bxc2tFhrOyZ7lim4xOx5L5FL{=R^`ed!%veei*R|IgltKZ8>M{O
zxXYdb?#rd}CdQ>pmUNljoZke;>^l(G;P!Of-<~+%3obV@#fg&rF?ps`?eb8(hj?{A
z$O8^KKIzsB+q+fC-ho8+QoLGt=hF^+h#s=2Qn{MS$l2M&Mh?Zm2m<0MddtH1%>%+@
zxBSh3aG6KngP`|L%H_ZNQ+=#QLGN)7H*g?rm~Jdw3Sm1i>VUfg*X=$&^xqX-TdZGo
z$QDY6`S3?iBan|W9CB1aIv|BKlyo%|=ej6WM_UED+3mzGG#&&m4=|@tJTD}PDzbAL
zkX0iwNklO|Qd%V@I99v%jtoYsDk8YIy5;>LvBlDIs<C(FybCDt6fR_ud5h!CLx`8+
zbKOuL=%N%aVt~Kb$u3+~cql6+MTa2;NV*V|mf<PD&JakdqPVST<s{OiX`52au{Qk8
zpos$5qI_0%{=CHWZ57rzE@vuXQ$17Nzyz=QS=MvIn!@%{!Xf}H2Po@Y8D`<@7ZvfU
z8GgFtI@ga^uk1SVYQV~m>FlGZ4&_xmFI*ptah=%P;LQWJv()ey!=_6i*e+Yr)52@C
z7*Y#;zi2Z5H4W{WTlI&Wb$vUZ=;3Ns#E9A~c3OUlwm>1=<ruaF9m>Y-3e(Ts`lFtV
zHX>}z%&N?&eEp16&+b&iaP2As62SLwE6IOKP5vhxu07=_^OxUGyJqGs%6+=JUJmF?
z)=E(d+xygp;JOdvTZ~FHzBAXiBuV&$-YeoSo~dn<x;Gx6QhXdOou!@OPRB>SE>tlk
z$P7gox*G;li9L0eY5a<qJTw**H@F*e+xPa3W42rWg+Q4+VwZX>(9A}13MVvwK7MiV
z2l%4=7ka@LNjIToDf(MITq>0-fyHXo&`bD<RJdFSNDw6^N{s#3OXWU(_sP*%W6!`W
z|N2x{*M5IZfhLcUy`z9cZP-wiKP*w!nW%q@BP6wN9)iy4eVVq!ad>@3w_&wy_-WD0
zFdIf|!iv7O=$&(Tfd)}wV*lVBwvM<fv7$Yf8XlC8Rpr|M>O1TD`|)Mhp1+8B#YZqT
zW1_6Tng&tXT*+A4I2mzg@0)bIin&+(Pe<o&v62mHr@>H0-p?j8^bHseHck{Ca*;=o
zu?YHiHQG*(R-dk2SZ@{2?OSfTIDdMqkgU<*4?(I^4<|JY&};U~CX`4h=my08V0glE
zWEl`Rd@K3%nb6sL%VW%z;^%_ErB`jo3)lYsMAY^QOVNLTzuI>3T^Em~&wpqA0piBD
z9A}>HgC8H=**<=ANd4a@{vQQL+~p~D@S9Pv0CoDwY!Tx2G)W{$iV~-i%!ucuZH<ZS
zJ4t3DKXsOT=!^Nw>RudL7ThSK=lZ7x?C`tOwezKK&X?KU7Ndmjz5Cff;25sW(C;wv
zZMZ^l;lfn~l7)>rn_yr;RY>9=aLcpOq{B_Tz?2h>-{~6;(khgJzr||{+o@bBE4xYK
zK<P)P;TC#F@{XoeQ&^@c0xzUlzj0q)jfG+YWo9UdIW+C+KY>BYFIbxVGuK9F8||I2
zEybXYP1D(eU(Tq_b5V1{6E%xcLB+;#qgs9G-A-k~pEy8`b6s-`&E0v#2AgL#5GjbB
zddo#&0?>=P{8|^)*3$N5+996Nq(2n8d=j(XqTpS+@{u<#=J~p$0VC+LEDS3H)6JgW
z7Ui!zgC*l=@DrC1U2}uIx@k$9>axa%<a2^~s*oW-Kda+yXerlW-oey@H3h7cU8n<2
zM{;{fsE3n^1CGhp$Jn$-RRnPOi{op`A9T}GXmFLFez{hbzh{W6=BP!FCvjY7>Ffoe
zs2}{3Lu%Tov-#dS8tp`gUwp4_jY`6v{sV7-^nKg!y5B~0xBus^t;>ac+WF>>pGOxh
zQ-o8+6|i^xrdfp|(0yrCbgB6J8=uED((<40?5A`_ZNIh>@VaDAWiIem06Q$J6NIRP
zujSV6Nzl$iupEs2pP-AF30`r3ZM!sA!SMlkkE*l0kqLj<C}!x1qObEj@HQ}Nhcx@s
zmBj1MVaD+~=OvvRcc?iJ`Uo^t&XpBadBR0iI0&WR`0V#B<GmjF(C(lq8}7wz)>hqQ
zbE`uY?oci@GUp$_)1~N*kgdD?(OfOH{=-zK7OkgxRoz&6#B@rh`T^N3%r}6yX5VMQ
zR5!rwtSD%lLB1^Ed8dO-ekL`d{_8J+>AcE?5EM-=v&QBLZ5PAqCT=!9MgL5aLlb{>
zw;KPYx5;*`;|Fnn0De;6GoFSjox|a1k<QX`!Fk~zK5==1q+Cno{%1dKSCuE~&)ack
zmRC!;NyA`~BPCVuo9t<`Do5%4t*VJ!hTPf@(T^{;Qz!K%smP~}x|Y~DtvO%wtP&d7
zxVoe1LBk<Uc|9%M4j#5x2q?^TH*k$~Iw(ngs#=fhp!d;rqabvOE5FHY7Az1f-WXs*
zu?4PPvX7p)<N4NXUSuFK9f6aVfsm!=y-l50F3~{f0kb|R#_bj#8DnXz8wZ}7ex=<m
z@gs0PFdTH>l$M)MQPeaN4u#0)APFCN#5<d}yHe4~WVT09R_Fb+xP6rx2~AIZSx#`L
z>Y7It?}f2$h?t^2Y<10WuPn6XNkC&NdYF5JWZl?G12c$YKg**{V0w>OatJ10$0m0-
zrN2_H_?i_)i;Nto8IHR9><41q77si1U|JBWJrq2-Qyod0jqohviMlMGqi^4J59t6K
z!ZSedD3Zt)Ki;5w@H_G$Le$UCc=;DBebaJ<o0F+)$ejCR^&pp*;$G4Xz>vKpEwKby
z>^ivz)dvy<(}3@{OA+@fDjLZ=B_VDB))H^K7|3^pgL&>CsX=&+>3a$-2SQ<2oTmA#
zze7<3Fn{;S-9vKD<-LTBu9rw9vTfwbvrm5Pv5dmS4rkD;&@8_WV7P8S`xCo5YmIz-
zNi|dSovf&QLyR&qX>0q+Z~ghAE5g!Vc*;eNeZ$`^Ll5@yJZk!c1__t57MY7qXsb9Q
zGXg4?*)`b8s3cI#^%r7oG<7|l=>BoFi~NM0moEM<?e+HQ+L<+Fe45y|DW+wC`Lz3Q
zTdOj*p(<Wi*Nuxe7a8yS6$mq<$7|Bp=cS@(FG1or>;aa_<Fo!MWc{?`b1ozCitUPh
zv<7gsy8DnXi_*H1`Q<Wm2~=&ZiM!4?hrh5HS(d(<9OgQwCC3O0>nu!UX2)YS@H%&$
zfe#_w2lG#xSczCF<L@+L3NyIo$*0j9ROn-qe5!OC2q%UZe_Z^i?nCblYDX?kONm&_
zU>SlS$e_j|uF>#BIjE%vCWaChJ#+N7O75X}+5HHtL#z(53k(DvBt#f7XNR;GMpy`R
z^pmdoW&OHxN8?J`5gk`RmC)x@ZU^P3?XO`u4#;}_=lRTIq^kFCiYskqd9nFB^S$RA
zs5drwank8_zTOGC>=@aI4iixTd5dzXh$oXQ2QB!ol=vp^SEBM`>CDQ5&5goHf~hg?
zS}U^Y7K6gfhD{azkletS5?193l}@CHH1}bVk_B1J&I7A*Lkl<AhWw_O2;cap$xMA!
z@FO;Y71E98(^Prk3zHiUfVzU?7x&CoL?)O!t6So@wC_Q~!h&BNq&>_VW>S??W*k{-
z<OjAM|J_Xka`>yq<AkCI+<_+Q4^ZHkM{T?Z@^C^#6u(bVpEJ~k`*Xz9Ubb7fKR;)d
zAp-s`H2H#%9LZT(E{&ddUA$tm1DaOfJ!UQ$FW$;b`B`IJ-~8x{pG-N!_m7WWtQI&e
z$Ssa972k1L8BM&pu#WX;m4Lz8wKgxW6rw&0PumnY%QFFvG9|rge56@!#n|=rACDi|
z4iyQY3(fRn?aGr4jbAOy@VrYb@Zf#zNbF&MbyTb~jpG45My;2*B@umLSLDse!{2H-
zQXV2WEMK#5!=Ys=IcYuES~SDZ1~DiRmFOEcSUUcqcfO_n8wG(Jh<>VWhE5yQ?qL;(
z&GMHYP@<&+^;n2l?Gjs`$fE*r!5tgO94C(w{1u#zO8gRgNHAJyc{wpBG#YsH53A2#
zexCn@a@EF#<Jss%>m+D0a@%}zHgGvG`*uD^>F)&nBz-Qp_jyL59&KFCxtp4%T1_yX
zBK6oN!gq<VGHX6&ktJgciXv$P^^6}VO9J{JcF6_A2je{%6j9;g;xRqTDFf(rx;&h5
zM4!7|%A!oHvdns%>KCau$rEpDwmTZFYk694hM#Yanc+km;y+wbt@lA_cE5UL;jeAr
zsdH&qbSxZT@{m;)5}QR`G2e&n-PCZAr{%1c)-R~ot!=WuL`N7OI1FaQik^=YJ1cSm
z1zu}W>rf}R^>A|Dw2^tk{{4>29}-x3C+iKSj^TT>;WI=`(-4mf`U2Jy!t70SbWwkz
zY4zqhUurY@r$-H)X{;R?naAJ<2=O)9L|#ApQ0;(E9l=HqF$5XvA>NO4mCh`=q5Pns
zW@-DCx;6$26Vusw723mM=qe@!(J17`8pXSLgBWRynNn^w>tD_e>L+$vOJ1m#DX@1o
z<6qk5zd|Y3(P~?J!g&-C8L+9w2Z-ZQLS}v+*WHFg=*4J-W2?AG;};^bMA-lq4i^%+
zgXpqU2H<-FdlGk#2P;F=jG4-H68WsYJIwqNd>KwdReR;+f}dseC<WG}5-0fGx)X$R
z46TMsJ3_;yBuda?c5&mevWenoav>D#V}QYa7fH9P2xsQ-;zp`8L7RLuk(q#bAzHGr
z^jWwa!u$;dy?=Z$J1FgS?N^kYEk`=hvmMj%<g;Rz<e);mQzbI@W&b?lmi^>(wQxk_
zfOu&wp~6hDK_s6)>zS`@OY-H@I({uCt7OO*1_<ns(oS5=rtFiGFlxtB7XC<vcrEV+
zT^iS>^NfeRulv!Gu237Nw41h8lwIoPz(PQ!J7T(c*X>mJSX2)Ay`eOg=+N%6Qv<(Y
za!N`{nz@hqv-d||Kix42knp(8*tW<2{IW)dNg&9o!*Oi>CBU|NP@kE75MD)?lIg^$
z?!D)B9~dB&U4?kXUM~DBe*maV4_}OYYWrOO96aTd;#r0oPO+wL_hh>`aQOzPi{aI`
zqTbqma`D7@>G-k_NHt70Av%@24~pk!eJ_YW`;P;ACgA_hD|{0sIOVH0@=pXEGJi|~
zfpdG)=eQ$b-FHZ)5~6-l#VN(pZP4zD75Kq%8I+h2&doo4TKesES2TC!UYqWxJIqht
z><|3~b<SjcB<-WW9y=ir*MQ&D->e|2kY8_N+V9GK`Ze4^C7#Ow^A&ZaVBh^Y9H?>U
z#85Jnv&`5$ikCWQCn)nqhUzzOj*zlB5o0gJst96-yCFOu!sC@0A|4rGr=gf{VQ2MS
zB;Rhj15IR655E>^`5~4N75(}8zk5gGl4=2l-UVHu2o^L9#qy-$*6XfWktTnJxk!yf
zBYTOHc>)ph6p}cDN8=WwKMU~MYc(BS7rnvla7C=J<1vjrfw=%ZTdpOUB=|hP(HM@T
zC<jh;8D=dkMBb)%K23j*=u|r>uy?{m2-C(u#B7`HSk1DiC;%k>XZp?vgFZpcLizn|
zeZdSS7SP-E664(`0eLIzuA+I3-%!HNX0KD;WjL)p@ykczW3O&_)P^R?oD@3S`(vvK
zBlaU2%Xo4(dHZ4u#(3ichr|r|dgK1?H>?pS=*|x9Fq6wMgn1aAGG;Y~$$@Qz-V1?<
zaCM5@mCS|Hb`!<Q@|e&lf%H3#V!s64kLxCG7X9lIYqpnzbi`)>0mS}N;x}<f8;<J9
z7?hE$;pA4}O+YHvt-Y_<ogZjtfLwlGeXrL#$<z3I)uPn*99AjgtFj#|?AQ2#`nu?m
z8^I)(*dNduKBTxwZ8@5K0CKP^6<-6)M45mE*b<?7*8{-yWC04m0)hg7hk3-aWY(V)
z6W&bWF6TYu`25$AIp8Y*8MBoHH|}U(V}O{=jtEI2JDZI%o>yxzIU;H#kO+dVx2G5>
zNQyIsKio!<k^sEGCJun^$uNK?O(tBt`}dXXf1#z!+>j0~v<KtCLVS&!JD=E7{V~d*
zX5zKv`z70k;7`N7yS&V+3$bh1o_o^+y*{zoj|#>pYuiD^5A+}U0Du1r^UFVi`OD4E
zi$Sb0+7!PO9|pFx{ieyIl!Qc;pPwrJKGi*Eyy2ni3=)Aayrjax<&*Mkyt@DOFPuDW
z|JLJ#{PzA`6XuB2cb<xz+ZRL!*ODO|GcVX(b>B7bB)rSs`TDEcC#Pu>$G(SNE)%Sj
z1-sxr!9I!eINb`eBH%L2eQ>MPRN*_#C5xZ4k7G~u08rx9VaOy4?tLNCtFhzN`&1?m
z0*{9?G8$e7V{a?dP845!s89=xyHSKeXoyc6^$*sq*5buw)<D@1Zx8#jCvvi(cybme
zp;#qcPkvT3Tb;2F8f&^X{0g^o6&S>Mg8u->i@%0bTIo&>r+NIS|8w41L=nI@v-)}c
zzRub~y!nUyfnVQI6r5^2!6i0Id_;&KoW^cY`;V*qfFC!W<dLxvyaY}|{snc5d`n#u
zaBhgINmgkL_AVgYr0+vu`M}NU#d^ExN;TIjP|G=mj~!cYju9sVdZbbXe*g}w<<CXk
zbDo@rh%UvwH|K)9<HwF)+J2N|-3W^M$GM&X@_Ewldw<4uEYW+d-jHjK9FF$}j@~q7
z`wv<l{NBB|35;2?&O{nxHR`4I-{~=&e-M#ehjtuwm$s*(Oe<*=d{9&hH>%MG&-pZ-
z*-sDRGKgb12*tzG2TTuT(DsH_2jZf)0pptew7Ki4i!z8)`2+@j(2UKRyU$A~jZ}w8
z5&n_^DNHF~KZhs1y=GLE(X;-b(!ZvMO?6{Kg!mN`BJxETT{ABBYKn%Dw=@yz5_SBt
zv<SoaU}AG`r46sRn3Hv?2Et;4@p8AOVa3W2&0RU*Qp=ME;{x^ZcZ8UAW*GP}MJ}$I
z-Lfa9qIxCwMjKb~00#It5n%54S`$Ajyxw22l6mXZMseEVdSXi84X7LOI=(}*5@2Bs
zjBEKBwPS53jfgCWvvc5nkNL1^7^ZpFUGvJWeXs_ULOeVUDXMk3zMF#BV0i%--}9}|
z<tO6R-OHdghk;^`Ul%vyWdpKQ7sp!%R3n%N07ib3YrbVrC1YiB2FMaf!2DbLk0_vL
zp@!R&t$y8+7*BO`8IOK!$NE>&30c3w@txxww5u7510GX{x2+9${Tsk>YWx?%VfpDy
zDxBeBp)KcL8^}IqQ}_ak=Z1av&O?*fQp2=+S43m%Yd-f~!4qs{273<H*a9Pi=f{XG
z_u`!An2_W~$}D0Bq-aW3At6#&c^S+a{K2D?1`xO#^4DMXwMXE}i?j(Tav{OPMg7i5
zVH~Et5r(ot;>h||Uf;Z$&q+at*#sn(2k6w<U5A=s`Zl+lgSsv+`KRM4eIMVh`|6N!
z$&ogAa3og#rEhE*w-6^fvELqk)=j4lrZvB>mS32q@Z<Y71oJ^R#kffl&%yB)%y_kU
zbz;XRjxvz?>r{Momm38pay)`uI>kGz0eO;LrN)z8Lnp4w2d7P-a$W@!`XPy$vr%q-
zN1GiZ)4@Ef%?J&@ZCv}Z6~t!myio65Jxc+;*B?9Iicz8(fY1?fq!zJZ_uA{XGJz=Y
zDZ8&4vkO<X7*LB_+*H_}17T{3tJ{a!jbxB;QUKvW<-ERgP>J1=afIM|6Pf2pA!`Dx
z&{&Fqyfv%_V7T`)*@27p(49Oo<0X&uBY4K80S*E8A_eX3Rh(4GznTpH<qY|6AD*19
zHk^flPV;Y6!TpMA#>mS20xy(ObANs(yNEVZkyr0IT;MHu6}e<!WE|pztBm!`IPmOB
z*tNa-ecRJ3qALH9^3n5?*U#FRa=rHbnr<7Hzxa;Gb{l$jKg;FhYHrsI?~`qm<|kLO
zq=s$87Ryqu5F+Se3OU=-(xG-IfAH0t=(DUJ$89Q;L-Wry2XzXL-A12yTn}BW+|QPd
z;U*uBt$y2EnPM{*nPZo7)*CC}w3;M%36wd?zR6JteH(E1!Ifd!_Z!dWI3AFA5`?`K
zv_ppCSjK9GHcE^~{NMm+uB!P@s`bAa=8(kf=H^}0b~}rJmV&1R=O8<FEDW@}go!+A
z$#)aDYZv{M<%qjq`NX>d`=Z8H7y|do@vDe7I~1Y!a=use@evmN;bLOaq#1ngi?~<<
z>#di6fMd!>e}G=+Cjx<>zJw?Ol&@SHxo>&Q5IC&Zu&wyD?E<<GxSx3|xee6E1a*O8
z7HY@q*Uu;vH#z2xa({q=7>Ik@@%w9omJ1-S7u07BkkzE6U661bQg5H?{`LS9-v-Mw
zhXniUAQ5xf6I8o|%nX5aUTDHe#L;>2xiol|`I`#~_3E@=fqOE62TEHT;DZIJpLLx+
zo4f#l{AH0(e*l((8LiW{V|K+8_>njG)oU-fus&}C7sA`1#D(emA0T#otLS{`jEdt7
z|3ub5a9JM&{{Q(AosJAHb}z`NFEF>VLB26Kx26Yr%mz*do{_x$1FT8@cLe_TBVdqv
zA$K~Y1RV@$vcrlH@0Y%r*|bO{+_-O=49O<=F+QN8&Am~lA*6YITWu>#K&?~!U7f~t
zf5qBd^uv#XJ}Ljf)rFuK&3YH&we<=9h!>wzMV|!vftoVEq)(ZE&DZ+Gsz>2G4&PLr
zE}dY#Q3EFmy1$;?&(<Th#Z(#5#`r;rkzusFP~;Gt&8seI;C|?V8lWwCYD7Vd1i~m*
zZ?I`wg$nhNKsd=y^YBO%?O)Z#Ci;N$ec$iN4PN^{Kt+THSdM`e9p>TbonY%2ewFLs
zHicICL{u`IfSx)h>OPpOSx;<DzY<f{wqxLxJkbm@5;{056yztig&0x+?ZlO)=Cj#d
z3|<^r$!eA@O76I)s}K(Zh<r3alF~RAS#Ztr(!uqCki>?Bv>d-a`7vS@ts2ToC35{{
zq9N^o4J|LQEo>z6%}8Saii5l~gPJIjJIJM<I1{?pt7O&*8UvsCBq5LgJ!O=2!(M4@
zYS3b|Z&hirusZSVX!L(^r#;c0=)v4)9~p4+PTR~Qy92J8{v>_B`#|5@wjbQ6YauIb
z#|M^WkAI&A{kD7Z@h{%U&+`X=`5wvoo*SHrHcLFto8DVu3@~Vnxywo#b>y^QM>FJ$
z#Y7=4cmNt`{)y?FY(VK77DdO9K{yD4-S2&Z&h{_RA^ggItnl{Tgz=>D@9Wv!4s>xI
zW!5M3@3J?~Km7h}?$Z2y@?8S-OfSvkgSpDbR9bIV)$rB%TwaF+IUI3rOR1Ukox1j3
zNUzVZc>2nhatFrInORZ2%wNkzF1P4rnl)}b{Qb_&Py0#P{~+%z!{XT1ZqdSBgS#~D
zO@ah>3&9BlcL?s9&=4TFH0}@}I0V<=(s+O*xLZPSk`RLARMuL1eQU4%?Qfs^<J@zf
z=l+83t~qPYs(Nb9cf8{rLu=zR`}s-<`!%%X8c%28n?yyI^beHKQ-XxUYhmwuxq~GK
z`F0IiHzje-<BF?5mm~5V=H(;r1czASVFnVk9<=wTyRqZNCNkTNfdi{v3ON2l1nlg=
z{0IoDIiqo?uw69pzT=cP-NLJxTv$`iYoFG_pVYV#gR@s<1aD`gWzGr-4sKk6BkAZv
z(Ob#C&2TP_c#(-}t!%^@W)^9BTw?A>?}XMF!<2!snOjzefP@s|dll-q4aceL98^lQ
z#ThBXf(O1v^P!BFQBxG`1}Np(1B-f{T2nkL?F!=0oF2}wKS~JFI@X`WzD$<Sq#tC$
zFV@81s<?hQ^QF{lAf1ao^StLRqI6U_clgKK(cl0Q3~UvBX08YZ>K`v+@4jK$Gy;YF
zxuh86eJ8k;t85H&*r_i<iLoe-_0VM44Y&>go8h=GYKEIlj;&dSN0Or<_@^LSjCIHw
zx6G$}#1gP1S<lf#cb*zB;iS&sG3W8(UA(7aK0jTl;*Xa$$I^=nAFuk{!iXfEgN*bZ
z&vd%R`n8JI(MH0AJ?V?=hJ*|bW@hdp2~b#>Izn2+K$7d@9HTtbM(%n;u8t+L!e?jY
zGiz+f^N2RI(19?a-93Oh>HBAuEHXdVc*n@Y!Lh~Rd);|;DbaGdv)l}v>ePan@)m|h
z&t|Xyn-}riU$Lqf<GE5yEK%-N)hkxSH8Tq;_K!o0s;pRIpXsZXr8JZ=kRJtEy)?`u
z3;b*_P8<nYfdcSEjkJLr3?zfs`ymEh%QV2fAiKisggTrnjmFC^jnqA*?g`%MgQX6!
zmP%HsH)mhLa3X#98NL0pclW5JAoqv6rxIK)O!fsk+L0GNH5oR9TLNsZ6dxmJ6<w?4
z7K3Zd?g=aUUK-d;dhQZt4Ed&-RzZ=}w7x&zxZxEo&ik=^lO}LChB}HyQC^;3`9ctx
zH7ermGegp@PZPl7j?=t^(&g&ZiE+2lZxLTyM@tv_IWHq*k#QS<3L{U?5NUGjQ`St<
z;(!<v>1NNwx~W~hlmR%fmRpo4GeWHl8p=si{76XnA|Yf}|K^>Bn{^r^jT1$bWz??U
z%K6SvujcdJ`@na729QFpGt@57VwB0d9z{usaL`P_v@%2?wKZF5tgB2^4edE%crJ|_
zGyIsQUY)QroN95y*(}hB&Qq}-P0<O1nu7MDDlSbPJ96MpfONs3y}CI{IP+V~fIn&I
zE_+{PeUurq)dQyN5el(!D8A4clF{v*WBg0mtt-W;5!-qCsRRe-&<A!Rpl^cQ52wp^
zWP9Z5mH}E${rsuK$4d5RMI+*gFVmv;jWklQaFQTN0&&e2y#Vc{CXxpT08#N~eI}XH
zx=e7VEl^;|P-nM|Ghk;yK@AeKfEK$Tm|(<f!}q!CxZx&CJ-Z7otHOE2(|ri~z!cvH
zXyyZz&_l*vP8kM*uG73sI~%$}+<fO>&R<K_H4Bd&LY_{Sj+bF$?l@2>$;Vmw_-MX@
zfw@GNOm8YNbsA!k2mO#FN}}R;LoK6GxIFiCuV7sKdX<X|qdK4%<Xp&(>v||{pJkDm
z`0UW6$Zq=tHF`Sdd>1)mWe|{a-BP2D!`8UNIr5F2xh(@mf*5&nR+NJDE%#REZm<Y~
z3*III7!lAokiR5>Z*m#Mq(E6ZXO}KJqyi&u-pvfj7+9O@D{fGW*q8%6e!heHlI&M%
z4z+s<b|SFRk_R3F5gZrtqr;qJHrmP<9xW8T48Js~|6|6&BWt)nkk)p0ci-Vi>sXZ>
z(+a!GRG@)fL(G5V-l5ib#m2_N97go=)wzd97pqfKg_|G793JKDt9m~4Y1glBYMw>R
zzYSt`-1y{T8@`jWhDOX?q6+J1)vOR<j1-;l*c9*_R3yx?Och&7yYOwkaIKqt(I<z)
zF-e^4*>qW5QriSSdb08{&A0lFI<fG=5Rq!lN(Ut=<}iEVd_^pvQOIz)_fm)ldq{xQ
zLP-!Yqim>~#=UdmN6(oi_UIKqzCDUrY12Otn*XAQqL69Ai6X=a+Kc0F1_h|bq)Ctd
z!j1jkiZcExO9`s72)w)J?06_VhWBQZBg6{EDLq1H$fn;WYfEQc(_vyI9<sy5hHrpk
z^0ni$n2Bf_Thb9DotI14G9{|AY+{KPbg*-eB{qnNn)eJw^CgdI&V{GzZI?;Iy*IO*
zC5;WX1|L@58weu9863lja#zh`b6hV;P)zQ<(H5m24O78&!NN@@&rtJuOTdx&ZQ!Lu
z10YvXK0KPw50u+%9?ClC3o9=KeYQ?ia=ky=6=ai(>LD@`^&Kv&INux05nW$~o>snT
zv?L*`X3yZ@ydDWER9de@UYFC4+E_yP?jY*$DjrN9P@nX{I8-*(RgUzhtLIT@Tp0~^
zHF(CG$ALuA)h^xf>azl<0>fphF@WoTtx!?YzR2`|mS@X1voL$ykW9^oja>yU9IvF0
zMAW6E$L45`d~geSzriD}8HEzL^~fugr!R`Hd1_}Hk>?kW%Iv<>M$KIn0+YB;W~<-;
zJmSOwJWz-bs4!&=m@?%T5+s(t-PXTtU~0h)%tiL>+<g8V#^Ud?IJe!kokRIcKLMJK
zXK}Ye&y>N?J|VFwpP(f|+=6B?E2LE8>0VR`&^N8TvtSarl(MY%zHMDdDADn&Dn)AS
zSP8D+vsDs*QKrLt>_a2PO$|-6rrAXs6`FoQmZ^GIZMwT1rk}xF>JKnd;<^(gesZul
z6*XDp)H-``^eTH&D-yAMtLvTvEY+9d^c6t1U{-<y!+0SE0SOoHIr_w_uf`N6IK1^6
z-XHU28gLR<Mthrg`(g=uzg$`1J3DylYL-s#;_+iGjNAK?CGB{8#oa<O=ZfC`N}`{6
zB;<LNAl2csesP+&=y(@>hfKFBJBiC&CJl|@)<Ec4R8(vVs}O#XW1%78(_x(nKuY_2
zFn&YjNZINbW0PZ`$jk~&nS-<GVVX)5#`wGoX<;vgH_JsR8eqHs4CQ1sD~jdIjFD{G
zXZ*QVEb6COLq>Y7P6=O67VZ|gF(Stug#W7b`0lxJ=nYAtGkn(|Kb{;)Y@k1i5{iVZ
zY^2_@zKunuJ}O5F7Aw8zpJ3K$Y<!(dKQbE@gFj?2LOg`H>f<aQBjQKW#VU%ImNeEx
zrycG$BTzhD7=w)P3@B10PNE>{jAU?9(L5%ZLg*AJ#m3sM-XV3Df2UUaa14283(d4K
z<7ie!-f*tvMxbEeGQY{8^K*Og-A!8X<#)3ZnS4&Q)}@Jf&FQI~RQto-rb}7QGN_Dr
zId^u@-e@xKwrm06LJ-fi*8-Dw;B$y4q|DSJ9WGjZq$sU`cfP1-06+`R-z6e-yKdm%
z;F+2cxn>_im6%#Gc`fA=Wp<tQDHTBJk+`}J%iJC5)ptk}V<+eR0jx_4E7fU>MxPU>
zM09nYRpKty17}6Jp@3g_Gogw&%%tVJP02z<b;t6+bQH2kk{SVYac26v-vTxNf-L{&
zs7hj@oH=0h_8O=3<D;b2d3DchN9%f`yOj`AU5iMaHYx>{<<Sj@^o%oiF%vsb>U%P*
z+MyU#+@T!X0_B8!H%Pk(Ub0BohRAtY+or16>N5;XgD}q8Np++BJg0xzQfy?Geb3-^
zKs>ON8{-x!Fv-++C%GLanynF@^)TDY!MSqffoq;fl|tXtPA2)m%)kdtbQ&3mx+u~5
zD45g7Erg*rUG!_<PeFX3jY;Ec4tc8r{P=Bc&8=z5Ddo$rM-$nXY4zx>B3AJL_282&
z>6T{iR;bZZcScy0K8ud0tD{BuVgVzUD@GassHy-FOVZTsQ=!~V3rt!2Y6(IV;;>Kb
zislV+?lf`X!`Y;RojOJAnzU}C2vtpVP`dh9wR_fT#s$)5Kx|lIduL-e?c=DeLzH&C
zc>RMTNttF@TqAxkxtx#pWiD14(ypw%85mh)7%{K@&X;I;m`*dF)7?|R+j2k<g_=PV
zKoh+sv2TcqaM3yBaHdYlrsrvtR0f>6qI4W`NSRcKMfqt-U}*Up4`bX$XZ#PC{kHWS
zNRzpo@rufo;!>(kmU>uFX&RqQUs^Xyv%VK6efjxE@kJbSb0x+Cy~kv4bx`%83#$2{
z!OqR8`Tmd$WJ!4npvkT6{rG^4f5eyTk}x~)l312b*NCqU$B){DvE=~*o6s8j05`kG
z9I2bHe~n<tc!=1c+GRU4Yrc5DUWs!=VhfWrHA0Uqn{#yQU@y^)3dW~!GW8(BpZ9}N
zx1>>|OHjY02_)1gN|TEeQseSUmOl7so`HeM969}(lZOCt#p?2GY6o+`)P0`*V8qr1
z0N;-Ec+OM<6S>(Q@)jdcfVH+0p?r6z4{do+*OGVI_S;K$g>}T^kMCF^X=F1wd3)Kf
zB)t#0i!@c*$3w=Vycvjqi}X3iufN(QT2W+W(IsM68|ks;EaD2kQ~-n@e1E!e)*_Uq
zGk!L73YnnUw+{8IrPhw>(#4@EcW29N1ebTcWLH!aGu4w<>FzHlUOhIR@P4({dzYp2
zYoetgn_#C08mNDErq259GD1%geKrxh_M}^-HFnTzjvOfrdufH-V=1PNDhbz}o!ZqF
zuSvHB;n}9bKutv->UD@U{(0AA`7-axvI%qyD!j1SBx!VD0_#P!mkmi2{VYxU3nKnc
zEDpE!ivg?R{Zf^PWns8dCUYAQ8q%Yn)w_pUC#Cu$h*!6cgpAdjYS;9@vbn)g|6<9;
zRcH5<vh?+UIJbE|-ykcffm8C*$kqAT*4w+e3f@M_$3zbt*&!SZTey$PhF=9ddTtui
zua}B`wE3aA`IAJKU7KP>?ZbQ8_37#$O%K1}-TIq2me>?S_nj!+ff-~ZG@@?}T*yL+
zqBT|py6+B6R$0;{rb+e3*iEK#D=2cv)<X-nX^^1`z{5E$j-@vq)lD#l1Lu<0-=)}q
z{A>~caqPU4C__`%St8yOy+3ZXtm6mdl)339y$xkYR%i`BAyZ!R*=+R|#px${j?lS?
zyn1sgjoHFqe{9IiakIYv=vBb;_?)kwrc{9l9>qn&XOr;4bn0do>gXezRdf&CR40Cf
z2*iB?Fh=D^Q)W2B+$P$`+-FC!|6`+tWO=psQL0*iO6{NbVJNw$>Vxl_;y=@F+U6|^
z>|6$Z8*wKV(cx@-qAD0PS@P(ZF0%k%QtHl=cCi@8FIVdQ8m@ONR0|%(&x<O_V^3B~
zUH}%&s#;p)+rO+{;w-RNO#CGcLLug4_8ZX-Y;7u#><d>`LZd1puqH41A?X-^Cn|1L
ze#yGQo$5w$>2bFZv}&+Ucfn_3AmiB{9$uw1$Jd4lOU_m7r)gK0COZV;jmaDKcRomJ
zWl86(J}(4l%!S<CC)D1&S)rU(n2oJ95yp{VIyiR5uag1LMMbv1jQsGa;QvAv^6y-C
zkp7xWvf8Iwe(V&=7QHX4D`ei3XVVKYZ`7)f*h*z%Aan<B&WmdnpP#__aar(s7bpP~
z`%6&>%cT4IYM=f)U&k-B5>ya+1cIxQKVID8fXM3i34jf3vv+IKL~u<GLb0b=K)GFw
z!w-*?ruwdMgCp}S@A)w|Xs{>T4WRr8puo@okY5m1vv&LR>z^&8Hn>_qna`(kpasB1
z@U<-{JfsR{;rG@wL5a|(Al6F>N(~Wr1YcgflR7c;1##owl#Tws(FsaHQ>#&Hn$08W
zEk<j_xZx|rIyB!BsQ~Naf6phlyutXCbo`4@VD{lBu=CN1pydw~taIUwrjrsk$Nhs;
zy?0;rfds_19*2n7VB=M(Eo<_0Wv#&UP#wEGlCBp3V7$dgV_oufIqpD(PusuHrrgP6
zI<c**cmiEsG`$q^O!1^h+vL!i89kb{cBN#GJanho2_++z$N#|j3MSg}-KrK*RsW>=
z+;GsP%V>&tXjJ!pxV9QIV0|t(%$K9GNEoh(UqgVpCP!E6!W%tU&VEIHYzJ4fQ*ev5
zvBhQ9*>MgRY~)H1cn%(?{dvQuCD8dUIaPkndDPsV-~o=OomYLi`T!~Ug)_JL^X64{
zD|#p{;5Fliy{|5D_qZ|4?9eFt(*upWrq*|wW+Q#&5gQ>{&^3N-%_~g|=o;>|{3qTU
zOC`9nvnD-Mvv#|>EQ^vHHFBF@Ro}){@P<kKv}<n_skSgk;@y`OmnFT<H{?l=xnMT_
zt3eVu`nQiDGIbE86xF)o`pfFwpq?~fs_DB~`Md`G{IUM(s@TF25O?&PX)K6$JVbnr
zSEV?tDYlZ|ud{%~EO%QU_;4x=yC-3}d9*)sbGW#_yDBep_v6b&E*X^Gvoz)TWy?>d
zA|t$!^zQ&$wUb%Bz{0?9h@G_6Z${ZxZga%-+#iyc>g)*UHtWT;hcTri>l#fhl&GaS
zOZ(zfk4E>Wbh_?D9k?78m_c`nB8;MNic)z)<s*p;_z^ly(x4Kg)nGo}k+?ih9$P3D
z(=5yEHd+mKX~wr1E?Hj}^9XW{)wmsNe4_v!&@}!#hTd$GJs-7Jni`G+FSe0?198%u
z!FNeYnc`ET4|E1eLKV@TO@>pz3Z(_tHkvD){mwqkxh)xuRCE=qW`_v+!<WPq*F<H7
zl*C!2u|IP*SUJcdMY*p#dup`L930xU<qV~D+qc~@zH}4U9>36ufNxn>yHyisu*4zG
zUK;es?f~4wC;0{j7M^9hx72}4!HtdS_|rG9#LVkuMoGC(lx>yx5*iVo7?X%$ce!t=
zp1j=`B2O27xk-)1m~LHftUP_`=v9l0!f^-8j@rxCtC8n~GE%U}t|Mi2_p96f1T@>b
zUuYU+S-3GJHua_qN(|<VJz4Kiz~!KASaNC6vs1#~$o5FYF*~WbXJbyTlQI-#|FK?8
zkiSjE8Ev*9v|}sK(To?u3BVmp()S=R1^WJKchmXi;$G*yG?gsT8oeX6PVN?7V+65B
zT_+zh5)iL=7HwS)fC6dQ-+nmb&#85^#&7NpYeihrDds+h=o}M`@osR#DaKHQ-lHL`
zC`2L1CTu;66LAqm4y?s}f%9Y(c8a+Rwr0Xl&oAri;sX-|Q0tZ&-4&U1i0}}=@SE@M
z)ys847oV-ErZ@DW9ft|)n)B$HB+fS0;SSoLc9YacN9f*(U}_?#Ri9iK&K5av^V+l$
zFTc#dd%r9G;++$#^tkPEQZI>bo~OKg9L)hq%Sr)8OW%aEF2z@9{Ls<_`#CeTFI|=7
z!H^2ULhMK9*gOjhLg>cHC{khRwcxwPvF~;*Z_cVVy4ySKE#cM<XoI86=uem47caDb
z(Ctxrv4>l8h73#uZkP;}maUpDP0`@^-fhupe>3_ZSu*V#M_Rlz^00gTItiztnqp5y
zK>^+beQ!Y1^CzzUWollFVcJSKSj7nzPp^!SG~g!@M8n+jxzSac{KzoT@1Qw$9GQrY
zo`J4n_IAS5Idhtr<CV7nN3s=%u;v&uzwB9WCns$-z?#3Y+r<4a$yCY7bizCqGFQW6
zZD^_zR0Ih_q*wH^!JVcE5mA}4Fr>%95$&H9Ans2f<Si|6K_f?yC2lC!^TazhG=SFn
z;<Fi{G(Q949%A~4`?<-=UQ39>!S@sI8sg>{Nb=4mKT!gSo7P4SjG_n*v7q5yT%=EV
zMAMLy-Bk2!uBrr#%rt4)+_Mpe9`O?zlp}VOqTlH=DE~nsax2K><hx(|CqAAXLP63y
zl^l%k1E5<)>u3zu#pWkUQgYA7SBX=~RCzw}*?u^61>LASYARhdP$<)?^b9`4rg$eb
zsyjeBjO?7nBz`!)^Yc|rSB5Pi^sG!?icDv|M~)Rl?jb#=-kV1!7x|oZ!os26HqpXX
z>8iix6Id5(p2Cn~*{EU<KS;{Qcy1m+5>h;sOc6)PWH67!4LzFNleFN6O_q4(grj1^
zqifg4@1vzYu%Qyg3T2S>=fXxajZic`O38@;!WVrs(MnI8@T(&9mzw3xlAy#g{7j0U
z1)mENF`KWOhng(F?m2t0R~<pxB4I3sddXuZ1<D&I#pbY5A4UGFwq8mGilSb!Z6wI#
zy1XTd3o_E~<ulDy*$ON}9|X&40f)JuG?_~$drNrdr&~jG6Jm<@YL~2dJ=TY2+zBgZ
z!njAhg8=j=&`)Q3(e$+b!CD~pE800cfh20mQEvDUAwiDFi18h1S||5n&blF?mq0~P
zfgXjXBn(NK;2%UMw3rwFt(_%FZH;w{E)g0Zcj&!kWv#@CWSEA6IR3Uz0j6hJfYGf7
z=%GjXPJ-trAPRco;qKFciNT!w4QX_50=3{t4bT+t{)>|CJvPudFIR46?K~MY*PAT-
z<a#**8t2(*erdVh{^hPG_<y!9supt12^wD<vIRAEb~A=ByGaW3SPoj55xOs+GXGzy
z){&$s_w*YyRr0v8)Y~rSqF^I0YJV(yHXK{!XrgU<C&`tMzDA|j^v5_Wz|cg~dW!P!
zL*Z~vh+%RoL5EAAb(kf&Xb&63E{y59Zev^Kp+y!4+Y2V;_wU-xVZQ956cChQRG9x=
zB=JY?YTSv6y~WR6Gm4}*+}mU%ppSNkJdjXf6xK*{<N}Lq*@CFjy4GLD`1R;x_)$Q%
z%R40fnIEf{hKJTFsT4&d<~{uT#i5Fd3c%w6>=&BNcX(Q|>2n#lla8q8dF2S(CXrC@
z>|-9-Bd`1uWcN3P$lq&?Zi97hBvXsKrofD2{ms({4maJWV?S2@K<h$(<uy@;uT|VP
zvrSY_J|=Fm>e}zvkB{E!g)bK(-~Cu&dT0)-ugG5wT8gKX7JT)-(}tzbn1ao~`8eN;
zUk3Az^fzC05k!`TAeI|bykU#K%{Fn7lWYZ2EJ4gyu58Dpj=&Oo>oBNdP%2!c2`!O4
zVH}h8aB=~PT%V8uC>LOunE5SfwGgYL^`YPwk}u4ln%x^U9J8NI$%Mr2)Vw5?M+nOz
z(Z5-dre0eFlMDN5-XYGLj)jydOGQ;gly;ia!NtKPiXT4X)^cISdUU5ZZWo(VT`V3)
zZM96V;;;&nbGZC~hw0Efm~d(#qR$U{5CfShLLR$%S=`q58skpozNtjpOi7a;{djxh
zNZRU(zWq+tsJ3$|_}UC_#jf_MZf6<`6U8l{wTl6j!3jUIqLeN*JeIROTTy4?8mel(
zz*Unx**_T}VF{tOHgrQF90Wu~#2q&;^JXYE30Ss0jg87175rzU4pwc=nk*ORRXpAD
z?QxH+h(>m{Lwm@+_?((1u9_u@gzv`L<R&gpCQ;{t9135ObnIBsMn!WJ1>C~uuIU|s
zJRm*J8!)WiYYFGIHDj?z2ud8Y@?cgmv_>s{<VfuQx;}rkDm#M#tg*na-U@SVP<q0w
zpk_TLOKT~|0{1UxHcoF%9J+9JzY~5IR3bLgn}Xt~{r=hrJ<fsWP1omho>3E$5R+4)
zTxUb)MK3+ISIR+i#4T_*89<N;K<6}0A5cj)dBGoMy&2peaUs%{eXYna?lZ=mF&_9}
zgdTHJw{EQ29yzY{)TWZ6v)qMe`yHfRj@yNf^!9x^QnWFbxa*TK{;&-zX(nvxLEy=n
zU;cnT6<sdRs5n*b&iUdv*#b*aqMScdBiWEWY}Fzz$=W-~ifvqbeH*#@L){jlIxDz=
zA!U?Mj<j7>vpQD02CGf|WGdjyXhi6ES&2?s6v~bc`5_hEc@<@Clxezu_K3S?pD9{w
zf}x*A!4_-#u9PEiX_3j~;b!t27N8N@6!+`^k;l}02Jtsm*cp<QCqy1SGN>F<p|?vC
zrj&fTO~{V&_T&GYx**8!;tEFS^ZoduaYHQu1hjxOo^48y9b@`B_+v>i)aTtx{OOAE
z9g0E@+*n}%3kdIJ7T*%730KtDzR-TMe;(~~Z2RRhXR`5*`$hJ{$?4?xE;VV*pDhje
ztXe&Zqln(ik-~*Rsa}}kIut4}{P5<9%|qRp<fiQUCo20*A6H_+l_y$<K9%_77<)Y{
zC&%QPiyoN&ZzxR2FpAej2sO^+kP+a=EKybCKdTvo-dk_Lpw<lMCs3dwO>^5_vZmp=
zXAn2aY<RlswBr6`{H?qU^LG9?7voidys$UOjiYj@wSFn)yI4lrJ|qt(a_k=G#yMm=
zG{JPT!U!wCu6yjL)tHRL@2}7Q@U!!fZd_f+1={PBoP@7~s_W)N(q!8SW|!|?W0QWX
z$5azg>@ye86#ts+4%y{{SfwrYP_@T}Piz{gPzWq5)}u>W4A`m}>f|^-8W@x`&)o8W
z34$(0i)IV+s%ctxp(>miTWgf|>0@yw5e7rPsx?=>u`jrlJ@jEzOmoPU9RjPt0g=wV
z3g|TcEHG+>pj{wQqkF_cB4$KxxzS_8$dt>Ir4f=0zYAvN6PpNSCG(0sARJ;2-PT0a
zG;;i?+0g1>%9fFQry`#T%_h#bW`3YjDx*SWL@~jQ+a9HMW~()N0d0#sC$>$@&uZQY
z$?ZO_&%R0l-f!fwKgh=Twp(iNaBK1242_9J@G)8rZPMg)`b;6P_-rkymUhot&|_th
zO1%nMo3!34_gE*-U<KxBygRc;c?jbo__}t2ay|H)!Lo?TH6G0zfg79mnwaqcrchMo
z{N?jR-$(<QoSW$m$^uj~l(-Jloe?xdBF7yUN1qVG;&V(_Nb`3|t(|p(jJPjI6eohX
z&TR{4?I{M4F?gI~J5{!}3+RsssQCR!S00-bbHX(2*8QAzqxZ%irBN29d&=VnmA#62
za($`Q?7DI`BtXSCiNS#P=EP`?Qh0?#2XZD$%u|9l5Cy4Z_75A4B`H)m3(*&=?==7v
z#nGsg;Y#jIPDv1R;m{q%P!{e@&7C;}i%I55JtB->v;gx(|5q8R>M^Itfh9v>;55d0
zhSmC#C8>JEj`4fy(DL;FiiX@t=*L;ev3NQk)hPPST7V9j^{yhadff(C7unHF0>?zV
zcLHrDGaQKrX}9dLNwQRGb{xc+CaDI}`;XkE*%B3#N)ghO<RRFj2`u29RwMQY%lYFu
zEK{`*!Jw{Q*)kRmGauI=fYQ^YopD$rIa+MYMPbQ)2ANT38s;EA@QN#eJUft-S%6q9
z^P|GQ)3SIaPYI-EiBeiTiig(qlc-T~j<xewQ^KJ%2M+X%=UKpkdHe=76cOJl&TWJ5
z)+%~V9s5FLSPV8bmIkzd>>v`P=T%Px9SCTr`xgbdwG}ar<q*Bv%5~!}*c|)NH@n5H
z>r)a@e$kHpSxe9Cbh}&sHdyB7*{hmgQhMM@o)>ZVcJ2GljZ?RozN;?vzXD;gg}wSf
zD8I}$VL+(Zb7?#xrbO8?cA@efgidV8M|=#Fc#wqt7jYa%#oEvw;!>_ee0)sA7ZHfH
zXXsOVq<8;T8R);x_#dHO570T0jwZae#?m3xCG2$-F@Z#8WRI?Z0JX=1Y-4np2!xnM
z%ZnyQt*|yTHtx2fqvDP(>)bC*9}-;lLLy&%oY;ia9-DHgcuH2xJ$H9#nHYl<SLGgB
zxym%b1-`}YDwjk$d9o*Edy-AcYoTfK1HGb??#6ymLn<;3EUb$=J8JUXS&!^|sIp(Y
z`DUzbdLbCla$Q${;2B_=T<svsZm}4-%bJ<Us44Hxp&z%yCTiF<%_L-F8?AtXTLk-}
za<DhYTV0fkyJQn(K+Geb=N_9V&A{Hs)8J>Z_q7KnNt&#NrzwTi8*ZCalq;)fewNxb
z6Gw=-q`cyST~*xiO2vlfED?W_X^`A+@#>KqLc|HL-wmLliG?BU1EAC}$d3PmasB(B
zx~Jz~=s#q{u@wAMRRY>zm9JyHR+|i}hYYG0Lnx-?dOY+#6;OJU;0#JqU3@dU<%JO(
z1iC8y1iI@%P|^zswpt31y17aJ3B(kjT+uB}gN`Q$-Pa}n{rtDpgr7h#$j00J2;2@g
ze+j<2;`<4ZOJjVKXaSk}YYV~O+X1P%!#DJ|w;+Rb@Ga8+?b9GZ?%TZSh|+rabrMIc
z8OrZQ8HpMX742m%yo>bgpI?{)FW;a0-%F{>xQ-m?Q{NxegtxhgM#W?4IUQ*#i)w>8
zDsi)tp``8{jeJTt3uvY%f7zU>4ZHnPiRqbeH&&?~#@WARgr$p+e?3T5gg76B$Y>qr
zeIy;FJ*X?>eU7H6JPDZN><!+3a)_>vmOs`TZLSsjl8}YY)MAB;lOu(}(xVuZ?%IAl
zQT6TBEvsD%rPv2i{B?X`rm*GxKqzvt2R_nWBtvnvQZ@Q)k}k_byGvpv7ClSLUOgP5
zX1_?0Ui@Oa96&!|P`_STHs}O1%Yr+wc$9Oo{yIAQY|N_)IRZ&hWjh=wTfJA0B{tly
z!G_L_zHmR=uSP~i=+YwAV_VT^d@**({Vj^G#)qmV6_$t@z0|`=2#UB(rVJ$j{muPh
zxk@len(D8QA4&1-M%E7RHd=AG>M&fj(6w{F+e^8BXDzN5S^yiTKt2RtV*kqie^z~c
zTl(WEngd_ME$Od!k`7g{>$S&iOK|B+;YvZPcsgh^d5gZh%N0k|oly%2yaSPl=+f*>
z7|Sw9=63TXL+G)>i1&ulM(%V9jG7>6?J~-rhu+PT6BbECb#udx&=$6?S;ukQ%yuV9
zCQX79owu`Nb-u<SPPgXa(5`O8HIMg@W+1gVEvcI5QzgoFlHz^5UjMk=Uz$$%X*oKJ
zK+?N)bWWsaQv=`9TW}ny#%uO$A44nZ!~Ai%JqM!eMv_7c3aRTKxuJ1skW|%|=2Vgh
zL#kh+E2f@`JomgkkT3E?MnLRhp+}|<-(rB3vv%etR%Z8Bb(P}uphn|x_P#CO(cV|F
zub&ohxr_jbz*X=amf5Kt`CDCnrMoU$cG<h)2<)#n3uhs?Zf?G$OQF(tosZcJ!#pXL
z1sm-w>q!!ocGqpP1DvNO&Jx{wF<^Mn|4K>!vxG?`qq-U`r9JLAm(kD#hcwGv*(i!g
zPgl8uAGr(#Kw50y6O}m|8eyStpsUkp@qFd!7F1WSpP=x8;~S5XO>xWU!L&+4p!|gg
z7LoJ_ccqv)AcKII?}=31R9*k34V^^y0c53va?fRZ@)~#1efZ0sR(cBXhNB$C`mc#B
z`ZLE9l>A*0I?3_~k8G5K4X%+!+Y9SR7fV$mL7AkNMC$vx{)0;5kDe0)RY1PDz)yfN
zS*~d5q4O)dxHOi`nC0<`vI8yXV{>0Y^d8`577lIumljNF+3Ku|lx%1_glMaE%i{+)
zTjs;LFe5i+2ri*#y#2R^UsQFgTbV<a9gqk=d>y$+OUD*ZsW!-6VNhhEN_7u&hAjC`
zVr7%Y1iWonM6_se3VgHulDcjLN%Sc6XFLj}pYEg@6t7w@Yw|1)G|$L64=f)tJdY0}
z4EW0o41b>i)A2QPv)M}W-xac}{?ykN1NF6~{zYH=7a{-GN&i#p|6XVMkJgl-Yl{3V
zZ+!(+Hz7=cxf6`ec?KGS!5I{Uh({jI&g*DSf8L)z#*^f-Iw>Kgtz11;q2kO1ZG?+(
z!=*_!mCP~m`<ZD3CjACQMQ2^~+u>^RE!tfpJ_@3uGA)kfT=r?87H9`^QH@p3e<%bI
zLSil@`J0*Yf3d}o2QQ|6Q(j8@oAQ!=Q^l*OCoZ`UVB%WgxKU|o@=+c$(3fR)Xqg!R
z)E<R(Zm3;v0C}V2%%j4PhWK+QnWm2m24~f!?5GvGW>9w)jB9YqQRS6iks=3e-_naw
z*!BpjGgGLH0JAa2Dik|ZNe_XZ{k>G(NGAw>`5LPT)~I?U4{v8et|)mOG+;j8tB7A5
ziUqKonx+E!ff+qXa<!{c93#ta_yD$=9W}u68r>dwAmD3CpC@XiKm%Hd!L2Re@=;_N
z8sDa^xMMT9!@$$TDX{y5%jd8rJMC_+s)XqWvH8?#R+C<9?RYW5QGZmLcn3CbF9-eX
zBH@SX!sL#n-e<PqT9N;}@c-izn#FC$EfAam)*^z1bLwevv|$bEB+2xR9b!e2x?(wL
zTCt)0q|dCHr1kn>0J?K+*xf5(L#s!tC=o0TyBM}somMo0Z6+c720z{+gKsNlbE~uL
z32T8W>$^1`WRyJpbkBYQ$y|&s#b|81n)b*wMH_cJS`7<=S?F}rw(wX#J@AB#w&LG$
z+3r~`HMbk`C6cD1KZ!NG$vl|K&^8?GZ$57wr8E$}2oCY+@M&QQv9)C&4DO?S6?t8v
zq_wl8ki=}wQ~RT)ICh=gL*^Wr;pq}NfD0x-1=WeTIcq9HkT(?(m^^)7A#^-1G29r|
z;aHaTKum9z7tT&u`Y3h<v!Jq;YEN39bnz)e2x?&adfnBy3h-g(i=#9BI9b8V(ZS~A
z#5R^lQz$vNGHQ<9FS~_%|44-Y8NL6vCU0L|_rB22?K`SG%|EIA?E52tV)iO{EBzNt
zX86W1o8r+bO<h+Uqu+aZ4=mlXeq>w2V#?1~bH;6xDwiR+NC1({hRJ;_>lFFwUCsh+
zNnO2IrEpqNO^;!|^VXFJCK$KM#>9QOv=FE?jm@*qt~zH)=UiT{ofrUEdIdVm+<l83
z<JZGk2@?SQT5Fc+Q_3P3DBb$U<Z{Y-(6XO0O};IUAd#cQEyg7rqn4-sywkxOkT@)!
zEKO?GAK(;!cCXzfWha3dKE`O%i$u}R)xi3}PIFv^vH+O??^E++y__rYT?^TDE0-zm
zn(4PhI|>L&$;Z~YMF1I(mm}95W~08O%ppk6)mXZ7t2pWkb7B!TPBR88jP<!j#KQ9e
z%TerdU*E-2N}M<GZ`}mrTY(ca(53UwmFKU~?QdVAM2)*z@n-sx&ZNWF1=Jj@Dg3v+
zIptlcLrWgwugmn~zii*b_njc8ek?Z1WncWo<ti7NAh;V7S54oTHmznmdgy37(ipSj
z+}l!;Qy%*Ik{SCo8csuKf%(~eVlFA`E3gO(CE+sZV9gIKP69D9XyaqOFpeFhGJh)!
zy9Ee}pJJ?}LMubK54C3lgtk-bAm1-|-TjvknQLe8?{!Bu4j<!_s;{4!r{eGwXLpu|
z5YRndsfP|!(zNHrg)Sxh<0LN{o^JhC3^n1{##3Ws6iz;^8iEX6eBg6%E-hw?uB|%0
z??GV6uW0{Gqf_bx<W^?{3a?82s@|&MIbg0!ei$$IKH3tCb;g#V;$=J)ag~%$8*UW=
z!)cF1@-e|RzSJ(=#6`ldaxIQ!LnGxE_Fa&m{m>cZ*$E;{x$EZYmL1(oX@Sr-fkb7t
z`ln!dSI93xxUSRRDzGdaeDpsg^Bne>sCc)5oP%jro8_|y`!YiNatxVs9;kS8_D6wi
ztMuP#K>4=pWBOlJW8U3Mi9dlUuI_8pR*=Ww_4nWD|4;sGQ}k(iC0E9|CcGb)?26|D
z5(AfrdN!G&CQ%7C#9B|$vH<(<mxb48>f4F}YrH62q<Tlu!4l5cwjEYRXIXA3D<Fc3
z>lqvUs*R(yxd!wQkswa}_EpXijwkfnr{u$ZuY2R>|Dk+5=Q!5JF@d#jQBN&`RW^Q5
zw?HR!TriYhH5A|f(_mm*z_+09QHm!j3KEOHkLoWgyIu_L!S&vxp_7U}5!&7IdAa%W
zV2`C?`mEZua#qf>f6mdjbYO%n@ATEM6V0*K+vij6q0dfwkBuo>?|Z+>@z)6&;i<ZM
z_9pK|OX`QXAQm>Pw$?$}hbrZsN?yk`9~$<n#v`xw8s(THx8v0U^;45z1~!?+1f6l)
zoCkm+$!n|gRFm;ewtC66!L=tQr;k+?N31m`qYar2rjTHlBT2fY3Zj=w(ZHvJnzV12
zM^+3~Wi-x^_@`KUY_y_!k_B{scQ*SKwf~#&GQCR1!5xVI382$M*%m!~#XYzqg<xuU
z2rOg59zsP>ZizhYvHFHB&s~=@EZ@OB#nC<@7avly)W<}1u=VFj5daJ`xV}*w4XLk)
znEZ}2r5{a=(9QDFfWXaLrBf;ZzSytaSa;uvhg0qi4XL5Nf_)|x6Rj1-h3(x%Blo_I
z7*A;m$BipC^V!Mo{w_PYmMU8W->P8)rD+DKcN}>i9;8uYt)mprSj>0{GB&JGWX6!5
zZTIbDM%Nylku(T8LtqcdQIKIm-OW6~oog3I8n;X^g2QaHW8s@CaE}%V2Eev+R}(*h
zXJCSAlO4ESXu3TQUTc&39t}t}JO97l2J%9uC3ir1P0S9ctZ{?7w@I_ntb4}hg~IsW
z{$&Gzlob53zYM_wS1Uu9v_>55q7A8xDBCFTOsz7zQ&9GhAgSFF8JS%k2LA+}Qy<?d
z|MDmM|Mh3QB}ebZC=1zxGJf3nGf_~i`*%OJx2RwK9=f*Hn^gu&mEY#eJXQlur^17c
z_~zdIPHyk6Ui<VhZhw59{m=cxzh4FaI0QK?t0{%s3cg9=Ey6id!0?06h~dUj;i0P@
zrO|X+AzMXEOA+Nwlf_R!N(cmOen{PN<~QV@jU5GVOW8^7q%ZehJ?X!F<_w}VUxKgo
z=q7{5_}W0Ho<MLC++AP|us;3yISAPYg8<ED**DKy!>3c%&ljdHZ7%q47hi*9vh3ii
z8+x!{Na>GmfA8YOxA!luuR&7k8i*5puaL<338a~U3OEeEbulj0TqU))yLJoese?d|
z*1_I&{Z;-Y#&2C%{PS=VejDab0P#m31c#LbmzN-ot$P{-oOFL5=-#c&Z+&D0I~xQ~
zO?2Pff>2X*(Qo6FIwSZ$Iny+r<LaXkva?|h)0e{fLjiUUB2#bFVv9~$-{{D<wqC2$
z>RG;*VVhbb?cU}hzX@Qwjmv{c7=fFNGhDDjyVgMJi}nnqoX$yFe&sTCWfEUjFDOrx
zVxfo*d>S@;d{h!sDJwadZCu_`rL%lmM`=q<sx?<tGCA`|+rf~F2WL?-+_8{(*p`O7
zin68cnRL%kfcqyy{aSIkht)Np%u##}FMd3lDuvffvihp}ero%H1CG6t@)kY#JhXO$
zHxD!ryb2CnZA*}roFGK?ci%W~butz@e$#5TyE1gJ=Y#GkO$-A?QveYF7r-#b06^pA
zxBrA5f<eTe{*{k`TF(omD=^?J#0CvrD6<k)!FyF34(=X2G|?4HtH(-B?^}5hK8{)-
z)$yzo#Oqkp<GQW(*%U(E^JE_cwAxQS6=k_)=s08_Qoc<(N0eAnqO13@UPcI6g97rJ
zSXQUeqSzJ;u&VEAP-Ond&@dV`w&O=$YKXn$c8PVuk<ANb+@#*laB9PCUHxEQ$_yG;
z_Lrg!9Z7A<ALTUBUzKbs%(B{>Li<Ff=U+$%`|mkpzQCOqpq=Q^6Klhs2MWD6heHe?
zIJ*oej^hOwOEj_6Kx(WK8}WL%dka8n3uMugRu6PNa1&wGkD^i}DstkbIkM<Sp(d54
zc+Ke{`4mRVcp8ZLe1bTNQoJvQ6IGASAxL@2<H~9iT5yDzM1jIw90JzgmDq<l6D}Ub
z4$zLmJGoWkHIIy89&Y}<sG8^?;`JANmgfCr$Gzfe+Yd(<E*cA|P|Hlgi$#+T3nFB3
zus|1jx)bF)M1i9ES<<`az;4`W>s3&cXM(FLFkA4qQYVpY?YXosOH5L5HpgIoS<L?K
zMY!9N`_8aE)k3^bb{gg7_X3RJO%oGl?QhoTm>mnYwz6o=m#p$JEGoHuk#nL^QAl!5
zK=jzaVy6JpgbjB!4Pj$(@k?3N{x>JgMDRmMh^5XhWB6DZB{ot+@#n?xopDW*MQUrf
zC=MaS5-z_)A;4KtHeO@tRF{e^L_%nQLZEVrU(XOb=5nFYn%Pn`^f|LIQh|c(Z2_aT
z!!yfuP9a<OG-;gfla#eym$~F6_6UkixWdwX<;RBBafNZ#alR^;dLVB^0tXL<3`N5J
zUZk75DpC;ZPmV=0Uhd9RU=+ETo)}G2-*7);>{3<;T83(l^kEh9ez}-wq@}(GN0o&d
zHv*VJj1dp%T+|08ZM^Lpe6O1eqkWa`&2w1%=+2ONn!LW>q(`jMcqhzH0*W-OB~AX<
zY%Rx|YXM`HqTKq?s_9Tnf|g^>W}$SgbCSu!Zhka5LL`s>DYf!Pc@v0P7RE_|?9^Y2
z!F$l9sBRDb`2uHGm6uR8T^+{|6|5JA45Bn2j6PQGaofA_OZDLexRFd<smFV@S)!p0
zim?;?V$yk-%gY2@gxoKkhWg#bi~x5Sj>A@>&bYl6IjS=>nZcE7+|UQJ-f20B%6Qu*
zQ$+za5!7YfG~~e>a2v+o!LH^0u8`QzUCPa5vvgHmmlrf=L!p%{O{}(A8AIN5jy&G5
zU^IFfO8f|}LQ2sWf|WFMGbCPsO#s%qlXcx|Yxg@s>l(An^oDXc-EA(bDItpT8#t)F
z<FrGKx}y%L&?iVvQ)jF*>?%Zkkk%V_8+IGcxRq@_^Uv^}{J07&c#D>CZN=QKKm*Es
z#t@=AiQ7#m#~3q2Udmi#GNSlqMQe=Z0YWvUwz=<j?NJ{9*m|;TDQ1&yJ;(a)4LJov
z0v)U{A*UVxf_N45IWK*SSo1`z^)tyANpIhxW&K-d6aPMz<?NSoS6me?C7xOHgwAL0
z*|)=dju#9Q%pan8y-(Jzcil)ZJ1Po@D>oEw4E~a$;9R@V%IfH?P3|+l1r;7W=MJk)
zi?0Y}7!Ih6+b~4AF2#574fanLJi0v_`|N{kpv9ygzp*N^Hb&p+O*z2qVoe|D=~k$f
z&mwczQ}Xy2-)`k*=X1<wYCFGiu`Fnrk6bGy4TnL>)^1`Ym$_So$AG8O-Hz@~(R|;F
zRC1%4`B+8SG~HEmMwI%>1MWu=dMr8g?W8S)k4XOPE%Pg_(4t6*mu5P#zkN{MyXKw&
zD={^q2q2c<wcS$*9NEe4)3sIGsZCl@=T)$Fkd_%5c^z8(s%KN~?7EI{RCp`Yy@dhh
zsn&7TpLr4NU+NiLy7<t!I2K*AxFz|F!)*sC$QiAfA4S3qUzqnHIA6bCCl~DAV4O9T
zIFX(uBuP<D_nnYRO31c{sN@_%fcs}{q9rRg2fwBPmuxAOcr!6r<si^NX)}+0oSDAE
z_|QYIr)Pv~7ER^P<FbVmXD)G*28tY^&`t|O!-v?fnV+w{4aI~|{W@l2{HnXN<(r7q
zUQX}@C@mRIGxNvHJfo`S5&CG)Z|;ul+<P@}Uc`(B#;;+rW%8lUt48Holy+XSe@@P?
zpXPp*>EjC9nV>_!?xK0cjmxn`edVV0R{LIu7uYUKDkW}zk6-fH_i7MDHt7C5E%n9e
z3)227xbI1{DZL5k1>Kp`5=R48I~T>@%GOand+VN*Cu!bFfw8+Mz8<WhL=X`NzC`l*
zn5K=MQqPS&%*sQTqSryuj^p%t^Rnz_FVN70i;JzM<-=HMNgRRcbF+{mb3-QO62I(8
z%@-V@1|Ettn4(iOdnGoJ{bN`x4~t@4I88sdH+-7avwGLR$s8S%dk<2?M(=O9Vz}n}
zs=MIosmr1_vCv0mk5IO3ORS(CRVU3|nKs?}C?bm5adg3W!Kym4N;_zJykDlGhg>N7
zOu@xRoKgu%Z)U~_X<`Y>QJu)Ws3>;|>~;8_h$aRkhc3s>!%qa5{ugA1jIZn2bCB#&
z{5P@(`<l_n{lc&^zhYv%^+OTdVj2$-OBvdpO|Tf%(VHvER7}wu72U?8hpvDaiZp__
zC_vY+@^r(5i|Mo(dcMF#xjEpc)DBFPnUb(aVtU;gLM*b`s28?_K6k01-XBl>zCCXj
z#v(Ll?ablO7>c?0y_Z^fNFcPE<139<0cLl@k@%K}RTH$HJ1`-`t+E?Hmee|bEi$z3
z<{1s7EUpM}TQ#zzTM^g7^H<ntYOmN5o&XLFZKC7)!Gh>gTpnW=2B%~A17~8IfHSXw
z`LM0x;XLPBAmo?Gn#z<hJRl3mPzrj%=p3?_2*F5BUTPDSEX`{KouI#G1kZNg%7al6
zEB%+_pFk2j_+`|K8!?cyqY6lEf}8P&pzSj;2+sXKJ`%n9&ASFAmflEi?r~(-5f(~;
zb2oH~ygdeN;Qim$d(7C=noUFLgkuj$P;pXN9JI3G0XG)!y@L)J))U=4Lq!;_;x}Qm
z(nKTJ4}c`SzSkD5C=oiT7J0D*4DmACn#f4Btq`<WvXPGk4RocY;{#v!RlXKr_?Ndl
z+i2X{MGTAM2YC3A0Ehiz9#8<{+dGLbfsZd4@lU?sC@6-ryYKV3j4=;W(;QeaE((jx
zwHSs4+L-x-WOPRhxOa+xHSn1d58b-4`U!Nc{U9nJkU5#V_UC)wo&WA9pixlG@-4Wp
zyE^^zzLmxyXdG(x;rPoJ#jmzbtkXH`cCP|AVO+g-c(2`w(TK&wE|w=%EIspz^X}uG
zup@g!2ZYShiUmBCC`0mjK7=mSUjk4oVbI<W)C5TQq%ndA&Vo(t0c>&@xW8q`U;s3}
zd;+hBD@pO)$f}VGHFlO~VewMfK-w?<;=hT?@Ku~^He29*YGB1xamEojk}x;C^Lboh
z3arP?0}~;E=dA{J&CXh6ad|Y&vWEB=1P@yNFzqn50Dh?P8nVIkde?LOtv2K4%vVTQ
z=vd(5h;4k?_o!^A^cs9hxWFx*zr`Q_3G8Wjc-~~?2)Iek@W(5&6j2OVC&4xOL?u)p
ze;&@i^Wq$Q(rT|q*qX9-R#onvJXY_BY+r(BEP~?afO3a4F|G)JH&0QNmjC;K{b}@5
zpzu@oxnRD0N>r$!zpeK?W~(f-9C2SSVa>z@Rnjg$-+2qf?V)n8)UE1IU|jScBNCK#
zRB<7LBtO(A>*2OKWN_Bh4C#xF9g2%UEJwR1vj6L-5H_<9MoGWCV_<)PlL(D2M5aMX
zSp+yeN`XXWunH55D1QPh!MilCZ-cK>LA*1a%B#hf*m&6h>#?pb=N#8-G-6)aZ~zW*
zQD*TxOG;Mamik+Zq6g*zH#wydG%MS2hi~TZz-jY$dHJ_P&fWf-;fxGc^>KjVZ^PV3
z>r_Vm6Y7Tt$sw@}kmRsMsLGK2zmC68%wf|c%A(OT$K*_94X&X*97sHnCQ2#Ji~l(I
z_sfWH@W*AEx$*(yW=Zh5M!o~$LH~NeneVJd;r8{ShRc$lZ!PN*%cd>l7Su7=0q}ri
z&=P(Rl-n}9eDRMNN`4UQh<V@M8tyzJVjW9xSJ?n@D&$rHU^9!3jBxXd+}+-y@K9K3
zV{59mo(tv=s!QNDS#mgZG?Y3QcFY<054kk{uVy&L`@+!Wk}cT=_Jpys3*foySnd|X
z>y@|O_daV4ae_8aw)tEhZw`;eKDXFe?F#s-4Spy$nM=`AE)zLhVdo0$CZ5^9a#;xM
zza?)uIa6kKU<nMD5%6K5Hs=%?@*s2;^9g;Xi6PBJ^N`oC%ha2s=$US6{+r5<&ox~w
zcID4|hf(MZMzxc*w4Fa*>Lsha%5wRl;zdgke#q!{Ff&qzs!E%@6J?clFTvww2bxL_
zx{m{}D173%mzUAM;b=Sb$&LpWdsT#c%9q;AI$+^bn@rD1I)axj76&LfY}jwc^GO=g
z*#~vrPceBZ<ZG}cY2ft$aTO_PRY_vUarPEN?-yh0FQM1J)wfpS4kcX<2-JE_db^nS
z;>%Bf>Jjbp!}5>88mBKe%&(pV(9d4mw;D+P@gpx8L33&0jnq&~`2WSDEKZlJ;u?|h
z0K-@RY~aC;GU=^BV7zK#yj(1zf2PVoHay{1YzfV08o_#G8{AlzY32|^?Iz7PQt~9t
zXYpxMPIz%s%xGrJVdU#LUFGjw%m)k^Z<&WKxtRD6ACV@zBfe&58yl;6LJpmM$*+Sh
zjUe95*1Muc0b+yfkJ!9y6{v{?!hnU_kq@YG+#ZcGhL0iV<aQH2hm4uJ^!zc}NF$Kf
z>*@WVf@idM%p9@o`3Q+H+0sDruJC|gn+3z!nz_{*X6cV+L?gtpRnpXpB{glVg^&++
zHl6Nws4iPoiZxh4!hG`1v3D9J_RCEnyf-6@Fp?$pxrv$3s{(^9{0RmorE{JVTg-tl
z8>S7wVD7?FDtDw0u+iAKaW5o$Qs}(Z94`?gf_(%x8m;PxA{wn~0Q&d^UZ+2um&Vcg
zn01P-Z0#4DO%$0#w=G+5+UR~6zNPOM`&KZSl~zW5##z!Fqg1vkvSKd~4JiYLLntaj
zgPZ3jLR*Hc`nQGTUwL=O!skB-K7YOUJDI-YMgsSDGX27{t}0OZBJ_V)i~f!maxAa)
z+sh(`{V6dkCg*9t74Wn)ZwllIN|OdRSKqLJAR1WnaY}M<h2MMA<ob#4<`N`sMZTPR
zZ6Nj6-wnUvVBgCiz;3wnks&1?!NL<JcBRjEWE{LM4(jB)fS|WQcN>@igMsVGDahe!
zvb^0HzC{7whC?9L>wU~sI{kM7DNvOYM8yBM+ud*E8spx_(01Mfo@%5I0%j4`xu{9}
zUKWX?9+=;lV330UM2kLr|AmaJedB{b=$gPm5#$!-`u>M^pL8p)+1nm3d36o5IH}VJ
zM%QZddvtRqH~6fsefZ(>X!c&9x-EU<{Ah#1kn%0EuFxC?8U->AN3ZGkib};-RHl=S
z#x^rIdWT*=Dyylc(^Z?q<^4a7s7g3bFMe|@YIrZ9<-<{wVauihtf$zR6BKePPk82{
zHUgT+f~b_1B>3Cwp2IrF!yjPCvaxW0R%M-F68txZ4(p>>erYwprwYi*Zi(B4EU~=}
z$bSMn{>SrT&~*tu77rBRZ_xtt+oe{`ZZI{$z_!x=w)T`HA|70pAIGS-Mz7ki!;28M
zKDtq;R@}k@m)natmulxuXhYIWiKASbhmuOVVPm}K#1YEYT<!mhxwnprV^6z<t8sS-
zZr!*`kU*dzIKd?lAh-pGV1a~2gG1vEfshb1NN@}85JG~x1-D>9&aIsHoqNxmnKN_e
zyWd^w{>5s#tA4ertE--8@BQp;_=H8<>-x<-kwe9Sda#d=_j#w0{)mKVmncLxx!;zU
z2$>vrUUBuks&f6qQapw$IM}v*mhtwWN;-oGDljtuARoM2(CXJFxEFmA4FAhiNAyf}
z7()!o-Qo~^hMl%0%*)7M(BPeO>S#gqs@fo*v$dK!9$bw6KAhSwC<4JvuKh5lRTxU#
ztmo+E5m*wmUrJx1AP8%Ba!*!4)qCJ^z%e?&;4~?{+4BV?Ye9Bp4F}9xDGwNpd3TH1
z4}!&Hz>7L#u$G|FxF$>lyEJy-${ED9r9^Ts7}!7<S`%_M?{VwzBz-8QaSP8w-D}*u
zz5sIy{By4Z;h6t#tSegf_))~;WeN_ZOC)Vy@e9<X=nv;pZ7M*{zp9o?QZ+!8f%VUy
zX`OokziQ>fs$+#ynaYjB;o|9jSF>0}<bf4_3!53w!-N$%!Tz<%Siv$fSM<fum`OHQ
zAe66J8Re3*)d41$D`=p;#X>071I4ABu4Ulk4YHd~bB2)tEiYbFJmzkFobE0Bp4b4x
z@^~#=9ts#V4wW&Pk;dd9im8fF9PCe(xcz&TEmIt71y_WGI!WI<c2lev%4J#t&QsB&
zHG6qjFXt;pnPSMga6j0HEQKRTlZX=;Nx4G8)9-OfEtFO9<BXa5gu>vONbdE;q42#J
zL!NZA2h^3*uX4|0WelM>`{H<z0JY4=eodCoP0VK&?3DDhGE{xu;9NH`Mrv`E1PQvv
zDl^7o$?vxb$52-!;nx3Jr?%{qd~`aH&R`{;nrGVsd4WV|ynlLcMUuffRQK+?Oh)#D
z%$VrMq&0Mz1dDurd0s54v=#_<W0Q-p`RP>uCaAS0BZRj4v5<=FWh_1WTD`%9m6CbS
zH}?mC;Lf8-o)iIAwCV;qrLy!v$7;hmbX&#FIZ~Pw93m7f(^CXW*JQ>I(^i3m-j~{9
zgHE^}m6jUmN!1;w5muV@;ylz@Md-5<drwu3rg@2(G9;rsj|-jN2u1ssTz#E_TH9TB
z*4Mi8BTzY2=Y0uhm}9NyX<n|c>eIwcRYQ{(<icazwV*U~tDI17*LIqFPTwlrHXl5z
zcd3TTZP6%FCcWcImu-lz8%8E+g<30st`1EwjT)wpF$JC1YbCFVeT_@I5sOTj$?LNh
zbxv%Iboc*M4*3TkRp_<csWja8*()@(HhUAu9U+NC_qPNiv7(t7k{?E245dr$V+gD#
z-G1HsUiLF*gg{{3<LXgee%-e3qp;HD))t~U4kVf=0THIf6ETx9w3t<I3B)D&MBDu6
z-7Q^bfyOU-7d1Isg*%pGnQk%PGAg=v7LV`UD0Wb&vGTm(&##H};!jeL+$l>m7P^-d
zCLF;WU&Kwjv~Qle30@#y&yKg~C^Bki9e&mlzvnHfOO?+*ahea%AI<EjJv20t+QR!*
zMgt|vn`4UA-k6q4b8wX%7^m%n%IYbz$QQ>9aH&cx4(hdL{-~Yg(DncP*l=;Zcu@^>
zxXj|#ZfU}{@QN8*H=!)ypu;kgL3<u-BGMY?+^g0o1orvBw&?TPKug~u+dUz8>8=9q
zv234WX*l_)OD1!xcC#+03jg$d$>vrg2BF8CcUdSMb8^=deM_Ghnkc=YVsuD~WvpB)
zpCVCaW}}Uev82guTuzkCd;6LqRncal)rswRyY)p+eufEM`RPej0B>Q8gh|fN4fgO*
zbI(-n(p|b_b5CLcJt{3|X{3UCNVHi|x{SPN*^f)-k5@IPteRSCJ1?Y7ZuhVPmRVDA
z<lNS$Th;cOovciuG}5cz_j%S20Xn6@SG$wm=g)WAIya<kn%Z_M-lgmBn6!B+$Qi&f
zY;Zsa%wuON9Ufwwt7Y_7Z7gfxbeLV<v_d2MTho~}yZlR2i3(}Kj*Aa(%By<9BNEil
z<{5q-mawy<GzoJ8XeW%Q(j1<<H6U^KY1YXf)Fk@d7Y_KA`2wsQ-gQlKT6BMq@~A3W
ztXY=)pg2NAMKi=5E|eV8l$&(sVB%%c;`i)}sg~c}@}_`K*TUDTGZ-bj?_qnaW06ek
zMatMMxPsN>IxXs`v0lhn0(eBX43{rBA(b7GrOTa~d-~n9Mhk!KsJBC~n+r0gv;ps>
ziz?<~&`FW3WFv*@BmNz_H}a@UVPoZFy(-7L7I*y~>c?5m-j{?!+3+U>ipHc*&M0)Z
z#;c3-Hx>n5bW6wUY`<-G+2|gTAJL9=iuWW$7IK-0KM{0(eD!&reXG1~V&-ro^?t<+
zp9|K>DW+l0UHuql`o|S17QBPaW(V>9;{g<|z)H7%$W1mi$FWvaq|<wGzv0Dn*j_nu
z=00J;r|~SZlF9KxTdDyLu_C|s?#J^b<y8wN58sa6mGH8zN_NUOcOUqW9F5JAu$<H<
zvRqa5APi@iI6Aa_y?J#4);xY%cEw}MMN%_M_0Hl7rifEfPuERbpfJUqCJowoA?yvd
zyuIq)t|;1D604C}Z+gv8ttQ;x_VLf<cV0)jLZAQu;#d|tI`2|F+0w$~UgX+2vcl?+
zb^fI`8VTmKj=j#yS<XXdccd#l^)xOnyxpOAu(T@Lt`(Q0a`DVTtJQU2Zw40wpi%l7
zw4}bPLZXqKO7bC%fhXHFQYOTVoKl~$#J>xOQu@kd4|_DTPp_80VM(L%?d+)dy4Oc(
zK|K5t!Gg?W69dX9UX_AA3<rx<>?ia#FIo+nb<uH>7i%5-`-;`Is*D)KFhZzp-d2^C
zaYs-~S~H8{vwl5E8mJOrXl13lQnhtn*K~i4z%>1@=I^gWqv%GXrvc$_ggv}7Ov>{H
z&b7F^g=)ktn%CUZr@E|`suCI`l->x|k8zW6hATjEN=}sHNi^<ac(3gyZfGk*VW>6W
z2uJ<leA0(Y0fi6b>vReaZO@I1ED>&K5AG{`3Z7)7sF|mpRMw-|dSy@$($`g8<A%ow
z%L1@@LUEcR#QO8_|J*wKHzMT_%K2c`hG1`MwvIt$_o$9)#HYstPW6P$)@d2{Zn#*L
zuh2$~k?+V$n^2=DdxrChJ3Pr)`(0iWU4N*?&;j=ZpMefmyU`3fKI*>mcEYqG<2If+
zHdK0ZM(0bVVc>}=sr?)LN#fUzcoeh((Svoa1M8X;{sK4<Zg?KLDalrBQ_6}U3KgMb
zsQ#2Hp0#oSQU;RVs)u$2CtE&xnR|b!DrWGG0H+d!{rF*mQc<By4>Tf5$Vv0%!+kUW
zlaPEGHcGal`Yh(HjPPqYZDBkLc?EsTdeY;PVxf}{BKQE2Pn%kX?W++vU7rGFsw7wi
zw*xzI*7X2|((yI#CJupHJbGsLjFlUA<-<hZ1ejfAykS(0Lp*_$CX2$HD^Ar?!T=Wf
zj!A$<3(~B%KGKl3UQYonm(SiKa0){wCqyt_$vhs1f}ZzF#p^4Xc=(%oEiMJB5TAv1
zXsgI3cUi3*Z6o^z;?6C}yr?g|`=#vtTW5u#1CDA2zW|!bx_$r4*<rvixXVju5QfW0
zi08uPZOTFUKJoefL#t==ZM4ZK2x!d_PhkfYY~C@?h2B@*My+`EtfZQ8=DXJb)RmGX
zm>F^Jk2vE$Rg;1WBI&%_cME^x4u1pq9{fJ~u=kVYV*axFd9}zN_wjp22*C-GVYGfu
z>n`-E7t~9Gy~v;W``>X7Oz4U<h5^Vf&i5p6ICWcT54J(P-#>~~nk&K?rj4Y76O?^)
zE9F#AY!Uf#Tc;48^}gxT?9W}dw!^|7e3$3JC(U3XKJ)$OyvxS*ol80f!;<U8AdoSU
zURJe(-kRirXja?p!-5^pw#-A*wZFa12og6ud2yFs!6%^e(b|AiozZ0*`mM}qM%(ZO
z-!WV8(*7&w9p+ghfd}z0qj$z}x(*$s_tS{CIVAOL--*s8+@KxZ_1d^5xgk_A;L}70
zivV2!2y6#j0hCpQ1kS2Brtc%rZ0Q@})e%_w!!#l5rl3O6K>DC7_ZkVuOb!4EWHYc8
zCJ8u}2k7;{j`lS8_F5S{S~7?}{=JRq1%n0P_+~>urE4hx;BogVg2k7FqGb_0&2;YH
zjdW^}plB`uq1qkHn+velNZ?c^>U^mn`Tfxx{F33}h{DS}kXop=x2t^$=ic9In2$A_
zLI}D7OQ3?7vj_r5LGWl|{u_Bn#g|!d7WNLYaYZ`noA(K#3fnu#31@8uMYk+)s{fyV
zoqr*^(?7W}UE#o|m3sH`^P;@XB*(js!<u}3VjDxWK*?nLz-UKpx(UL&o#o@N4U&X-
zr74Epm^;yk?_|i!VR+H&ZzhY(Lx=@bB+EMP;;E!i4Oj<KRbEuBDNVYwQyg=@d??XT
z>Q`1)$Rm-aivFl!u&?Z+rL32kS+FqlDC4G|go!Pql2N&iyP+XxdVyI>wb+;WL14Qp
zWh@nfZM<3Q{>_}eyAf7&e6LW|P}v7H>~x$ktZ_!lnCV9ms+OD~@dN|^4E{iaO45Ta
z24JgbAoc1}GsHm;t5kY2pq=o93}ORru(@_vo5}sw>(zO*GEc*&4gItqjsc|>FLU|k
z!M>a=^x2vz-=HNuE!I#1nHIMbS(9$<ogoFMiynj2t6pIU@nLLMmk@XKPW>w(6;nUK
zx(w5otBh8%<;q-@UaNNP=tYte){a{F`ueeQN&E>9Q{|D~0`n&nhE^obqv<VCYbS8>
zjl+~|*Ky&#W2*FAeC`m1{T-+<r;+2sapneg2<*8P5oTRz&Bn9%?vpMVorbo}EUl&J
zReJ-Az8+jgmzD%LREp>ew*GM%8F2;4fGD>rPERcA@>l=x*l&H@4dUF>K;7Gm=e<g1
z-;kHq#0945vBZ%i&57;DW4!LVc&O217*?&gAABT3PRR0y7;O?1kMa7nhRic5IaQJ+
z$ylBX<Y6avh~N}3>#(B=`Hn{@quNWEy=YHjl_LDvHh(jQ4m|mIcoP#v5p*9>(4*r)
z#=a(?9g@sQe0+2q)NV$?jw<ZKrK$;!Rd-9=98QRQt<UVe)>RA;Cp-e&+VjAm`n#cZ
zVM)jwYC}qoxMdq?9j)8Qy^Q}JQXSl>?zeYyVM!EPkZ`1EkYIb|DtL!BJcRM!4&|j0
zar~`W4B}oSXd&?z$zj_84+)<(JOgb&Zre)Qg#If$Y<qFpdM#!<*rMi9y!rvHw!#5+
zS7do<pYL)z?ETWA+t?V|_V$usydHuvI9}$v%s$~$z&4j5eQn>ApZ6x6rgoF2_H;H!
zDB6}8!2(iL)UoBL9OwpCMDAFUL0H@P0Etp1hc^?s4EGQmAW()K0<;Mr9Tuc(BM^o@
zfuc(sPa~mB2X`t9dcL&!IuG-A(UeZGW?g*%F9&%h8bTs);{Eq_Z%!q$-(@2IgkTb~
zX)|XEnh}zWh`A1t>+8eYlomjvD=vjIegJ~tG-pu<m!P`)H;`XE%K)T4gN3xz5vaNQ
z4Y>UR$DHA7+gy;o`t|ON9dIRoetp#oD)~UUml|NZ{rJRg>?Z%lX)k|7RM{gsSDs#(
zdtm^3`#H`+GIjF$?)UBylZ37LAF9J?UrW?Oe0P*(?=P-3)_wP2III!Qy*vO(lK{{+
zYVGL{>1u)8lMOJ$`w}{OJKhm6`V}nbLGTZG=awQ2<Z$knwH@p(UPmdO*$CbG4<5vU
zcVUJZ1C7g{ZHH8#4vq=Txq1NNS2^Dn&(B<L<qNKaz<*1D;pD&KNcOndu5ZB6Fz^mb
zEWK=J54|;-4OpCRyQGfW9kRW?1T)WXm85Gv<er=cED3=JBo97NUKa+8I=Eb2iT(yK
zf4)hN2B9Fqt5xupj(L_sdi%2C8YAF3JfLH2ylwMi-OWuVc(8W2Lp=eb>Axby*MhH9
zu|dh?qgzzzTe)Weq|e@&1vxk-#+{C|mBup@UXT`@G8eAb*OxR3eyNVSCT*L$o3>0-
zRmPB!VComCbWnN#ZP5_qj;0mNp;Cu@0tZIXh*YZL2UOxUl5680Og!GM<<S)SH{M1)
zM;HaP%cZUlabfn)KB?ZZ7-XJ;2h)3Yw?nK<8_4j6nFaxXW?6%9xZq<~RZ6(=Qh0O;
z7nd_~Mv*-ND{&M1n2V$cFF|?$L>}&D4w8E&T`q&p)Ss}R_}+J`oQdTkndQQjp*hOt
zF~!~hmh-g{N1ZvX1x>UwDz_V@(%Olu<!CY!cVxFmU6u<v9Ju9bjFjylW^RJnzrrQZ
zE0=ke+_7eiH6~xbdS4XJ8A!b)F{({#lq;i^vKS;unCInL)u9bk>1XX%ZfAlFi0SLp
zKmwL|(iGeJqu%b#u1#lW-VWySNju)+r_DCqR3sp<njgGq?p>EVK1lak{|v=u8Trgg
zoI7;940rX)-fqWRL)hCtVRBOWZj?68;<FadVRMo=$RD`D0nbxnnWxf+6=7ns*`a^`
z$T5SP{-%!qW3>|0kp8ZrEU#W&i5R>$s22wlDkcVOzB$TGB{-r^oo%ugWSm~-x_rgn
zrMN*6EjmOnuKN+-yJi`G#m=a#g0~kj*WBLH;hVCpgHJ?+$=$nO+2dN+P9q(0@R*8v
zM#9}Zy3cl=tG!(k*u5kV*GujSL4GW7w2jZBTm154>%#9>#Oz;+BOec+wr0C*nuta6
z4~P;e^?#Sr)R0zrAWm`gBzhI!gB0)xN}yMKF!Vyv@>_i8Ey*yYRa9Ca8{1l9;up4a
z|17th`aG<SBdI7sVYO$024+d5P~ZiXreMxAnp>|55c#Ex8b4YUtQ$C4R|HvX1`|fQ
z({U-hSkfb4Ick6*sEDan=##dOVl<;mup)%}HwW&GBj`XYN-yvyDy;?HNdyCa;rYwF
zV9UO_Eq%42aVrYPyk?n^zP?fX4e$q{RuJI__tONv$}Iv_#Ocx(^8mwPsvTHyoif~<
zu>Fqu-;(Sx+`a_4&{nHoLm{BKr3v_AbRyt<DEAkCaG_cgaQQRt_7be0VtzNn{Qvm~
z@OhwJ_q<-ae|S8S(D#5SPfQGz?SPS%@VUjkpB8`bd=a(x^e1tVvdy6yT@u0fQ5tmR
z{C*#0Lm`m~Oh4ZC1fp~{_dJZ+l8W-UHLCcuP5j1(%bLYOq=0~+k~*`_M}wfIPO?Y9
zdg0O6FEVFo+(CTP<!mS`Iur+7yF;PUUfxVbaoHb4s^SZiFwO9ZS5eX8Xya=lNLLI|
z8IL=STZ++SPE;fAR1B!lu6p;uX`EI)vp>@l@;p)X6!h&o$~S&{kv_veYZ5zw1=rri
zOhbk8qqivb5ZR}eS#32~svWD8b;;nd>M(Kw$FI|EBn&gnV8!doKp|U9fxY&$rQM92
zA|94SL&BV+CnM)Chvqbbq2jqB32(r9aCI75E2pQ>z^};R>P8tLIHydC(eYY9z4YCX
zQv=?10Tock7n_4k`67GWB?T75mzAD;AlIdo7bct1IVgc)wC>a<(oXmwQsXZ9p^kgl
zOedb8P#En}Y>3qf{D1m{p&+Q%83RP^7Gs(|h&o|1c}!BlR^O`IL4E+5nDNE|r2*%&
zzX7tsknd8|zX5R|OXb^g{{`a4{l(6IjnLiFXh8ov%Rb*UX3@(<-)55_hXl!brIE2<
zX`%*2_n@RWRux{*PWwt1B_TJCO%=#4`{4-|I_6<c0XGv{?x@RrszQCXRy2>*cMQz^
zTRUEYb>j`k>}f{8(e%R0FY3IdE~(wxAdm}|ce_nfsMd$2pqF81h2u&yDA7WRDj+HJ
zzEyOtS*4zf+Qhi_+oD5Da|ik2kkY=CKIH=uGXJ4=RFfKq1I`&(z4dYSxVu$+YOTF!
zk-oG*x~w9lmpIn=byp6YKeOXraK6&Xeq-DaHe0S3@j;aVIoPloetpALV<qmtf2o9G
z>f>iTAxICly!az)qz?y3o~6ri<C!Uyw31-yPH7!At&>6CmDt@m7acb-?E4VG7{<S1
zuNB|L>y1iMk;<4j0;kG+=BHXTR}zoKa(G)DJM854AwMi4$9GD=V09X=GX9ZmR`jt7
zuG03p%5s_}y7%EiO*jSDxRq`WONz3!Q<3HIQliZm{wU-PGK!IV4O;sRp#G^I?CqQo
z)v%U0jF6|af1<&jlAep|_;iYpx+Hn=BT7m;8p5vA$paR#kr!bZFO7#2Q+a7_0a$Up
z*x;)POrG(Ghcx{I+fMeYlc9R7j8oO+lgyUXCvm+$67$1uU{5NTp%Ve2XmfG%wR3X9
z9CjU~sXd|ZixbS=#(mF@!vQytcu$K0$K)f=si27p(<dnoK_Zb6?X|IrA>uQJ-^A$!
zn4?Kgczqb}<U9Ed#Te0RaW#a8h$%Xfw9_>$E1ioOm)!3mWtId8#t~A!7xUI$<1_P!
zVH;#4iJ-o?s#VHv)1;mD^IhiFMds|g)Jf&Z3SUm#RNwhYEKXcRA7?9UO(<UpXB=y{
znd&)sS8nP*Pf0neoSjcr4Es9yoYgS8x-FfQ)_sS{&^&&PZzQw<@T)E~RM#o=D%6q?
zw@Wf>u=+UN)T6aiP#b&8axcjkijyJsX}h4rJ+s-UcIz&COG@$25}gUF@$qqkJ^#2G
zikLth0h$Lx0;I|#t5hKa6`^b_zQ*_*#S7zt?}z*CxuoPvG%u2#eVj;oJn8WLbfBVA
zGs(W_<O!epiwdse28ZgnyFd1dt8$$qas5AE2JkLstPUO5O09lznYkX$<+y356BK;v
z67faZ)MyLW!^F`0%)f4OwJj&~c=>c@#%Q&TCwtMw-p~Hf|0CbyZR)$3%4@sPN^<hm
z0#ceO^HD*{oI|Z%yRNe6vm-QAU%J#3bM_ZbTe=z=Y|5P9OR4(S9?Tl3hl*U1mtVRZ
zET(2;w)_-nIM{OVcKqp_NZ#zc&Um79oITubQCvGR%$Y1LfG?&W@z5$6SVL96>(J28
zHJG}hEZbkF#d7CGP4H8VOz%1ELK#^;rA3>|1MA&ccYVKi5@IE$YXh@2gbUHGMNRz2
zLDM9c(YRK=;R~AboJ8fjYYBtzuC&)Dy$;?uw$kwM?0+2g%06&W%>J-&7AIF$nixR7
z&}brM#FNoh{JMP5X3GU5$I_fCH@taVr5Vv(-zQ2%1<c*yq(NY+%n}r{iGOQseAPYJ
z7}w%#BCa#t@_25LXzL@EW^JqyhvQ<?OXu2!ndc0u*P=BI)n5uCcZp%HJ+U;!*(diD
z7Gh}mNIq;gGktnUI3k4o<$YwyJ&|>%r?pP7H<Kl;E#A`dgUi|}6iHmB>1+k_th13X
zBWIpX{djyls`+n(J*;ucHIZ8tDg3-N;{KJN%*fMq6T<h4i}xeTw_h8EuONi&Anta+
z+zT~;iWz~I0f;i_z%kSS-Pi%jw+_k1s*IiDHf&UAp?FGgCA1J6N`w*&2lxml9wjk;
z9jVnqL!~pe6vluAKs(0#yN1+e0<b{6%m(cGBI*4UM{uvoiEwQ2xBeGd@nk>`k|@*$
z$9P$Wkwg&&S&a4hy;mZ-dCPOF|Kmiuq2BrQs$o?9xh4p8Ac6$N=_mdY!usPFTdsGB
zp@CTJ_6inl%qOd4;_!YdNE)pbaZWl0LXcGJ@LB^FA(B(U&#X^k6c#Tqh{?F#Nw2=U
zcAAI1_N_+Q5ayRj;ZtR4DU9|SifPW1+_$t!MFuf(xt5HC8a`VJeo1z}9(9Pu6jh97
z^40C(66oVKSZZg-Unj!#<;@4e#@W<@09^mh&kbO-hko{N0M<rkL&C<0GPMlvC2Jiw
zEq?JM8a*tkPkLwxsw7<rkhed}gZ9U3&hVk{6)brgY-IWM(rQ(ZpS0a#1>o2>@AEFh
zT%<aO7*TGmTUYMT$T&^6x3`aAV1SsR`GlloSE5LkDsPAC>{?zA*~vgOVbT$(wI%<^
zKv?rqRqb6GLX)W9r4CD3t4^#Vg+)OOh73{zOz5HGuTYM^fC@F{U&cIOfer(EqO<?`
zk6*=IBG{Yd&T3p^Mg8vTb4#MebsGRu=gfS!ykPC7EL?GU^NXbqZ~JB7^PleEE@O^F
z5=qA(%u%p3L=d@6NrLs08dO~VNfEmEOA!h(&%Xih=)byefu=73kAJ7QO~Ak@uz}?5
zTPXTR<nu2yo4-)eLXUUd?i~tq3GD3&B3AyMpRA!=IbO92zCCs*ZD&egJ31+Sepv+E
z_A{K!Y=TYpU4UU4dg}+u3Klm&Aqx!bFmtc2CxBN<+Wa>4jHej-&?C%9k+1d_IFp~_
z13K<IZG-wn@T@v$*h_DMnVEbi(CN-g=<iM;!MDUaE|0Fk4wqE1CieuKmqJOsd{zDG
z7%Zg!%c|qsLd9j=Eo<E0wk5PBT#NhV83NAqm$jIlFkGwAj|Yr`S)HaE^dk)Y4A&Ua
zYYc~RM$f^j`~~5Ex}~_kv||X7)#~Sg++o=d*I2??Yd_o*O|o(?V`OplDBrD<wLN%@
z1+A4KQz5>SM@y)4k=PH)PIJ^`tZM$PAD6@L*vIdW_y0|W9T}v5rxAaoz#D%)v)6@N
ztDh?URoZqr0gA$aj@L~ojF6@r>+*A?CI<O!aM>H~vvWK;vzek)(k7RwZB5}f7zDf3
zREy`IlaCYE^6*WBWWVybSk^Z*+4FohJx5VAE6mX*N=1LG_b3{hE(LBuIgn5T$+#tH
zv^IRr|H<crDkLp<gXElZ!#YLsUUd%*?YiooHPjQ(HM#R7#h&R(uE5ISHh#Phsm%Hv
z3x&n<nDb5XtwDGn!zR)s0-)QEb709rXMy0VN`z1{Q7C7B^;r!yZ(kw}1czte|C6$3
za=vD_-I10=P-vEsNNH3P>t`g;Kkg~yw_!BL9(FuYJW45%<c#(PSx1wfgwm&k$FKL*
zL@5un?D+%C$vJB2;y$|(DNc!p^1ak;D*?OrK06A-Zssp+{`Lm!#7IG}Ew$9^D{x-n
zCD>_2fLAf=;O&bg5c~$=?k>=9E71}JUJe5m-+-5`9eC-3re3)|(g))KM_?j>)fCvX
zH8Y%VNnd0D(p8QiyhM2QBllVj{9%Zgo*ZD_{M5K*1r5ReqZO_H)r!*r|M7x%EMu57
zkwx-PP>KM;JX##!#h)`W{}wSd`}5?#hH$-aTlerdZkhrln_lLYw@ibs9HGCI4;WZS
zEQvFjQ&jJwMvj39s`SFe^*z0IwvB@?w43BvY}8R11lxQ5pC`jR^*#-2cgc4+3uLG-
z;w69i(#TdfS?XM%Y>|$mlzD8x+s#P4fx+0Lu80R2#mpF6qix&^?z2!{@sfY!RQ`tf
zo<u?A2#R0<(LAU&|InCRK!z&}8_wm%Cf)or<K=N;cIdT<8CwJNeRL4dFj&oD{x+m-
z-r_-n|K=6d>H*&qLHJHLaQ`lsGGLX#svp3kgv1iGlz?ESe!{fd1XYJ<-%8i8^x^*F
zuND0z$YUaJ)|DyEX%VG{t}o5uxFT<vy>w&N3`XcuT`+0FH4TK4pBONTeHUEh0qhD&
zBk9yZj5K!Xm~b6V@W=U&3hpwhb`WTY+QZ*dGCvDD1BF!hdm!>iGlL+k5&Z}-*tt9f
zq{bE|fETY@ih!#JexUH`fBRz~1`z|O;uZE|(&`Xf{9A^8`1#+Ya{qv&{#CRx3PRxE
zbnu0URb7&}?TlfvI~XvCg?uAUqqk-j42jccWUdBqNw>dw6@If{iS8hOgSRb$(QYy=
zNda@hOhg9u^`Y4se;I4cOe5<e&!Qr7#M9+)%n>w%k9ui+4TBSZoJEsin_=esTvPH&
z`>`-uH9J}g!1avk(&*|PfR!;{8jIxe-|rA?wh^bImZ8lftsE%9V_2bij*Q2){>GiR
zxS>Jf%l)3!M4`tqzHAf?p-w1<mIKMd%A4fgl#uL>8A?<r-Yp(7_foW`T6d3@*)NbZ
zTSCFQ)+ii=%B2bj!DQVZ;O8@M@L%0-p?@+)QFrTwGLmFJ@7?2{e)AqSDeb0}9J|P|
zPT)F?rA2^+39GQo0H*%<9kWBqaXE0j60q<Qu70%iU?@At=hn>M<KgAw<QXzZO;8k1
zFeF?^P-q_%!Gx3RqQQ%b^H6SpzvGsDvwOolZL){l<ElUIEEK1kN=#=6P%Xu=^>MMK
zp8M~{)NdeoyWd>|YAUcAOrx3w6Nd*ncc5dh9q1X>`cA`Iv1N&N0ep%a7+@h&XL((E
zco`|#&FEqvBDqKT?2$mY<$wUer#e7nQ08lXi|XaNjaSOz2regH2hx~Bp$pFcD1pt>
zBnn#6h$bNq=%>njW3I1n_%Q3jr7YnaW&tK5fZ>lw$toO$&vKN|RxhcsHmEp2(w*;6
zJ1K1!>B+ickg*&dT}eFKjzFJ5>1{T~khgH(VGbYyhn5O1BA1~-_9+JE@Pm{X_0ub^
z{x(PGGnw%vX4c+yQ2}EoV0vutZr_IDS2jZG(n2JfnQ%xKX?$k18MYyYR;qhR7)X$~
zTuFCjywny&KX_-Kp6?iLWygyP74GLORoQV0iY%Tr)YI)h0i;ZXOur(BN(E@YTw2J6
z<8m}b&<hh|7(@yit61@3foX1YkkYeOCL1|Jau4?&L)6~7zJ)w)txJg{UzXbw;UH`L
zhNLw>r)K<G-mwxrS>|R8nf`e`ow-iIH?2EeGbwjnErH}HyA#t6(--Ya6NFoqrN?6f
z<5Pzl0@Hm}de`<M4B!R3bacSlbUSyts(174ti6<uTW*Rtb_aI>1GAKC)mo81bZ@Q@
z@yj3S&m1-g$kVHyx|o^<Y;_wq284RuNSiz~KWpo`x@~)#4YD<6zh8U<6F>Z3=o32$
z#<8o?7Q!hlX<k9X?vY^lU5(FLWV(N?y?K~^&15e`f-Nt2nMtn6-Z5MB(5a`rwh!3F
zrUN=*C2mVm4uQ;6#)`bhy4*hK-7{JKEhzK#I6jwTzX5)X<eP_yg~w`7;i3B^8}933
z0z)U93OV}gms!!Jkyx-g#si=_VA;~mb5lVkW<9|dl}PY0<!AGD;~FPn%{h`@_OVc!
z;Ojgx$7WO<MdwL(-$Yp?6j97<9m8xANW|F3|DJ@n{sb9QoJTEkOKwMHIs!gPJ&}4|
zC1oWA3cEr>UGmf}(w=xxCxm=v7!xy=HKEJ#3Z>l*YD3Y3A7_N>A@yFKu9PXL9|8Mr
zlJ+PP*P_?(GgQ<+1t_9(#kE{$Q~kN9`uj>thaym2l!2YDL+VrG>9!`l-aXVg1OQCb
zUiEIl?{I|woBr|c_rI*7|7!LR2k4v-ru;|~Qt$n2hS*AewpK4vOZe%ucBf;oxNKok
zRjtetO5s81YEz@%*9;|VOPY5nP@F0Sz>rFXJozjr@C|x0Wic{j3L<;;>DF}~Z=cSF
zq`O(MmesGw+1c1a&?Gybg+i_G%^tujf>5|csj*G4*!`kL8@azlL&|m8J7SvT>xg$u
zSDCEM&oAZFPEG9Nmat@8le@zfyJ9zi9yb(2YjYPc&r!rsrs3V9=CX>JfIJ3uX(El$
z6_Qm_Pqg^s9Bs&5cvjpk*tKSq)~tOg?=Z3|&-S5O9kS+fmvK2W%OmNqWJQ{WcGk0-
z@&(f8m}Ch=Hepr>4c}$52_l~1t}1?|q)G!gD|YmlxO_CLW{P$mx~DVT><yr5xvV67
zxspOf#~gV5HBg@=Y8bR*u(rLl#Dm0PT71yF4h%*>CjLp){CBritykJX4zFsoJM6+%
zN@LTF_vWGpDCF^vQ)Js|Q4|#5EDp2JO!i>ruA3|qc&w^foB4oufH&<5g7Z`9v<Xq|
ziK4)z^6`|I=21Fv)_V!^cx%HCga9oPeg}Pm&7L4FK0cTKGJN|^j@u#`@OFi<jOiIx
zNSIS6jv^Xq778I6eG*XNM)uTjUQfYY6~MT6tS&Yx4AI<9=@+Q;n%XV}J+U~ObOz==
z_2D9HqHQG;;NWAAc(BZ{y}G&&b6WaaG;Kvc%^EwE^(-gd09JpGJ60Y(8PYiZ4aqA!
z2qtDZ!97|cSI`vr#~&mPRF8g|o+VXY9%LG{TDnAYC!i+V8%f_|6|6Ml@R!)1$pfB(
z=k3oS1yTPEBezvZef)i}B4F~zSV!(`-N|6x*3X?eaIm5SYzqIOa`@v!1q6!>aH0=F
z;1`T(LTaAl03vZRaE#C2*@2n+=-^yoULLC5kN@Z+C<sh-aLIo&$RPA9o&KL6*<VGl
zp=6(yEXc3-3fGp!`}g^`TzlQ@y1yk1NR$fE#1OrPo=g8Aosd3O1*P#tzgqm4o3}yF
zU)?GP9Fv3WP2AjXz?cRY3f9keEBnjc=PLIn_BO*Mcn<q?LGni0<2OL&{sWN4ZM($z
z<uSJ(@SUwFU=17|VbX+vNXO0S4H_6bmH<+zoFF2=&;S~~=e!2lT+{1NkU#o=d3mF%
zahsYXmGen&P6)kmo6VHFK;pWQ+$Eg?E#7J03PPj^1+={ZK?gv3=-2!OJ1WW-<s7ce
z%%})xmT}Pgt9OrLC9{#vC+T=kvHRqrn-X^2eSnR<YZPR&nsA41m=I;0WpU5zH&#S}
zqBQ;;rM7o4<n{1;)*u>)<Ru3W?x(N_s71=MGMDY$bm<+!J}|0_z;&S0jqn(uKhey@
z-e6jpFX=v~$VCy$m@<&6Wz4{yj@mO^Sx33z#>8$k$W@PUmS2uA`;w~`>nZOW5*1z*
zLBGxlynVo=Kl9Rq1L<vUz*&sI`|gi>X6Ij2u0iyPXr72GiI}Go*(~Cmg7v_>Q$aJ?
z-J}SJY9DsN>7@JI7sJewk9M!v5Q;%>Cgx@%u8-Ghi+_CGPBeQheGEO0>G*(^CmoO0
zoif5DDV$@@Lu_!}Nr5@?h*uU5@r<7SaK?^L;?>FH<?80k%z=XhIK#8@==On5cbG4o
zVjia2KXk-@$^>o$Gl5H<{{*EB>i0R<zg%;HKiO?d!jHG2i>EijyPz96?TQb=|D;)-
zhe9!o1NBadz4ilQ-9X|@yzOQ6n=alBd7TUZWE`;z69$%VRXvSMr=`W2XP;u7g%J$9
zRokyWv~{K31L`FoSu;iLE;w}<tI~48v?LU$<#+|x&^w9-mlDz;2u1|3y5eVGoj?=a
zWs%gQPBp;`?Wz(ipF-xq5e=w}SxW+%n6nr89oxD=tRApZa<XpD6uhR+m_ET!DYF}a
zA7Vg)lZx5UXYQAesrXBkd?j;WoQeZ!;y9FaQ~jJ^>h)7m5_Zq;?ZiKz%m})FI4ytw
zSoe9<6&EqO9HIYh8n3FqAz3u-s}@~>pvu-&4<B=5FRf$n(>vZ0$%?OEb^7@YsDD<U
zah{%kK)6@Ix<~#tv(~pZ_b9+<V&Ag5t`0FMgk~}+8ku*>k~SKu2UH6z>ykWw<oH2%
zDJ!ecdh1rvs6!{x-90(=-6b{VifMS4luu1WHB;1}QPf7NPl7@C6zlF-tM4-W{zY!_
zcuPa!$AiK$t1I99mt`tv8!3~mDbvzl$!Jy<!!?r~P;i!rtlH2>jPY)-qLW<jtB9Vf
zb8SCs%f11%7kqcmlTTGlM{ZAVpIG}yi9O}qwy9N&k`^rdIwL@LR+-!`m9Bl?z8UYH
zit=^Xq3afh>Dmj?*Z1FrJ2Fn}u{0bz7m%>quj2`QHE_8aXfLsh4i1v{sSbX}hV7gk
z$L#iOZJFl_p-7(wOI_wOSeVkPnN1enz-wgSVo=s{nrkVR*uJ|2+vm5pOKV;l1!^~4
zp95@%nIDi(#2&w5C)w7YgU+_0i8Jt?_Kmo@ixm#S%D*TZ9ZeaRJ^iA8qqtj%=`xec
za{WQ-+i$=QhG6cF)M4MiX+J7e;lP#D)w6xtit2+p+2rAG*-jsD(+dT~qp|kWmXoO!
z<{swZaVEHXOrh$&W*h(Z=-bV%c1W(Ok?C0LhiQo#2T!JFV%B$D8kF#qphJD_`fSqk
zE)OEs9gL*wbM!w}6UkdBX?ZfS1OdE@2gLDhJ5onzME8#G%YzGE1t*tBTbFv(fpNc+
zq?N&THb$?k(E}OrsyU#vLHEVP->$6M{HPbJpZRG#UYVhJ;Na@rPx0*$z<aUi^^MV$
zlHA&ip8yp=bs|zOfHO$@gLrFvsp;wW+@B)Pfm0Vk@UbBH<+jBPG<i~0vT6C#(8&L~
zYX3@G4T009w5*7Z^YN4wMEBE1Q*YHOE$DLZ;E1fzSl+B2@URW8ce68yU;*86E40o<
zi?-6uYY<^u#Op{D%wdla^!m#Pc2WFmKwAAME0}nJeg33c;^h`f{sEKJl`;n!d4#S2
z&Mv{7cpTLu$eOKZNQj-X9Nt@bB=w<0@%3A~@Hz#U<MG#E(S>%P8Z(-YLW8@Vjn!U<
z>Nxh!UKw?7CnoaSv?j+CE<N^qJ9><1cPfXi(~Gw~c;0GU!ORr&a(4R(@$`bo#^Sy%
zY?#uBKAU+hg1Px<re~>>^d8(=6sO*cN&g2YufWGTBiNhVOKV24O&F^8gCq8DYz`i{
zMpYe&_#+kd;*3kZ$v6ZeDb`+S{Ly^Ekcr<rt^aibQBAs@n$+u|<>syZ*gVd|FdC(s
za1iFMQe+NO(8j4kf@!cs@&Fje`s(Mw1?1KO!99k-TVVdegV9g5rv{!!MkLQ_#I`ZF
zgp7yxste7HVFa8>Re%q35Or=>4FIFIt{6bAY#w;4Tw-Yh1GjGCKxOL~s02AASp;LZ
zZhJv#*LQZ%;{w|SWP1WEL4^AUS->?~-LC{L>B`f9pE%ODC`O<H3pD)y*>;1@0K(Zk
zpdm1b3cfJC4FYu~h?L)eWe|w`e_~yN$Z-zF2+N!Yl9Bx5<hpY&yebByf)L#QREW^~
zE0-Pw4R`(<HM|K>`x|PQ{laq}lp$<DFTA>^XB{dsZq0Fp2TFLCdJH~W;nEg{8Lr|C
zsaj<Z*Q1CW)}{?s_XB2TVXiW!TzGFp9uTq$)zfvohb4e-dya7<>x%iMEL4CLV{9lT
z!JU_={425;R#YU;{e37J%R9Icc;oV^Heih=6zY*IhD1e2%E+6=;sgl-ELD)yw-*Wv
zeW_XLv%`^cRLPbaOtKv)!c`>Do<|<ZIx&%X76_5`@z=@I5uS!pKe>qF;vs$8q5x_r
zCj*0+<QPUg<<g%nx_{J)`(GYOFBkTPv#Ab>U~`)%-FYO?>;zRIkAAvGhU`1|7)iMn
zlSJ`IBXhjdLJw_O_|mA+;n|G@eHeXXeimykmv`g$QK2ubR6fC~-YN5?A#tQ#R2eo?
zFo;R=<Ei%+nTZ?vG$!>USo<lw(WSX}6E&O{rG927bd9IPWlXltx7t473-#9!vyQhP
zs>U!3+bKLjjgWh@7vgB|ziGo!hv!~Tg-QM-XnItw=JDfiSEY4=XA}A(&z<tWIK23V
zdDs@2f%y?r!(dG@+PvJGSrBGN9u2!)*K5w7W*p`cu(+0Xk-5wFa(mQ8qOGkWpU_EO
z_-5y)@8Z$U_gHnp;Kt5+L)MxI!biiMd-Si->$zWGDEJ}2)%nb*I@_*0ynH))N6l&Y
z+~`!Q<Z$WB_1(9#TlxpkUI$9}Fj<3Tzbzvx#D;r{7H_4QGtm>a@xy6x?C71Swz^9R
zv^n@;OMswann2QkS1)^?T?%XT?M_;syuT;G>tH;KP*FPa+PYQ0pF8I$nXyqH+h`Ui
zf557*$dgK3S<}}b!4#ngPY!ByCUZ@Z@I-VtEI2C|AwK`OpDzbgIA&sUl^C*|ocsoe
z=u<TM=*5lZT5u`c>32Eh9_V5Ak6v|0ZIiMQN@a_`DOeb6Gr2mraFp_%_TFg=*pV4_
zcuS7G@eqg`SP^C5?f)XZ-MHc{m5$qMob$PScJVkM&!es9Hz4(r>d4UOviv|2$w*^1
zP1D4jlGUne#D1CLrAevOS&^nRtn)s<>U3*%bZ~I2!v1a4<l)Kj@eiKb+&670RE6f)
z9$^uE=1ehZ#OndiVN79^mcd(6pG#&dwgOHp&SFeQf3#g@P#aC#`!zSPrDt1eQs04b
zt5%ZB$~JTyD)+M`JhkR^j&P~VSyM5d=V@DQsI;VwgQa?KL=TXY2*nIiJ40UzidIVq
z0NDjk6XP8O@$UiuH}DU3l<0fbAKQ}GdrHo%tzMztJpKR)`iVkj3nDH>0BAC!fnwY<
zHXsU%)C*JUgQ8gxDbj~f1JA(u3TQOC97GS^4%#h(Ljq#JGcw>d34p{V{h<l|9q>Ul
zspW7atszASs!KrTayk(FlG2uUKV+=vUEP~k-Y6_$ETtM*QR+LfVe=n&HSp-FDbv3S
z@l5#dvZ~1-o1_;jc5Hq+IKC0jKihg(?nXWqa2xZ#eV*3b9GK&6f#B<1&2-_g7El>{
zHP^o$Fvw2rn>i?W8ChKP=>h&YT_Gw50i5tceRm?%Ztal-0{!)jl_7~Vj}=MUY^uI3
z;d)QHt@+0wguLx42Opm{Sun*HWjyxoRlEw=Ba$Y86D(^Cl<*<~P#hS$oTP~+c(F7!
z%HF87K%U~01n++P0Pj6cdeU`qRW*WvlPDR}RU9CA)vLn$m}4o~61l2Gu1O`5#+ag*
z<on8A$BlA|j9+s^6mJi31Y`7=?8aosB7|eGXZccqNK3~D*HsDK3F|m-{IW#68BsTY
zsn6FYE@cDpvk$~hNR&|<^NV7o`S8!r>3Vb_ddm89w7fIGaNSXHDX#akqR&HB1Mi(X
zlo?|wXAIFtHXf=J*Rw||C2|CV;1Par7mZJ}BQui7+5S9ap@^v=9&1dwWsp)3re{~1
zV<6&%P;*=TZV|e!YTq9#c;P{2Rv&99>&&Y(<l5Jv_Er-8veg_;{N!R^!qd)Db5cBw
zU5vd|w>;CBJG9j*W}yDkxPlUs46>l;f%od^J%OE2GYv{MM8FI~+9?_2?ys5)?d7wV
zwuue?!%b&a&a+w0vy;v~BLX?>C@TM4Isd|Fa&qyf+t#m)Y?C&PNu6K1`Bu=abL*Yu
z^SuAWh89x3Lpj&QPNyu!ke-JnHR}S3zCk9jb@Cb%o;$T&pT^x@nI3`cQ0=cl9O<jQ
zfF5w1A5{5`8i1P7kDz}FIKKaXZ6k8$CCiUivKnwIkL&L!-C&-~$$7WSB~CXu9vbl*
zP+*%!s1I6cUI+6??|dV?A*%`d|H4;y`vi>~`&~RnPfo(}PgP)ILOPSbvxl2^&c+ll
z1p`M2++~E|M>SF1D4qHV$FFe&@lI@R0UuWGe=0nFJUfaeNEsY)-5{EF9tlLAy>K_o
z`T32*0#o4a50foO3bbBMG%S&(vVp3WLc$$o3_X1RF6BDPQcZdi%Xj&yd{QS27~a)&
zQL2yxb24(SUim?9WjkAa<jTsVhTr#c-m>n7D>*HS6TG2HUp`I@MNdG5N=Cx^nU`s*
zJHU}?Y(K*;hg94Mg>_>qy%yy!RYRq%iFJBdCY@#s4Mr5|8KZLSc@|ka$p@w^Gh@Bg
z!s*EuJ0)DeBf}c$n0|8^L=lfdF13V~LcLMpZanKdsYx|Mxh4Robn+AIF$vXVS7@Y3
z@-!)w3)DrZSNo*XGsVxow#V|(aZpRIMosEXD#|D17>pSjG0COTMfL0G_rjm3d+B>(
z6I0+25-ZBdlc#?(7r-3I=!yXmW7}AsLM{0_j_Mac{dX!}W`2d|#XoO8@8oJcdD%RM
zs{f75Vmq926~>OX<U}PlihCR<0}_{Jm33M*@|2okl4zPDqzP%g^K1z%*xT$V8r5<D
zgcP?XF3I)L{%WkqZveqPuRM&KSV-Hs+wIkjZC{(TOKx0dtd!#zN~VE2Bt}Y`>ZRUN
zU=49E8s7lc8UZF5INGX?9U~=+b6s*A51_ey0syRCuzH4kp6$jSvMW-C?P-czrbrT$
z`bxb^gyS12X{CP?)^}GWD#j(@R~GAsxhijq<zbX1H(EMsm3Pn7%TwxP6|IJfOA?4n
z)c_^-D7>Gj(NSq+izq)CTT=FnE8NGX!v`2F5k&s=pHP8a<G`%dcMlWXw(THWF0{7p
z%<oTeAba2Mzgh!@0lyoI5LlYjC7e0<I1wjoi=3b@U>W&*LV;^2KWulrlIC38VQ@(a
zK|K5MuY|e(0#P01ccC)bIu|PIvauVg>PB%gsIsh2;n#+byToWqJ~Sauv5nAmOd<#B
z7sTuYQ;CWtj3refSgm3udn%hFb$M@&i=GjF*^u3VQ_q-2JU)#SX3>@BDmc)#;>YrD
z*W~L@ytn(wak=Ww`Wz(7|AjMvwBVuW=uVLLsDIq+&MXh_eq(lpu@{jn?%J)1Fde_v
z{uxa4t%CZEJ(S$#Zd^Jyk}V~&DP1FJXvE8jmRxKYuvR;QSlGzb3W@}HQRuN9sK0qA
za=Q%nwX;t}cB?s4beinYCZ)tg^7d=|n*=)~yDw{1xivP-mBKgpl5F7J$;vv3aKg-<
zR;?Jd*2x^(P~t+Go@qJAv@AL5h*@dz?kD$lQ5B%XVYLUTd;i0nMI9gW02(g$4k}=h
zM2vOPF1Q?S{fwiX8|YlQit>|?m`2ms%<N>o438Xy#23XrBpUw6pGUYrul_j!;H!%s
zKt@@f2!-k=>nrLth?G>~T#r*hY{O}LLRAH9u;D}%aTf7+Vlk#daV3<<^~L$~bwX{p
zHh8*x<ZXtVDk0d`KwaTQ!$;+Dtg>thLzw3Nk~tK=K6%Dy2o13OF3NWxb*PCqyGVPt
za3~jMLur}CZKDbEwWv3E=}MF)h!!1KhiUSriWUL6TNf+Z?7*#ji*&D4c+YEMp18Xr
z4%0?p%)4gBOV3}%*XQ96M!h#&ce(reIK3TU?d!<1wtv9E&9WEv1PeE8P!r>(IfmPA
zS44=j(o_}>dx;qdiopJedlRNf@m%cx2B<d24s?g8Zy!^sa3#rb$LGtHQ<0~29jmf_
zVVbLaucwo1iY-e{`d-V_h~>+0Tk|RZgr%1F@UK^2bL?MV)O9`X-t`J_$q;rLhL#fb
zeeR}CMRs6St!t^1nN^#64115nP|6QZ_x3w^{ZKg{+smfbj7o+1H$FX^_|DdPBupex
zTfjVu+E-Q5>s*;H&(hHxeXC{mnvn#LgY6~2M%6DHGk*4TnCtQRS02&*U7ObmJ9GM8
zwZC4SRH{`p+aS|hr|?u>U$;9AIGXKJGO#6MWzI$y_Y<4p2I}>{nnjv^%uUVBUAiJn
z2%C$%0eO_s(UV;dO@GBBJl-nYs*6p>`1ZaR>He>gJ3)l6F*Bx@i}w0b3n#Z74}a9I
zsg8fY66&~9yTJN+&r`oPlC>dRh*7@XRYhtpdT;Jcx$kWB<cQv@s;u`1Ha_G`yPND@
zmTVJyJkHj288c)C>vD=ru3PH`15?wT^35b!`?8b_&E&=2%J057&(ySD;mdB_ops5q
zTQK_AT-8)>q+7!|R6g{CeR6P$nX4XzW(;-T8?VOCDlw|Q;@oK5I$1of<fSb>HwCc+
zF8tfiU*Py>0mv%Qqq{e$P$qXmK7~?jPQidlQ;mLj@7>~LU6H#q-^KkFl{@#kGeY<u
z2T>*r!#H1C5D&7Y0hi$}EXl4y@yf<d^G|cVT21zo+ep4j?fEy&bG>A_IHeO*mV6CR
z;ps(ll7E#0FHLu8_lrKX>vxo95B)@ve_Wl-UVo;Iad>y?a>D53pcGyHT{eQUI1yzj
zbc*VytwlPqL10z_oXOzTZsGV$0H~B=x)S%bzj+zja!*xFZ(ZhT1g(W&;fkh-mG-B~
z;Ny4<iBmKb0Uh?^!is?8Q1H*mH9ju7NTRY0w%uoKrE?OMl2jdf4Hy>_SAvrM>}Po!
zo2O&{cHZ}|q2Iq4>(&0bVq|dLXP&TCg_%ktR~9_6VbA;!EUHCbK=SZh_L>fUqAvt2
z&Jy0Lfgq3b)oq}6?)h0K7|I07yk^0oFVAH2<_2Uo)@HzLii5WAcYMM5K1b<G5zyW1
zUu+B^sP^x~RB2*7lu6Y9w;li-pSP^3klY7BW*?j?`z6A>J85Jf#q_Us@_%#$|3@36
zd`)@h>A@cBKoh0QxS<TIv8JR&VQxTPe&-K)zT^R?(fw1iH2PT4gW&b^q48!Ox~2|T
ze}pM1ra@5A>UwlNO<DrBBm#`(_RN0yy&I=@?I7k{WlRONzfq5sQ8WB2nZn`CyMDp_
z&RBflQ5eV}MY1NPm)jUvCa@%YUB&qgFw3em%M_(()Kd(-)b4!x-fjvoZk_!2LQ00L
z9>NQaVAvheUsLuZQ;fed;~-1dhea4|81Gs!Qr~N>E;f3KK_f=5>XXkq9Xcg0PqM;s
zXPt*REbsx5+#CN8ybl;JdMZo%IXlmMMI?>pd<BaXEUJ1a<e<qqYkjyuR*Fn0$8f=N
zPkd*IfXZ(2&s`)b@!ecXFaoO><Rp3(5Zz;F*npE~9**8{s^%_YzpUu`$-<BxI~mQw
zD1l96ph}7Eh(ruWNx@J_4{C?`)<`&pgeoXPg~PRBh6dHuq+MiglLjHS4avhU`m>zi
zKhTK0e@X3S1G-s}exeO_DE=V6R0K`HUW#2qdC@Km(D+0-vlmup?NN;YBW~Y;pMZoW
zY6s^Jz;ev8T<H4M8av9}+DJj1d=BGyS%kttORU(azvls*AeJn|DMk-iLI?2NpA))k
ztk|K1fa!ZAsv_eDt_mkmDlvWTV$=k3y|j2>`$ZVQCrR9g(^$f>jfF<<(FdK(tpF{G
z9||N;f`e9^u7cRxim&e<eM3;483fd4m3JP;HL834xM~2WoHSGbw;&OS%6lC5yg-B^
zV_+<n<Pn@efQc#cJ*ToxV7!L*eeC{zIuAHLzrqwc*;0^TK@c|Mk8Nz&a}uRIbOUWc
zPzY2Biw9si*kaon9^Vku-#&|YGt*tnCu4dEL?4at3*@AM#C)4=6jLqlk~_iYcvlP$
zFjngY*dk8zFeP`zQ43WlaN^>*^DFgjA`jrCf07wsCi(0vXSYRBSxX?tDix!PkfPZm
zX>L^p=_ic(b~B>3oa@F#I|bn>^xGW5=NfIEQ`?14ba|8iM|<BL7e%(MTTPRL1VKSE
z4T6AV34%n0MnsStB?rkFQM6mK<O~u71SRJzNRXV92$GR35~K+t(B5LkahN%J&fI&?
zym#O4zW=D|s=aFm_Fj9f@B3E51Nudec>|266T*QXK4E5=Jjk{Z0vnbx{a{dCo_14I
z(_$oXDq%=HcY6JDUDcPyI|UnuA*7puhai>sacJ5WfUVKLnHG&fIBHb>1a9L+>DPXV
zUe^HiLE=70;}tKfUz&KhhnAtA*+J!|Tb+9(@7c2&q$iX_avc{{>`y97Nl3_q1jx}<
zv2W6!=jX26cUf`Y3tN>(bXBd`6+T}Z>N#4#6~~YcB^<gfPbtBdRUTZlO}r>R@nwzK
zE$8lvi<i=HeUtQ4K7FRRo~JvRuob}pZ5?d^W!-0O=kS<b=LAFcwjOlMCq+70cSa{A
zMpxb|?Xm5szA}}^63{CnZ&dYItY6_Z!lSfndJnx9w`Flq>yjp)pQ7Mdi0Bqcc(+~I
zh3F2Q8vp34Lyh6b*8-2^3~AtSu4krDrxXF$k=O%%^HU#b5+{QX@G*#Y5tB}Hdl81b
z3`s<v$KaTm6BCf}hy;;^>2}Y-b+~OKwW2@7?ZM}V>$Hx0Uu+}V2Ey`b`s#O%n7J&b
zzn~+YCh+;k%G-<?2!}=2;^#m`jijsQpU^w@b>m?=jTeq7TrI0SB;MjqUXG1L*ULys
zRT}AH)ZOB&ie&T}?USRzfgY>!Ml@tCK4@Qj(5BrycGu{R$->!I#C=K}C_yAu0KPDA
zVN4iGqvGT==^YjOaj2yHu0oFpkwCNEcydl|c-E68tNEm-+D{Szl4tVV|Nd?7&mOUV
zbX9|Hk&~Q|psdw9FWQ+bxfWSu?7XJrl}#hO+Hr|m;h-IL4*(GgczOn?l`Js)0iwi?
zfz6vSpqD^AAq))xcemzWsHuN^LL<(gG~sH3qWI22(2;IM$_1A`{a{s&6k|4wzC#vA
zMBfWAn1WOVg)u<{^=r+uhhMBDK4VGz0>=J->~~22m>xk@tYIOgV{!?j99?&aSLSFx
zR^ShEhi?dF7FO;ojeS$8sh=(5$=qE#+*<o0^!eQ$DBf)c4$Kcn>jyU>DvM}p=`*tX
zqoz!`qT!d5v#2U|Cxb0s0qW?n%I!GxAxNKSR;5JPjDG<UEf38=@cISNc=`Q`4I*0%
znZbL!O>#qNIU3h}H_u?A3JiJO0V7!;U3sh+;WP&Zsxp5iCtI}~b%h;br~JZ2KFU42
z$0f0O4spzU{_F2y(CSc7nI%hpP^_IH&ffZ*O0d}-l^S{eR4^YEoFNRH9oPRJzw@6r
z*OLIIUw=D68Ndg6F82g_-T36lTOn~7^!z~`{Xyvk-OA*Y`yfnA0OlGYligW_Nv|v`
zb(jTt1G!;!X3?$eRGkwRXL9RNi|jo+Mk=o*w|-s9MI@|pIBz}kKHNNH$tV0%F2-sZ
z^4;zF3k-tdD-1MbY#4V7856WG&e;x1mB9f}2yP-Z$%MsW6o-L=8E9fSRb3s}Bla$y
z2_rRXh^vv@@k2Mx9Jn`ODTp3CkkVc=m5-rJGi5{?1qX)`-x>-8l|xA6oXPV{WU->d
zHLF@7a|I9vQ^%*<5Te#}+dG^NitKWnOQdOrRDA~=Z-T?|S|JP;%*t3}Cy-P>H9Q<7
zZiL<YrYDkr3{P$2`U>P2_>P!^SQ9#jzMLkP_iT$oM9evZ9gDT3%_F1%I+V>pb{{T|
zM%G;I{P1yU!w$%IeNSXXl|X-SPBZ2$neAZ*wW%gi5u2%o%7Aq1HO@2^7~+#G#LRqT
zO_K@6FA&uUV|YaEF+y#E!u0mEdBK-hlqUTMDcet!&v&3~9T~-0s(X}puh{$JQV&sQ
zl_$|gl5CbkPG&d$^-`qqyVY~sIjvf>@Y4be4bB_^19O2Y*FD(tx}Ta4YvUUVx0(XB
zJ#Q;rS~0Z=>GW)vc{&J7$Y!b=C?5|X4KBu?3F4%v!~o7$zA4|;jI^xqIb9tp9A7uD
zhDTQFtD({jrXy#KCr8RRq~b>y-1QfCmfaF>(14M`8>Kv-qoQpGZ7NL2eL#mGyQ?IT
zsP&rdf@)c!%U!?Q(_J1B>t}?_RrY;asKw&PV{r>42{n*hlWk8-$<oUfGT5Z6Jssyg
zPGP?xI7INxR`PE;NnWn1#5CZ?+7vQ*;n;hnRPqFM{G>ww11T=`c_jCC&}d#|t=nK;
zNtKG40+SLmqh7F`77YHHabK;yFJ#dC)dV4|>%vj)_<-)tl_VOI&ZXT#`)l@ZP|3vd
zLCVDm(lsy6@<<mxPU#9&k8*x5q^6&7VVZ|G*mmyH^39uk3eOXl3x>-^wsevQqk<z>
z%)eL-*Ps<tjmH}uZs@pFnOBA}+v7hER#l*R%pgx~++Gw#J^x^{wuq_3RcCN)-y>s4
z$E7Z}y=T~3!5V$%lI>*!m5DlnvWuM7u-C2bY$b#@isg127c#8YX%y#MH;cQ-F=yuO
zW3+QcT~^AcxhgASYpU6E2gWlyH{x{n^(RnW$T8cY{IbGC4{a4w?$e&Zl8)`BVivSg
z?`zK1#=Kp%-CK6$_Tb2WJDzg?F3zo*;cWuyuEV1jmJ~@5UWef&q^nH6&f|-7f%`h2
zl(X5IOt-hT_H8^TEwkQ4o0K31_epPCpN-X2xquBnw*U*^^f0QxjD<gL6Sw3vaUN(o
z?;)iqeUU4)=auJ}(!#LkLC7_Mm!kTsOQvZ3hg+@51$_@($*)Qmz3htBa68pm^fDkm
z2ecxa|Da2`Rk3PNqoiVnMLtzIv@^Zl?~f+C!;>LLr=K`KHQxI6+7@pqT0C@Z$^d}8
z2`+lr10q-F{-{e?cdSdP2IaS9Io745{Z*H;%QM3$8ag77M)B~KxVz5AqKc2^0_r6S
z#mOCn-`T-w8SsR8!**b<55L3<$x$ku3Mlabd~O@JyA<hX>&C5@J`=oKNk^BBZyaKY
zpRZCq`-O+e!t7Q(4&H*7xC64iRl40<L~Fcy=DQ}P<|4Ow`G`HYLDON^ztp5;1~t+O
zZ#MU`3sydPIB-=cs)Zi6i#!kKT15Aw0NNlQ4On#-omSN2h}^#iX!FmJ;=gRlC%_{h
zFh>B5?RRHvuFsX5U(Xi5=4$sx&&Fv)^lPGb2i~B=l-HAhZZb?%kRW^(NOT?tS#*kR
zjzMnAeCeGHx038qaoZjNjc2JJYN`a`lF|<5J>w;H!?TZRYWCGp?xj=7F9WnnH^t64
zUvr?nt!3t?-$RzPe@l^6eTl8cT>LiPmX~b0!);0G`!neeP0956vLo*p;ZdqmRYjOa
znA+~goEl8TiN)u~?y@xlg3u(CWbk?U48=(1VC>o244$hQMd2cj^LCmRPMDF5gwz5M
z%FhqTJgnjf$zY^oCYW}?y5?8A9<FPj8|P-2fXB4*qezG@5;T6YjAChwS*N=cqgJQH
z7hlTC)gWKNDaxk2@UDn}26>APtE;ugl_`U-_A$BCvp^oS0SQ}p{1crk4Str5k=L|h
zsBM8uhq$*{kouH!TeX#>uTMK_t(#~INBJ`?B&ha1Vd7X2AqOVq8n5yz8P2jAcb&FX
z7o1%TlpLsMCGl}wc=T9ijYUKNGVm2JDu31OE~pZKAw^r7F3U_rel6ijp0+lXLd9I{
zDcsHl8Gy)=DVdtDy@b#N<4V$(CFh4)hn5(_zwp<vOS2R+#N4&Xbon{?q;WRf;SI2+
zP*cO3bTnigaWd8Ta7aDqYWfr0@>hP`{*ltE_u8*e7lgsc)UU}`^y_6oMHdNX5bV+@
ziK|A22gEEpw)f%CB{@nG{M>8x2U`!){yD7CjgCdX(lH}Y*HN3iWTQd<!>zeUA$E*X
zIVOK)Xs)fEHGWjahT{0n&auv*XyfP{Vpd^U0<}TB1UjZVVg`0zP9MtyUKTIaJeCWT
zM!b&gM=XsI_k#F_s0&ASm8gdVhu*7~5Wi>*Zayy~{R(jPKXgwyd?NRD6(KZJ-~R2@
ztNos|{cDq^y1M3UPSBvt8{ZTLN$v+KQE0F9>@n9%i79Gk3eChV-@Dv+56RwPmy-%$
zo&umq;4BSfRFkw_w5uK@3>P7$A4}{rA&Eh20ezem>LD}e5(@;xYEH-lvH@Egpqfq|
z{oZ>eFn20`(VY>&-mTV6oVX3%Kn+$fDVueaFJ>f#Lu%Bc9#z}r-D`qV$w9Y4#PN4s
zLJH;pqk0&f3&%QxXV?o1n1r%iIiOuurhAFujJw;!`b23lU^)ZvfC_^Ypcdj^QW*UC
z*!|e!_?OK06GtyFgv644H}6h}QyA3S>TM@gG6tMWdsxo~MSBaM$0p4=IG}wIDPZym
zD?4yZUjA{RF)9L=Qyqh&Mnu0em(q2rr6PEz1u#{Z>)|Eo!bx@tA}=ZSJNw`nH*<^_
z2373cNq%Ifb3{Zq5#}ew@TiWM!^$a5pXi*hOKGYcp!CQ^rs$?{=wVtIHuB7Li;nA?
z$AmW*<*C$3n)piXWtfTxz4y#{>$?vgd4NV@O}<-i=Yq|WGfgjf7TagT-iTnq$xLD<
z?4^YXJW$#MKl1Lgmg^bzaS`fsge6QbsZ_{1r?iRuT!m?6F0`v?0Tw-T3R)Lc+%-<i
z<KJX#GHo4fqo#21)oWY4z+P?APq+;vC{eAvT?p=5xEh$k&*6t6nBZtOW@pw2&=nPz
zBk1Mfle`?Cp&elw>?a3_@n`Vj!`+2NoV0{4yz=4GV;K(_Y<_Oi!J_IuWu~`ws%e2c
zWSlS6mlGGO^T$E|Bi;QYoE^Fyrvr&ugSTISg=G_BF!iAOk;)-g?YmdXHX4DuQy%9i
zpNA|2Z9IEf$|}4cO{V!&1eyS9_7n0k@klrDTUbRxgjXNEnS%+hOd;tdDKcuk$We6g
z0U?`--ZXbFwF3FpnFg;{PPnbt07aU|Y?IX3R4{faDitXjcT5sFV_dO*=rSaqDNWs&
zy!y45B&UNe^vxRPj5AV6(h@vokPo%l_{k@mNFlXH*}ZOJ%QHB^p>L90Q?UX~<4;p_
zARVrUOA6!Q&~8e#rIABeju$&Dg`k7`(q}Ai;l0F0L(V3mni9>Uv>xw~7rk)X=RuFy
zAJ!mnI`S5Nu4rq@(OJJ5d;z})7SPX2?PY=WRJzJGBE3k3$}1al1^0UTf|u?7S<35n
z{fhOla0yBQ(#Dr%R4WId{@j_$FXi_02><=WquYgB5>1Dor@;4B8Yq8P_)Ssn+wcCv
zAWRZ=DA6r3YrkxO+OhtooTnq6ue(n_i#FQ1SKs~>AV!_{eqZ<4k*S4t`00|c{!qI&
zYbxjNhxAVjDtE0q3?k6<>8I1wt$%q`G|ly%?6q1`x)gBXSyS(HCfH5<T?{Y>5FY}S
z5`Gf{90n=5_P>h(f<#=!-^Bpc0s1?j|3Bp}h{QP73bX=Y8bZ^k4f><wt2H&i@57FV
zVCREa$CL&EEB+nBE6W%Q&&TxBOgm#(^eK%Z{MC&{XS{ge41OwV;86bG_ws<m?Mv(4
zcOI^BK6<OkOV3L?Fr0=GtB_R@3}*=^6W=P<0C^l#LjIf<egv8_yZ6OB9PMnA2)SmH
zs-ZPxH+3Bu<4N%6UdLikR5m}=k>ix~C`{opyJpHv0;kh6!`qLE(4v_S#{*%k)WuC+
zzO|Fj_e5!1&I<vRVv8!;^|g4aTc0E;zqotNRubAxW}eqFRo94SA}|Wj+>31gNOIW3
z9sDWSjti3MI;$_f<ze?imQSzsQ^!FY)FvXsP7Rw{E5j1Xg&#v$qZKI$9>;NG6PJ!M
zy9^I*$!*YE;xZEWPCja>g`puI`l>LXGs&EhQ@UQttf#N@;KX%?H~1ZOdwRD{1e3i3
zl51g^JXCThazC>Dutj@pW4&VLScJIp{EkK|Pj(qJ13V17(ELL_Uz~`WA&U|?8$uxX
zT9WoF;Md9-?XsT;S_IqTufMr;Dhvv<za=fLAJ~V1vcqD#_CyBP7t%>2jh}w7T#%<x
z;G5{wd)-^iA?YW`_)bTI4ATW_*bW_P`qJRa;ihu2G5DcNf%<JZZP+PIE?5N{lUpNy
z0V=c%)LX5~c&dwc*cx)$ZGVw-U7EmG8*brifmi8dV(!k4-79$xP5-t#P-Rx*QpkwK
z7;A@y@%uAQzCjF3EHA0e@cc&goFG<81bPZa6m<)smUedQB#&Ph`nlGSK14z0EywQe
zouw4jEd-G2;*`T0nj9`G1e^;hRKdEpwYg}Pc&b<qM@Q=kL+G&Orhxvse)|HI!D}wM
zxz-*=?%EdDh!}h#{g;d>uMWg{wm-E<@OcSH(zE&(6y!5{-NCO_?PF^mIuml6I$$=$
zg4zsm@%fG7vFq7jkR0fXlYFbMdm6n*#l8F3t9#1SCUFigz{FR5&J3A*Ge2_q4dm`;
zbGgzpA!X!m&V3{mXeJpdYnVUmY!IL3=6s_6ZV8EBAx`~f%`Powofp5zLqi0A{XrI0
zJY{?I^|RL4>}o`v?z{|;5gofs+F3AQ8sq95${Z7@OL38xlfopRVD#-M<dp(ks7eGN
z*L^*fjjbNfiPjE6jGgB)Ik@3$W6n`jo5d^}W1^VCrq;v@oW=2TWke-*=tySXv3^{)
zm7f(*lBL!AHgu+f1PA5RIUb;VD)ufHV{(SCSWCq47M0q(+``8P(_4M%UN!NwO%_g&
zG!r{p!_YILfov*r&_|<g&{SGKwqNbj6TUvr`=2U0KiQ|fbZC9cD_~aS)+XA=oQW{w
zm+mj&ZQW5!P2qgBVW{U}hV|(-+E!PoMs=*QY70zg^Xf=brngLVmF**IWmOE*9Xmr#
zf{*5v1WcU}l6F1Mrahzg%(LE(`l#UQsK9sP$u5=Zdmr3-#7zg^Nz^O28a#aQD(~sJ
zF1@pGeJ2%$q2xlE!T4l_v!|Ftj8LRoA{S#iZYA#4XxDAr%r;neFJ(MX%tsC7XdWbg
z)Qv?oMG6#mFl!~a#|H$X6?hITBH|oaB-P)ehOcKir2^2k=$u@Er-5T&<~{R+I|HN9
zIUK)TqV+#|Ob&SIJ|XKqeH#9nyf40mfHtTBtCt5dMsUx(hGI}}eEfFGW}C`Og~a>T
z{RgWJXEYPs{XbrGrG34~;d(01sZ)e41U<;81}oOn?9_COk-ttYl=%T|v!By*JtIl5
zE@dQ}cEK;5_D$57pG(35o<<bDm+)!RRJ&QK;b$>tWB2vA2^DS%%5N)Wx~;#m%|S3`
zQZs+ynw*->;k?t8eW_bT?}-ninSTB}hE^Ukm4-MEtvM;V2!MP?RMlOrVkKCYe7IZR
zIo}m?KBh1eaiwsp`s|ZDBjIrI#mTM4((Z{w&4P`RkJBjPX^U(ee1qzR&ufKfMMU^f
zA9tHQ>JUFp<8uCBT6CEoj~PLL^!^KKUtCFgzTABlCnu`M(~q_W9YWSJZ`SBr??)${
z8FN`JA2}pt7``M_6?59<J^fCA7Y0TA1be_J&kQM^5eFVX2%pbC#Ut-hH@<KGc`a4A
zg=MG$t&0}5)R7oRHcLUBD-JVE+30S!Fv7)ki3LhA^aLjiiSp{*3tuGePcIdVFV_2^
z-S<D<?q{miW{us3pOZQz*2lfUPRbxf%D`Z<6@?-Vj(Ypdv*Nno;DNzHy^4h``8|XB
zE~lex;`<Jtjv9((n_c({<F)R`$VyHl#R@5(ocmkUasF(~ocK@r&9VN6z_p2$IDP4`
z>1n+@-(l&Hs6LVg=A+T)*I1diWba#m`z7L#F~MMu6?BPr^`Rv|ist{WOIo7md2Y8j
zNxWdeMl$>&Z8ak15*p0Mp^c97Nan$>z;NY}D`IJze&mDouNsu@U+z&39U$i7c1n&O
zXg}9Z{0oki?~f?g3>m%>&A=2CTvt(x>2<3RHtS>5;`45&O1Jg44F-b}viVo2zXCL1
zAcMX7IBRkNm?Zk6#O%4UZTmxzd>fFSpg%ozoSOMQ@rh^I7USIaijGq|x3T)?KNC&o
z3cgIip78)z`P$k0g6Lh2R|V)@t=|Q$;NHKhSRqWq_Se9o5eXnwCj!Lp79ciIAOR>+
zVyV3E2yF!l{z!fWVt=5C#WC=r8dil$viPJzJbw+al)`k&V)B({+P>AWBk@=)(t|nD
z<2d)M=g}u!v~)3I<QZc5-7<8z77T(hbSZt=@%{>2yU3WZ{nJVPGXdT29s1jx|4|8l
zV9YzHTHnjBiWIh;Pq_NBiux&@AZ4XU1-#RSumm9KtB$09#U_%9Td*@}*-R!XN7lid
zHESI1!G?Q{$#}sO5r4ge-Qy-i8OjBRmJ_U*Q<VBmQPBkCXGDW3IpIPc#bQVwAEMm)
zdnx=qqP)df7`%C_BWGr=#LGpVk78p{Nu<mU_HW`W(1B4lU6A58MY3Tm)K%tnIAbbW
zp1EKeexp0GFp>g^OTDOR=u?$KKv?f6n3Mq6wpQoMIT`x3iy1GZlaVr|`Pi_#JB`Pm
zoxBh%8Js5NFy4Tv_@35?NriJv-c)jwq&qMaa}k~tE0zYQFr76=QKeHJq*4@=_n64L
zS5=4TOtHARl2(yXoUyRsGCdmSiFEZ7BwFnBm6~V(h(Z)JhiwQMZ3h~CZyQr|dOSJ$
zfCshpHNMe)PI=0KPRD3Jm5}2BC`t<RbHrwffkJ5b7~RfyG!pi<vZzNcxbwxtU)6T=
z(*a&4tiPOdD7{t5+0e!w6~^JhPO#Nbnls@{UgOSWNFsST<kZ%OUF`d#wU0HlPusm!
zH`CbHhbAv*Ax^WCId4I{Bn7{b-qQusiC%TPMJ~`e+^~@)edlz;=%vRa*-d{eFhjvi
zVHw5_i0KZu#L(wH()|jIXrd9SN8(;TFjR*I&Z$2s`qM%12W#h#=Fy+#*x!L6|0~sM
zAqv2FGW{YOMi1C%!b)DLnr;`Ri|!SRP%9@PLHO%=`uI<cOMyTHt*P>|3<n^E!{FV{
z5Q+;+BL~)_f%XM?=VEVLmYcZ3h7M9~(!`jqIQf7$5+5*)<dks^4+`gNhD1t2S*w{L
zAK>7r|MB9Zbh1)e<IeE;g6?@+#xSbMkPNyiFf9VtHm6BDC&1#wM^OTS72pv<#ArxI
z`=LmD9$_dF=S1#8HYkDSklFB*sODI#m4>#~>BX9Kzfj?J`j?Ps(N5~_20XgKmN!s0
z@GIKEa^ukXAbS>M9)g)p>Q%qFAa(19`dd@R!Bz2>T+lu2-TxVe!aoU%{w?&Me^TGK
zN&SZ~Eb5BP>w7UR6MMGI{CL4cKGT>5;Yu8B5T_xgJj<C}cA`OyW|-(Dz*c|dUTKSI
z@eT0-42tBvn1JGIbVeZ<PiW!i#omj>PM@KqY!Jy7qtDhGw|(jU)UEQR&l9eB2;H?x
zHnmprGJEDzH#fBjYmj4tY}g(B<*Kk7rDfN&btq1^-{N=aJ?IBYB5YoZ3EMUs8qO|5
zsjrm|uj^g+Gos-iH&t|WGKn(1TkQ#t=#=4|2uQukGCL3lYGLnYzp&Ok=MyJb!l|4g
z*I{s3vIPEAErPRnHX6z<PxBl&>Q1H&0wBuE38ODnm!KH3fz3UPd_qs`Vf>6(>fRSS
zvz603U2Zy!OY$vkR+M}qP#y??Rl>bEx7cf7<LwzCd8EUUhRj!0pp5&EZBx%!Y`!h|
zaQi|6(*l(JW~&i?$Gr}cDp%(C8=G~D2M1Jq(jhZ+arl&TYUW&>sb_?{NO<HMpsd*q
z(0+U%5}aZur8M}60EOpYfn3BF&_~nv0g>6S5&4T}tZQe7H*@zZ(8j$A?)9+iKS-<d
zugCagP2cMMS9!+%ODbl6Y|{^~PS7I=gZ9hW<}q3c?xc@*DLONAQnNC!>-6Hbo?2^|
zk0>)?#)unpo!;Lr2F<}0&~t47x{v;MUsG4~@Lzo~t0Ds5j}_u$5D)wq5lgplb_K*I
zU~_Z^xWy_zAOJj88by{W^8u}6d$IoCX)pe1>p8Ja{F})5lQe9*AZn)H7m!~f1_L~G
zx**vb<)4n2z6jF1J(>pUH)4+&-eR-M(|cVAUx3bG+x}po9;9^(-xE68ng$8oNmr=R
z`}QD(yq7KnObt*8vd8}?lttl_syI-$w5OD{n@S-551&m=eJlKO&iG9!r@T=~3K`Pc
z!+l2o?ldXe%td@q{m|f_bpjtp$TC$#e>k2>HM^3rCOdqk5!RmoApS@6gtO2+isZF7
zmwk4-ScVH`3G;kP?2b-delg=lc6}zPAG;u#H8z+^kDj-0!rq|m%LA-CT(KX2*;!49
zL<&-x#|GA3jJ>+TSsRhI6b8xz)KMR@b6Pu~+CVtlG!dFyi+gns=jj!C^k;C)x#;e0
zBMxTkUk70wJ)HUe3|8~^KaU?L_^lu|0{^Et7Qd9qR%9@;PAqm$;%IYv_L|r1(xZ2v
z9~wkQ<8z+fIq>eI3j^np(C1r*RUUI-H1xzT(9&-oa-#C4z8~K`QOb<lw-0Ulz3lqJ
ziQgM=q73dMEwN9_UxB?Qgzp*fn}2QXvqpqL)xW$C`EytO*5H3=`>DR~P5l0G;Esgz
zdl%{bu(lHwfL%bFay$~x8h^iwb+RSLgZ0}N6rC*Z%TeR^VJXtv<PNl>R|`POePMUS
zM09Dta#S$9V$uXA=^+Fao(r`kwp9k%M*e|&_kG9tNs?+dpgk1|YKsQ~e8+$OBPQ*)
zjq;D$O8noR|NiRF-h>V!ImTV=_r^fw223JXe6oC|3$#*Zm=CFPm7|7P_xNbumpLgc
z`W=-J@2}7w?bgpJMH+OX7rE{t_zwCXe7`HlTpx4PEi!x9wIQ|JF0qt>*aKa6AvBR_
z%{`tae-!sCoN)#)&<mcAr>)TfP73=56HQO)yX&?^?9!ae_3^F%hD!59taul7?%d<e
zZdpz^7`P&3^z+#2zc`Bgo0j*9qXG05DBK|p>VaSi(K~-4hscI^x7C^QRo|K)r!8>0
z;aidGnS;%X0{EOJB0^_KE6VK>w`e@H2?axQ;D+KhWEnJ}nV1E$Jpf)_v#tq8HkbNc
z9CrMWLmJ<%P#*XPSqKC4HuB=Qi-e9bXa7%5R40HXpl)HUc(k9CBn8)!wZkKTn>py*
zy0Ee?E2ktY0Bx90g1klYrwu2_zkTz}pXHHg=tR2kgG{IhLG*1rmeSX!C8?u9uT?O@
z<pCD&Ptak&b}IhvB=r%v?2|(_3j<_b6}mwaZ@3K|a_`8W2$ap<S*QPUU4pI|l%y;?
z@=QTTcL(FIh}gMamhexl55##Y54*qWUtUStN~=C#!t#P8+V{K~rKGN<`!XQzYI8OF
zx)rISs#msXXU~iId@PH?mpg8nC99d4GQ{VKgOW0m<*TGSS1xtsB@f5dR@9VFUrqFs
znSIl*f}#KXeulOtzF4`;xieUeBH{368+td1i{noKVxq@)<1U#|V87oPt}~CS+yZGu
z+WOo+T1l6iWQm_t3S^WGu#%6}qx4^0=F&iOaG7Adg7#Do-W4#>D{7-(aX>7$6cE}U
zl-qyVlQ?2Y{>+LVl0(<Yd<Cw{jhF8;ewq0fGw$aum482Hi6%?mfeoWD96g=P7&Cn%
zR2D@iU;)Dlpn~;(K??w3&)d!`w1(6!l;E(wP^!bj-0SGI1kRaSjr&+q(s*H?a==C~
z;LLzj*1qE+04-2jP2>fW)gSEp?<*7AAD5PVfg4M(K_t@_{WvOvPsFBn;Q~``_6K6v
z$XB2MERy$yY%1g&P~(Uc9#i1D!qXhFF28Px(e_JCbTS7IT_BFw!_a<Jk`F(wkN7%J
zXgg3pZ3Prd(sQlS<GZfru0ENC>xfvyUKMws(sVOxhcV1-U9sN2EK+fXJp1)c`BqY;
z$@>{m5?2bNjV&~s14EvRT-vypXiGJ{nN<spp%}<StzSh`)bF;Q-Um-DNdA-qYKk$5
z&t%*>hnGH?1&RrF7qxLutAU&wFA-?npym|^_)3cjXCLHNwxWpe$4Sxh5!A?=DJt{J
zkq$5RRVOdJlW3dgv-cBcuTo;y52IVK&3C|^$bzXrXh_fHU`Y6?xnLwY-yozHuuD#O
z>3y@O`qEe6k>HW;1Nm6ZkjRB7MSW3`TzwXbkrIUgmi}yT-wtY)K=smta;~$Wo~DhF
zM1sL*C?C4D#Vrht8B%!4lWRm^O=WO>mQgEz9Tw9bO-4b<+W=*rF(lTRZ(gjjDzj4Y
zjuS{@D|F4*DIW3bEEcd<&AmiH*~|BE>z%+<+t8&=oN3?Vi2qNPnV(PL;}`zxUPwIZ
zoOUS&2Z?;%a~Ntn^vQsXLuZ3wXzpPPpoLO>^UwwG$o?R484!DO{3D&!y|7*+@ue$r
zOOiMVPt#GU&>p2*`~8r`%&fy@;BR>We>Pg721X6<d(Vc^_J63(pSDVd{kQ`dD_tcU
z!o`g(F%bWquD~vDb__0M4^xpm7MQ4;v_B~@;d(+~0z|ZY7nrC7oq;C=CjS3R-;_4~
z+Z};nmLN!_fl22>8VGFC2j)?$2Y9D!Uj=FMrOG(DpAl%O*p!`B9CV<L%s&wi=5wW}
za*45d2dm;GJq;&dYL~I)O7&8sF(n>JGiDhay!&xRq3Pv<QSc3?Q)akgO%X_^cOn3>
zl;qjv|B~nB_pRVBybgtdfV(gm^cLbW@Sax^n+<3IC{v;2fH9I#84?Kmr*A>VB}>a+
z6~61t!n%=IjeR9QBD9*7vX#eUnF#P;ZJyr81K~rr!38wkJeBzJ&kWuFR2%+6GyjH1
HzP|ep@nejc

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
index 43d0713f40..4e99f4bfda 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
@@ -1,19 +1,19 @@
 ---
-title: Enable hardware-based isolation for Microsoft Edge (Windows)
+title: Enable hardware-based isolation for Microsoft Edge
 description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise.
 ms.prod: windows-client
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
 ms.localizationpriority: medium
 author: vinaypamnani-msft
 ms.author: vinpa
 ms.date: 11/30/2022
-ms.reviewer: 
+ms.reviewer:
 manager: aaroncz
 ms.custom: asr
 ms.technology: itpro-security
-ms.collection: 
+appliesto:
+  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
+  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11 and later</a>
+ms.collection:
   - highpri
   - tier2
 ms.topic: how-to
@@ -21,39 +21,34 @@ ms.topic: how-to
 
 # Prepare to install Microsoft Defender Application Guard
 
-**Applies to:**
-
-- Windows 10
-- Windows 11
-
-## Review system requirements
- 
-See [System requirements for Microsoft Defender Application Guard](./reqs-md-app-guard.md) to review the hardware and software installation requirements for Microsoft Defender Application Guard.
+Before you continue, review [System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) to review the hardware and software installation requirements for Microsoft Defender Application Guard.
 
 > [!NOTE]
 > Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host.
 
-## Prepare for Microsoft Defender Application Guard 
+## Prepare for Microsoft Defender Application Guard
 
 Before you can install and use Microsoft Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode.
 
 ### Standalone mode
 
-Applies to:
-- Windows 10 Enterprise edition, version 1709 or higher
-- Windows 10 Pro edition, version 1803
-- Windows 11
+Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-md-app-guard.md) testing scenario.
 
-Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode,   you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-md-app-guard.md) testing scenario.
+Standalone mode is applicable for:
+
+- Windows 10 Enterprise edition, version 1709 and later
+- Windows 10 Pro edition, version 1803 and later
+- Windows 11 and later
 
 ## Enterprise-managed mode
 
-Applies to:
-- Windows 10 Enterprise edition, version 1709 or higher
-- Windows 11
-
 You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container.
 
+Enterprise-managed mode is applicable for:
+
+- Windows 10 Enterprise edition, version 1709 and later
+- Windows 11 and later
+
 The following diagram shows the flow between the host PC and the isolated container.
 
 ![Flowchart for movement between Microsoft Edge and Application Guard.](images/application-guard-container-v-host.png)
@@ -62,71 +57,56 @@ The following diagram shows the flow between the host PC and the isolated contai
 
 Application Guard functionality is turned off by default. However, you can quickly install it on your employee's devices through the Control Panel, PowerShell, or your mobile device management (MDM) solution.
 
-### To install by using the Control Panel
+### Install from Control Panel
 
 1. Open the **Control Panel**, click **Programs,** and then select **Turn Windows features on or off**.
 
     ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png)
 
-2. Select the check box next to **Microsoft Defender Application Guard** and then select **OK**.
+1. Select the check box next to **Microsoft Defender Application Guard** and then select **OK** to install Application Guard and its underlying dependencies.
 
-   Application Guard and its underlying dependencies are all installed.
-
-### To install by using PowerShell
+### Install from PowerShell
 
 > [!NOTE]
 > Ensure your devices have met all system requirements prior to this step. PowerShell will install the feature without checking system requirements. If your devices don't meet the system requirements, Application Guard may not work. This step is recommended for enterprise managed scenarios only.
 
-1. Select the **Search** or **Cortana** icon in the Windows 10 or Windows 11 taskbar and type **PowerShell**.
-   
-2. Right-click **Windows PowerShell**, and then select **Run as administrator**.
+1. Select the **Search** icon in the Windows taskbar and type **PowerShell**.
 
-   Windows PowerShell opens with administrator credentials.
+1. Right-click **Windows PowerShell**, and then select **Run as administrator** to open Windows PowerShell with administrator credentials.
 
-3. Type the following command:
+1. Type the following command:
 
-    ```
-    Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard
-    ```
-4. Restart the device.
+   ```powershell
+   Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard
+   ```
 
-   Application Guard and its underlying dependencies are all installed.
+1. Restart the device to install Application Guard and its underlying dependencies.
 
-### To install by using Intune
+### Install from Intune
 
 > [!IMPORTANT]
 > Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](/mem/intune/enrollment/device-enrollment).
 
-:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune.":::
+1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
 
-1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Devices** > **Configuration profiles** > **+ Create profile**, and do the following: <br/>
+1. Select **Endpoint security** > **Attack surface reduction** > **Create Policy**, and do the following:
 
-   1. In the **Platform** list, select **Windows 10 and later**. 
-   
-   2. In the **Profile** type, choose **Templates** and select **Endpoint protection**. 
-   
-   3. Choose **Create**.
+   - In the **Platform** list, select **Windows 10 and later**.
+   - In the **Profile** type, select **App and browser isolation**.
+   - Select **Create**.
 
-2. Specify the following settings for the profile:
+1. In the **Basics** tab, specify the **Name** and **Description** for the policy. Select **Next**.
 
-   - **Name** and **Description**
+1. In the **Configuration settings** tab, configure the **Application Guard** settings, as desired. Select **Next**.
 
-   - In the **Select a category to configure settings** section, choose **Microsoft Defender Application Guard**.
+1. In the **Scope tags** tab, if your organization is using scope tags, choose **+ Select scope tags**, and then select the tags you want to use. Select **Next**.
 
-   - In the **Application Guard** list, choose **Enabled for Edge**.
+   To learn more about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
 
-   - Choose your preferences for **Clipboard behavior**, **External content**, and the remaining settings.
+1. In the **Assignments** page, select the users or groups that will receive the policy.
 
-3. Choose **OK**, and then choose **OK** again.
+   To learn more about assigning policies, see [Assign policies in Microsoft Intune](/mem/intune/configuration/device-profile-assign). Select **Next**.
 
-4. Review your settings, and then choose **Create**.
+1. Review your settings, and then select **Create**.
 
-5. Choose **Assignments**, and then do the following:
-
-   1. On the **Include** tab, in the **Assign to** list, choose an option.
-
-   2. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the **Exclude** tab.
-
-   3. Select **Save**.
-
-After the profile is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place.
+After the policy is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place.

From 49266c873699aa42190a2c5b39b1a8ab81759538 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 30 Mar 2023 14:35:17 -0400
Subject: [PATCH 25/64] Click -> Select

---
 .../install-md-app-guard.md                                     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
index 4e99f4bfda..edebd554ce 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
@@ -59,7 +59,7 @@ Application Guard functionality is turned off by default. However, you can quick
 
 ### Install from Control Panel
 
-1. Open the **Control Panel**, click **Programs,** and then select **Turn Windows features on or off**.
+1. Open the **Control Panel**, select **Programs,** and then select **Turn Windows features on or off**.
 
     ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png)
 

From a719395b4e202f7f2641de6cdb0984bbed2ac1ba Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 30 Mar 2023 14:46:29 -0400
Subject: [PATCH 26/64] Minor change.

---
 .../install-md-app-guard.md                                   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
index edebd554ce..061e4162c9 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
@@ -103,9 +103,9 @@ Application Guard functionality is turned off by default. However, you can quick
 
    To learn more about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
 
-1. In the **Assignments** page, select the users or groups that will receive the policy.
+1. In the **Assignments** page, select the users or groups that will receive the policy. Select **Next**.
 
-   To learn more about assigning policies, see [Assign policies in Microsoft Intune](/mem/intune/configuration/device-profile-assign). Select **Next**.
+   To learn more about assigning policies, see [Assign policies in Microsoft Intune](/mem/intune/configuration/device-profile-assign).
 
 1. Review your settings, and then select **Create**.
 

From 915b9de38f1a73ec569a38c9d353d32ca50d1394 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Thu, 30 Mar 2023 12:47:41 -0700
Subject: [PATCH 27/64] More troubleshooting topic updates

---
 .../TOC.yml                                   |   2 +
 .../event-id-explanations.md                  |  52 +++---
 .../event-tag-explanations.md                 |  22 +--
 .../wdac-debugging-and-troubleshooting.md     | 159 ++++++++++++++----
 ...r-application-control-operational-guide.md |  19 ++-
 5 files changed, 175 insertions(+), 79 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.yml b/windows/security/threat-protection/windows-defender-application-control/TOC.yml
index 2dfbaefa4f..c003b5258e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/TOC.yml
+++ b/windows/security/threat-protection/windows-defender-application-control/TOC.yml
@@ -105,6 +105,8 @@
 - name: WDAC operational guide
   href: windows-defender-application-control-operational-guide.md
   items:
+    - name: WDAC debugging and troubleshooting
+      href: operations/wdac-debugging-and-troubleshooting.md
     - name: Understanding Application Control event IDs
       href: event-id-explanations.md
     - name: Understanding Application Control event tags
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
index 8a74cb79d7..7b259c98da 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
@@ -22,7 +22,7 @@ ms.topic: reference
 
 ## WDAC Events Overview
 
-WDAC logs events when a policy is loaded as well as when a binary attempts to run and is blocked, or would be blocked if the policy is in audit mode. These block events include information that identifies the policy and gives more details about the block. Generally, WDAC doesn't generate events when a binary is allowed; however, you can turn on allow audit events for files that were authorized by Managed Installer or the Intelligent Security Graph (ISG) as described later in this article.
+WDAC logs events when a policy is loaded, when a file is blocked, or when a file would be blocked if in audit mode. These block events include information that identifies the policy and gives more details about the block. WDAC doesn't generate events when a binary is allowed. However, you can turn on allow audit events for files authorized by a managed installer or the Intelligent Security Graph (ISG) as described later in this article.
 
 ### Core WDAC event logs
 
@@ -42,12 +42,12 @@ These events are found in the **CodeIntegrity - Operational** event log.
 
 | Event ID | Explanation |
 |--------|-----------|
-| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required. <br><br> This event is also seen for kernel- or user-mode code that the developer opted-in to [/INTEGRITYCHECK](/cpp/build/reference/integritycheck-require-signature-check) but is not signed correctly. |
-| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where an expired signature will be blocked by WDAC. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a non-signature rule (for example, hash) to address issues with revoked or expired certs. <br><br> This event is also seen for code that the developer opted-in to [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard) but then attempts to load code that doesn't meet the requirements of CIG. |
-| 3034 | This event isn't common. It's the audit mode equivalent of event 3033 described above. |
+| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required. <br><br> This event is also seen for kernel- or user-mode code that the developer opted-in to [/INTEGRITYCHECK](/cpp/build/reference/integritycheck-require-signature-check) but isn't signed correctly. |
+| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where WDAC blocks files due to an expired signature. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a rule (for example, hash) that doesn't rely on the revoked or expired cert. <br><br> This event also occurs if code compiled with [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard) tries to load other code that doesn't meet the CIG requirements. |
+| 3034 | This event isn't common. It's the audit mode equivalent of event 3033. |
 | 3076 | This event is the main Application Control block event for audit mode policies. It indicates that the file would have been blocked if the policy was enforced. |
 | 3077 | This event is the main Application Control block event for enforced policies. It indicates that the file didn't pass your policy and was blocked. |
-| 3089 | This event contains signature information for files that were blocked or would have been blocked by Application Control. One 3089 event is created for each signature of a file. The event shows the total number of signatures found and an index value to identify the current signature. Unsigned files produce a single 3089 event with TotalSignatureCount 0. 3089 events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the `Correlation ActivityID` found in the **System** portion of the event. |
+| 3089 | This event contains signature information for files that were blocked or audit blocked by Application Control. One of these events is created for each signature of a file. Each event shows the total number of signatures found and an index value to identify the current signature. Unsigned files generate a single one of these events with TotalSignatureCount of 0. These events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the `Correlation ActivityID` found in the **System** portion of the event. |
 
 ## WDAC block events for packaged apps, MSI installers, scripts, and COM objects
 
@@ -55,12 +55,12 @@ These events are found in the **AppLocker – MSI and Script** event log.
 
 | Event ID | Explanation |
 |--------|-----------|
-| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run, but would not have passed the WDAC policy if it was enforced. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. |
-| 8029 | This event is the enforcement mode equivalent of event 8028 described above. Note: While this event says that a script was blocked, the actual script enforcement behavior is implemented by the script host. The script host may allow the file to run with restrictions and not block the file outright. For example, PowerShell will allow a script to run but only in [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). |
+| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run, but wouldn't have passed the WDAC policy if it was enforced. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. |
+| 8029 | This event is the enforcement mode equivalent of event 8028. Note: While this event says that a script was blocked, the script hosts control the actual script enforcement behavior. The script host may allow the file to run with restrictions and not block the file outright. For example, PowerShell runs script not allowed by your WDAC policy in [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). |
 | 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](allow-com-object-registration-in-windows-defender-application-control-policy.md). |
-| 8037 | This event indicates that a script host queried Application Control about a file the script host was about to run, the file passed the WDAC policy and was allowed to run. |
-| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. 8038 events are correlated with 8028 and 8029 events and can be matched using the `Correlation ActivityID` found in the **System** portion of the event. |
-| 8039 | This event indicates that a packaged app (MSIX/AppX) was allowed to install or run because the WDAC policy is in audit mode, but would have been blocked if the policy was enforced. |
+| 8037 | This event indicates that a script host checked whether to allow a script to run, and the file passed the WDAC policy. |
+| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files generate a single 8038 event with TotalSignatureCount 0. These events are correlated with 8028 and 8029 events and can be matched using the `Correlation ActivityID` found in the **System** portion of the event. |
+| 8039 | This event indicates that a packaged app (MSIX/AppX) was allowed to install or run because the WDAC policy is in audit mode. But, it would have been blocked if the policy was enforced. |
 | 8040 | This event indicates that a packaged app was prevented from installing or running due to the WDAC policy. |
 
 ## WDAC policy activation events
@@ -70,15 +70,15 @@ These events are found in the **CodeIntegrity - Operational** event log, unless
 | Event ID | Explanation |
 |--------|-----------|
 | 3095 | The Application Control policy can't be refreshed and must be rebooted instead. |
-| 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. This event's Details includes useful information about the Application Control policy, such as the policy options that were specified by the policy. |
+| 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. This event's Details includes useful information about the policy, such as its policy options. |
 | 3097 | The Application Control policy can't be refreshed. |
-| 3099 | Indicates that a policy has been loaded. This event's Details includes useful information about the Application Control policy, such as the policy options that were specified by the policy. |
+| 3099 | Indicates that a policy has been loaded. This event's Details includes useful information about the Application Control policy, such as its policy options. |
 | 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. |
 | 3101 | Application Control policy refresh started for *N* policies. |
 | 3102 | Application Control policy refresh finished for *N* policies. |
-| 3103 | The system is ignoring the Application Control policy refresh. For example, an inbox Windows policy that does not meet the conditions for activation. |
-| 3105 | The system is attempting to refresh the Application Control policy with the specified Id. |
-| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL are not related to WDAC. |
+| 3103 | The system is ignoring the Application Control policy refresh. For example, an inbox Windows policy that doesn't meet the conditions for activation. |
+| 3105 | The system is attempting to refresh the Application Control policy with the specified ID. |
+| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL aren't related to WDAC. |
 
 ## Diagnostic events for Intelligent Security Graph (ISG) and Managed Installer (MI)
 
@@ -87,7 +87,7 @@ These events are found in the **CodeIntegrity - Operational** event log, unless
 
 ### WDAC diagnostic events 3090, 3091, and 3092
 
-Events 3090, 3091 and 3092 prove helpful diagnostic information when the ISG or MI option is enabled by any Application Control policy. These events can help you debug why something was allowed/denied based on managed installer or ISG. These events don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077 described above.
+Events 3090, 3091 and 3092 provide helpful diagnostic information when a WDAC policy includes the ISG or MI option. These events can help you debug why something was allowed/denied based on managed installer or ISG. These events don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077.
 
 These events are found in the **CodeIntegrity - Operational** event log.
 
@@ -122,7 +122,7 @@ To enable 3090 allow events, create a TestFlags regkey with a value of 0x300 as
 reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300
 ```
 
-3091 and 3092 events are inactive on some versions of Windows. The above steps will also turn on those events.
+Events 3091 and 3092 are inactive on some versions of Windows and are turned on by the preceding command.
 
 ## Appendix
 
@@ -138,11 +138,11 @@ A list of other relevant event IDs and their corresponding description.
 | 3012 | Code Integrity started loading the signature catalog. |
 | 3023 | The driver file under validation didn't meet the requirements to pass the application control policy. |
 | 3024 | Windows application control was unable to refresh the boot catalog file. |
-| 3026 | The catalog loaded is signed by a signing certificate that has been revoked by Microsoft and/or the certificate issuing authority. |
-| 3032 | The file under validation is revoked by the system or the file has a signature that has been revoked.
+| 3026 | Microsoft or the certificate issuing authority revoked the certificate that signed the catalog. |
+| 3032 | The file under validation is revoked or the file has a signature that is revoked.
 | 3033 | The file under validation didn't meet the requirements to pass the application control policy. |
 | 3034 | The file under validation wouldn't meet the requirements to pass the Application Control policy if it was enforced. The file was allowed since the policy is in audit mode. |
-| 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. |
+| 3036 | Microsoft or the certificate issuing authority revoked the certificate that signed the file being validated. |
 | 3064 | If the Application Control policy was enforced, a user mode DLL under validation wouldn't meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. |
 | 3065 | If the Application Control policy was enforced, a user mode DLL under validation wouldn't meet the requirements to pass the application control policy. |
 | 3074 | Page hash failure while hypervisor-protected code integrity was enabled. |
@@ -152,18 +152,18 @@ A list of other relevant event IDs and their corresponding description.
 | 3079 | The file under validation didn't meet the requirements to pass the application control policy. |
 | 3080 | If the Application Control policy was in enforced mode, the file under validation wouldn't have met the requirements to pass the application control policy. |
 | 3081 | The file under validation didn't meet the requirements to pass the application control policy. |
-| 3082 | If the Application Control policy was in enforced mode, the non-WHQL driver would have been denied by the policy. |
-| 3084 | Code Integrity will enforce the WHQL driver signing requirements on this boot session. |
-| 3085 | Code Integrity won't enforce the WHQL driver signing requirements on this boot session. |
+| 3082 | If the Application Control policy was enforced, the policy would have blocked this non-WHQL driver. |
+| 3084 | Code Integrity is enforcing WHQL driver signing requirements on this boot session. |
+| 3085 | Code Integrity isn't enforcing WHQL driver signing requirements on this boot session. |
 | 3086 | The file under validation doesn't meet the signing requirements for an isolated user mode (IUM) process. |
-| 3089 | This event contains signature information for files that were blocked or would have been blocked by Application Control. One 3089 event is created for each signature of a file. |
+| 3089 | This event contains signature information for files that were blocked or audit blocked by Application Control. One 3089 event is created for each signature of a file. |
 | 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. |
 | 3091 | This event indicates that a file didn't have ISG or managed installer authorization and the Application Control policy is in audit mode. |
 | 3092 | This event is the enforcement mode equivalent of 3091. |
 | 3095 | The Application Control policy can't be refreshed and must be rebooted instead. |
 | 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. |
 | 3097 | The Application Control policy can't be refreshed. |
-| 3099 | Indicates that a policy has been loaded. This event also includes information about the options that were specified by the Application Control policy.  |
+| 3099 | Indicates that a policy has been loaded. This event also includes information about the options set by the Application Control policy.  |
 | 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. |
 | 3101 | The system started refreshing the Application Control policy. |
 | 3102 | The system finished refreshing the Application Control policy. |
@@ -173,5 +173,5 @@ A list of other relevant event IDs and their corresponding description.
 | 3108 | Windows mode change event was successful. |
 | 3110 | Windows mode change event was unsuccessful. |
 | 3111 | The file under validation didn't meet the hypervisor-protected code integrity (HVCI) policy. |
-| 3112 | The file under validation is signed by a certificate that has been explicitly revoked by Windows. |
+| 3112 | Windows has revoked the certificate that signed the file being validated. |
 | 3114 | Dynamic Code Security opted the .NET app or DLL into Application Control policy validation. The file under validation didn't pass your policy and was blocked. |
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index 31cf192cbc..dff2b89907 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -20,7 +20,7 @@ ms.topic: article
 
 # Understanding Application Control event tags
 
-Windows Defender Application Control (WDAC) events include many fields, which provide helpful troubleshooting information to figure out exactly what an event means. Below, we've documented the values and meanings for a few useful event tags.
+Windows Defender Application Control (WDAC) events include many fields, which provide helpful troubleshooting information to figure out exactly what an event means. This article describes the values and meanings for a few useful event tags.
 
 ## SignatureType
 
@@ -30,18 +30,18 @@ Represents the type of signature which verified the image.
 |---|----------|
 | 0 | Unsigned or verification hasn't been attempted |
 | 1 | Embedded signature |
-| 2 | Cached signature; presence of CI EA shows that file had been previously verified |
+| 2 | Cached signature; presence of a CI EA means the file was previously verified |
 | 3 | Cached catalog verified via Catalog Database or searching catalog directly |
 | 4 | Uncached catalog verified via Catalog Database or searching catalog directly |
 | 5 | Successfully verified using an EA that informs CI that catalog to try first |
 | 6 | AppX / MSIX package catalog verified |
 | 7 | File was verified |
 
-## Requested and ValidatedSigningLevel
+## Requested and Validated Signing Level
 
 Represents the signature level at which the code was verified.
 
-| ValidatedSigningLevel Value | Explanation |
+| SigningLevel Value | Explanation |
 |---|----------|
 | 0 | Signing level hasn't yet been checked |
 | 1 | File is unsigned or has no signature that passes the active policies |
@@ -76,15 +76,15 @@ Represents why verification failed, or if it succeeded.
 | 11 | Page hash mismatch |
 | 12 | Not valid for a PPL (Protected Process Light) |
 | 13 | Not valid for a PP (Protected Process) |
-| 14 | The signature is missing the required ARM EKU |
+| 14 | The signature is missing the required ARM processor EKU |
 | 15 | Failed WHQL check |
 | 16 | Default policy signing level not met |
 | 17 | Custom policy signing level not met; returned when signature doesn't validate against an SBCP-defined set of certs |
-| 18 | Custom signing level not met; returned if signature fails to match CISigners in UMCI |
-| 19 | Binary is revoked by file hash |
+| 18 | Custom signing level not met; returned if signature fails to match `CISigners` in UMCI |
+| 19 | Binary is revoked based on its file hash |
 | 20 | SHA1 cert hash's timestamp is missing or after valid cutoff as defined by Weak Crypto Policy |
 | 21 | Failed to pass Windows Defender Application Control policy |
-| 22 | Not IUM (Isolated User Mode) signed; indicates trying to load a non-trustlet binary into a trustlet |
+| 22 | Not Isolated User Mode (IUM)) signed; indicates an attempt to load a non-trustlet binary into a trustlet |
 | 23 | Invalid image hash |
 | 24 | Flight root not allowed; indicates trying to run flight-signed code on production OS |
 | 25 | Anti-cheat policy violation |
@@ -115,9 +115,9 @@ For a simple solution for converting hex to binary, follow these steps:
 
 :::image type="content" source="images/calculator-with-hex-in-binary.png" alt-text="An example of the calculator app in programmer mode, with a hex code converted into binary.":::
 
-This view will provide the hex code in binary form, with each bit address shown separately.  The bit addresses start at 0 in the bottom right.  Each bit address correlates to a specific event policy-rule option.  If the bit address holds a value of 1, the setting is in the policy.
+This view provides the hex code in binary form, with each bit address shown separately.  The bit addresses start at 0 in the bottom right.  Each bit address correlates to a specific event policy-rule option.  If the bit address holds a value of 1, the setting is in the policy.
 
-Next, use the bit addresses and their values from the table below to determine the state of each [policy rule-option](select-types-of-rules-to-create.md#table-1-windows-defender-application-control-policy---policy-rule-options). For example, if the bit address of 16 holds a value of 1, then the **Enabled: Audit Mode (Default)** option is in the policy. This setting means that the policy is in audit mode.
+Next, use the bit addresses and their values from the following table to determine the state of each [policy rule-option](select-types-of-rules-to-create.md#table-1-windows-defender-application-control-policy---policy-rule-options). For example, if the bit address of 16 holds a value of 1, then the **Enabled: Audit Mode (Default)** option is in the policy. This setting means that the policy is in audit mode.
 
 | Bit Address | Policy Rule Option |
 |-------|------|
@@ -173,4 +173,4 @@ For well-known roots, the TBS hashes for the certificates are baked into the cod
 
 ## Status values
 
-Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
+Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. See [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) for information about common usage details.
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index 575a1ebad9..c729787737 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -26,7 +26,13 @@ This article describes how to debug and troubleshoot app and script failures whe
 
 ## 1 - Gather WDAC diagnostic data
 
-Before debugging and troubleshooting WDAC issues, you must collect information from a device exhibiting the problem behavior. Run the following commands from an elevated PowerShell window to collect the diagnostic information you may need:
+Before debugging and troubleshooting WDAC issues, you must collect information from a device exhibiting the problem behavior.
+
+<br>
+<details>
+  <summary><b>Expand here for instructions on collecting WDAC diagnostic data.</b></summary>
+
+Run the following commands from an elevated PowerShell window to collect the diagnostic information you may need:
 
 1. Gather general WDAC diagnostic data and copy it to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag:
 
@@ -34,7 +40,7 @@ Before debugging and troubleshooting WDAC issues, you must collect information f
     cidiag.exe /stop
     ```
 
-    If CiDiag.exe is not present in your version of Windows, gather this information manually:
+    If CiDiag.exe isn't present in your version of Windows, gather this information manually:
 
     - WDAC policy binaries from the [Windows and EFI system partitions](known-issues.md#wdac-policy-file-locations)
     - WDAC event logs
@@ -47,7 +53,7 @@ Before debugging and troubleshooting WDAC issues, you must collect information f
     msinfo32.exe /report $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\SystemInformation.txt
     ```
 
-3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device. Skip this step if CiTool.exe is not present in your version of Windows.
+3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device. Skip this step if CiTool.exe isn't present in your version of Windows.
 
     ```powershell
     citool.exe -lp -json > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\CiToolOutput.json
@@ -94,7 +100,7 @@ Within the CiDiag output directory, these event logs are called CIOperational.ev
 
 ### Other Windows event logs that may be useful
 
-Sometimes, you may be able to supplement the information contained in the core WDAC event logs with information found in these other event logs. The ones shown in *italics* are not collected by cidiag.exe.
+Sometimes, you may be able to supplement the information contained in the core WDAC event logs with information found in these other event logs. CIDiag.exe doesn't collect the ones shown in *italics*.
 
 - Applications and Services logs – Microsoft – Windows – CodeIntegrity – Verbose
 - Applications and Services logs – Microsoft – Windows – AppLocker – EXE and DLL
@@ -107,11 +113,17 @@ Sometimes, you may be able to supplement the information contained in the core W
 - *Windows - Application*
 - *Windows - System*
 
+</details>
+
 ## 2 - Use the diagnostic and log data to identify problems
 
-Having gathered the necessary diagnostic information from a device, you're ready to begin your analysis of the diagnostic data collected in the previous step.
+Having gathered the necessary diagnostic information from a device, you're ready to begin your analysis of the diagnostic data collected in the previous section.
 
-1. Verify the set of WDAC policies that are active and enforced. Confirm that only those policies you expect to be active are currently active. Be aware that [Windows includes inbox policies](inbox-wdac-policies.md) that may also be active. You can use either of these methods:
+<br>
+<details>
+  <summary><b>Expand here for steps on analyzing WDAC diagnostic data.</b></summary>
+
+1. Verify the set of WDAC policies that are active and enforced. Confirm that only those policies you expect to be active are currently active. Be aware of the [Windows inbox policies](inbox-wdac-policies.md) that may also be active. You can use either of these methods:
 
     - Review the output from *CiTool.exe -lp*, if applicable, which was saved to the CIDiag output directory as CiToolOutput.json. See [use Microsoft Edge to view the formatted json file](/microsoft-edge/devtools-guide-chromium/json-viewer/json-viewer).
     - Review all [policy activation events](../event-id-explanations.md#wdac-policy-activation-events) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx.
@@ -123,37 +135,47 @@ Most WDAC-related issues, including app and script failures, can be diagnosed us
 
 ### Event analysis for an example blocked executable
 
-Here is a screenshot showing the detailed EventData from a typical WDAC enforcement mode block event 3077. The same data is shown for the 3076 audit mode version of the event. The table that follows describes some of the elements contained in the event.
+Here's an example of detailed EventData from a typical WDAC enforcement mode block event 3077, and one of its correlated 3089 signature information events. The tables that follow each event screenshot describe some of the elements contained in the events. Following the event descriptions is a step-by-step walkthrough explaining how to use the events to understand why the block occurred.
 
-**Event 3077** - WDAC enforcement block event
+#### Event 3077 - WDAC enforcement block event
+
+<br>
+<details>
+  <summary>Expand here to explore an example 3077 WDAC block event.</summary>
 
 ![Example 3077 block event for PowerShell.exe.](../images/event-3077.png)
 
 | Element name | Description |
 | ----- | ----- |
 | System - Correlation - \[ActivityID\] | **Not shown in screenshot** <br> Use the correlation ActivityID to match a WDAC block event with one or more 3089 signature events. |
-| File Name | The file's path and name on disk that was blocked from running. Since the name on disk is mutable, this is **not** the value used when creating WDAC file rules with `-Level FileName`. See the OriginalFileName element later in this table. |
+| File Name | The file's path and name on disk that was blocked from running. Since the name on disk is mutable, this value **isn't** the one used when creating WDAC file rules with `-Level FileName`. Instead, see the OriginalFileName element later in this table. |
 | Process Name | The path and name of the file that attempted to run the blocked file. Also called the parent process. |
-| Requested Signing Level | This is the Windows signing authorization level the code needed to pass in order to run. See [Requested and ValidatedSigningLevel](../event-tag-explanations.md#requested-and-validatedsigninglevel). In the example, Requested Signing Level 2 means the code simply must be allowed by the WDAC policy. |
-| Validated Signing Level | This is the Windows signing authorization level the code was determined to have met. See [Requested and ValidatedSigningLevel](../event-tag-explanations.md#requested-and-validatedsigninglevel). In the example, Validated Signing Level 1 means the code failed to pass the WDAC policy and was treated as though unsigned. |
+| Requested Signing Level | The Windows signing authorization level the code needed to pass in order to run. See [Requested and validated signing level](../event-tag-explanations.md#requested-and-validated-signing-level). |
+| Validated Signing Level | The Windows signing authorization level the code was given. See [Requested and validated signing level](../event-tag-explanations.md#requested-and-validated-signing-level). |
 | Status | Windows NT status code. You can use `certutil.exe -error <status>` to look up the meaning of the status code. |
 | SHA1 Hash | The SHA1 Authenticode hash for the blocked file. |
 | SHA256 Hash | The SHA256 Authenticode hash for the blocked file. |
 | SHA1 Flat Hash | The SHA1 flat file hash for the blocked file. |
 | SHA256 Flat Hash | The SHA256 flat file hash for the blocked file. |
-| PolicyName | The friendly name of the WDAC policy, set by the policy author, that caused the block event. A separate 3077 block event (or 3076 audit block event) is shown for each policy that blocks the file from running. |
-| PolicyId | The friendly Id value of the WDAC policy, set by the policy author, that caused the block event. |
+| PolicyName | The friendly name of the WDAC policy that caused the block event. A separate 3077 block event (or 3076 audit block event) is shown for each policy that blocks the file from running. |
+| PolicyId | The friendly ID value of the WDAC policy that caused the block event. |
 | PolicyHash | The SHA256 Authenticode hash of the WDAC policy binary that caused the block event. |
-| OriginalFileName | The immutable file name set by the developer in the blocked file's resource header. This is the value used when creating WDAC file rules with `-Level FileName`. |
+| OriginalFileName | The immutable file name set by the developer in the blocked file's resource header. This value is the one used when creating WDAC file rules with `-Level FileName`. |
 | InternalName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel InternalName`. |
 | FileDescription | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel FileDescription`. |
 | ProductName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel ProductName`. |
-| FileVersion | The VersionEx value defined by the WDAC policy XML file. This is the internal version number for the policy and used to enforce version control over signed policies. |
+| FileVersion | The policy's VersionEx value used to enforce version control over signed policies. |
 | PolicyGUID | The PolicyId of the WDAC policy that caused the block event. |
-| UserWriteable | A boolean value indicating if the file was in a user-writeable location. This is useful for diagnosing issues allowing by FilePath rules. |
-| PackageFamilyName | For files that are part of a packaged app (MSIX), this is the Package Family Name for the app. |
+| UserWriteable | A boolean value indicating if the file was in a user-writeable location. This information is useful for diagnosing issues when allowing by FilePath rules. |
+| PackageFamilyName | The Package Family Name for the packaged app (MSIX) that includes the blocked file. |
 
-**Event 3089** - WDAC signature information event
+</details>
+
+#### Event 3089 - WDAC signature information event
+
+<br>
+<details>
+  <summary>Expand here to explore an example 3089 WDAC signature information event.</summary>
 
 ![Example 3089 signature information event for PowerShell.exe.](../images/event-3089.png)
 
@@ -161,16 +183,63 @@ Here is a screenshot showing the detailed EventData from a typical WDAC enforcem
 | ----- | ----- |
 | System - Correlation - \[ActivityID\] | Use the correlation ActivityID to match a WDAC signature event with its block event. |
 | TotalSignatureCount | The total number of signatures detected for the blocked file. |
-| Signature | The index count of the current signature shown in this 3089 event. If the file had multiple signatures, you will find other 3089 events for the other signatures. |
-| Hash | The hash value that WDAC used to match the file. This should match one of the four hashes shown on the 3077 or 3076 block event. If no signatures were found for the file (TotalSignatureCount = 0), then this is the hash value you want to add to your policy to allow by hash. |
-| SignatureType | 
+| Signature | The index count, starting at 0, of the current signature shown in this 3089 event. If the file had multiple signatures, you'll find other 3089 events for the other signatures. |
+| Hash | The hash value that WDAC used to match the file. This value should match one of the four hashes shown on the 3077 or 3076 block event. If no signatures were found for the file (TotalSignatureCount = 0), then only the hash value is shown. |
+| SignatureType | The [type of signature](../event-tag-explanations.md#signaturetype). |
+| ValidatedSigningLevel | The Windows signing authorization level the signature met. See [Requested and validated signing level](../event-tag-explanations.md#requested-and-validated-signing-level). |
+| VerificationError | The reason this particular signature failed to pass the WDAC policy. See [VerificationError](../event-tag-explanations.md#verificationerror). |
+| PublisherName | The common name (CN) value from the leaf certificate. |
+| IssuerName | The CN value from the highest available certificate in the certificate chain. This level is typically one certificate below the root. |
+| PublisherTBSHash | The TBS hash of the leaf certificate. |
+| IssuerTBSHash | The TBS hash of the highest available certificate in the certificate chain. This level is typically one certificate below the root. |
+
+</details>
+
+#### Step-by-step walkthrough of the example 3077 and 3089 events
+
+Now let's walk through how to use the event data in the example 3077 and 3089 events to understand why the WDAC policy blocked this file.
+
+##### Understand what file is being blocked and the block context
+
+Referring to the 3077 event, locate the information that identifies the policy, the file being blocked, and the parent process that tried to run it. Consider this context information to determine whether the block is expected and wanted.
+
+In the example, the file being blocked is PowerShell.exe, which is part of Windows and would normally be expected to run. However, in this case, the policy was based off of the Windows in S mode policy template, which doesn't allow script hosts to run as a way to limit the attack surface. For S mode, this block event is a success. But let's assume the policy author was unaware of that constraint when they chose the template, and treat this block as unexpected.
+
+##### Determine why WDAC rejected the file
+
+Again referring to the 3077 event, we see the Requested Signing Level of 2 means the code must pass the WDAC policy. But the Validated Signing Level of 1 means the code was treated as though unsigned. "Unsigned" could mean the file was truly unsigned, signed but with an invalid certificate, or signed but without any certificates allowed by the WDAC policy.
+
+Now, let's inspect the correlated 3089 event(s) for the blocked file. In the example, we're looking at only the first signature (Signature index 0) found on a file that had multiple signatures. For this signature, the ValidatedSigningLevel is 12, meaning it has a Microsoft Windows product signature. The VerificationError of 21 means that the signature didn't pass the WDAC policy.
+
+It's important to review the information for each correlated 3089 event as each signature may have a different ValidatedSigningLevel and VerificationError.
+
+> [!IMPORTANT]
+> Notice how the Validated Signing Level on the 3077 event is interpreted very differently from the ValidatedSigningLevel on the 3089 event.
+>
+> In the case of the 3077 event, Validated Signing Level tells us how the binary was actually treated by Windows.
+>
+> In the case of the 3089 event, on the other hand, ValidatedSigningLevel tells us the potential **maximum** level the signature could receive. We must use the VerificationError to understand why the signature was rejected.
+
+</details>
 
 ## 3 - Resolve common problems
 
+Having analyzed the WDAC diagnostic data, you can take steps to resolve the issue or do more debugging steps. Following are some common problems and steps you can try to resolve or further isolate the root issue:
+
+<br>
+<details>
+  <summary><b>Issue: A file was blocked that you want to allow.</b></summary>
+
 ### Issue: A file was blocked that you want to allow
 
 - Use data from the core WDAC event logs to add rules to allow the blocked file.
-- Re-deploy the file or app using a managed installer if your policy trusts managed installers.
+- Redeploy the file or app using a managed installer if your policy trusts managed installers.
+
+</details>
+
+<br>
+<details>
+  <summary><b>Issue: A policy is active that is unexpected.</b></summary>
 
 ### Issue: A policy is active that is unexpected
 
@@ -184,36 +253,56 @@ This condition may exist if:
 
 To resolve such an issue, follow the instructions to [Remove WDAC policies](../disable-windows-defender-application-control-policies.md) for the identified policy.
 
+</details>
+
+<br>
+<details>
+  <summary><b>Issue: An unhandled app failure is occurring and no WDAC events are observed.</b></summary>
+
 ### Issue: An unhandled app failure is occurring and no WDAC events are observed
 
-Some apps alter their behavior when a user mode WDAC policy is active which can result in unexpected failures. This can also be seen as a side-effect of script enforcement, since the script enforcement behaviors are implemented by the individual script hosts and may not be handled by apps that interact with those script hosts.
+Some apps alter their behavior when a user mode WDAC policy is active, which can result in unexpected failures. It can also be a side-effect of script enforcement for apps that don't properly handle the enforcement behaviors implemented by the script hosts.
 
-Try to isolate the root cause by doing the following:
+Try to isolate the root cause by doing the following actions:
 
 - Check for events in [other event logs](#other-windows-event-logs-that-may-be-useful) corresponding with the app failures.
-- Temporarily replace the WDAC policy with another policy that [disables script enforcement](../design/script-enforcement.md) and re-test.
-- Temporarily replace the WDAC policy with another policy that [allows all COM objects](../allow-com-object-registration-in-windows-defender-application-control-policy.md) and re-test.
-- Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](../select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) and re-test.
+- Temporarily replace the WDAC policy with another policy that [disables script enforcement](../design/script-enforcement.md) and retest.
+- Temporarily replace the WDAC policy with another policy that [allows all COM objects](../allow-com-object-registration-in-windows-defender-application-control-policy.md) and retest.
+- Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](../select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) and retest.
 
-### Issue: An app deployed by a managed installer is not working
+</details>
 
-To debug issues using managed installer, try the following:
+<br>
+<details>
+  <summary><b>Issue: An app deployed by a managed installer is not working.</b></summary>
+
+### Issue: An app deployed by a managed installer isn't working
+
+To debug issues using managed installer, try these steps:
 
 - Check that the WDAC policy that is blocking the app includes the option to enable managed installer.
 - Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in [Automatically allow apps deployed by a managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#create-and-deploy-an-applocker-policy-that-defines-your-managed-installer-rules-and-enables-services-enforcement-for-executables-and-dlls).
-- Check that the AppLocker services are running. These should be found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created earlier.
+- Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article.
 - Check that an AppLocker file exists called MANAGEDINSTALLER.APPLOCKER exists in the CiDiag folder created earlier. If not, repeat the steps to deploy and enable the managed installer AppLocker configuration.
 - Restart the managed installer process and check that an 8002 event is observed in the **AppLocker - EXE and DLL** event log for the managed installer process with PolicyName = MANAGEDINSTALLER. If instead you see an event with 8003 or 8004 with PolicyName = MANAGEDINSTALLER, then check the ManagedInstaller rules in the AppLocker policy XML and ensure a rule matches the managed installer process.
-- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-managed-installer-mi) to verify files written by the managed installer process have the managed installer origin extended attribute. If not, re-deploy the files with the managed installer and check again.
+- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-managed-installer-mi) to verify files written by the managed installer process have the managed installer origin extended attribute. If not, redeploy the files with the managed installer and check again.
 - Test installation of a different app using the managed installer.
 - Add another managed installer to your AppLocker policy and test installation using the other managed installer.
 - Check if the app is encountering a [known limitation with managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#known-limitations-with-managed-installer). If so, you must authorize the app using other means.
 
-### Issue: An app you expected to be allowed by the Intelligent Security Graph (ISG) is not working
+</details>
 
-To debug issues using ISG, try the following:
+<br>
+<details>
+  <summary><b>Issue: An app you expected the ISG to allow is not working.</b></summary>
+
+### Issue: An app you expected the Intelligent Security Graph (ISG) to allow isn't working
+
+To debug issues using ISG, try these steps:
 
 - Check that the WDAC policy that is blocking the app includes the option to enable the intelligent security graph.
-- Check that the AppLocker services are running. These should be found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created earlier.
-- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, re-deploy the files with the managed installer and check again.
+- Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article.
+- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, redeploy the files with the managed installer and check again.
 - Check if the app is encountering a [known limitation with ISG](../use-windows-defender-application-control-with-intelligent-security-graph.md#known-limitations-with-using-the-isg).
+
+</details>
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
index ffa96146c9..5697c8f256 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md
@@ -10,10 +10,10 @@ ms.pagetype: security
 ms.localizationpriority: medium
 audience: ITPro
 author: jsuther1974
-ms.reviewer: isbrahm
+ms.reviewer: jogeurte
 ms.author: vinpa
 manager: aaroncz
-ms.date: 03/16/2020
+ms.date: 03/30/2023
 ms.technology: itpro-security
 ms.topic: article
 ---
@@ -29,12 +29,17 @@ ms.topic: article
 > [!NOTE]
 > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
 
-After enabling you understand how to design and deploy your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they aren't behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature.
+You now understand how to design and deploy your Windows Defender Application Control (WDAC) policies. This guide explains how to understand the effects your policies have and how to troubleshoot when they aren't behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature.
 
 ## In this section
 
-| Topic | Description |
+| Article | Description |
 | - | - |
-| [Understanding Application Control event IDs](event-id-explanations.md) | This topic explains the meaning of different WDAC event IDs. |
-| [Understanding Application Control event tags](event-tag-explanations.md) | This topic explains the meaning of different WDAC event tags. |
-| [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md) | This topic covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender for Endpoint. |
+| [Debugging and troubleshooting](/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting) | This article explains how to debug app and script failures with WDAC. |
+| [Understanding Application Control event IDs](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations) | This article explains the meaning of different WDAC event IDs. |
+| [Understanding Application Control event tags](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations) | This article explains the meaning of different WDAC event tags. |
+| [Query WDAC events with Advanced hunting](/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting) | This article covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender for Endpoint. |
+| [Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues) | This article describes some WDAC Admin Tips & Known Issues. |
+| [Managed installer and ISG technical reference and troubleshooting guide](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer) | This article provides technical details and debugging steps for managed installer and ISG. |
+| [CITool.exe technical reference](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands) | This article explains how to use CITool.exe. |
+| [Inbox WDAC policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) | This article describes the WDAC policies that ship with Windows and when they're active. |

From 82b0de063da825dcfb1d8f192a50eea3832381ff Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 30 Mar 2023 15:51:31 -0400
Subject: [PATCH 28/64] Update appliesto

---
 .../microsoft-defender-application-guard/install-md-app-guard.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
index 061e4162c9..d9c35a5617 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
@@ -12,7 +12,6 @@ ms.custom: asr
 ms.technology: itpro-security
 appliesto:
   - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11 and later</a>
 ms.collection:
   - highpri
   - tier2

From ccfbaedec6e0e6889ea50754254d9d3cecbec2d1 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Thu, 30 Mar 2023 13:13:18 -0700
Subject: [PATCH 29/64] Update wdac-debugging-and-troubleshooting.md

---
 .../wdac-debugging-and-troubleshooting.md     | 40 +++++++++----------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index c729787737..42d02bf001 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -126,10 +126,10 @@ Having gathered the necessary diagnostic information from a device, you're ready
 1. Verify the set of WDAC policies that are active and enforced. Confirm that only those policies you expect to be active are currently active. Be aware of the [Windows inbox policies](inbox-wdac-policies.md) that may also be active. You can use either of these methods:
 
     - Review the output from *CiTool.exe -lp*, if applicable, which was saved to the CIDiag output directory as CiToolOutput.json. See [use Microsoft Edge to view the formatted json file](/microsoft-edge/devtools-guide-chromium/json-viewer/json-viewer).
-    - Review all [policy activation events](../event-id-explanations.md#wdac-policy-activation-events) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx.
+    - Review all [policy activation events](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#wdac-policy-activation-events) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx.
 
-2. Review any [block events for executables, dlls, and drivers](../event-id-explanations.md#wdac-block-events-for-executables-dlls-and-drivers) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx. Use information from the block events and their correlated 3089 signature details event(s) to investigate any blocks that are unexplained or unexpected. See the blocked executable example described later in this article for reference.
-3. Review any [block events for packaged apps, MSI installers, scripts, and COM objects](../event-id-explanations.md#wdac-block-events-for-packaged-apps-msi-installers-scripts-and-com-objects) from the core script enforcement event log found at  **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script**. Within the CIDiag output directory, this event log is called ALMsiAndScript.evtx. Use information from the block events and their correlated 8038 signature details event(s) to investigate any blocks that are unexplained or unexpected.
+2. Review any [block events for executables, dlls, and drivers](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#wdac-block-events-for-executables-dlls-and-drivers) from the core WDAC event log found at  **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx. Use information from the block events and their correlated 3089 signature details event(s) to investigate any blocks that are unexplained or unexpected. See the blocked executable example described later in this article for reference.
+3. Review any [block events for packaged apps, MSI installers, scripts, and COM objects](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#wdac-block-events-for-packaged-apps-msi-installers-scripts-and-com-objects) from the core script enforcement event log found at  **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script**. Within the CIDiag output directory, this event log is called ALMsiAndScript.evtx. Use information from the block events and their correlated 8038 signature details event(s) to investigate any blocks that are unexplained or unexpected.
 
 Most WDAC-related issues, including app and script failures, can be diagnosed using the preceding steps.
 
@@ -143,15 +143,15 @@ Here's an example of detailed EventData from a typical WDAC enforcement mode blo
 <details>
   <summary>Expand here to explore an example 3077 WDAC block event.</summary>
 
-![Example 3077 block event for PowerShell.exe.](../images/event-3077.png)
+![Example 3077 block event for PowerShell.exe.](/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png)
 
 | Element name | Description |
 | ----- | ----- |
 | System - Correlation - \[ActivityID\] | **Not shown in screenshot** <br> Use the correlation ActivityID to match a WDAC block event with one or more 3089 signature events. |
 | File Name | The file's path and name on disk that was blocked from running. Since the name on disk is mutable, this value **isn't** the one used when creating WDAC file rules with `-Level FileName`. Instead, see the OriginalFileName element later in this table. |
 | Process Name | The path and name of the file that attempted to run the blocked file. Also called the parent process. |
-| Requested Signing Level | The Windows signing authorization level the code needed to pass in order to run. See [Requested and validated signing level](../event-tag-explanations.md#requested-and-validated-signing-level). |
-| Validated Signing Level | The Windows signing authorization level the code was given. See [Requested and validated signing level](../event-tag-explanations.md#requested-and-validated-signing-level). |
+| Requested Signing Level | The Windows signing authorization level the code needed to pass in order to run. See [Requested and validated signing level](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#requested-and-validated-signing-level). |
+| Validated Signing Level | The Windows signing authorization level the code was given. See [Requested and validated signing level](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#requested-and-validated-signing-level). |
 | Status | Windows NT status code. You can use `certutil.exe -error <status>` to look up the meaning of the status code. |
 | SHA1 Hash | The SHA1 Authenticode hash for the blocked file. |
 | SHA256 Hash | The SHA256 Authenticode hash for the blocked file. |
@@ -177,7 +177,7 @@ Here's an example of detailed EventData from a typical WDAC enforcement mode blo
 <details>
   <summary>Expand here to explore an example 3089 WDAC signature information event.</summary>
 
-![Example 3089 signature information event for PowerShell.exe.](../images/event-3089.png)
+![Example 3089 signature information event for PowerShell.exe.](/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png)
 
 | Element name | Description |
 | ----- | ----- |
@@ -185,9 +185,9 @@ Here's an example of detailed EventData from a typical WDAC enforcement mode blo
 | TotalSignatureCount | The total number of signatures detected for the blocked file. |
 | Signature | The index count, starting at 0, of the current signature shown in this 3089 event. If the file had multiple signatures, you'll find other 3089 events for the other signatures. |
 | Hash | The hash value that WDAC used to match the file. This value should match one of the four hashes shown on the 3077 or 3076 block event. If no signatures were found for the file (TotalSignatureCount = 0), then only the hash value is shown. |
-| SignatureType | The [type of signature](../event-tag-explanations.md#signaturetype). |
-| ValidatedSigningLevel | The Windows signing authorization level the signature met. See [Requested and validated signing level](../event-tag-explanations.md#requested-and-validated-signing-level). |
-| VerificationError | The reason this particular signature failed to pass the WDAC policy. See [VerificationError](../event-tag-explanations.md#verificationerror). |
+| SignatureType | The [type of signature](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#signaturetype). |
+| ValidatedSigningLevel | The Windows signing authorization level the signature met. See [Requested and validated signing level](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#requested-and-validated-signing-level). |
+| VerificationError | The reason this particular signature failed to pass the WDAC policy. See [VerificationError](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#verificationerror). |
 | PublisherName | The common name (CN) value from the leaf certificate. |
 | IssuerName | The CN value from the highest available certificate in the certificate chain. This level is typically one certificate below the root. |
 | PublisherTBSHash | The TBS hash of the leaf certificate. |
@@ -251,7 +251,7 @@ This condition may exist if:
 - A policy was incorrectly deployed to the device.
 - An attacker with administrator access has applied a policy to cause denial of service for some critical processes.
 
-To resolve such an issue, follow the instructions to [Remove WDAC policies](../disable-windows-defender-application-control-policies.md) for the identified policy.
+To resolve such an issue, follow the instructions to [Remove WDAC policies](/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies) for the identified policy.
 
 </details>
 
@@ -265,10 +265,10 @@ Some apps alter their behavior when a user mode WDAC policy is active, which can
 
 Try to isolate the root cause by doing the following actions:
 
-- Check for events in [other event logs](#other-windows-event-logs-that-may-be-useful) corresponding with the app failures.
-- Temporarily replace the WDAC policy with another policy that [disables script enforcement](../design/script-enforcement.md) and retest.
-- Temporarily replace the WDAC policy with another policy that [allows all COM objects](../allow-com-object-registration-in-windows-defender-application-control-policy.md) and retest.
-- Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](../select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) and retest.
+- Check the other event logs listed in section 1 of this article for events corresponding with the unexpected app failures.
+- Temporarily replace the WDAC policy with another policy that [disables script enforcement](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement) and retest.
+- Temporarily replace the WDAC policy with another policy that [allows all COM objects](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy) and retest.
+- Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-policy-rules) and retest.
 
 </details>
 
@@ -281,14 +281,14 @@ Try to isolate the root cause by doing the following actions:
 To debug issues using managed installer, try these steps:
 
 - Check that the WDAC policy that is blocking the app includes the option to enable managed installer.
-- Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in [Automatically allow apps deployed by a managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#create-and-deploy-an-applocker-policy-that-defines-your-managed-installer-rules-and-enables-services-enforcement-for-executables-and-dlls).
+- Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in [Automatically allow apps deployed by a managed installer](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer#create-and-deploy-an-applocker-policy-that-defines-your-managed-installer-rules-and-enables-services-enforcement-for-executables-and-dlls).
 - Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article.
 - Check that an AppLocker file exists called MANAGEDINSTALLER.APPLOCKER exists in the CiDiag folder created earlier. If not, repeat the steps to deploy and enable the managed installer AppLocker configuration.
 - Restart the managed installer process and check that an 8002 event is observed in the **AppLocker - EXE and DLL** event log for the managed installer process with PolicyName = MANAGEDINSTALLER. If instead you see an event with 8003 or 8004 with PolicyName = MANAGEDINSTALLER, then check the ManagedInstaller rules in the AppLocker policy XML and ensure a rule matches the managed installer process.
-- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-managed-installer-mi) to verify files written by the managed installer process have the managed installer origin extended attribute. If not, redeploy the files with the managed installer and check again.
+- [Use fsutil.exe](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer#using-fsutil-to-query-extended-attributes-for-managed-installer-mi) to verify files written by the managed installer process have the managed installer origin extended attribute. If not, redeploy the files with the managed installer and check again.
 - Test installation of a different app using the managed installer.
 - Add another managed installer to your AppLocker policy and test installation using the other managed installer.
-- Check if the app is encountering a [known limitation with managed installer](../configure-authorized-apps-deployed-with-a-managed-installer.md#known-limitations-with-managed-installer). If so, you must authorize the app using other means.
+- Check if the app is encountering a [known limitation with managed installer](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer#known-limitations-with-managed-installer). If so, you must authorize the app using other means.
 
 </details>
 
@@ -302,7 +302,7 @@ To debug issues using ISG, try these steps:
 
 - Check that the WDAC policy that is blocking the app includes the option to enable the intelligent security graph.
 - Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article.
-- [Use fsutil.exe](../configure-wdac-managed-installer.md#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, redeploy the files with the managed installer and check again.
-- Check if the app is encountering a [known limitation with ISG](../use-windows-defender-application-control-with-intelligent-security-graph.md#known-limitations-with-using-the-isg).
+- [Use fsutil.exe](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, redeploy the files with the managed installer and check again.
+- Check if the app is encountering a [known limitation with ISG](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph#known-limitations-with-using-the-isg).
 
 </details>

From 57284cf6de2a778b0f0bc7e7042c2c4f11b9f4b2 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 30 Mar 2023 16:16:48 -0400
Subject: [PATCH 30/64] Update appliesto again

---
 .../install-md-app-guard.md                                    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
index d9c35a5617..6f0853d443 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
@@ -11,7 +11,8 @@ manager: aaroncz
 ms.custom: asr
 ms.technology: itpro-security
 appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
+  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
+  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
 ms.collection:
   - highpri
   - tier2

From d48d56a042e0f55ad03c7f1018b7d8f288aa1e2b Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Mar 2023 16:51:14 -0400
Subject: [PATCH 31/64] update

---
 windows/security/docfx.json                              | 3 +++
 .../hello-for-business/hello-deployment-key-trust.md     | 9 ++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 7591454011..47e61524e9 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -76,6 +76,9 @@
         "identity-protection/**/*.md": "paoloma",
         "threat-protection/windows-firewall/*.md": "aaroncz"
       },
+      "appliesto":{
+        "identity-protection/**/*.md": "- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>"
+      },
       "ms.reviewer":{
         "identity-protection/hello-for-business/*.md": "erikdau",
         "identity-protection/credential-guard/*.md": "zwhittington",
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md
index 6104c34401..193fb414f2 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md
@@ -2,9 +2,12 @@
 title: Windows Hello for Business deployment guide for the on-premises key trust model
 description: Learn how to deploy Windows Hello for Business in an on-premises, key trust model.
 ms.date: 12/12/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+appliesto:  
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a> 
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Deployment guide overview - on-premises key trust

From 8f4699ff43a9d6f6a66264c7a26ebba2dc5bbcd7 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Thu, 30 Mar 2023 16:52:13 -0400
Subject: [PATCH 32/64] Update dynamicmanagement-csp.md

Removed highpri tag
---
 windows/client-management/mdm/dynamicmanagement-csp.md | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md
index 9bb47acd36..5a0260cdc0 100644
--- a/windows/client-management/mdm/dynamicmanagement-csp.md
+++ b/windows/client-management/mdm/dynamicmanagement-csp.md
@@ -9,9 +9,6 @@ author: vinaypamnani-msft
 ms.date: 06/26/2017
 ms.reviewer:
 manager: aaroncz
-ms.collection:
-  - highpri
-  - tier2
 ---
 
 # DynamicManagement CSP
@@ -276,4 +273,4 @@ Get ContextStatus and SignalDefinition from a specific context:
 
 ## Related articles
 
-[Configuration service provider reference](index.yml)
\ No newline at end of file
+[Configuration service provider reference](index.yml)

From 0baf6f2c167f4153c55bf3f66e5067b18b35f83b Mon Sep 17 00:00:00 2001
From: Amy Zhou <amyzhou@microsoft.com>
Date: Thu, 30 Mar 2023 14:05:04 -0700
Subject: [PATCH 33/64] added diagnose and solve problems, added links for
 onboarding to enterprise

---
 .../mcc-isp-diagnose-solve-troubleshoot.png   | Bin 0 -> 52453 bytes
 .../do/images/mcc-isp-diagnose-solve.png      | Bin 0 -> 26735 bytes
 .../do/mcc-enterprise-prerequisites.md        |   2 ++
 windows/deployment/do/mcc-isp-signup.md       |   3 ++
 windows/deployment/do/mcc-isp-support.md      |  26 ++++++++++++++----
 .../do/waas-microsoft-connected-cache.md      |  10 ++++++-
 6 files changed, 34 insertions(+), 7 deletions(-)
 create mode 100644 windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png
 create mode 100644 windows/deployment/do/images/mcc-isp-diagnose-solve.png

diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png b/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png
new file mode 100644
index 0000000000000000000000000000000000000000..75028f213c1d3a7d734eed731fcf7b7be081e519
GIT binary patch
literal 52453
zcmdSAWmH^G@F++^2nhrW8Z?C9?k<54EVz4ccXvX96WrYgcXuD$-3E6Z90q15^83Ht
z5AW>RZ~OWj4s-kV?XIe>F7IGD88H+jd?YwHI1~x-&kAsG2%T_n&q-cAhxKqS|A4~&
zJ#$bH6NW1rCESNSyfFDB{Rs}PG6ET*hX8wiZ7Z(s00)QK{rm43(5Ao;4sO_8;`1jZ
zSDm936d@($Rl&33{M!IV|1w5Ho}7WmvfR?9!UFmqvtP^n>hj_=sO4VYqZQ63NIEV>
z5+l^ZdB{tZN@rDNMd~R^c+^masu;+no}=`}Ds*xxt@(`d@2)noI_x5R7J+y>&z|r*
zoHXvHdzd8Njd1UB6c!d@z<~PGI&$(M?f*Tj5$jX^_j{Ez;5T-^+ZxgTr*7?-<YfG|
zJ^8K0oKI<w@jqR54*i%IZww~}28V&CTZi?zP6#F>P?v$lb_AK%W@9m*17&pIMcLWf
zexq&l8r3Soe|TEg7GtcMX^%Mh$Vp+gRFW~YVBf=k+)p8s1i!=yr6^Jz3m;ja`3oN0
zvMZ;$VC?b;w^%sg4lRnvjq`}=sespx0=6!0>xB<MYE);P*017t?XLN$5z5%QG~42h
z=9cPBUI0<RUf3Gnr*(O95FF^39LVu_SQ7uRWPS{KuD-F>p%UTkIBkaeZy8&%6+`CO
zGiHN&p9^Ub<Qz2_ou|Ufx4Ia-S)SJpZfd6-;Db%5!1eX5wLLHfl|H2uZ!V6G?|x!}
z646=idRxM)q1eJFW?rveRY@hIQEg=I+25Jh0*W*629u<eML>1zZg(bNQ)rRVQs)Jo
zm(IyRf34WSk6h5**dvTeq||f->fhX6aYt>h7g~Q!2fO}2%6U=OZq>#ARLJYSdFWTM
zdFG!f<Nf2*lD^#8#wCTcfL=51QOUh9yUM*Ug9q#cio7N*-I@+4L)kkCi*z8h5w%~f
zK7w-#F-os3jNST(T+)rqYca?&hn?y~kNyup9QjbZLBYCIech~uA0<_e;5d(?hrs4~
zi_w?qE&OduFtjNGg{!<7BKGFOQN;J-dVr-RkD6<Uf~k6L{i^p+LN1s4xcAXdTOFv3
zh8gJf7r9yf^67Vqz-+}hx)LD`gWme~Xc1#s41Y>miA_h-g|Kod$x)rF8;ixPxCBKZ
zB+v6=-9FG%nF(+wxA%)7A!K)6FtUy((e}nfFd-%_8d3dy@khHA(DMZf;?W>psH*+>
znUu?^r;11se&aQjgkB2NO9@V0N7eQ^FI9J5NBn!PB;E8s4z~?05Ph?Kn!{VkI0GrZ
z+LNJ6y8^gQjr*74`z^w#xD?)vJ8uqSz<JMNjK@WUI-AiZ?KjQEPQ2~;fn!<}pl+zc
z+H%Rm={M4s;G;?~txo$fCJIfMy()0$QyRoR)a(s;^B&>dT<x3$5#Q5kGzBBnb58K4
z{d|pNp6k6)LVP+=N<=$=XlZ{zY9^O?K-jc=_T$RMJ3BD}<R#Q}MjmBq8)DW=X9eTg
zRWOX3zHNqye}D3pj_XeN$DH`B?s!9+(;0rAXs4@XZtDY*bu`G9KALg>9GMk{QLPdI
z74J9%<o+DhN$;TnNgUL(gD!t$F;tRu+V*-FOZr?p++|IvR$a$K^ISBI%460>y@7+}
z4cCkBQ8wJ-F*yK77dIeMm;3jnO^18E;pNx^+TTNDRKkyDj8}42fTi5R3bWX$<O`mB
zWG4;Ik)$4!f$v>Df57hNwM{qNl!gBb=koId(tvDy<X0z0zy!Vzy3;>+YUg>X0n4r1
zN5xH1t+$pX#4Qh_gPHGF&M?Ss?@xbCa~H&bQb4iTX+@678;0}Rr4kP?sPM*X^V)S4
z%U48p0#-jgX(vNz?-FWYd*t{n7V_<4BDyuknHR<#Qrzt&v|JwaCO>UgQbqN)9$r)i
zP93NIJ9+r^?m<}<YQB6CukTQy+5^3MF6Zx*`N?!g5kU)0buktty7kU$9iLDreY-wi
zTHKUFAAd<}b;W$P93Lr&3sj@T@FP4bk<K&Jn|*YFZR}gOXw?tbp$dSkuergiu4iZ#
z&KV2NXMASLlXdpoZ`6&bi8R=cS5G*q*4D#bI9)%CeRn9Sm3X<0l4vB80yu{JQVJ$q
zfx&#sGW=WHz*?q!Q6L`DU3A99v^H!*D!vnMrCf8$x2A5qBBpzNy4<Sm;O2>xGBW++
z>Tnj7gjs(r^OI+5C)0~sl*1K@mIz5oeETp>lWWiG>dhm(flk!piR7B4*vM-{%#)|J
zKvudmKFDKoBgaa=j#WPD!P#wlMAUYz&mluX_elii{1ZpKaLA+7X<hDDG?SlK=6a?4
zx1%cGkCkO&rgkj6xu&v|6%~$R;CU}4H|k$R+kpOUv~8%Vf}&zKuFcEF6bC=YCSv}R
zjl;hf!Bl3CG>*u>Er7e#p6*s7{`boF3mP-lf5T4E|7Xw{>i-Gd5g}7#PM@O8RN9a@
zX&w9+sMK(6c8cecTo+z|3R+j>+DJ6WtY7>_uR)nKKq14@45RbXBl(tzj&W_k+<xPj
zd&Lt-^)L|2Y?Ewv`Hg!wazZaA!>ijf%%p;rmML!}L%{kr(pw?vM_`~Jek~i|r^z>6
z<5c3umx0lIDJ5}ynA1t@27Xc(sQAPJ)*8a#CO-pn6s;C>aAxLO#oZ24`aja55b9IS
z{TgXGrfl2G=3`yz!Bvhs{_5r_w3l;Et<GyjIp~)CUMZD|dcJC~C9qsU*{C_5-~BX5
z3{!#ggodHGU}Hd7RDD2pNo8C8wy3BG%o4pT+C2`Oq6Y`qqClEoyma1;@HI9f@8y*~
zC6_@ZAZ#30^22%gXZeN!(g1t@nu}BMr`ocy<-XZ8qM_m8%}|<<S?LTWdIQeGmNi_a
zZ-!e_j1;X=sWrCOTdy`F1)h0tU@9rE-zRMX%IPAj0)Bq^njvN1R{8$qJh<<n_E~8!
zWo#GDmd%0;2?5K_7~#A5uzckc9RVNmz9OyWHGs;__RhK3lZ&W-^TjM<YJr8e*#bJr
zQ-MKd(b(lxb12dU&f%lmbGYS}@X*^ohmTEXjy%AAP3SxXyHGL1lSPY!!*s26tCDRW
zCA8NdBj`(Biy}}6oDovOIBedEh9s~c9(ecW9na5FT4gIuJ~BJiciNW(Sgi*s8DPOt
z@vsbQLK8Lt9DW}OaFO&9CNP8>fz)SUxEB<nt{M2bwf+%kBOs#--f)a|SdJ}l3yoPF
z8r99kWu>`wLfv~SMDqAWCOszV?j;n-=I$U=bN6zYs}x>@STi-Lz6<aDD-Vo<=cYAv
z)+@rqp1+MwIQ;Vah%Crhip|q;l$c7nMy<<f`jWK;F(Kh{i`zwn;M46nbqw_BCc%n>
zU~H}c0qvcH0j4s=)b4c@SM+lSjz<Qfx48y~k_d$ohrI<s<2Kj#?A3vhr>iHB8oqrp
zW{c{z1}75W$|-5F=2L(j*@A*yFq;$7bba`Ju1og7KwV2*KE5KnZ^{a83P)1gtzY?X
zsDw6^$CzVpadp({t?AVh`8`H)^N$$Y?+?0b57U#Ff8?6hE}En#Wlfk`2Qv+>1yWk<
z`HZM1jaCNJ6L1n^{xrT9_wv}im7J*?Mky&4?qA-X;IYg6#e0`@sLmTOEb$BJZNfq3
z23@&GhR~wJ7Zo#h`XpmQW}#GKC!xItvrz5)^wOFn)(sLAqG5m>5z8XeV}>yfG)igF
zeiE0@>J?EBc-$VRrM`NYG`!;^{w)?C>B@PPt#rb!)h|xu?dHksF0)E_94ha7`UkTW
z{VHCMIAZC3`@MVl>*J!IVtGj}h-evv?IBKgjVFHT$$ZIu)8OM;Y_#$70@?`d63P*V
zkq=)1jds=y@(ZKN_Csj+0&ZCYDg*eGA94~+<YRTsmSVY9-p4Q4RGjaBp2A4){*=^U
z;oUb-hBB2<LThV9xLwwZnH+uUid{_`X!NbQ`i{xu++Wy11F}`IeiPz>M*Q{qq$Q0z
zolg|4V$%47Nm5!5X@FU1wQ{x(9a{TY&!lHYMBn;{cWleImtaqTn~#?z?Lwt;jKt`}
z?r!s}-VlUzt5BWb*rPxZe(+bfY~)7A3diQE@`S-2>2k9i^Hzm(V17eQfA5(ogl3k0
zl-7uR0O1JC5=*OI8Jdplu6&sjgLG~{&B~~(1t)c(<$Q2OQ)&Z@ASo{>pkibM+WwaI
zzF*1(45)N17i)}$<{s~_K#$!KvV3=j_0}um8-XOAk=NHt8l~46HXkeDB)@#&83Gmf
zfBy1w9D1^P<VuhR9;Q2gn4GtZI#vtm3WqFDZFKDgV>X8(TU!l{8Gw+!d=c0{e=NWr
zTD-d3@H4)o@+eQtcADyb^V-5?ad2KWez0mI?NFDEk8jKy?cI{t)MbD=^#X#Cf<o`>
z!!m7^2hO;nt}9t+FPDkiPW@~ZGF@<dOcEcx<FF?y?=Vjhow&E9`$64X4ND_(Xo#A1
zIxfz=>4y7nZb1498e|RuLqr3{0U)Nwk0ULb@+y&!eV5D;##q6{bE?fAB7OrtNTK|1
zc9|Jpc{rXgrU5h%3CJkE;0HK2$$gVd$Eh4YpXC?bkIKoXA7LmsLw-%Z5bz@25J*5G
zORE%tp+)o6WBB%laqtu=A`Gw4LfiVmS-b0}dQ$kYZYB8ySIEhIVrGs}bgJ+`S#5Ak
z8h+sE;$&4jGmF0d9voD1X%vzndv5Z2e~^2|jEeikW~4K)|D^97&Y8swkwsr@P=iuT
z9*gZOP_xsVhP|AO9{a)M)8)YCMmrVS8|Y!rxc4!QCGQ-NV55p~u)IGBde-1-Pp;&Q
zQ9Pkb1)+LcUr6!1!?%(M&BT?k8(OQZp&&hGSZW)oPhA^(+g2B+aMRyE;b-ffGjR7(
z>u4pD$n2{Ctqc)CWX>;EV~qob?<%WIO5MrKbUNGHDpd^k6P)0Paa`GL{~@~4_(11L
zzA+(&Qbldyg<iSy7_<GUZn7z)y9?_ek1W-wag&cLat=wYZ&Vk$eU=MbT)U^tW|zd?
zp@_gg4$>2B{E|PE3{jOPX0`B=07Ok9RG81Y240`L$LSzy)?2@0cV~0^#)bArPN^!&
z($LTlyW1Xhc!<cP@$|-+n?F6CMo0|i21ltB$CX6;46sO0)6p5e!+&?Ugz5OnYrx<{
zm7RT?K>svrC;)mFB`6(RmiC1eV)iu0&i*j<p=Y=W*M1=eAdou9!I=vgR#@KHzMSE2
z83yFX-dsTz74rc7-S=K656BchD|*_8hv;|TSqwVtqTyl&%1VQrFW*XVLob?k11DlL
z1xFqaN)iJ}lC5tq4zE-5+{$!#?jINL7+YjzS)Dj;5b7jAk>?k)UOv7jj<P4<Bp<!t
zrb3GdaB8E2`rs{_nPwmRqtLx8vp?U-JDldHT`AQ&%$^7-k_}lDsOH8!N$DjX8szq_
zs$kA-NrUyakQwqA+I8`9eR9GI8um?Wy~RRIe@e8)%eTD9z$qoNEu*~n_5h)(ytCYD
zyZ8u>$T=;AjnxY9I3sd!+a8P-r4J~h-G0rkT2C=q%}RHTS@;+vCCHdTMI0o8&;uTL
zhU&A9+&EkenC%@;z0V7=s4_fei#|>dd^>{rz~Jd}@JgZUOmxYWH)BP-{&C8am4AIX
z51zL@p)UG>W6qFqcQW0mChFL~famN9`J%0YCS>~xqPW44F0|DqWFaHdS_M%&G@0ya
zhfI0%L2M~L9%Gd&?<kecM{kj~&MU>)1buLO;$u{G3z~&K%3J&BE=jugN_fzYd8VJN
znC%`pU5>Np+%<8&w@4NIh4++TcKT#l{xFk6(5rf~h5%Lu+6!FH$LekQXIg?aNEXlZ
z?gMeQX~6NPhKvR6t-4)`srcWcM@PZ@*IpSctwJt(KC+RcR~@hSancnoG*7e^xwh~g
z!d*L`oR#}m?Ez(RG#ke>rIaZGP|v<FlPzHXIELtlZV@z^DG83YKh`rF&ebd$`EGH!
zOez<%gRznjTt?#N#h9SaW(HL0TF7m`_eF8s6KY0W(g2vv_-Q>WXWz$)pzWI%e^B%h
zqjMD0lwt~$ryZ+$rmOgvymZ={QzksPSdv#?5)OVVB8EnZwz*jyZ%tKVIV;0Sy%1~F
z&il2qd5G0)&h_|myEsP}-fX?}2PLEKTZvOPCF{jlsfW+0RGVaE0bwc2<wPS>!;H4$
zu{~S+8*mh#ZucK!Eh~R`wJ#iUGNki~(~jyFM-25#8X~sQ8r3dS)dG^P%VU9lk6V>8
zKo#;<%InitO!=1gu1^M}_&hdc9EQtBmkB-UPP82PxgmlP5jv2Gw>jafW&Mmym%Xvv
zu-HWQucYRE9~<8g`=^w4{Kw@m)4+GOkN|u!M5M0K=R63^%GVP`S4Mu&Typ9dth5M-
z-=+!!sxr}?vgoJ*OWH)d84lCk{=VT*v^MWH1M%Hy-ciw8;T^+aG>7^6ll|!irm7*Q
zBu|+PMWehe&^K+tUhG`}5lfIw??JxXy{^Pd4{q;AW1wga=3rYts8ey;6hO(yVUE?y
zf$ZvfDQ@5Tcw6mIPh@`(w~fe$!`jN*2<Lnp9WKU`I^8IOMb!HI@&Z=^7l24PXzJqM
z>~uqeCeO;2i>!OySekkVb^73iux&Z0bV*&*&zvG*hJo2ze5QdPNnK6|)<2l)yl&z|
z4ub$Ky;!q8SmfBZ`+cKtpr`N(7Kxd=A0OlqW6;f1-MS(HZ}<Ufx9C4!VD7s+bzZ-{
zA3WgdRmS?3$nS;jCd;%-d;fr*48&a&qjsJalSQQfs;L-horOFat28CaPN?4A#FH#E
z)fd;a@$p$NclQO}U}OKnXQweYo`xBkvbqx%<@6t5p%`eJ*GKq)KF)&HO<=@WDz^wR
zVQf?sgUh<3`yb=lI@dik3yUOEyRudT{4RMhHKuy6R#h9Gig`>xDt%<I2|=IA9`|ud
zH_;7x;x|lpe=Ka`ndoJ4zk(31od^yA7sooy)o;|#3b>QqsgPN4*uQEHl=JSC0hfQl
z{VGDU#k)>0F*J-LpadMPqt%5-E-`@B0qWX|qB8p3ID;-YuKO3K=_)pkrh=N+xJObc
z-lM|&#fdT62$n3Wt)KAONRbFRlps3VRSxxmq#RedA>k?GmuD<riot5%-KL82E_TEO
z@o@y)&$ey|DIVq<Q`mggdfLIkzQ;VP9yTOxdzqW#q=OgYKbJ)it%!KZ<1{NmWw5h&
zK9p$Zc8Wh4tV(Zs=Po$iL^EddPVMIHl5D~kU=7xLNgd!o&UDilk3Akh#rP<8&RI-8
zQ%zyy7ntcBKLb(Flw~IM=B)R=0l*@Tj|1)Gljm4Zx2-AN@7N+y^TA)qh&Re=8qJm@
zwa_YYthTck#J$vbvj$Ub;>j?`2?QyDT+^oC^0Xb`k%Vv65_pXsWTy`YYE3GScVB-k
zSl0s@6g*~KA<s2y*^{Cj3?L7xcy^HL8&IC)B{8#fnGqVSwUQdPU#n$N*%}szD4Mzl
zGtQFc5TaHkeGw^=cM2|dZ<IWo>fY=t_1s-y<gnuLhTLX8oEQWf>VclT4(CdT)b2)W
zU&uAULd0u>-HI?p3unteqxoigi;;4m-3PKsvS40qd|f_j4`+0J#68BxDgsb!B$3`^
zbI<0gE@49)jQ_R4Rzccl$2Yn4`N_|!vPtH}x;UBiGfmHqA_0s5f&gs)`0OsfmP^1s
z=V0{F?EoVUV5vg=CIm_^6M;n;7fbS*Tc78lY|_%Ot1I~X)*IEht@2cCZYtCM+`B`c
zs<9)}m9Y)7@8Os;A-QZz7=dp3<|4R9T!CdZ&1-8<We&q~b^65R7`sJEd|TAo7Bc}(
z3h!5!cq@u6LdA=a=EVG02(C?+Lv2d#`RXf%%O5gry#%*0)FX&KK+V}*s+CC~Suqz+
z$#)Y$3;WfRH$#emez(1{2_Bz295aupxr6=cBc#`9afIys<wr}~6MFCgUqi<F<z-lh
zy`hX>-|fzKHD!_>OrYn1A><f0s3Ae#%*;l|xV&hpFPHfTUE9q?5S$MN6AblTa>4e*
z{k+a4^N;JUGnR&0_KxC*RoaE}>pxzK^#M|dj15agH5-v0Ek1I8yuhiX#I+l?T%~`d
z*B9tUnP6ciM8S2&(3bnLPIiDg@J^_PXIEA7810y$RI;6TmcC5sXf#K7St^b?d}OZJ
zm8%y?^mwtbEjfjnCsEFuo+!H}y?oMrw%!I5ciNH?71j3eaH@`^uGVh7B1QsD;p<g6
zD1n(=xwagoco^8&(!`bv`_#Yrp&{ykKEVE|%MEO^D+u{s8nAz5(-LJ^tD)=8{2f6~
z$8$fAGTk$p&*`bl-}!j4+VWQ#TeW3+lBWZUNoZ6o)6GTiD*ZLa`?i%Mu84wAV+F!2
z8jvN_XvxI;d)9feVh<_2(L!~8X^9i#8)#*yL%la2^gQdkqgI$)rOW1qSRete)rHof
zrdnqm{g&p&_&COaJn<(gPR7(muJ+HEmEXKpW&J(chsK6<;##;)p3TYm`7}2nyy7#Z
zf2p#3ZZY68Z)du^2y^;%nC_lBhCHOH9p2pFzr7&Zp*4!>D&iA<Xz&_XQjrPO(cJU#
zaU28)VrzI0jtyx-uQz%mMpu~4J1^E<w*(EZ?@#N>b-9ehZzQFz!Cc*NyTyyZI(v50
zuut6}q*qJ%j7TqfEvvM&@yBt!>(3FQ9G1TqUu1FH%_oG0ce*F!7(}2az^QAywo4wy
zw72_+iuS?|BQL`TWW%_RV8Cx9B6FfJ121I6nAaiMTap}^&Ofr7s;5g;$7?I9J*p?B
z9b&(Aw$AIZ46`8IzZ(F9KnV3ov-v4KWrSaV>mO0?@$OzFPv!T_@rlXTyc9^!Tdpyb
zPqTKIl7SA=Ms3hNi=XbfYEcxwIVth+9=D9i3%XXb^Zpom5gPPdm|{#b?O{c>@m=)-
z9dTX6PJU2z>Wk}dL{^fLT0Ytg+c^x5F4Y;8nl%PFHbo5F5G^{8;{sw@Q-#ov#gotW
zh$NdVfbR8(VZ5vKPgi;RA{sB<jOKZX8W!WAZb{>Il3mf%q$|fD!)<07!bfLwYNbXA
z$?ZHI=RAz1_IZT@_gZx{wf_2^a8z8&4qxgE(9naO3r-qWcO3(dciQ~3!dAh@aFF%h
zR48Ub0pA9p@q%1c@`%456Px>hrB~!*$Izgbwb~)U;&JwT(Ij`VWYdor)sg4I#F`c6
z7qWuhlDiKTURc-<7{y;pmj*FH3#?hAFzK;8^=KSZaSKOLsAyrv=7^dVn-D%>!KB&e
z!s|fiPo=<LiHZ%HrJ+dVCwYAHd-je;%x-XFF2~DSc~>@vIPPM^;M3uEW08R^gBiaA
zYQA3pu(TamE-i^QhYddvZHz7q9O2XQG}rzVmuI=!k_34G2tEdva(J(hk#+C+xU|-$
z$_z}{Wls?Qw8iG~+QGV3E~N9AHMsbSO7^-yaw-3g+Rc&LR%6&OeFp31*0Z)GA7Lof
zCjX#AHv^q^v_!tv;rwl7L>RiKP0+l2_8zh>K;3Ew7Z1NRM0$m0WHA%@9gR1LW=yMk
zaOcdbj_+dAX(PNQOGIt{Lj`824c6)Mz$TZ{z%B)7Hx=dG$K#V@$53-BQp5MiTuB_2
z-7Q%(bsq(;7df&P#_t##(K4_#_eX-$0#=o<j~4SF8p8qK)JAk0hZh<jkgJDE^}JYF
z*ur8P=`S$nZWSB3BT|1luajxz>yqw$?cPv_UW?iBjQOrT+xm$UvSMZKk3xdHw}q~)
zAM<0nGcr;RT)wd7T5pj3;Sf23@g=tRCq;!Gk>%Qy5jBmuy6B3agR+(pqh?N%rPLkK
zA_w?E$vP{$RwfQ_`H!!X$4PbcscHplJXzZ@nzh|_C@}9LywOwm24-5DK5Z3^j<oAx
zyxc9Wd9qq)%5#N2g@s+hB;iosRcw5G^yeqG-?EO4XAWOP{-s=Y_MNF!9#gCL@O-7G
zD0)1j?w2R8vrfc?1A3u@GDh$Exv$9u-cT&{J-;wDftx&f+ErKR*}xcuv8N%+#6Cw3
zMFgIur`={{@y681mr)-Rj*QBgI_6F$uFHvnUbDlmDPIq#-sX@H2~4AB6b4BafHPvz
z=VY}OquB&gypP{_ZBX0sMLEq32O*GP&&$NBA_*I*Cz1QiYyfgpDj5%Yi{HW~_86k+
z{ZYiH-5?O?C1U1s%CB$u(b1jo0l)U}mzm<*xzoD%G%DI93z^^$wfEkQuYwXEv7jUB
zyj$KlU#Zo2c%x#~ox3zDjAs>x%rCIr9oaxDtJ_hV#ztFMlPgj70+Oi^+4E3`oBsWm
z%p5gF-iFimO$o@ktJ_9(&lNR1x3U+#8?TkOqx`Or$%HesO)zU>RC8snnKCR%teCjt
zL>n&&7!{R`-Oulo1Ml!L@A3F~>uz@FM-?F@I>wTTt%EyvP4*G#=f=XFRaAj2{*pr;
zmBCxldpFaLtE$-@ErpS3c4b<rN}`za5?aV^hG29JnWIS?B5yFDvgKC!gz|R6bRRp>
z<}IV3d>*;eqCQB(6m`)*f;Bop)7$*0sP(!)e|vR%>S@2b<bz<6v?yw&xHAd4w2O04
zTYVe>U3Sw@D%j0Cc&J6($x4WK$-EZ%hmyylV#v2&O&TN`Gj*}I$~d9~G1XsmSCaRq
zpfqi>N;RRWY~(^zV_IAmtp>yOM@yHc*9xsFI%SjY^-e?a-+#RHx;$@h4({(-aRJfG
zM*PWX{*sMJwn$tBS-^=FmXsX%LvNthCo8N*gPYJ(e_U7dO?|0QrjVO)b_QC>D#Y+Q
z`Zhsx{>KpxE^9@VSWni_jmv(!A+tG`?hxT#^mo~Y-6a4W){6(kW?L#qe_sP&CuOBq
zaw~e}RBHY);N0$<K%=84mT_M?oZbQ;O24pw#vUGXz?iT@)lu<*SG~!sZ$FK?I-A9r
z*Hcmd`H601rG3bwH$Q;0&wqrIcXe3|mw+fSS*BeHVT8jApZ+PxdL;3icoykPgAjXh
z3<vk64PZ_WwFl7v@Q?w1eUU<PqZ6reff)F3)^z9c+LDoIE^msQO+mzQZcI0cPu-17
zeK0jM#i)uT?VChs&_`U^YUgCqtQ%*#2WB6@$QT~yY<yLnoLe6~ElFBSi7#7myYXIs
zWQYCXthQjBQ%E9_MuVqU6!^IVgYJiX-a0+eQAq#ouPyfr<X7+BE;cI~y<YJ^D7@>5
zMG4K*Bnl>|LmmJ5rnO#bXb@A-ddaA?0Evm=fyImtI;s_gX_IL1K^2uzjLYcp8t8|)
zMR035^%7t{FQIvd@CJ`ZfmZFp1t)d3Z{#RF+IW^ad4-S!E8+MS>22`-Ag*Ymo6ct~
zmDi;R^c7Roi=VNZxTkpO$y8$(d&!1^(b5gT$m0QT8ac;L6(l}AF=#frb{`qudCRud
z#$DpuHP+Bn8KWeb;Pi{KxSy9{k3L2p%=*5tNFAt5URF}fbJcqVdGY!?1}#g%yp7Rj
z*}LFHqQ&{WhUiNyf&m`MrE@HP3!^yU!$?@1f5}F?WcC$=CxPLcU{!*);9`Fr1}##;
zndLzo)>!yZaa`-=*3`ixO{o|x(hF+00ToP)Mpc(;)-A8p+i(uw{r39C@n%{{LgwHG
z*Sjw{FGE6*z~5QO_`SY1c%QEF=ZFc8tHD#9{9==N+m49pKEDQT6;)o##cl){<@LxA
zPEvO0-pk0eWdw$$3;0;+Wb^Zoz2c|Hw|t^@SUBp3rGUUUAECY-&&U9b5H8hwnT>(W
zM6Ow}97}@@mV3?Clk=IKqpkfMk*(*C&!4m3$cAawIpP=lBxFTlh_Gwto_;JHI0>^G
zsv5C}^WWoQvmWu;TTTU&_Ajg|zK{zF$5a%MPWNn&HzEUpK7jglNE{*n`}EpQgxo$c
zT-c@=aBZY_#7@wj#+Y0^1pNTz^BM`a0ORB5O@TiJTEFp=1Sz4>$i&7HZbl3`Lp&c7
z>$}K(vxRZ1-IZIIa}Dy2H5GT_;g5xNwM5&RK%*IP`^Mgu-lw9QzP>|sY566;1XV66
zMy`6_KGs5pPXwLMaZ^-!-U&l!k-^m*#>P-J85ujs0c0e^X4G#KPpXKLkZfjX(R9&4
zg@A{j`ay88JpaicW*|;Pb{nBGwIq#vgspELJHIx)4H{EAODX#<`<(W{Omk;fFdoFu
zygyV@&}`xIguS?*V3@KRi8OqlEr*Byu<A2AcDWvM0A(`!DFcfxTPnCIt|LhAO%3Gp
zdBFLfm6k4pVG&~S=+Z$a4)r2y6skk4_|&V_BM*OJd%eUq`tzwbX>>XSWxNW?%_0`g
zveS!4A4R?mFer>!A;dkA2H>h%sl1R|9`7~W4#lmoP1NZ~;`ZMrI!$Xi+k}W-fmtrS
z<7RWLSDG4M%DsvXg8R)@LI%n}Zz>&ls(1VQw5rBu*zySs+Sxe<#KfH8<?zc`o(F;8
zW`p)VM4*w0=pERK03R2vRqD6;h07$K$s-Agc!pJ~!n@b@@C4a?Ap7t^*Zb}i`eX?I
zoC<DEv^PQ!=e01<!|7G#pHJYlIBUbRZi$8Nb_pbCRogDg>sOOGeV%$GVixPHh8*C8
zT50YK$<lsYJ!M_y|IzX=AJ=P|AwZ!RE@a9p{MlM^Qo<LQ$FDd#t*IUzgV$OjgzlG<
zURWQj{da{9WqN%o*m95)nQg`hR01Z$%bbae9mb#xSSE|hbCgF@+1Fd%JhgtG?{6A?
zP2(0{<P#i1=CfD7MqHV}-lZTn=iS&e;7=LSfCcIWs6-N0fAzn~uhyr$++dOIY~#`S
zdK(fLl7E}61-Ou8a4_!Oe~7|$lnw*DsW31pQu#f01a)oJ50U<F?>b=b0?|k&uTMr)
zvCxJ7CG>qYf66k$$Z1ijHaIwV+w|($e+m5tr&}zMcTDfMy6!HL2sqOPePHfFCfwiz
z3gg(Cg3DP=z-B)sV>@I3qb<9F-+#`nuLXrhw)lhCfrs%w5F6G#lhOR~*v@poHixsN
zPMw{z@Q9<S+*2?wvsdcL?(sR5n1CDi#In-?Z)JDy%yEY0-g$p6@do(H(XhLPjr9IX
z!UgPvCXO=oGjWbYUd7zwAdEfl9)a(CF91c1LK>e!U~>Tm5CEB3%DUs(zXBm4?b~TI
z|9M!7YARp$bh_~3<P;|0+Pb%>6<Ji;9QXszETLa9gh&HGL2!e$JYb1BeqZ6`eNDJO
zc~}_i_<Xt#S<9xp3MQU{XK7sAKlSVRjrx*XHxzcy5cGj4m4ZQfYqA#hvWu7!btES#
zG$lIKfm=tMakx&7-9w@Fy=L0?QqPjf2zJOPQ6wg75VYI3hCDIjAT@y3^on~VWsHxV
zStKFN0(95f4W+^JXuV8pf$YZ7IOuJWxF1L?eOcK46=uM3rj|d-Syzw&CE=Tje!emN
z`YG`~+_ck|<gH>|^(Bi#9lG>Xm;druZj$14$&=pu5w2S3>Jf@q-Z=}~cA886Yl|MM
zdcemgrf<)rLWyP#CZiG7)8M;s+q&VYM(-jl6U71#f+XOj%vwbD#rFrww3S~zi_-6<
z7r&ATVaKQgFx>0CUqB|ms^v~fp+B+uuG2rF@04=h?L{}{_gyeAnBX7HJ5F=H_sO|C
zo@%HZ@bn%;O~yO|B-0e#`SkbNZxC@lza9q$5plY|d513N9%eJ|gO4oxhGbrr?nvBh
zVPN?)$I{^ef0smb-D6<uBg)CWOTm_)0?kk08KfI{2;YOC9#NJiC8bP8#H-M&@YX>#
zgni+>JKg)`?g>qr+W`L)ACvF#VQz&<Z9`fM=|Ap+$l#m45#5_$7Yd1(26(riA=erz
zMC9b<rOh-o_iJ5TP%2&REjAtnLY-ba9f_x%8>!B^7?}$uuazbILar1G`-r1h{NG&O
z_~vi6M<oKhJ!a=^ZafS{kkn5mYA=X6UItQlMYjS#LaWrhxNHpF0h8h<ge-FX(u&Q3
z%-a<0Y$~P?CZh&!Ki4tV{kSK*33iAI4e$CZ6~2p^*FoRQSWj+_!6Q`9RdTa^=ze+i
zZ@rGwvaC^R+P5|~!y8y&w&IXGb)ucvZHMN;AxjpFS(om%7P7eTK@5rNnn8yiq({I6
zpC`Z)tU3n?Y5b<W6KiyYAj#Ul2*^4H*+i^qVLqf*L00>&je0v5DQo|+xi9F`kMOL2
z3&OFXqd3w1&ZPZrLLz>6f8xHd-@YzE|1-!HR^0Sw!2c25(&pyox7i*ZPY)o7l_rB$
zL&w~+GQe!9W?(qs3N*rJ>%S5w6kl29*m{-R&oZ95QgdaVL~HIm@*2sF=P|p+z2{DU
zG4_4g0jT7|WzZ6WL$JoPugsdl{QH89EfMWM$<e{vBlnL$a4jNl{-?Y7J~#_2Rwwyv
zJxZPyEed$~3kWNn-H`onEF01ly2xEg#l}oa%utwi{pgVdv0e8G9<*~p1W<kku*uCK
z&`FPKO8Zlk@%yXk6j(7_OR|goRqhEtFNaAnskUYt{;XMDVQgtpW)!Lf(g$L>jJElj
z!t886x=2{=Q|eDG6D(lo40B=^%y|VRr}9OHj6JnKE5IracW7n8tzF$F(BNUR;p?%6
z`%l4Vwxw$0Js?nfcJ>EuxBY^N9Ce<*0C&_D2YOQxY0Oqdj=~2n58wt0vJ@ifE~gJR
z=eM-17sSSP#TXASbqLdc+}@Vu7*FLBT{Zu5fXa+mDIzICnV|U^ITMzUAVkjW0gheW
z+?dGzQ%73O7QeE7I$AW&IDan}=aUYw-;Mk(Y@O}kxY-}zX7STZe=gP^-bbxxhi&2M
z2b1zw4RnUBe6KFvlGr3E#ONCG8253wkQQZE)$5uHlaZTCx9GPOoSLXWq0N9l#s>_3
zEgKmA`{Pv$RMLlYPYxmF$X&2%UWc!F<pE9`hokOaHNc}vdcQ;jqlhxLk=8c@gNIyD
z-_1AH#P$gU0Q*pIV}6UV_Y88+?$7Cz=YPu~MT0w)7>Y`SET~c)Ha*}Cng3rp!DZ^O
z!RoiyLr>_vHm@2P+lEyMv14`cp`B4?KX^P<)R@=PolO{2tSZxd*h?;Mzn!+i)d7ap
z99TR%qb2yAb4S%$0|6oTvL2MqiMCrY378{BbmT(qYgc0Kk<wMolL*nm>C%|`^DJVN
zn$+wqm_vSaA1}~uChXVpH`k*bc3t*Es&?C<BcQtNE`;4OHCTDLI!qIbh=rd(fr8-Q
ztnHi9$=)lc2De>J>G9Li%56tMx$|5KR{2Oa1Ti}ew@gf+_}nhAFMbeqirCiek!H*0
zt6=^u*uJ5MI^cuJ8oG!X-2u7?skJBGb}2S>6eh|3q%yt)EY{V={r@~ezA2wpfM6<k
zDnn($>8U;sI3uwlFYsJWvo{wt!yAHmpHqB~raf^pbs^PR;8uTGhN}%$9<dKG-g_IE
zT73x|S;x6NYp~k_!8{QkAL#9Eqh`IO-u~Q}KQiubd!_&$yb~<r2}8+ts?gv~FSV}%
za(AE0qe6=r>L(j}$o)t6i1hVJ<Zda|3q$9zv~@eh=48y?tD4Et>pQullhn(mmYHml
z7rlwZ4MzMh?mYAmeljA({=1dF?()D&K7P==ZUP*Vugw8R{BB>f`oU|sakzE*-!_vq
zkJC}0{a$Y~#{aUdfVHbjcyN4FRIP05-DEi`#2+H|2_n)Om3lM&&6<J&tJa?zGV#YQ
z-$~OlK5B9@mIVh9I0J9d!ijmj`~|(ph*r+PVbjN+y(r0nu5R7(>2R?r`MltPAy$Q!
zn!Qs~kHN46LGCWqgM}!R3)`sQ6L-)fF=P22Zo{NWF{RV#LM68*%KjpFrb4D#I?qxW
zAwoaM`u67HSiRBDyOZ~{!Yn=O*%>+buejojgh@k~l+2)Vg7%_i>O_V9(z5s5&aa(u
z_KwY$4vZhUZ3@awg_XpsrbaRjU&<(-GATC4>i~3K5IY`+H*5Yq%MIHwyY(7!(|)&9
zr`2Hly&PUkwp6nom593uN&@YlBVa<~jGH&-l_iFqyPd;mm|V0<TZk#Ag5hi5gkEhJ
zErn<B+urlo6BgoX$K@g_tTblSM&}7+MCT->UeNAtPIkCC!*Zj|g4Vd`dsw=<$rtJ+
zR~XkO&e|OC+I9C*CjGX+cG9tM7k1b(V>Br!UhLtvJiRKNj*``pp(DccX5qXsgchFm
z(A49?&e}I}WC(Tg!Z5O&N{VW9$vDremS_d97UTEJ34Bg4d#@+QwvgEB*HPKj%clwr
zKB~fro(AQ8AuqGC#<03cCeiLe{~$N56d6kt`0}{cMy$ZGrI2ImeumjDa9J-;wbuas
zQO9bo{mTdLtI|(BrCJC1-x%d8kwrxckI98(7r8ZqocGGNhR$isH`cSGiwy;FOnYo~
zf0ti1+)cv?X_G%*ka!OC?uV+1853^NM*nEnc9xDMeA+r4<Ew@cwDnE&#2#;Kz>ssN
z5cRxI!Ak!n@G#kqHkG?Q#@C&ZXF+W!x_E$DB~%}W1Q=rUvj6O<@;$bLQ{K9)pkv)9
zhDC{^WI?9-0_pJqvnf+tUP)73q6vAMWyyc;4YAaYQ_j%n2vz*`jjX8@HEYmF7k*?W
zBGq;lul~?rz9Jjf$S|hFx<a+MCiS8uUulR@!pMpuVWz#NAK`OdXV827m!d0LR<i4*
zlAMMMu_)W~M+!p)Ixlr1=CatB)988Qjb&Z<oK0)^TKs?8lx$yNT6L{y@BdX!cN<di
z3JhU)0nsoMP6=5m9L%WGh8$e!PKm}1`hDT-z9WrC?0UU)hExDR(`s!qxe}J2_5|as
zM2Dy^m=yN<DHpCsBua@7+IKw)1s>m&X~Wm~v;&}QtDRXuvX}s5F%C~NSyF7K%cYBM
z)VdF<_O~70s6%-`SARa^GcEf!#Y<-o_sEpm5sdHol3jxEh%tyOZV>k)?+IK<B9AkY
z5V#|lEIk{}x)}r<il!a)En**Qq|_VcwG^shLQi*<T^4IBN<WF+E8;|ZhGswAmAvPy
zXi@~-l%0<~s6b2=ZP#6`#4##TN?0p%E5P3JI?#3K()A<7a-&0B|K|C<qkN(6@$W+q
zhw|#TED`;*pEuJyHa$K4Ggm|RVXTll9}^~dl6eX?siX<gMMloJ>{zh$M#9_(ZaG0Q
zjlmlqt67ad?xb&l0wX-TC^O<-+HrB&m#}5hLaRyxJj-{aPPi;rb1ZxTHV<NwvP~x=
zjd0wb?MFPRl5)Z1oF_+%ag5yii*a5_faT95O2{DEFKq?v9xp&`cW9y7Olyel#@m?3
z$|k*8F(PY}y$(Mv6Kf2MDw1dEW=QM02p5<l1juzX_#`CkO3DBYv#GR2?(&7&|4>4N
zp>$QAc{vG_ho0Al5vtuhHfakEhUK%0h)z^NGvR30yWD*E#PuDkud_i)cG2n#&Uh)p
zT^%a8do$e#bGOG+dKYAQMuRq|G+H-1T0)N_Dw-tZB=q#kf**`-Mc6rVSMi@+dVgWj
zH93blpNAhgf92k~qEQ%)cY43lAux2ME1gl&tDQm#-v7vzhc>Y*PCwloKTmxltP#LC
z6XGDMEc<<E2K6`n$1~ptJeM2Wf|C@Vi~pnK0_Z)e$Yxd**Y?Ut=I5sM;2%!4H>ZF2
zdOpUsEt4!<#YhUq{x1y|hx#g=%W|~OZW)LeT9CELeqFLtzs3(92sjR>&V9b%@qkv6
z!Pq^gV6SeCQ@$B+sioI}p1^q4jd)EvB%R>yKW;}3A9!ZkpME5(2ELx287=*kEX4%i
z4xlveocqM@7%OLuUmoB}X72u~jWfui9$z$4ylr(l*yAp`{tZza8N+mlEN<N5{~eo*
z)aO*SF#ermykiP@cS!*(;q5+~_g~N3P<tauc*D$RZLZ2na2~0$s9s7km=>dxP_J?M
zBNOb<E;cw~GG2z1-VA@~x^;zcufUN^eoooMX*3unn)h;dsdIXTJ(duC^$O9hx@UP*
zQTgPD2*Gt)VOn10M_uPykldF&K{;_u#ktr6T(0_;W@TpD4!FT%m~BopQDO!oYV=?8
zczLSy(iH_UG^(;d#P$`8Q{w|?^DbK#3@Z*mj~|w@MzSN~5ItYTkwD<!j11!yUrXqb
zsC5!s=UVAh2z~|wO<Xb2?~Tj+biTjZ2bVc`)tCBD!)xho(0dSEw%XSNMrny`A{OD6
z-`d(3zy>$$XObWZdGTCsth~w;Dm}i<QZjP=dqa<n?zgK1Sq<ndLS_8p82i3NfL(<!
zy$k@}do~mPUJDM+<^Oq6!nes{rRgeoQlSm@g#ejN`WAicA1i<PBTV@FHZ5I%pgT58
z_Ul~;Z7?=#Gh1nL+UuWqgx-q%eulGU75ZO(25;E*KT8_!e|HI^jNu}S@c!xmO4O*O
z=3cvdJmS~P0iDvOzy0UWz`^}eDuosMp0?NMFLAeha9^`-S0{V?6B7OnzmS1ab0uH9
zl2YrP)7^H_K}WbW;_3oq<TcTkOY8Gr$CFK`V;6)dKj`T{xC%G@D*q24Em~Mq1)?Ay
zcLhQQEz<ZDHb~Zm;EmsZ7w~@YY2<6NNud<ro5>fQLd$ryrtT%5O3ZED=wJQ<Xf+se
z(5?D=>E8|iea3xODpk4rL5?B`RL*W|IBu}$Al&LF<<m5UkB^%;kd+rzC)LeIGrFyE
zjSp7TbVf%h;HqVPo1ZNldOMGm&dWeW8YuYs?{qNx?G8&sz3zC}2DkXcbjq=dMAL`w
z3hl9}&UM#^_OkQXCBC+~-DHTfKD|{-`*CNMRkln}-SYqm)JN~oMVKN2j1ibf8Vbt~
zb4>X*l9>4_9}6G`KIhtbp)JSc_1O?hN_KyPb@GF_ewW~8T(|S^dCd!+c*@n`7*pfA
z#zaF#m9U+P&vkS*{~{@HYyAMc!TLZ(ohA)0v8DW*l?8p^ldhPlhK5gTG<ak|(AlPz
zX}5l`$Q*o>S9GAbTi*6~tlsvEmpeuJ)4Dq#iq`;$7ivG!tKsEZK^=j}V(Hc>+@K=@
zPh0)d$UXv_dsJ@_J3hK6H(|bxZo+bu;{aG?)R+4H#!a1~M_Ro8Y9bJsul+bP6S-=k
z$H*al052c#H~b2t7=vd>7Q{WPsH&;S=z>BxCb{UKh{IbtJWh9D!N(g?w7CVULRKB9
zj#Iv@bjv`C88WZMZ~Hi9`lAQ>)BmtUr7|XHCYAPQpqYPa4VIoW8*=F7M4%KY+9#$j
zK+|4?)>S#v+K^BfCIQTYLP7NOBZfiiUOJ|^JHE=}<~9C}Zieu7xa-d~>(tZy82{}c
zoU=f$+)GCryM6O3*}R01p)%CdrTwMu1SCnuU@zGsH8iX?EoCn;0urPx`M2aLwc<JZ
zWM3rIC}G!Cuu8EWs5Gp%e%QUC7FB5Y{E5UE%cES4mBrFdp216^$|QIx8b}u-B*OHu
z-CrqdKDC$#6B~!2!YGRqdEmeG8^F{7ELplsuq`>XN!Ya!z`k3r%q?xN(xHq~W}ken
zOY8_B0re3HSO%8cIr^d@>zSINlaC!RRrOW)jS0{SL~D73MzU0MrkD}-7{x}u-_x(g
zP6@rJsDRAEYgB~_Xp}b4h5r|7gOl4;e6t<(><PK+#MCZDPF-0Wa%coTC1<wYxIBe#
z)ojH%xk3fr@2Qa*rLytT!CW#vAWj0-h%jDqg)J%P2wg-;)_J)4>d9ix9KqL}H*s9A
z=;@uxymV8)5Ex30RhXI02Utoa>^G49hahJ%%$ztAB_R}W*zPyG;yn%9n@MK8^XrrT
z>Z#6@uNI9>W?S+O^9}VPw!giGo%>e9HclNO+tQ_3O+Y?jkcxHhbLPooZ`cj0FBWeY
zKQ%JKGsYYDqX0ysu#-R8mi!m&^!>5e`#<3mYiWUB|0B#AdjB^Uob?2-e4BVx<wp}T
z*Ub(=;f#N!%{1cW|4(nD`5xwjzsZ2BBlx)Vnb<cvfeLNAvTW9xxY6Bd?Q!MQgzl%o
zoj)?vjJE&99yt>z*xA`VCsM|oNgnslY&=CrrZE=N(-y(lzM374A@*%s2g9?yikKX6
z_g6&Bc3;)xI+C(&>R;uk_WjzC<<!^2MV0A)EqiZ$PL=+i`*IaC!tfO{i5HjlkYZVJ
z-P7^y+dtbZ<aNd#P*r+cAGd@$MgYnvZ{~73n4^!!EdTOm?GUaW?uI!wM4Ay|bYAZT
zXop&djYa@gX#VLk-@bvlN<QeS!wHxuS+$M(^rZ9R8Jylq!#Y9MF6QflXR*;EQW?-C
zc%OVSPhwZY(V|n@9wm+!#@*ptlzWO~8EW^^y^S{U0_Si<h-^>(C=W%Z6dZ&U^e)}0
zuXsM2LXJ=#Xl|@r_4u^ie62s=Y+K`Y#ov9@>kK%ZN_V1D3Em#4EHP+y{dN$Y`u6<w
zAx+cimXj0-<vwy<Bo?O!hVsdS?dWaP4@Br4qb$VW!Y-lpm2mIP>4@7;l^@p4dV<p6
z<2};>%kEAz2>sP89?4%<80C98b1Z&Veo<3?Q}WXgv8DP`!fvzo?~8*N?|MB)g1H5#
zxK@W%Jq@Hn3yvw^+IUQtC|`YYDZX0bsdicqLm-fOIxplDgcxowBmN{Zt4^<##Q<kG
zr8H6I=Jo!vZnY8FAdB#!;=7s+4DCAQdK#I$X^$ntdYHB0W3wJ;w)uMG0a?nc1~NW9
zwe`3p$hM!>c@e0TtcaxFv>@wUG}Y1rTA=F$m>$vkiYz|c1E_7%Zilyt{-<p>i@7Hc
zg1WbpMIwCK^9e~)&N{0uAoB3*mV^~EiNF(Ctqa(9O~((GouS2OV8?;Bn{+RZoPxP(
z67Q>ls`FB3x?h@2KY;2jL@V`$%(Tw8{53~0j8CnWgG6yA^D2Ku!(1ASKnDlO#mY0P
zJwD|sszXDnxkl+@CTu^mE^xXt?J%ijGxokpsVI@uZG6qpQc5fVNO7NcVoqA=e-MIq
z+^fE^_daI#T5kcKo-VN(PC{ZEo|GR1pwTZ83!Y*&hz~)WhJ%}EPMD*&{AWkY6HRRf
z8Fv=CpSZlM!getrK)z2?VuHMOiSHr!e0I+kww@9t$i(-75)_Qh==ZXocJ~$OUSjQM
zx2B(NpW5x46vn78cEVBim!O@EuVb2DKeVrYK#*UQ2{KNzXgPuf_=Axtt|&bu#9dp8
zD;Rx>3H>pwR?be^>Na=VnJZ6;_yc>tNSi+#2GD~l04;=RC8Etbu=t<H2|ZKin?EFB
zLvQPoD=M;J&@Hu|sB!O2yr%713We5@LBscF{Bm{MiY667WDf2{eWpxF4!1l)Id9R&
zrP0IVh<A&T5F<`7e>VTPKUdDOxH<8&h2R#litnBnigdNt3f=)TAR?DXGg6T9T!OLb
zI)1M<We<)RhjMGLUa0#L!a_^&Ey&pW#Kb%be3l$p4`(Ne-URBrK0f?DZYClAOy(4Q
z_QylfPlt>V48*NB#C#sz+@Bge<M?;C_kKR)#AF93dor6q`Y|?j)#@W`{+<Bal{-R_
z!oo%cZEa;`FVzR*L9yCI@7ki|-3$3q;~2fK3W*c3yYrajlmcqF9|bl>4BeLPL%)Sg
zA&BOyZwpZGxZ1_BQc}G&1I2SwWSKU~<HklBj3f#@ZQl_#)ih*}RXx%m;|9J84t~w;
zDF!F-+U?s{S-r8qAqTCOgO^R!<?oLe7l%~+Ck=ovvTVwmZ_T|5BD7PBxqu1bkM>&V
zkfo+&yP+W+hV*R&B_cs*1@y&QqxJVPOT{*<>*41Tx?bmT5OKWDjLSY~8z8~!`ihf;
z0@4UhiA6Xqyw3TnEed>U@rE4yuQ>~oqLuSKkN7mG^XC`>^ha6WbzgSPGxr^_Jz!D7
z*w*1EmXv%}UO(27CSHnGgIS#nQ*`Vw-h&n2rQR2*vZRPv3<Ks3JYq@A80Cgxsuv?1
z>LJm6=2z>T_F;YT3A8<Z{oF)Jn0@qf3^@<<HHLw^_-b3d@i-WiCFq!;mu}Tx^;O_N
zmp=N}x#`%NxcET9v<CBT)f5K-$s|^%eVk8w+{VjZBdBE>HHOFa52)CdI`;~L>Bcv|
zJo+nh25Ji<w2xeUo{ES9QBM{cK5mC1=}jjhLOU`d-4=%Gi*Z_7oj_Uq7PxdPj$iN|
z*XDU|F^4nt&{ob5am~y?gyrZzLng~Xx_3@V5jTvB$>0q!57fA{i^ExJU&_CvT7Ff#
zAE==0b*~?Hd}*|A=T9GbS*%=}gqFv}&%abaA{Bq>E}~~me0uW<o_1(Hm%@*NVo|z9
zBr_@@8{U$DIMhxA6Q`_Nqt`U_j~!SDlAVc<H)bgj&%Pq9k(V!V3FGEh4hr4yKa5eu
zTX^ehv$!gF(;e}a5(UhAYqU72ibMBxjC%+4%X{~f$813?cyrNuEb+02j1|{s<)|EH
zD{)BRbNye$eRWh+-QO=J3IZzK0@5*}NOyM)ozmS611JbXcSv`4_aNQfEirU=bC3Ew
z@A|zr*1Gqvd;Vk%bN1Qu-TUnQsSW1Y*1^u82q~vex~|EIv}IT#zR+3G)~ru+p6k=j
z4&tb|jT1?hULbiD=<3$ehPoj8w8isuX-WOmdXA7b*<)=Pk@(6JA8nC@IRx}rEz13n
zZebf<q8=opK?Fbd{f9U@D-e?kmRSz%n#96Ru_9-BBYI9DwdwBKU4Fd8BEqz!%XVbi
zjsW}SR$cib<Fl{KBlSe0xOa4SOlo8*pD6k<BM6Lw$%jHXUR%7Wpotkc;#)6Ge_zx{
zFC{i*IJQp%6dZ1oly3UFSn6rJ-Zj%OpSo6gH)U)sa*KM)isZfckCd#1k7YM#davZk
z$_?&+VcT^z9%-%&aI2fCKR81E?r>7M#|`OZ9IB?_-|zckt^_pJuNo`j?T~$TRn3#%
zu&;`Z9NTl7iKR_&WBOCN+K^(hb5d%Qyb7!x78WwGJt@?(Q&X|R>~#H^J`oUS!R(SK
zR~D-H&x#Fr?QfKEuDH8wj#DbGG&A&ZrYN(SP(My8`9AQ8pD0^}+038Sy@!C?s(_w;
zVeDzKJ!$m7mQqcd-EL>d$a;3xhG{zHr+n5l0grMcv5FzJPamf*-?0x;k$X?ICYH^&
z#{9Da{S~uj#}gHgSB4lc=jp<2)$c-)q!;^|@jIVU%tX6>oUVn9?gNHiF|QtxdwK@S
zsJjcn=GpVe9=u{@)LWg-&i0qPFivyLlBsw}wVTEYnrlHL%Xo{VHp>>hQen)pI=R!H
z85^ZV?M?#UE7@O4jIKvcOAEJ8T>jpEJE`O(?e>gIqGf9xSbja(^N3^T=MbOrDPh5Z
z9Aj`Bm}|~#SUf5<i#kbT!uyvE+>Qm_jfE-F#n;9CCPb?6X8&sj5~qbhI~Ia7^qW#c
z$q#G3fp(LRsowdHhW)#|J?opo>6P+(&MhC{waU!4xYK2{ewkWp4x__SI>dkZ=)Zrs
z;7yk-LNUNO;(h#wcTDxTV$Y%br`LWKz50(Jh7U1_sr&Jbx1Y4Vd~?>%-2Q9b$IJ7t
z<^$ni_&=!3{|`%ONN`$Woh)HlW91flM?4!;$rC&X{yXyk3=0bIYNep#;7%0@+(x^B
zaFyJcsWw|yX{`Mhk2?Pt_y%*@`b+V4Lj5!&-V+nDS&IsdFI)fg2ttjQT0hiwoxiGa
z80PS)`c-n=syFFa;a>|r@F7bz;2v6W);HZ9<RDM^bHQ2viKQqRWQ(rR8Z`zif@1x?
zDnO0-VzMLQYIdMCo{<E=5=u0X?I5xrxLoDG2nsXGV8o%@OY30AlNvfIBogJJ(+XfG
zBK`9aUtN^~J*X%LwKOBOVR{c899C8yo8!?%F@a6%1Q7b2sV!PhmtVx>wjj)<A7kLp
z!rna^#7BM!GB&RD4%O7EL&})uCMHVWa^0WjoFAhXR%EjYiS^_5(VOSV*sp(-67L+q
z3VnQ0tbIXlA5?#2+^9mY0nr@t!O28LN)Fq<lzx2nUAP#3+6uuke{KKRt}XGa-|axx
zS=SF&Fprfs%K90<CrtiME}%mDVG4f7MhRmE36~w=uesHh+Z1ms;hoiFEZuMg-xsTb
zc(R$<QQ$*}?r{YgBvVK3$F8->C3GwYR#lLU;tLir7Rr6$TzCT#uw6B98I1F4i@u3D
z=e!36Td0-@p<8)=yo=4lrQ}Xpu;^?2NgR9XY%AFCvM=Oh9@af${xL`l=~MhMftlp}
z&oEkF?o0t2v1MgUmu?Y>p?U!#SG;zNstSpv`{{~XsbN^%s<w}Fg#xPEL^uixwUCzy
zYIAl+0cBE5CxcCutwP+V802MF6m4*Myq(Ws?hk8{sog{Nsqc}QoI-KB7!-p)r@oiz
z1<efdVO?sDFi7m`riLz^=*c!YB<CZp!EfD|JBr#8lWE#5XlQPk)b`w;&x0F-r*@WX
zCt}m?Lc?#3Ul9*1xTD&|dYsgIh$x_0MWbvbHEU_OC4`|#&vgD?HOzukP{JrE0-K>M
z^HU+$OYyD`wr3o6#-8pGSyU!;+Ihs6#tJ2;JuCxe^IR+`D|mBRD~C?ovoiB29ves0
zzUAu)$BJ^A?3L?rU1+9r^*$d`q1xS=9&`q?evZ#XOc~R=5{*9k0=K=2q}2=IeP~n-
zkSuFj$ilH}lhPFr_#k0UZP!{mZ*7}2A~<_qUFpZF<5Q~^g`1J3J`+Av2!KPn>rxdR
z8{O-DRdgK@gvn;5p6lJo2B;ZZ*(xOD-!#hC+&^(Jh<=FZAN_10#+6EmKdN{EXZ@5=
z;oa7jNJBxBO@iT0T*R$my{(+??>~~A-6O^zhw~fLu@Lku#q;@ceNL$b9klX7m`V~J
zgMz-5bR!zvXh)`F6rHhq%BQ7tY{6o1eNtz357f9knGg}OQWs5AntrMMvO@WJ_ElL)
z;CCtArZNMPPexR8x2yorRQx6QYqE!Y=F%;EACsxHJP0wBiE%`~g}fs^T<4?kQAx)2
zhYTN&_6cKef>y+MExeZP^$O75L%Ely=pH)ZXQk4ttQqiA3x%k3v!JNrm&j9?gt92I
zo4R@`XPnU){C7SiBEp+Q6)YT<GPAu=gBfOqcGZltjGUPh&(+aL{YJw^mJ(g`gYUEX
zI9S*mo#Y<|WIdD^JzrDPkdg&Ej_5v8jviD^wA-K#m)a)NJDA*rJ#B??9H&P2%h5@U
zZ=1-xKg(?Rq4zc*27e-CT<cL@GR?Dq=4S?niSkdx`_kE!73V)dqd?gW%#Uwy#c8Al
zd1+s#FjP}YkittNl90olwq19>m#3{^EDi)?lSk8GOBA$M+s>m)r5L=Gv?-2-Hl<;}
zX+6i@A?B)Jp48HQ8}EW?M?@0FN_boE<M*bCn}cl0E@9fSZDmeRBgMfp83C!*O{eRH
zq2U54$u)}ZO49E?zwavs2{<qy>ViaECVHd<WopK7?fZ9m;qh_>jf%bN&Wwi<goA|=
zXQIzK>1(JMc%;cS;lqH4F~Erp+V-9@c0#Ftb=hFY`sGnhhr~!;WFER(2Zmx*>|hD|
z6j?b-$=x)jGPjw`R<DAEI%7BhWGUs@uIxgw;tY8n-pcF1$v38dpbqF-J@U|a#l|k=
z*892ANH#1bI#jKy)f79YDUVP(MMC0wlp-KoDTZ8ULqg8Wlq|PA<z1e>kopKZ4Ph<B
zfTpKwQ<hfyoPj7@b+0OeH`$>vW<Eu?s&6`LVHaQAMH9^GibQZf=?9>d2FNiA-c7t`
zES^x!X^D3oG$EpAd)?A-@yI@9rb0E6^Hp2cXABc|mYxycHn7#_=!o!Kx-m;*>9`AQ
zJ>awf7^0tU>@5l)N|nT3?i<D9`15;#9WDp<c0wJS%e4ie5x0fz*!Fh!Zw5W~$~aBW
zYGQxcZufvkr4_ZluBl$xMmQ~Ba_2dQizecAX^EYUrP1**DBadl5l8hZ=C9d$8GB4A
z$JA=WvsOlvw=FEK0Chf9^uc2!8mafOCAraEAdC?528GbwRtIN9`WXx4K6*Big+j<!
zYT}a1i|FTR8hG>JvpV&1V9J~!<+DVKo1<a!>iXS+vDJqS9QE_w>+`1z$aN3{Pqp?-
zCR$DQFm4b2YY)b7u+&xovOMQyb)8+uM4h&O-894Q&}{grUk%zJX1HB|0x?v4^mqoT
z=xbx_Joa_(Ts^Hw9F$DvX!He~F`{WYG}fGIPjt2+-Lg<ph$vdXdntNnLLGcEfxH_Z
zRf6Oi*E2=m^x={M6?d&qWmco{{q<~#j9dNe*}Cn>Hip}>k25u28ArsJPMk7-RWg%Y
z@%xPF@Ce(J`I;;XO(cwj?zAlpwY(5TI6h4b9BZ{*QvxcGpdg2GB{(<s5*oRAMn@}d
z$ky?xL%yS)I;P{5ehd6@1=-N?+vqNa{Ui`=ud+NAEoQowmoB!hN#Se=itfg&Y{2t0
zI29hBe8L?&QOL32TK3qpXs-OUnZ$y$`l6=S6A@zMd;VMYeBlGpckHLu?@p<&yu#79
zq-Uz_4}jp9<XqM|NN90Y`e!G1l41T#JQ~viEiNGrR$Ec0ilQVHbhZY_4~&@@LO)jv
zOw`QgpEc<yv@sM~0j6E#H`~v&P>V_%$!^|+r(@u**&96DMWNjf!Q@Ae?i(f97=#;8
zy~T|Eu2MecZ`YkV?Gw?2T4;IR`F^f<LW#iZuJ%QQh@=v8Y&zd=PLQGOxORVD?gs&u
zD4H)I!I>AmX1q=0P1XJhj<W9>VkBg(p1PHxBIeEq&`azIu;B8L@N+Y{q2RI@@wp!i
z?po|{hYEm)4Hy&VGAgi1Q!Js5k!Z5nqTzGxNBVgRlHn~|jkziI5hBtGOc~R<0ZkQ?
zr7VHR(=J@mD1%hUX?^E?Vp;z48j+}bR!h`H5w>v#a+N<;%j^QKB?#gd&Qev_<OfU)
z+Fzln*R58!EHtVpoHKw}E%)V#JF1zyHCXBh;>Wab4es`&EOO2}smSJzjey~DK8n#G
zOHjT-YQtKQsJD7~FCyr&H$ppb2Mm<;hzxZ$<skW(U(?B!bMr8fa*!6fD_yTznfr{o
zK$gGpRmf*~EK-(`CMN!o#_b6^W2T$s1`{1233j3e$&s(g=TsXu(-|sYmlka9GXa~4
zG>5U8YzLyd&<M++x%vV2A4g|#z+3s!PD^E=&WHb;j_A=_Pb|@m5y7bus$%MZqc>|U
zP|;GN5!&x;oGL<y;c5Yr%XPxBFCwQMI=%@6oP8B4D4Hup*6!QNP&^Qiub6p{ksY);
zQc`Q)619xu0=%M%$Ss6&Rvos#KSqhTGe1^YpI*bTeLl9S!7Ks)l)H(8S+p5L{<cei
zLX5{ZG}ymFCJLPZyQ7{r&vEcr5W9g%{5C5|AIr`BO5Uro0a)dr_A%oZg}QQaoxQN*
z&3P2Tg6(;GVg0KS5o@m?OQZS%qd-DYs71bB%j)&Gs{=0BxrB9gq@Psg*4$5Lk9sXL
z>&5w}g3x%W-k4)&j=o!S0Nyx9HIQdvQ6q+z|7fXuNWx#~iFQ5lcdHp%qj$;xr@B9J
zDO)L2Y`jQGcst&MveI6bmhR%c+2*~OXH%zU+N6E6Jj@q<>_03L{;Y~Ce?-__T*QAg
zw&=E|?W8(?sNUYW5cB4nb8Y%~U7etiu94UlMws$b_a5WVYEu#mXFk8y6~Q~()R&b-
zw+tKKHe!pIY2uU<U<*B*P9F&q=#n^W`8%EwJMWJ5#wWq*fpNo8#4W~d#^jA$g}!l^
zUF5Hdx6zbrt2eofsX12znsB1rTFES;;oe!tJIqopQA_Y!69hr5p0Z#!SF;?@C05Mf
z5fvNsO+Fa}FHkQLcl&E~GVs^9)jXKypYP<h-;?EEuG%%hOd?lporPF6Okj|ovXrsf
zJ1i(y&!j(bI1IylFPK=Q6mBk<hKO?&v=fqf@ameYHMM*PDJ6oTWb$rhxd%<$JPo}`
zn@w73L`yjCu8->3uzQuW8it;ncOG4Z`dtSu+`Tj~_3UAbm>UyFD2N1U#<O)F(eoGi
zE0n08?P$XXawaG2EOekTyXZ|!O7Nj9uLLevGwYP*I$4LHG`b<Sllkq)G2zMtv)#)F
zqU{frP6fc~`^G*}uk76X7mM2uUGEN_uu~!3__hbj>Cw@FZEADVw~C91XTzVuxdNRK
zXr+g`Z6tLzxPwxz)$$D3ic3@+XJ!(zhRa)3)*wFNX5&moF_$c(aT98}d*n@3eBNI|
zFM3Xn!(t0Qe`e9}P~;dj)m(ZL)duT^KAA$x#@Kt&#jP;Fcy+&$<N5tkUQ?nJT(B{%
zkJt6yAm6d2szNnTL!{=){+Gi_lYSNYvgn9CYE<|bz>dvs;8(ToEi>zxrdbio_te~B
zdO1&K)(|>*Ma!v|c;9a(1YHLE45<lC6hBSzOOoplV9vy-Yf#&+*PeJ?y+gE+S`qJm
zVliX3;-VgFWPxZ=&+faTd1)<_2W}FCYlDn=bgqp=QzVTJNU8JPl`yCB6O^Tr3Pd#e
zs!hkWRM*I$Odj7GE9&GQ#Jn9}V%4NC1i5cmkBZ&g+zQiNKqx?-$!qQKcD5#V)4cr>
z<0@fC_nYI}eZgX4*xEkcVIH~SY^D-WU{!(I*IGJ*6+Td*9TfAK%wxv>vnD_JB@VZf
zG_)-aKRgp6a+B-KYsgskg$u@talvc`>(uShPq`%R%lwkb`sSQE6JW(SbRV-LTaHvh
z9NefmcS|)c9TPB16h6D?89P**yolrO{=1mCJ&95w4`k{0x)+Z8JCGi>f|D-84!83D
z95fRo%VN)t1R2eO9OGp*kMjJn4J_^7W#gX)slL(ZT_00lf5za}IF?vOxJtZRYr0On
z(&_jEc8p!(#7YrcJIE*v5+>g4FOUC02QHL?aJ=}qj+EJ>0G6*jb}{fwhKDthuy7{a
z3YDR?$CG8U4#340ZI}nD%dz)Z%LEMq2EPO!b7rMnM!x9Toh`4T5;@BFRydug-oEY^
z4iMH(blENZ6DjMPoK;$jRcVht7|~7PG3~E>HU0Jh-cU4QsL0iqpHyKApOug;$$=8-
zglOF7UIJwUCMIv#G0whyEo)wtKcJoK7}KFH)Qu*Sk{q3QvsAZyXt~NYExxE<m@u%C
zDKW|+PcL!k^G)VvfarD#um;2N&Udc)v@Jr3!q8UEm&7=&3eL?5J&PRRZJ1fodv7N?
z3~BS@$?uZ|8Wx=s5R<G=^7HJ@{LE%1Mb;{;gstuqf=>%lStf&Co`Pzp1?{n1me>;Q
zQ*J6FWat21l!Karg{Lqti4|VZW>_RuxS^({%H8aKb-us$dmbX6_*)|rfhqTyu?a@i
zBR2?PLu)JL6I<X!QJbJ@?_=F2Sl;A8!uhoRZ01@Y+e50`9x)oh#FbA;%oX0^*gTUQ
zS0jj8Ldny@_1<{xY_@u8@=8B15B?@^|E|;1@$9^Fa}{}bpziSQgtzG4FSmKRDQVcX
zcI^kdXRTu2?iiFwaeooAy<AaqEc1jq4pgVuHAK(tX_p7=$_8h_1%{4WxWkDhft_fk
z93HX>6IXD^0*ZTiUz06>w~5DM6tK99mXJ?jxFsg1D4gfSbF1{6OSR9PvSu{s4T(>c
zadq7Dr~6FTP&9-oP2<O?;BM&2(Tc#G#dOEbX^C?L7I!*Khb@xKBtoOIsm~cUu)|+L
zL@J-;h?j60tJtor7FJ|L>a9F=xs89<U6V~ZG|Pj)s7oMqpCNQ(Jww?T<-DH=4>SX{
zNN_bd1lvu|CkkUh*beLKVj}h;*(v+wc8rDHOc+vV@6O@YCv+gA8H|m+q*<;ZZ`bag
zs*82>-4ho#Ugom6RTlLtzqd~0VRzz5JX?JJ$lRnT1_xCelJ#oEI?bq*t%-bC3Kyc>
z_-yX`{r)u@X*L!%EqWG;DGqywDk7+e=|AinV}<c@^aey#EZ?MHy3`Ab6@4GCvxE(g
zrlie3$nUKyu4cP(=j~OWc99Z|mS+u|mASpR!=QD)W8TQS`=09s8I0jJ>6!Y9rmUF+
z6cC!%sFm4@s1dd)r8LArG{fBl&B&&O#c~O~Qf-p@N9t5)?YsP&x!5izN~hQwH2SS0
z-E*HgVe92{8Q;r~l6~YQgi6Hag$`R}bVM1a8;gm9p3)cY2i&C3CNC1IV}j91gfv&X
zo`_U=$V7UIXKqO!yd?rX89FerjNepS9AhohU(!m*Ck~z`ih{<H@Ti)ax(IH&QMxrQ
zr)V}cGrD^Io^djzIB%t#6asljw?U3W$|g-3wm}KZP7gU_qzk*z*&IplLZvcY7sTfq
z%OUme8{g6Q)N9CA>f5x?v$&nswPdwr-pMa~76P<M=069iG-<2zPp9}Sc$VBlO1>hx
zZ}wAYt*XOlq(c++PITs3=f9j24OZrmb4XQEW-`;5R4d*)48CS~@8{B8k)W_*d>*0<
zpzEeQk4zNUji~DmILVKcyqxmS6t><7i@YB-mu`@?Br?kKEdEm>z7fI8tr|yuhN^ld
zu`Jlv@B5JGlins`B^M7=cgZv*!gpB<<|oGNa^A+-J#aX6_e8s$JPYM`U4*CVD0nZc
zT48Z~H?<J;PE+|kqm^U;U;j2OU>lkuYW}EM5@R-9axB<iKDxxK09ew^gO~++1*~lQ
zA5Q|?Z@21D38)CMmapl&hTP~5l?scpUwjcx#p=;p@+!6LvS#WL9$o-VNCnUwvs&%-
zKb5oc+Sqm_@n)1Gv%#}0cTA)Usqom&2Zy);I{fHxl(vuVavDu2<$aBO>m&N5@Pq<s
z7s1}h{U(`$ByLqpXq{4>MB{OhJiL8G843}eXY!kq7+i1zm>ge-CDui`YRPR!)ufd+
zH;kjM$zxo7R6T*!x)$FDX=w>(;l3v|r31N&4mJjb5Yu5a53tF>c&61SE}HE2wZIXs
zZeuY}`e7E{`sibEGBjcyqG8qNn{f_Yj8*P3$RT5vSfB9aD;W;trVf+Wv;9r4lCy<p
zbnPaz612GS>KdvwwS5^V`wAPYu$23p)TWvqq*F8}mT;mW&c7=R=1%l_V*StJXzwN5
z)Ws_*Hh|2@Gkf7~YrNx}IWR6b4{w7H-&88ob|K&9q}NutX%@mHU#;);x@gh@d^HGe
z7@~hmj23C~Cl2}1uTIhu#aY#ns}eLO&NaR7pcH$2MBCDrt@2i$oPZQ9H}SIDn^6lE
z%tYZlW|`Xma&71Iv#0IhUPbz6J^uLhG5jOyXTS&`m10s>aYb%=wqU(}`OfY~NwcB`
zr9&bZ3-}IlyH498rf4pNpHd=;CdXLU=Uyy(zC8pb9@u_6>C=TD<6n7TcWl{#ebl$<
zH-*8teCHg06n}!cOTSq8U}aPYKL<oo%v0Ek!`l)ZpXd=I^L9}TF)x%3;<=}P8ev?!
z&~M&yKCFe$8r1Zw52Jt+iKuHzXJ3@#qv`!aa3BC?rT-uS{<}c&U+Db*N5JzR-BE|y
zHQNJZ>sz0>%QV@ZdX*6C?<AGq7hVy2r>vu=YMD-tSh@A}Xc+?u<^+829%hQu`maxR
zSY?8In*>qT4~$({(qv>jTMX%H9xDBp^7z`BGkGT)^(gARhGmB%*Ti7rS+gPi!RDgl
zS`b3aA6+kSqv3AA5S;!h_0q|hee)aEKmto%Bjn6}qGUjwX>Xxn?kAL^%xIzK$LlEh
z_E=m^b4SCVnE$eBF^N|Br2)Pdi#e7pp2jVUn()Wp?KVKqPc62Hhj)L4oOrq^c71gI
zEqL7Ltt3|+`uC^-1Ux3~jo*1AkL#zNE@=Y<eAV%BbZ>9LfR&ln<$%9t3Xz$o2yIN7
z<DV$&mK8D*XwFM7wr`Z333e;qs{<kafJ{aAUt!@-lw~uXsHi-VnWP{N$D(?$Q#3jI
z)_jH3^qA8T<`Bl6thve2dg)p&w^taT850pr^9R-{&&?F%MpYsven&KXETod0q<Z@Z
zuQCuDl+5K;U0)wx@`nqYuZ(B5n1#9DC>3p=MzZm)u9&@ouheZv4-s-`d!(7Ah^P6#
z3k%k`C%o@Ya^K(SW;v8}rwe7{t5KDC3$*o<YXW!hWT}36JWKWmRjUv*@hRP7jM|rp
ztTrp>b5>R(>CdzgfB)pQCYmtFRn3ye&S)00He#*M6?;sM;#{^~irHM5NJmF+AK)f;
zyt^0*Ux1*bvPOz*_J2IW;2Sn|K@j3gNd!>scWh*1g`6)_`SOd4h5vef@eq%Du(%2z
z;b`koweM-FE3g#h6*k&#9ZvwA9et_|<2)W|@bVqs>+A$%o$-!fxilY6B^)4jTcwB@
z_I?_*H*hvrMvNIxOs+ri-|n_vm>~5X-5O*@-`LDg7}uz`zlxZ?Sd)ii9$QVXHhDel
z!ecruG1ZH_gvUfQ250(j(t-%}=+u%2Gv2SCj`LT)A2F@;I(t{2{`<Ls>t`@H5C`c9
zN@S7KINmJwDed^<&No|l%a;2!+QSpidemz{P;ga8SsAB`*Elf0SDI8ipyL0kP;Cw(
zSN}v&8U?%~o*4@L%S7S#OtBe6hY;th)P0%CLRO~aTJjv;+~+*2FUu0@$BZF0e#{aM
z!~r_(Oa}k0<@vS4E3B`1nmicU>M{?wB`C=sS=OFEmHobQT9?P~jPv;4F?Z;eFToSF
zGnANGD-vp>3e*qml{FX$b^iSrc<2z=voCmtub%x{_ibkU{iop{zfR~8z_De(r26-&
z!TaAEDgP&bWvULFLs~qDI<eWSF6Hloc^K7#(0K0(<{IHk(ORk}OA?eFIK96t2T};9
z^QBHGW+wZz)o5jsbNqc5J;ttUFi!sbVDqfNzafmRO@W&ag}$nf?mbGnlE2GqTl(Q`
zl)utk{MxiTQ2xsU>i+Ef^qiH>JsX?Pt=Z=4#W=D0k;R`jTfP9Ai~|U;jbC#wc>=Yw
z-KRKl+&mYm1gp%_h~vM%tK3{UBbd^Y9v0HaIEhxHl@1*TXvBadKt=X(pjUaj9Z-T4
z%3Ci0;(%HLvZAZc1kRda*{Dd9&&byf&#p5Zzb>kjUwjs0C_Aj`q&7Pn^6cU6Qa0Ti
zKLH)MRYa9^8#fejcPKY<To{&%lkDdz)yB9LW-TC==q>+lVen(XOo75Lb`{-QpeP+0
z&J~ZgZJPjI`L<MiY@rZ#FvRy;mj#I~&l1wmdy#Q&{JB`b{%3HabB;i96`*mBDa_@D
z>^%nvleky3Nc2KtdM>@evTDb%v1o=zn7)vLhpVdvufgFO3U1jh^p;4oz>eRy{W*XF
zn9-gun<@^#3)c8<5?<}kCelCDxdm>1v*`XPCgz&T<yP4kY_%d>Dh;G12_s6SPTH%X
zXxHo1J34QMAZs72n<;F?fqc$~P*%)-e<i{%+~1GV3aHO}3zTU~lol4{olR64NEWQj
z7Ap;>lRPkE3))<(obP4svsaK0ZdLe*YCbO~)S@R>@+Yt>yE7pYR`Nr`!k}}5)JoK$
z>2^@IMHgCjm@hV*slPKZ^;0Is%WSsZx8{}JuLcS~_6rj1MoM>8m)@R>*Q5Sg7WmTb
zJ@H*hFGLK`4o7u$<XSLHF@KaQY75ZCh&Tynj}}(iLxg`Y?F6H<5h3=NNYYnk;;rHJ
z&du%=!pLk&6+;xrh03&0!_02N_N!~orxDHcEx2hn**6n~{f75xcv#ZV%EpjXqoG&3
z+}-Fi<*T)5WnmF4ky$8Pm)J@n?g$c-rZKt)y(Br)6505(H+^BRh5~Jf%btk7q>r2u
zVMsBuF0Km*)IIBN(;`>1sE!s#7A3c<oRePTUf$V*MmL0^wJ?67jD3jR4dfK716SE%
z+-WG#NapU#Nh{EUi3;HNOm${Vzq`5=ura6dIhQ&W6exaH&Nod)I^xliI}^1|Sa!O$
z;DBrmSPcylkLWCwD073@n+w+7_GC0Qu>tCM_fde4_TqX>%19Zc4y1G|7?XtV9%^{c
zS|_wdz0#o`C~Z}#<kalvg{5@8wEyL=OIt95XPHhdMEx9`C=kS(qTdsO{5D8mBt^Ia
zh7~i;MB;Bi0q1y%fg`c~h>JRSoie%~Wl8W8HUs(!h7AFYQN_>gW|Qi7o&HRWsy=-|
z{KMw*xHcL=v+Ha}of=wmS^R3^;VMyh9pP98oyLUX74LUk7%*w1GN(<_R<p0yNWtc%
z49p49Vl`Ex*JFvr&|OIzuX3ZKPn#!?wx3tKd|6`KDmcz7xmY+K{#gwP<~W0FUqN*b
z@?7qc<Nf*HU#%=uwF$IdfjU5kG3c#NoHV$p7>xGn4mBR6?Zr%%Ty&6Ts+FIjuq0wo
z1i;&?uRcb5@K7!-lKBiW!Oz_8^-^!Ls15dzJ1}4zN+I~#R?Wu<Jz`M8aI1UUt39_7
zN=;J+%k<N;^QHFfg~*u;(_2GE-SV3+rCBHiyxG<f&p>oM8sWVrcay>f`e}Q}NBZi^
z-<F;HyQpTJj(6^v?3NGb7H3z=!9rILZ#@DZqO+23j-x8aVA!M`)4^t|uW2wTGPxq2
z)R?c8VY1M>Y@2DVYxcCxY`}+uwoP1{_NMSbhksO#zn=dYer--Q9&5?WGSEuGi3&J4
z<ze(9WIc3oY@Mh2<iYK<b<!LA;cCDtwnRy@PVKW^D$ml-in1PRwT(Ai=BTJ9k5K{E
z6;Kc24ZaAG(EWziwD?X1E#hteRvy0wM&M&(KsKkF4nVnGB7nN?s5yC4H@196*x0aO
z;<IpSV6YCyYg*j4912{HP8Iu~%Q&4BC)XDvP(**^ka6Z3L;W8?a*fsTKeB90@jn8*
zZ`Za-C7+KH6falajMTy^2@Id`pF3uzbO`ZBw;f0}{O-WTSH;SkX7<a@J!_e>VW`PL
zBmr6<(Dzp2+{)^#>F!w!Ywn(1vsT#)3%6$)cgKjwXE*b)Sj!|yKV#5hsyu!=ybf#J
z+Xo*VQ<1Ry`Uz{<YpT64hz_7?%d4qI?g3}Is62NNkMa7v&-tMdJyavC_hRoBq~-Ao
zNEI{N-~G0{pz7;)U(^ww=w{dFvmtzf6xLoMGg3^-E&y_4Tk+%y&*xhO4{|tAX&Y@O
zL!h<qE8TVC-E&qvHSwXgd8MK@zlP2Xaym679IvOCur|^)!`h#PZ<~<DQ6BgH9?4%h
z0DBS>Mx@sqlhy3nflG5TO!kbAPiW~YRvjXPMp3>C!_8XwC*|(ee!ji^o%Jp|w+tC2
z+>zA}h=^AaC0K)DCRHsEF)B&iF2sakJ}UE!MCTZO=;&q0ZWO34mMbu}Fu~xhIWtt?
zHRV8-%*ZnTwgNNSr0I;^VvrQG&jucF#>6K-=It@eRsywnwG=|~Sc+}*q&i8z4C)Xv
z7X@Rc^DXl#ydsbszPODSgq!zhj&+BDk0U}<`+#tlgBs-}+f@v&9x-RFtm}H;*J{u!
zb27k)Q5Oro+L`&HHMo4KT|&eu4V$~58BfabKbIz@cP#^*V4zG6n{$^Y*52|`#wI`-
z#^;MH2Z(=3w5sFJQ1GzKIP(R7yW7-7*|>MMb0*)_oXIyKzbC{b-;0tnA$TU_6K$Wg
z*6rsiF&fUX65>_U5EsbKTQ&Q;LsNlsZoc}a8$s9GTr1~oE^ng?6!AT{6O6bX=B{Y<
zuf!E6;021E4eC5BwNHk&(Yez_uG|x$JUBa#0w=p%q=Ko<Ghe#B-!VZT&!}O#ZFl2|
zQhS3~*WCbKWax@#Z21zbyJcS+MpHEqE%!2E;!YOZ3l+5-V?-1Q&3!Y{m<`~RlC5xd
zM+Mub_3L-tokKoK>sP6oy?GrzzJk!fjknQE$8~nbT@~`a@}Ny~r5p8pQ-XsoOzJ$T
zkKIFPsu?{P!>`Yr6jSE<IGlR7g~JTzI>G>t?pI_e6&c|MYD}F!Yp#yFaFl}S{(?o1
z`82BAp&Wnn*@}Ns(}lnhKQ3myb67BZ#=W#BW_`34-)#ylw)1Gvc00cq8UHe4G$Ll#
zy(P!e2&%+7KcGJzFbIl4kG=ZiHmJ3cVvPEIjEGgJ^!`QHYpH{Vp4BT=o7<NNx#*fX
zSj5u1v-vKOZ8;_Vx3}#R+j!Tx`B!GLb1bcz>&b`W1S9CNYTc7eI?L=X&rz5W-Up%Z
z97&cqB_9cv5>~#HzwJm=PVk^w3==Q+mmZ%k6q1Mhw(ek2%g!aD7Bd<gQavZ!C1Y@2
zca)VOE~@qmtt!hJh`w&kWeQJ<<>S(y<G)$^3<w$dYhj@cgn71hUjzJY2_0Nh4<<lU
zcjrn=)ewy!FUv3ZIya2))2wu*rv2L6$(TOfuioa;v6>X}HiB&ol!_ZF<e4_Kl@v!i
znU>i08ZYtH1sy5TSlMyvWHhYbOYf3KYpWfvTRMHdDBKfZZ_#>`9i<?-Jyv$3L4Tc=
z`<n77nnElsBY3*izt8p{w2*5M9F~i^ZBu%{;_;)>M&+Gk6FGfOv3Qfipu36O4wV0i
zsnOC(&epj4{&oJJ0iU_g7zL-!8yX5oU_bMJSU4K+*6Z3n(|J$}_xgbJ^E1-^+Qmqw
zrRFSigBl?4))XMB@O6|Vnv3Jnl(=5QJl7%x5CoQi>HspZmqVohl!+w(`+5z4x;S}#
z9lKH^Ek&sfTdIfySZ4y-++85T(4WR@HjE)om2cc8OLN|$8pA!P>`~ur!8lD5%yi4;
zE18~%#nHAq|6mY=HAo#2koZVh_bEB}&L5hW)t!!%J*L%GjWR=@>0%#IHQ^c%DUe}^
zC=hYGIP`a(aLVkxc%r{Kov2-s-~U3w9_4nZ9qTC1{Cyy#01waXG9Hn&dz~J3ugGRA
zsF>q9f-93{+kQlSTpK}w?;|<8D&Y6SQO58q)0&aQ2|r`_?!M1R(bek&E{jh$0dO{w
zv#359E|9&QvK`3Y7j}+RIyVp8V(PFjoX#Nh*DM;juB2Pb5sZ_Fs?SraHfaFLPbo~j
z+7<%Ca^}I9>a;1a!q*|}b75nPk+CS4jd(N0zGJK?wo>N(C?9|qa<=B5{MCj2OrU5^
zzV-o4cJ@S4LKk^BJ?CP6?k}Xcai7m$*_kOdJ=_-70wbf>@e9w;Q|nK)T&W?;FVRAX
zc@~QjhV<T!M=2`}T^+YS5H(#cez)|5jTtQd*%*Jt-<;)Hdd!3h#84a$obS21t9-fG
zw?o&W;gYL2oVXdw=2^%TL%+8tgoE(j)Egsf*TscDQLPLHO-1ar<!m?ZeV#s7+XS1T
zo?y-#DB!-Ez548K#a}Z3c6;~r@1Ay;cbw7J_SD#)!S5V9<$7)P*)tv?$;7pTgNIOZ
z{~|S)JDAg@_f}e)$TV?4s@P_$)iHL+IxT{=(arilYGectD}Y79z$U(=q0CXOFx0Qp
zZuUsv?i)3&q?M2LtZ=_saGJA9TV7oFG__{+;LC-Dj4S|cjv4xAcZYyr9A-)=K+V8?
z2r=Ky^hY=18rqoMnJQTt&GZ~SRkaC~jBkJIj#Yn{(6Q`74B<6O?$>5o!L|7oOlq^2
z%a3^D=O0*Yq1sLgf=+P?U{yDDj%E!|vsHW)CZp_S(*#HD`iKf>iuQgYHV@Cw@w*pw
zux26XX)D&u5Us2UX(AZK8{@%nI>@UIks`5TP;wq1jc7&vW(Woe?vt+7QD+);gmV)g
zjvA*cl)KyAz+O}Ql}dk2(Ad+ZqWgM$8AUzBd50mPTFq(TBEB6IC#OdQ+0>?$CvrQr
zqHAL27xCR&x(;sBCxAAyu?Czes$#@6gh}=A!Ip=xvC0-{GpgzP(LV(ouUjE!ZS5q#
zQKBeUc`^Xmj6+kkiY0G_FhWx4mKP|uia;3DX2O<9+aE8wVv2w>Jia@jXAS?nk0yRm
zGR%(!-54-R3urS-j-#YAY`~A>;Zg3-Nrjok;`Q$1v2E|qLx`MMZwHul6gD-r%p^pm
z_-G);X#{=K&Bw!35tsMl4d3Ylvm591{A<BE{O8R#-%5EUwa4|c?3VW(lWG)Ic;A}z
z$)LDPX&D-Q+cn$ib}-j2`Cg9ldtL%AOL+hjD@Ewl3%%d-@5(8SntHer9$X*L*V&zB
zT(TVU+-yNqb+tI#bz#wtnE&jMhGYEt`$$G>#{-i3WFdy3B)lT)JA(#BXH0HshdEYs
zgK$ve&CeDAeX;)A-th+G{C7bRUEk8r52e;qnp{2tA{c2%266Gja!sKGj@zD$t|Tcb
zKHRhnvQ9%9hu>A~H@iP5eYuZ!@`;l<{Ls>^jCI03mv=Cm<?DE=f=Y-5Mzxxw3Bt39
zy_kI~4}K9(nLSGec9L-5xNSjnSq{Vs!BB4JbeYRsWN_lC;59wT`{Xt^MqSf@nm|MJ
zxTwfBF3G3C_2{pq21wjVDPhFG;*G<>WwY2;h&k>x3#_)BJ1-d@pRp+mfAdDO-d<<R
z!FqG}KAFpziH|gtK<;#F(<K&6VHDrsdQ9Hc|6cR<BhPU(nuvwF7lzrvsm-q>YKVwT
zA!q4B*vB9~!WiG0Fe8_U2-54ZRR*lD)&d4ork^XvzK6W6wy5ww3QU$c-t>)~Ww#EN
z^xxmlGZu{KA}Mbh@e8e(-HjjPJh~^<AzBbD>ig?y0-))R92_L%)F8LZW!xdo0eLLg
z@%CU6$3t}dY))vCn=s)Fw?-s3bHtg=uVd`s%T&q~C#8`b?~A@vRARQ)*m*g9EORK@
z**>}Nvwc@vOzKGAPnY&2IuHa@H`YbW%|pbo6xP%CZrg2fTBr(uR%SN@L|wP5*5q5>
zAPltG!_HaVL(4gr>2)XAA}LQO`vvq6n!pLf8QQ+6lC7GlTG;eqdH~v-GW1U$|1yMw
zUy)yV-fy&&>7}?a`xY^XYc%dO9Bk8mJsux-a_!BKz`^qlt9LM;=>>o{B2158NuMEK
z#ef>Ps33RHU7yM%BA(-hh$PAgQUn*0%w)cl8Ykek=S3o)KCa0>69^xs)>QK7&H<4$
z*lDwM6mw04)tj}8>g>c@Kr;~{V`l>{cN;Soum<cxB;Tws(Ly|MXD@p<C+?l5N>AI&
z-YO%JiO@7mT$Y=meaQVYg9D?&18_3;uQvi^V15;xnZ*ISJD+__b)zh8kipLnmEmHY
zr~-Sh`zt52k%l~aNtg^0y_4m~9(9qQ@l_Y00kC2|tBbJ{O?F3L&dJl;FzFmq;veYj
zGAeZ0RDG`q_ve*K?Mad}6(KZ7Ut~g|96$vb5ycPn&R}h`69>!|E1GWlp>Fi_?Xig?
zeQ+r*qB746qvCEj?C$>@5>7p$30~5qtf9AnxFt8FY*k4~=0pw_>!QQDA=6a_^rwcr
zD<Rdv@&*4@G?_gmIUYdx71t-SeC=j8!>*3|p>lYFo!w3jVs8~&<9giG_h&RVP<0%W
zNNQ+uJE67d&iU6tNZvgGk4GbL+Q45~{x1sXPz^$m%$@9_JLPJ_!wnCxT)fy@T6+DM
z%4@G}Y7x`wUqcFlwE&R)n5EOLomnd)b4i+#^SQ|&l~{ZM$ZYsM?R+)5gdqQ%7yO-$
z^!Oid#L#b0^T-4UzZ(Y<(WF4yKuXu|&mveFu0_&cLHd*tEG;&nk8A38M$q6Z9f3we
z$wkG*>wir^EJfK;3DrQnq+)>*5FCf)i-R=3T`cl%Bm*AtY4^W?@c%K9K}<>tMf;z0
zHsHL?|MXz|U!kCXS_=Se{}VX+|L|wCzkF9}vPPrx(e6ye#KZ*TPc+7_?1@T~vGcvT
z8q<jYAf2@p;D&NNDWwx@@6PAcD~((Jaut?pu^{dHy_%(Z`>ocgN0vG`eNSW`@(T+7
zhGBi}{01o(LNh~n{vUpn|2LM&Qu0+tVk&ZgWW{k6KCn3=`E9(N`sWc5w)3$Vqr?+T
zj>ddR?!3Gl_*%SCUMBQjqE7|lJQ~4`*<auJ4&+g&IB|KAnrriQ8a(6VQwaYYNVNOi
z9$%(b6|<3LfORjM=TDIUWwI0wcy|I4uh2pRhi;`V#v9i%St2%Mre5X@9&Z$bcJh6!
zFcglWcLu6;^kDAV<oFf+_k?ptRS7fHebRHmY?}WxEI7)FF)AN8Ta7v9JHrPn$q?6m
zV*;Z@g2=?vN~PDmC$UnWPz|}jq*zwe8&{z}usGRowIZgitWTfkHS}6>fU{93*bWFk
zEkWYR71b64k%$GEiC^EFUo#|cQYn=1G|?Ot@x$^J47IN9apnT$%3L~P+C|mK<=3zI
z-FVxf?!iR3uC5tk`|#tj&i(}wwP1VMd_=&7mWLc5p^439h#-a*s%E6)Mz{Fmr`p$j
zY4JiDjfX;&<(4t|hzzgaCTCsOIG3aMvmZ03pUsf#MzCI+^w7j`>#Nmgnd7U&ocMKN
zH<Rc$Tm9mywAmNPfm#xC1HTio>0b!-1vd}*(fsX*ubn?@aC))q*0+9c$;iAk?nHl|
z(>u2bC=VBkt&~L^KpH$C@|4UZW=cu_p+daKN*%ZRE}Qy-#s_bBh9t?l1h^ApAUya)
z*_@1;+$@7MHfa>pcXN~wG&~9)!?rB^q8feMMW37l5=%&tZ%41qw+N){S5qvO>B)8*
z*;nOuA7sb#V6A3woU8{6VCh?4$@Ka~@|3^x3B55bnu5LrVyP9r&FCX1;LHeVq>ZC0
z>ECDT+s=A^+z94ONcj;#-l^nKu*+?cbv1Wj8~Z(ZA>zmB8<h8OP#kc`$iiCC?rms}
z_M(vb*SBczYa}$*_fsUxl5AHq<ULk~RBSzl8;{AUm8PpWZ6)KE3PX)|FpDJAq!0<}
zcu4K;{d=}%R8Iu@PGU3lm0qNsR1cw{f9D=kwwOs~RP3|+hpyqZ0OEMdW{{ro<sdH?
zAgQhPQ<KCy-V;K(35e(txz(v(7|iTQ8jx+2XrvxszaF*{pVzyUaQjv1V<YgGDJ`<i
z`+LCH+70aU%}G-0^pCo<Zyt{XC?f}IFn0A-39s;D-Ul)CJG-zQ478XtmVl5G??(gE
z@akiq$qD#quHT}2(R0`-PjuIMN{%?Z9OlA8pMk>9ZM65u$SAHiEashqe3?I1^!DWI
zz7Oqf`FL$oiC5o68G`XWLcWZwCyd%g&-)2`HF6M+$lE^JK_su4TQOXd?{#Uj2m{@9
zW2Y<GyS!dG?b0Jv=VQZf3$GfSmER0x{^+@LE^FP)>G6#p?jGj$+MA{h70FEDHp<MF
zI9#(y%Va0-dfFWFDCzcTn(B?T=Htg|CzAh+JXu=cRm!x`fb2CubG9X$TWR4+c0E#h
zIN}|g2dNzhjY;AsUT7kmiBIyx_k;-&(3FKgzChxyW;H2b@Uzr%@aNen)Le_`NbA@-
zQO4@kK~^slP@#PH?yE2j&C{J_{_=}2Fxuvr#?_#q8$2$X^6a0LJ!(f+os!EscgD$d
z@@y)dG9z4Fj%zq~GQi29C)v1dt^9}sAN{v7k$e;b@K{dt9x%}|KNuvk3W`!1#_$Vy
z47d>S=S=uLoWcEWG0w_}IND=>87j!SnuKh%1A(F3v<h3S|157<BCPZP<b#k@<<rt<
z4)@@K?f@28E$!h<(AmsVoUXTOI`an=s_M(bV3`b*x3`oA7-|8TBIV;OZ9-lC656;X
zE@t<xCd_D3#N`};LiK^ts;Y7C?2$G}pWgG)VyG8!zLInC2VKHS!n*xl2LcCTQ&bp^
zwxw}~%X6u)AjxM-OYjtF*E9Duy7`1>EnwnMy-=b>gDEH+J|8_D4NDpvh@@4D!d>mN
zPMEDEnom?Z;I^~Mceo1CMh?;b9fG=5>G=-<e`^T|OtX)Rc#W?S!_{|aypk_PF-9?V
zU3vNaqA;g-GnU=6`MlNNB2N2c^D70N#+12w@9rr?J<j4HKPq%yN;iK3im0qlPCu=n
z;>h1$*D_|Ga~~N);frNxC_%_8yhDi?Rd~IDuMaYCn<6*dedYH9XCJib`wHcCe;z2F
zj<WEoCs65R?rKt3`<pKmI?ZgjkK_+&*Ex*XZmGA)-~F(Mx<aW@?Oy4RR%XI%-+kw`
zx0)HGS=o95&bpHI4Q6ztQ>hALR-W<aKZ#I0W}+pUC<e}ktU?d)oHwB@PzZr~Jud_T
z%z$4|*km>gKGSw^x$94qa;I@*x+r!|_qSf>onalaPx-JTqZ2rV)Q>twu~*Txf@H2T
zGr=j+@nSZSH_`f%_{E+iJnsaz<3}i6&)h1!B}UUx+JYIiqZ~|!#x#u$izQw9J?G5c
zq-8)w1{Wb$Xi1mo+p|K0>K_D&vPR9<ZXJ5U2Vj1mUZJ@&W$D`=Ukkaidl_|m1-X#<
z&>w~Cgcg~emogEHTbxh8b@YC``!1C@okaOz8?iu|=PE0F?_>kNjYukQbg>Wp2?eE*
z<i6Gqeu+y)g=Dl2?UdT%j$h~pk?Tk(2{E>XLhn3V1J$auHpygAOqwjpbS~E}IDOPo
zmz_T!tl8?t4kg!C7<H|WF%#SrmO^GzQK>mRR%Nt}PM^yh9TVnTif==Ctuo0M&~_*k
zrvyH9O)XbztbboBsN2+Gj*=LTXetr2_4g^6z*pPd21DRZ{M(1IyLOPQ^Kzw!e$+G)
z0%V|He+G|aW@r0?T2T~^7c-W7=r^oXxn?|;h>bb_;3?`XFnLNK8;{*BZ+oJ2aFvIX
zUx~*py$iQI-s$*D>jIrO2jJWWjHY}QQYpe?dG_5bqc(jVpl>ZU3FYaT)9D<QugxTv
z54gF5lx}z{hgQe?kNCD`&6)9v(+FA*dj3GTG~##?%2C0qpMWFArFPn$wZYpFjZW8N
z6A7sW<FNvCVzchzF@pM>$@ffMws-hUdbH(BI4@jFUcjUi-9B9%wv1fdn!VO8(f*63
zmc*@Jb$RaujxW2U-FUvTxT=p_Kuj<<(ZV6lUEQ(#{9W%6!q=U>zfchDT;Q9T(Y=v^
zI4Ys5UXLp5i^I3qh7g=b7}k1G*$zNbU@~EX4B>PdkON%cl)`O)-OH7vew@QK+F^L2
zYI|9u3OEJ<-H>iCz~u3>6R$kCCfkg>Oq5y+C&Ye_ld)-FGRXRR;4J_V4w@h&dH*kb
zt!B#K)ZO{a*8+7m><;-%APneY|C|b&KA+*SU`J8_0zp5KN7vV4dXXZ|@iN7VFiUzK
z+Cr7;yQvO6_LH223N_@aCg9APHFIWMrNgDGF2KuOXE=3Gz;?7tB-0Y`2xHwj=5171
z8+a1|x69nTJ17c#B{iM+ZsWa=MAocC*oA<Ig(#a#grB+44fT%|`_Xq8Zqida)PS^w
z&t}GpeB#&EYvY#z@fD*4PPCJpfN78U#ay6_gHi$h%&?YBgpL<Z)7zael9(P-15k>A
ztil}p119t*RwnvJL?nR^NtWn`fii3fM<F$_ek&gE{#?s9t^~D{h^Dbuc9Q%fwizp4
zHZhSg>G0TeZq;qQQ4wMy1!D&`S#cO0=1o*FZP%C%kFYIyX@(tp=&|qq%4ZAW(S`F#
zqMNT#g#$*<G!c`=c%w%nnj3HJ(63p4bSS}fxEs)p1*>=2t9=Y*&1uuyblTfDvJQh2
zNzvZvVup=gG^x^LzqK`pkSNE<ur>CGDQ1TWmqputjTlq1cUXP4JXO&mzo0=YEU)4F
zILS2`E;so*`Yn|)@6p$5M*x3;DNrgGfFA6xPl)^Oop^g6EoU{Yjod5tg?51q3Ej8c
z=T^HIcHvj!Yp`Ku>~<p1T6t!P*05OM)1D6(w6Om0SMr8Cb0+#NfQwB2ai4H(SB~n|
z%C}SOX|Gyr8{`_cu0FS(Bng_f07{M(T;rE-tcYKyB!$7WC2gyC==r&k$_Vl#4XzyJ
z<Dy(U)*fSiwn@wVunbO`*bzRbor3PqY9V&H_QIQ`u#J(H8fJBRq3>ea>_!cy4DF{A
zlRr|2LaxU{q{X=9S#px6z$<x*FXf3R?4-_D6v7%ZGDO}hk80^ew7|4oK)olqlM%%s
z#O}Yy)hV>uuI43#db+mc)AB@B97d_j*4+|HPmOh?gpTFe680XMu-Q#4ZoqPo9p5)A
zIHzq<sit<o+ABs3)bMPM*<c{~<3&VCO#L1U>AH`V>zow|i~$PXl(Q3tv_k2o9czj5
z=p#9aXg~}gUZB}61bNu_caorYq=WV122_idPP@UxweOMU)@9N}Wc^Led_@6k!zFM8
z81YhjdEO}Hi4A(TiaNoKjn<rcY*MGE8%SDa2n!nn$U<2CxJb>5jy~XqD5|NvnN%Hs
z>euwNQmzM*kL-@qY{UYO|3pbI^n-A~sCJl=UN5c)7ng!L#QPn&N@1oWUQq-0ix9w7
ze!j?*Ng*c;PR{W_kLo266-{8xVto-3s5|froMfiWqQ{gH+ip6Dxe}3itk>-Y<aC6c
zOItM?aBZeJ1X1rcx@`8Qr3PyD8ZxKl42g#bo^2}RCAzw5JF58&Z7RMgc1l+3h-cJ^
z`ONIA?SQHgBHdUVBMz?L%rHc*GYrKH8_H11z~rpX%>BQnV4-$i*838HhhfrR`Vjln
zcz&_IpfVfs*`PS?QL^{t<=zor8Z<A*T=>b1HazMl{jgFIFzms&;?+%_BVbVf{N9YU
z53)Z%kDZJ^VD!O%bLn~qjNKtrY^m-)uh9R<1f|6`eLr&i_x_y;@|!zl<xy{bD9SwE
zc=9mS*yB_5$<5<hF!ZS9zFCvgabMvqE7Bu=vdx)0l!;N|sx;|$E+7;2YWufWFZpY~
z8HK4>OnxbX#tGk0B}a8B_1pY-9|c|?H=R+oq_j8o*LZyQyg2yU-sc@fJs|?=2zB82
z`Q+98Gc8p{-)jHYB4#T#PXoJS*{7;3na#q5R|%A;)+i;g^(E=;iKk@K8NJlreO{9&
z7TNIK$s<lMM;iJZfpNo%Cu5u|9WZ5W&pN6>lGi;aSrd=})>2-pbVd5kHcV**M9_%d
zDf)^~3!YltO=7Xj`uK8Y{_yg4r@V5GiIstoYjCU32oZ=6L2!r9eZE;dt)^pgnm?a!
zDW7w7`QckqkdmlP1V(SXqmhx9UxTEAX<=)dMZtx>JYy}a2GPBbI0P4}NgEX;F&OuX
zp>$BOWV5;jG@wU$1pugow@tS?OVh$t=NI7{ded2VdDfwWYUEY#yJpZGB*Q?be{=jH
z?s9=kQ@}+D)O}$G6NK&mkJ{ckEROE$79=4F2@qU^CAbsZAy^3R?(Xi^@P^<4f;8^#
z?w;W8?(Q`1G*cvbf8Y1a+_`g~nLG7YcRy9tRi{p!Eo<$yPsMooC)F!M-Iojmw-jVh
zZt1u(YlFb;jWKn(*KF3@lnk%Bt=1L|JNn9OCfx0YMlrwE28j@4yqSW<V%K}8Q_iMF
ze!RqGeWSQ-k(W5Q<vG!X;pVbo=Vc?6>F!9skmN2Ui6xdEfdPr2teoBb1<<r4QDW3R
zTXvB%zn=omu|Ts|7=c+PAK6821cuBg*IeVqeQb7a%hL8j#5XtHYc1B&WfI=oF(d-R
zD6j2`FrCp0h%hYv8dKtz&e2KV?wd$BEN5T5@_WH0u?{*T8`OR(&JsHf`y$PD4|C0<
z0)^UQ&l1&n>@_jMcVZDHu1^u5sU(mtF{QNJZXM)}ta#W77)H{5=t#vT<N2Yapl~)d
zjEZ|lVRWd&LB(;BB8_}pWF3#5WmD<sBlhEL<c&kqe%%``-42!j8)FFxmn*9{f5EH~
zA5NKKqF~Dd90NcC1}Zg~Gz6)ZbSAB9rTGDXppHD!m$bX{r5vxxiuk@FXurC+Ry1*O
z8b2RXz1Bsy`24&zyp#l}?Wc^jktRVP?ZnvTC6!~~Axci(R)CDB5ptEE;B>wrc^ipG
z|5pDL?5Z^g=8BB_EySSy{P4#w6Y-ktL8%C#0O~9O-qVSuAuisLtG(ELkVm17MyFI5
zC-Bz(x-_6y$gbIQ>fWra(Zp(u|1r3GDg>K+gheZ@+87~2X3<L@u^sKC&*`MJM_~^v
z1@lLQF9;?oA?(`mW0AF&K?shbg7;hjz53w28q8IXPGOvhCqO0?>o<WVOh?(<`52sR
zWZ`cHof_m1%&KY_e2f4E<@U=Ea;o9a9HrbfK*5{m#2#394tfJ`*-xxro~N+VGHN9r
za#;(aM~P6#tZKYD0?p+5`W7|WR<6_&1@i?hmBk!7R%-9ne{zn_$iA}D^9vM!yRoKv
z0y@paQN>bsOnn`7Qh@d0lIiVK9`W{oVX0i@%kI0=I<jy{+*rJpUIiKC)V+fe>vQ@q
zmh<(36PB@IZ=(6?ztHm!iLYbaZdleQFD?srVXqC)W+@+W&*c#$!%r&Mv?>e(sH&FP
z*hxc-!4NYiqDw|{)`3vWPJ3=y1Yd83po9$LqOcv~ex|`o<vGm{<Y6uDNi#an?S8=z
z3kCc}SNWz>2Om~}McA9XCQt_4)pXprGy>Bx{XCV2EW<mb)Z1z_M2aILjrp7oAH*3M
z>R0}{02>ySvAEKjn*d>aW77Z*mgiDPPT4s5IBA0Y+W{rB&yr+-(pWw7m*Sdt6I5y|
zSDPor`rAvATV%rU$&UuM@T5<3oaNQ;jvd4>6H&iur(1fbu$ZaX^o!1>Qb1xhrJjL~
zQkO#p^BWoGdU*0IHty+~&exoiti-oB6}&2{dsagTFnNtdll<O`kA!RxAhK$^kbO!W
zhoS*b`=S)d+kjq+^YI4x(R_OE67G@1mqKhvlVdWydaiVh-EZyu%iMHk%(ym;55$?s
zvO=!MGkN(6$jq;}1AKd*CkYM@_8foTS5_lw{ugKabdT%+Q!tTCCQ(l_hw11QOo`Z&
z^F9n3RI!!_!=$JKV)Z&};I-8S61r*7Rh!>=aTfBY479Ga8gRqExBp*h^-oYKw@R`_
zKJD%1o?kyJ&%dg-Y2{BT-w@fJ1TE~A+Z*CpaTIf|TC2<3>q{&3A4V{?w)fX3K;N#D
z-|Y{467l(#pMR|038*j|?kq|j(rHrnIx)w*xjK%gd7O0#;&*8WRB!jz20b^s0QRtO
zj@k{p54%(%TeIg4lg{rHR$Y9AOwGm_ozAnm>YEAV%}=vnl@=a{jEvw*{tu6t53)Ot
zaE>-78>w@V-fA^-A1QW><F6|iJ0pv>`<H-|12S2M9w2f+$~UaHt_V;}kwKv;Q-e5g
z0!k+Jzs3e|=yc$YcmAK!^IL#)s&`GwjmuBBcl@XcuSvbp8DogUc0N4jNFn0j>~vS&
z{-Vl|OG^2XD|5=oBe#ts?k}a1C1)A<pUyWEUuAeJKs=yb%S|vdSf#g>*QPWDMG@Uy
z=gtH%ImNB6Kgyr~AisW4lisoz#W@MxIdwa+&O|!SAY?vk2W^ZZ;Uz${NB!CG{v;j0
z*g$$ENZ<`8Pf(YzY6fp+5*=}790lh{7cIc#&PRr=fC$RH$73fYm;R!Hv|c`~Fhsk3
z&)bFjH!Ilob_J-t`*ek6!k_}yX%UB7&1LQF3V^)00g6|-$oOS#^?~dBr1D^xCRPzx
zaFpz){E^kM;E=I`Y+VbojzU>N@hbU~q#b3aZsb>jtrv^5dbm=w3oIIYFZ6@^@!I7b
zXU+6GIuaNKhOkn&rFnm(1I5xN$wtT>wvHMWmTZeL2kLQTgC6?QIKZkUM$0VrMTQOo
z-R!z6j%G5-M0umg3J&-0Os^9IQkZVWUpx$K_xH#rO{f{Xy}u4oOdQ#7raW?cdqQq}
z`L!q)yrA2VT?5EtGXL%P%a%|$^<sYpDznVUOtl8S0ZOO}VjUobMMwkae7R0z8o-Ar
z0t&)#nCiu(8tTCxxf4uCg4hzxRWK?-vSz0^!%(s8=CjA%6L?Knewen*OqLpx^pB&&
z+TR6=qS;h6D}M6?FWuFPNJ~HW7yKPon9x`m#%LtE#Afu_i`W|%9nB&d>7Drkr9wuR
z<;x$+ulHsQx0*r43@VSe{ou-0ZB%+4v+3+$oArOduLu=;NF2A0XN`e6Vy;P7gxtxV
zvnUKY_R~=o|7hYX)VDyJc-+y<@4M%t<{?OB#fyh?ECGjKiYR!otR`}4UNDYkM?GaP
zo;DUVr+OhJpkqt8B7B4OAUU*LDSSTh<+4U|ZMV(KMNq%Z)%>Nzwkx?yR~RGKW`fpT
z(1@9iM<pYZUw;;e^6Pu&^W%T?{5Ych`7y4R?Q)nhL~+NdYSew*D|^1%Pb(L)#E8BQ
zTW@#n=*}&Y0W4QZ3CdPoeCXdaBaF2@z}7%%O~Djg<~u#WrZ^4PoH^F2-;xX&>Q2zQ
zv2oh<E<MJ#-pw@di?$0^6|!>|Oqg^YA-{rS+&%$O0(!$*H5d>|>0#UHeuD#?%%nkX
zwhYmRN~X|V+SLB-PpE)&m7gtdzJHws+bsN|lY33wdw};TC@$ELScmkVc33RxK*hSF
z>Eyx4F3s-a-F#1#Zz@#hrVBE(b?<3C9MlJ-G0yOh%=9bZW6k8d#7OkfzU|=9?Gyfz
z9{@@rvH@wVoLOZyXJgHh_u&h6IWm!z5#29b7?Fa!K<I+0hHB|jtYuc?)wB1nx(ui7
z$;94f-)Egtsk<$p;5CsfPj&ymOF2wO_`QGwPi3L$Z(S0XLw>=^HCaX3q;rc&H`Y@h
zrpF4Ce<#tqs0Kiu?eAty;Dq1*hYJE|wo3^73lRQ)LGAuqgQ@=;=&$j&b}%Z;UT-|J
z3B7hxAT~BkTeay}mRO;3F_+^`+q4BTqzeXS`e<%B^w~Rf0B+n{J^?B{fmHe*a4+qW
zUZ+J<Ss7>u!``Cp;mZE%seu&K8gV2}mlnCr>7Vce;P5={r7tJeh%mOH$DiTTzWryd
z{9kDvwhi=&arSn*I2Ea#J!;A|)0Jfgr1000-+y%C1TMC*t5%^24;E$up(*)!56~QP
zEGx+N(lE3UZunowbi@^qaF1v#P*j?XCg66Nk$1kFM);4ZTfth<;KzXKr03+gKel*@
zhR-4qmYrnbJ?U=pd`N~=bMVSzV-$t-P#XV%bb%)}9c%L-d+qHPT)8=@F|FC)epD0V
zlmycWKwI&~n>3QrO}rdyDdgmZ$K$4<b(TY_^c}|7>J=Hcf%_>Dr)F(_ylaCz)hYS-
z*nb~C3vtU(z%R{aQpbmOq7-if+o(d&b|1s(#N0>#E?vE`QAY=$-u3xpB@j~8T;<tI
zGUs6w_CueF+A!Qm5a0dZTCz`vllpwo1%)c!O9rzluBPko{iBgWckow1GE-xKP-%u{
zC4MI*kQV?%-N!^6cp!AdPCI}pC1x5kWk8D*%=}P=9t4yo%4*i=CZJ>RtP+*VycX|4
zJwtQ!2{&MmdMe~ez>ug&DUE8TNYwX>Mob97q=ZapBP}vWL}$_=vC0|h7B-0k;z$d_
zeppA@D1Yy-E`B0|s4rV0*5<4*-^{uC+*BlLYjQ9FD5S#bS&vO1x>T{mWWE(FWyjds
zI(h$<j$v9KCllKj32;2iYri<VmIwr!V&tfH|L7RNsh<u4Si%_?zPg&qir2f#k6473
zed~JY^3f=G2FS6L@G4_~n0y8MnN@{Je0v9!D$!VDyG%EL)!-NHKN!;J?GD|&0=Obl
z_G}Wk#t8Wi%)xG8M@QEPoYLMP_OY4JZb6u&QQahl^|?L4B*DO!kdC@^gQ`)I{ywwS
zaC(NkwZc|pJK+@K5w&6QifvJ(9D(6)3<%6ANQprEVSYPU#l>UZ=RVkLjpgSCy(sNf
zowH>3xJ1cI@h6ru&4y?D=fCR)TZvNjDJPX!l~gPW=-KWJTJNAN$Izd?{%@OYgiE>a
zpkt2HDP?yqEaAO3WKgGmFTT(6=Rg#|m(*=OM91R4+dJKGuK0mI*pIvF_E>jc0L$=A
z4BF(VPv9gqCfT<D&Teu?^;iKxuc}K)e@robY@Bo%N0yL-Cxw>EOt%a^o*v`%<}Vnm
zxQVn@B20k@NJT)}XPqhk41sReaBKOY2_NZ`R?<fXSI6sf@Wpg}Z+hElWILRA7&zIy
z!)1-D+*;uNbHCR3cx5fcl6R4zx0u*$K0I{6N$z-wWj*kQ=eyJD=L1w2^WsLkBfMTQ
zn<kv4weE|PaQdO`-j*I6)WnKS`JG=y_gA^o&UsA0OkuI*>yrJpSNQAAyhwl8GVSuI
zsGQtr@7?yr?u_DmIj-AzeY2VKE={ZEsh*Dvkyl+A53eXn@L;`to8S}e-203%2TNU5
zw}VDKnu9423$w%}USByoNxzUauhxPerI;;_0TZyaI;nt~zn?PLCg+qvkrY<O9-}C5
zd?Yga2TGfhtRCGxP~1m&7sP=vBi(A~vC1BD0ky1VEXbq8ez6FPF2wo_L~tIojIqg3
z-xA=_S23>a98`L}9LW3pQ}N9eA?J`OK0EJ;@5^+-S!|8k6GtM&m?(B|dRO;XSgzX>
zQs6#KX#r46vpBy&(@XS9xf#;fJpBH4hxho>+LyuE(j#4jnQz&$a6X|5Wk^HXMz4@?
zG=)5ehnc_&y(AWt!8m6EB17)PCnq$^%wVZ^Q|`{-2+-q3<7yM#pW_xOQ%AVrseZ+l
z70B-zi_UG)^}?4mm^YCicMRFjHn3?%;?*&jV_W*ZL90LK?JhP34<)U;)d!CZdq{z4
zyY9PR`|LAuO;JepxU~z!WxK9Bu2sQ{`)Gs&(sw`hzxqpx5AYAxC@5){v4KtlpA}X0
zkj<N_ypDZN&;?Ces;7pIjtEp8dx-KheA-(cIxSkR_T(Z!WqyA@>x2~>7v|nM^FCA2
z!MJG#;$_>hMz_%jr&LbE>yB7F-)xXE1t~QQqNlb>+&UA&!KiVJjdSj(x;BHgVxN1%
zPi=rrGa?nmh0nk#852rWB19l>67dq~bHAQPvu!6|DL?hu?+RTZEPgX#1kJPuY>gKy
zg(Yd{DT?Gl+bf+!pSo-U)Ul3lU%CSTNQsk#$NP;yvu7Secr2bw9>b2HRU4(2u32v1
z+x>)QCt9^?*XM3g5zC%an+!oHI$P(1W%?2s90Rf^IR&RBYrCO}c~uEm;x=;zOS+H<
zve|p9sHV_)2Ot;dW8--kAn&Ba;dCu{^7x>9&+COh^PnNN`8cK6@4}mtF!eeclTV6;
z<}>@))|}`vAVjN>bWWGy{2$3%Eec%J?$Hja98g)d$Vj~S28@*RyVPS=3cfHYD{klS
zj2<!FX4sZf#QBM0<(w)&%VV4m2_%P#jArzo4mXO_C+%-ViAv*&sCsoGtDrB$=4u?b
z@NVb`rH7ZS-S6_H!I-~x{B9tlEo%w6DgfriDMgY*eLV^(ee7GP;B`n}vVk=0kP&Jt
z=YnWW%`{WMtz;I^9jusYxuA_c7pjqxf{zAURoRW|pIc7L&Dw*_Tw)Eo_#58KK<};8
zA3*)PL?+ohIdroC2|^B6CdM@{&PYmKz|?$e4*LS+x4)e|LVwmh)ydb)^H>wGT{@`E
zFKV)s2EwQThvVujs1kB<dkF!NW;z}H>tALLzoM@%D2_rw-2GL~0(E6{o4aOXO+)5V
zd$vsoLT-E!HcqyBL$t204>D_2qA^6`w}aZrwTsb=S`L=;Yq8^2U!CW;=eGkQEN^c#
zYPN?RX7og)?>DZUas~BwRtFHUPh(|L^W!81HlOB2Q3a{@?45DC)^%XS!68}Y-fHy0
zVf@KeOi^gC7R_)JaqF=tmCib@LUoGHbWC{5vCMs#OwQ+xqCP~;I`_el+o_Gg<Mf`Z
zZ#!3&k%-AXiRQQ4Yl+2ujqtgrpQ%-u3E4>vmA-!;>=}T%9-*{~L-{JpPfPQ2=+qp9
z#HWUXwY()4o~mFy*8x3a8rDVkJGjUCsH5R$4e7~_La^?vcn%Fs3EL>(<a(|G4;G!1
z??a^WrgGm~Mk!3X)pm!Q)`VJOLmAH9i+i)2Qn+JADX;<Y<MS)+lc($ymCd-pYizWR
z+^v~4wsJ==v}B!_ZI#5g(y3LF?EwU2_#@&#oK4CA=pzFqa+k?KOkKP{;sX)P83@PC
z-_1?s57iXlMu@HqTiPmp6RLd?seNpLJ(Ay?`u@6l7h{C1tu#K(jf?Z797QS?X3?NB
z_s4#e3{I9fH?P~thQOQ;{m&=^qUnexxZ;wRb5?4p6)GdcVxf50g65dD_F{(J6$3?@
zX2jt?y0Jb7n18)EOCg?IR5~X4J%?I9(A#O28IPRrh^eohhsWsuj7hF96vw+jR_9%u
znawXJaZ`qypDLxt5XAPZGITfPx9TwnS^tbs^VTefsbTe8R(>VA1I*yBh-nO>uTHiA
zmJ%Coqgs#Uy%lp)$0kOfYK@tYU5E1q`ez9v*t=<+8L-L~nLa+!j_jc1h8G-{XSF5X
z!-_dU+O!1Hw@D~^5P&mvZzeMhIG@~XW$dK1x4afT0~0TxmuO5bHvm26l<!jf97S(>
zn|#-60Q$?tHMI8fwBgd5l)fZ&&Fj5k-$MR}27&S1M^;&mMR|Uce_C|PPG*BP9_lw@
z6<B=d8sXP(KT~g%dV80ma6vLV@=2T$e)NVI2UJ|e3ozt#giri%fx0mY6*wCk(=-e{
zEk5i3PoTgJCwtFa>Ov{Kp&+M0{Fr+@caCkrext8+Q;A|&@sQKC-m8*NYyNz5-c<l%
zq;PFkwI*uK=og;W8=O&&>4l~PXr!v0!Vq~?oT1>^>8m?A3YqDKtrNa+%e^Fc1JryZ
zpK(tJ<0R7ZCMKQdM-SDmDJdQ(BBgO)Jzr6ZZTnO+A_@J*%Va%!FoJ-W*^OA|A~``F
z()T(Rpx~L^vlytV?!0$7yXXN{`lT<fb0~yt_u6(mAtr1Z>F-~_UD<R`C%$|I6+jX1
z?-;%i*41@6X&t<e{^wbIK=4cFO}M@3BpY*H$;)g6!nUaw-rm)-f|fBvG6)Sn()+fP
z*f1K#*=RXGOv+`8EuQ8hQ9tK$T9pt4NH!7~<WWL|1GkqR#xx(cKe@=f*1>$<INp#N
zxu;#&2isPy@6cy#xCw!pJ>cK+87#^yp~J`cm+PqcGc1w4R&mn~z;1zMDBW+9zBd{a
zV>olR>fyF(bUrv#&Wtk{d}s{b$ICC?>4yJsy>yqwZq;YJc=tHpNR*dX;xW38_c)3(
zK`OXMq`oiN#FSZIzPe<p5Q5yE$Bt6@Jc~i(EMw5T4M)I+e2yjI3hg3?x*k3V`-^sg
z%Ot-R`zLwk>j_4*{6ZN>Xapa4^j%radg|+h*TEU@A@{S)18r^b&sc(&hZFqn4l0LJ
zyoLtwx9^Q1Uf*U~^@E|zGWYUMj>EMc^Q-`Cm0h4yHlw(iQ0$1EFZ*J>HSy8OvVBeB
zi0Go_eEr+%Bh48RUo_r=WcTSAO*8uVbKV7?6Wp8mN5_>+GP{dL6}mo)MeOtv+f_#o
zy@xC#$U}*%i5>UZ#TTc}%PbL*>Tvqu<zu_qfHOL#MlJFvrNH1|-;|%+Qr1^0f-e%Z
zD1Bt#<pe@Y?0Z+5X<}?s5giTWqGsnb>ZqebzF}>lij!zzdPjz=WogVZwLR2-9g)Mk
zrSxzVAPmf*Ih34|PdQsCQc4va)IMumEB028r*xP%30BsIoz{a`6!2y)znFxvCiIe?
z<*+dHj@N^7Z=N%)g6TZ^#CgN7-r6*dH>d883{e-$%uz?V6`_RF+q=35;MtO@Jcsdl
z{{mBpk$0iCxx4C3uLJ0G=<)h4$s6Z3i`MJRl$l$4nbF9oa0%$exv5#LtL3I7rPaEV
z_a&aJYH9t**J#rSX&al>`U1NXwEDnMSG!?#P(~!~1keTenwHz#U4UjZF(Aqo%v+=v
z!L`{U@Y{O>Npzb^0nXS1-o-onJypAh&d<&i2n5?PV#L^@@_KG2<-4K5r*smrMaUfQ
zdyVhRvS#WXr}p>zkd$I<w38I5C4;EeJyfvn%}*LCf(stPjLuY|uTp+6H8ZQcE}knp
zUT(q`Fz)w-?d+AYKXq0iu&37;bM8njY1sO9%Fff&ng{jV<XTpXnIH-(?5hED*BnkV
zvut%xPy`m-cb1wpRvMX2?b$Q(kwpwyv=#rv;O`vsfHdgXaHL6JIbODj+E~)EA7D%Y
zLwY$({cM-waI-Sz{?1xO=_Y4-I{HoJpfRTRz3%Q7thq{D0;~uP8~*W&AOPC?_%%3v
zq2N4%BN_kwIycAbIw|1`?uVZT9YJ<M@!Y=@RJI0H?gA3WDvZ@jV@keg$nHQ>60nRU
z6wp914xnGrNR1wGDMR9TG<`7?-Mp1Km!tV~53-&#(P{}xQCQwpeEUE5q*~p{cX!X1
z6+?S(SJpd0Q5iKdh0Hzv`Gg6nsmbP?<#wwBsdNii;1m6o+#rv`^`vd@nKCPpuJNGC
z$3qFbRFrm;4VzwR++#Iscl)t{Y3Flkt@`ZuQbdLr)Q@b2vr*Aa$9#JUb#8@YUD}JW
zi7Dr2p|FuARpWl$F@TcksP|%A#I@>_v_#}^Z`b8PWZf#J2ttb5Z7N7hHNympLpckH
zRwMI3dJb>CJ*tx6CG$P^E$sE>_deCfpPu{iQfe|X-$Nc}#}-#dNj4IY9QU^y7AwVd
z_r&g!XV>337m3S=dD1@)>!;Z>f%G041{fz3x3fEBzIz;nE;eU!qZ_<}SwX^@S~zgA
zA%M|x*_+7MYxnPcdH(t?hGJmp<Hy1*j$~__HmQluaVir7m>sMn>1U<$4FC~-fn!K%
z*MbeKG@%IQRvvaY^3~|b&Hh8xKGFqpK=0G?K-lmO+LB=sp2n+N44J7z&PCF1PnUk{
zbGVasox&`JABDk;&;dMenA+#kxjxtre^XuGQU7+{`q-sPn07b1hzipnQX9U>dDSe(
z<ahZNI?ovY9OkW#^)m*2%1>A88XnUpZwY<A0zL1(GJo_@25@%mf4dld{QNgf)`s&h
zaok`a;JG9J=M@)%%#&x7*5{s-N#>6DSTF<zd>CzjJj%$!_0-ZEd}0_YRH1rK4q6y4
z;2g*Le_Px8Fak)>@2!gqU1%1R&iHsx9o}kY8TmI!&8un37)>+XiQsK^4ZhpEo1BhG
zX-cp^uvdZ|&;Na(PYOd7j`)y@3V-X&jOT;9gF@6PhuyAv&0U2i+)9jG6ZF`C414qI
zwAqzGDIr4)Lf3O(?RotUcmy!+aU=Sa*(MCElRDN7o+4g(LH!;r1&uSVS|vxj1*eh4
zF*y4QH%d&fJM`GgLwxv`1<RSDo(9TS``Hin&tR<Gl0u)sd=eE5NoUzhkCKSR0|!Lr
zsXRJce+<V8FXP@E8&p&~Rvh?cW&bn4Azi>D>8768qCX-yoJo=iZigO~VZNKCl{JUc
zVZ?B>^@~^&>(+S3>v}X8+bCN$KvRj}4V^!enQm&%Esa#{Bq61F2DC4n*d2KXU7hTm
z38;jMYIGG5rN0gwFPUiwU$<H{v}6;D|JFkZ>Z;nbbk~@di(V&BK7TkizBl|`beWG1
z`&-??4eKQPc;PLXno_^I%>y5Q!>a;eE7kc(tHfNM&Np|Q<u%8)suCp6R-D^sabRFv
zzhObk!U^wXAGOUXFsg~fA4asLO4TzbFhwg8ky}bI-wf3phIQoAphx0!KX`yFD+_&%
zCIWILz9iyvrhWDz#l|16xNrQyaafTU6#1ps0gGp|v0k2uaXZkKcE|LKw9nh{&0N(j
z&Tl0B8ASz(OwU<icbqRYI*+$%yPEK5G|5C2%wH*)@&~i!24iGGel}hvVKblqdN`;r
zezioi3>gkqe5jpjtTnfoyzP824;v0ISrQNa%syAEV&OK)u&G_PGvC6xW;gxjA(&Y9
zEMv*bLikdbQH9Dfyv7s{w(T&e641Pn^+OTLw=mbX%Q;C*Z;v$ahdzvW<nn#oSZc+q
zPcNCSZa?b)^M4Z&4)j&4$V1(h7M1@hC7GC@7&(pRGh<v!kHT3(f>}ZmHUKx*FV@Gp
z%ZaIxa}c+L#`UHLoJgTu;OBrwpk}T%FRmh{{QZl%)ko6Y3;#@}U`+^V5b0)q$X1+?
z)vFP;2OtSKGHG!Ycz~M%X(^YRT^pN%X*H>d<FUK$7pjhyceQ<>U)DRmD?HR6Sx}|p
zJx}R|)8PfFtNNd#v%W1ZdC>$W<)6{f*{9}gbv}RSQ~E}}ws{S;K&D>a60#<QSy1Kx
zlD9BQWsK1cIa@lOYOUE@eJZh~p#=8Br!zYygn?Y3{PLTLu9j-N&g{iO?>lU{2Ms$*
z@Io3a;GsxFT8>9Y55}mL8|2Ov3#GqORyLWhsxp)Ik2H-^P?H^rBmu-Oa6(^I7?y}n
ze_ozJixf68I(GQ!T&LGF2-6_c8gW}|tJKlc)3u(v@f9_@OtPB8<tMd=dumzgctJ3M
znqGaD@vD0&C)MR%CNgr-MKT3=G9Az~#PJMf<?<IWC4IP6fQtuv=R0_L<?q_JU(l#P
z_wP5iwzi5*_Q6&A4fRm&2R~E9{YA=KmLQL=zPEEK)eZqPb_Ik!W!b~n+)3)+GAatj
z%-JmJ<>&GJbi!sWi+SjUKE4`2cC0uvUwO+tkC=8gu}r~BPguIkY#*oj5iRf7bXHE&
zd#BY<9Zi(R?4t3`y*blWx3R$M$P~0USJGp9$UL^Y^{nmC?`b-@l%(lXQk1e_rC#UA
zH6nzcUY~FHNld@H0x9KYA?w`!taNHc^}WjrXLKXpOWj~QEO0!^Lm@lcFeDzIt_v&b
zjZNmDrq+NXMzp7<p&2025LL4d*2u!Ga}bsyTr^$Yxsj4TgnC`A3;E%^v*x6@Giwx=
zo*Oo^U~Rlq+|N9k^lUCuvFupLG?{PgHEOfo(2fa!q%2e%cGgPlZ}Z_yTA#tB<*r&H
z!n6_4<>B-VjXO=3YL0TJ?|6HA?Ht4-RA}_AHW1xUgJ=BreLHxA?0u0e`}<MP2yP{b
z=h`F8CXHiQ=W|pE5H>o9mE3NmGx1Xy1;`z~o3ISBc_;_P)crGO@yZsKZ1|l5#_sN^
z)?BUN5CRUXOGeptK|DjyT?L$l2x}C@<zhBw&C#yPgge^LJQrrTdiaZ_^@_$iiN?)u
zx0D!GeRnwT9?be{D8jn?b)@FaQrLu3xdmW$1fC|bEd_#wwRKGIB^?d_1w?1BS*-or
zag2?a&HWMoqe1FvnRgMI*Q;I5L%TVH(?PPmsv_;~Q-vHzTtzmASG0R&V%7pYE3<Kn
zP~us2Cccxu%5WCx-a#c2Ys9s5SlqTGM}>XDqXX4&g>2E-cElut2lcrveU)Xc8D>qT
zp2Rbe6=RqLg<R>kcw5tMw+mPI)*-ytHVXs!tVpOnHFGJ_LceA?zC4-2{k2(~9WlTM
zqkXvVaGzEYudhMHcz}3Z(cjrEx4TF|1<zRlGwbrarP}3r!0S&M9kSL)NC-Y*faz`m
z4x@xZ@@=A9TNp8PP-DY*a9BSrFn^|pbz%D-?%&KX9PYoE$wO}HJ<mso&-%|F$}h~$
z&#$5Be~j%y?^l9;*!Qmf&E0x|DH|{t-#7o*X23=GW3&U)9SN3K0E6y``0|<Et5+lN
zjDR`+R}ZWUxZ2+v4vGJtYC7HTH?lrQ-9O|2zh)rdv{;u91E%<R6YH4RA8-$#iO+nj
zM-Ks?;S+@|*UP3SFXd^|{r(r3`fq-~|KQaB8+KYiQ7P31Q^9=7b?gs{23}D|R0{bv
z6;%g^O3CLt<R(K&^`M6aO&AzQ<x=fte?(kjY{70|v1t&&9`5=iBlsV`=U<7&|8lGT
z;}gx)VhP#VXq1!MxFl=BgXiO$>(Z)}>Holw3%UYbveXDE!R6}uk;<|Ch*DZ7JY?gy
ziXia7>z}<3sTi1t#j;VXL({229*g-#aJ|itD?gFDs^UM#TQ`l|rYm}>s!oxP3)Ufo
zB*PvNP{s<fK&yE%xv@i4qOc2)Vx}i7>VGDbT_cM+-`juH{PSq)ehLPqcgO_aHH@qt
zGMwiA%6M2GAWwb9$~vSpOmRPgW<YTFWh~_8u4Rhp$rS5X*s~i;di9tG#YeV`W{c=0
zIXA;f82wZT;uQTxDc4v<yO2|4W@}ZG%ah^kakDCuq9(tlEYW{@X|(%BS;GD&<F=rL
zq_}oAh4*g5X774;m#RTjtQ*`le#9^bXevR8!MURH4|MB8AB`jKok%CZAr5~bCfS!9
zR`6{i`orAU4700>+^yom>doi_synTio0WuF1h&5G0F)vAy75y!I(Mrvzlv<m&X%*d
zIFsg9&?V&uw3uk{ks2Dq0^XRy(gI#{T3t~U>2`0S$fZdPxHn_1XK8M?wa^wbmuAz8
zU{>2&UAZFr{ox&EV$61aduVjmy}sFOTh)CeZ=&~7*|f%=8Tu*r8%vCdthoK2PqLpM
z#pHVtIlJPD8K%hGiTZqU_e%!s&Uj*y?jhAkK7j*=nB)i=tI7$_{(%WG!8#caA)12Y
zp1gmW!QMyV_-LH(n<_T0JVfsAjrc1+BQbW*R*oGN-)vMaR_q*8jG>Vj%}wV`AZ9n2
z$<JXFa_l;@->`OJ)SA{vVf{f?calc7giufN&2sF!WBMAFv9W?EEKis;<eZ8GUxyea
zX@39y9V4S=$YDA8c!?=J?{;4-9zLz$^vB0eRk)tcojgcz!(5@gSzB6LROvZXx=xZx
zI;99rNeL8s;^qANjr5Uz&FD|ul}#G%z&TaCu*SmsAe=Oy82?$#&$gcD>M%b)AC;JT
zjC+himHbRq&ME5`x`&;LH(5r2aBp^6yg#x^J7f2G_T1bEdC?!zf+^huPH>>Kr@p6>
z-e`**75|0f*+}R781dphs2TA1a<)dgvR`_TL@DID-bOi^j`#=&)?LOV=Ubutj*Q1x
zL)cX&lJaT$hh`Nmq};|HgTA72>v=-@q*{lTU2?jrZ>p2z<NpX5jBtMFmhJdK5sCKg
z%NHpEdgd%3KD8N;-hB{LUhAkcv0pfuO<byai7AL0A;S~(&db=~^F2wwbMQ`l{XSE-
zVu^HEh|GZfXCtq&mJ7s+pEyh;SIM}em=?y}{4v$uV+UqTc)!Of&EZ!<Vxmz+w|!}1
zd|AP8WW@#ZbEz+Xcp|#A=OD^jxb1>-)*&HQRuk%^LhRCc2Fvl(f0aA9igPc8sC0lz
zlAAl~{RCmx4UYMcQig~4$?YZH-+us;UXKohb-y=9B^hA3{{3+z`TynmNLy52uSPy!
z>-`9de{L;SUS7`h`}wqmqALDf+*XjfRevi&!oV2(Tj%^gSmypK^!uOeq<YmMOP|~d
z%G>Bu@wSfc|8pa}62Q-W-a3yuB2JB`3_V7_fA&eq_Ry!Ce%A@6nQnEEiPQWeC%dC2
z7?zH|>@gXyrE=5#s-Cu^`W33PitE_gPnl*=>Oe#NQ-mh7snSdK=QKyy_K4YQ<Ne;;
z3%0i1M!*3<kJFCRFekhgMD><w6)X91pFSY}U7R${_f<i`ok!6KAW4T{8os`d|8*L5
z#7%YII%;>nWxT10LKiEk%1DR$lADg7IdMdAxSvMV==7zaZ1rh{ef<tSq_&M_d5*NH
z;Pa?}q8OY_Mm|2f)tGmzj~3gJyFmyci|Xk^x9&DSL*DQMx=rdPG`U)4iCBJ$?GXfB
zG@<#ZG8QX8$e(WDTs6H@7Rj>lvMu~5;iS};;{N>T@&2K@fT09b({i-*VQsmU<K0<b
z_qg&=^yYWT_{fc!U5{s51H-IFM(Uf9f{g>?C10u$s;!&>)noeAp2%rXADO1TK#CSs
z8f}4rTT`rqxY+XBixA$62u)i_8W_jY(qsuVbZqOA*F^j#C&33`8m#QD&y&g)XEf7_
z%8E+LQ&otb``;>Dm>k4QJDRmMFB4}SYo5%CkBuDQgr7!Av_5PnICwV}xNzbUj`!c&
zmc9*<hTL7>R~PP)t&NUXtN&af9q26>ID5r9Ax#;iU}Z11s>$Ki9Ze@nttm>a98#2f
zT9{*`Vi|9PDh9+*A`S!U@xe)b`Qp!pGmH}#8$MAQMSF^F!OqpCyXjXehZh3A8|_O+
zqN|*jXTd|NmGF<1l-wj%?($>jv!#Zm!`|8+8ex5uT#i{gFH>txcix$UWv0GmrK*uY
z-p2lBdHUE00oN|G{J1p`t5Pz_9u2+7IP^vDGuX+~4h@}7Oh~wM-s&5&OeD64KOZ6i
z4-pX4G?RVH@KfCC`O#gKFDBZ8$g<bA*BCTZKORxVr7_Gp*jx6dvX_=R+{I|%`A9lH
zru7^}7hR83cmyt}Dbu(wCakt&U@7hGv7Bj$TBrHUs8$7s6yA&T_EetAqAI2L^2t1u
zg~DR49=g>E+60g&4v^({rvnl(25U#w-TLag)3Mx+E>${YDK|R<zk%~Q<wMPsB5Sn7
z9}%^+(t`zb%evDvDtlsTEgJobllP4LBqyl6{Odx)+B;zzx!-{%G~CU8PkuyNE<Bt6
z=@;`3-gb}2#qie5EEkYl`RV;6MELx6l7d9r(|e}<k>wKuI@)*=rx@9MwH=omr?E^&
zN1<T~8;q#ifJ0zGL7M-nqOy|uAe8@RzCt4B;EUqk?%V<LCtW9RXQel1*F>WIo0lED
z5yohD&eqfI$VRDN@-8;!eNnLcHM8Rfes5*AxWq$raJQFO7#zj{seQwg3usE`8}VN?
zb&fJW9k$vw6RF{~<G>Ch(HD)pVcrsN7&H=EJZmdLJ%qLn78V}>uv4+(1}ry3{D>R4
zKvY7z$8Yiwv)p{T1Fl#Y$euU%%j1)UCTFpB8fABetl!nMWid>$<<Hl1+}yBY3XLgS
zQ&ROwGb32VMIKpf|I#V4Q`^EWDs$SReR>mNYQee&loSTP;CQ?tI!7lots7CWkGD4;
zy8juHiZ|=;De4<`z`{_hK9tk%r5$~>@{J2IH>1KSuOkT>A@BQ6Ol`;e?HfleAzz3l
z#T;+$`Har~jZU|e_{R`0BlYR9MWcChIMSIlcNOc~HaYZ0%5J`1mX3tWxug>*j}Y<u
zrJt)25pw4IrN?<6A|f8<sdO5swny5c*_Xxe@XUfWqA$k(VSQY64DO3uhG6D=H|jU}
z&a7sIU|+d*LCw2Xd5S$ln`2k`Xaq{ibGp|{J=Kd(Zl<N1!p~Ps;T+F62%ifm+=_bZ
z$J%aE<Zc6!FPdetg3`!%tVf#=*tBe+h;c%URNec3kHzn(At~SLmOr4h=VdtE-D8ZF
zy(;~;q3Dky8$<o53YO3hXmpR@kzAj@0pURf5D=!A8Dk>u{d|jh<8=ljx673mo*xw4
zuecp8^{#~O2JdQo!cM=|L8F+G=5E8nLA{T3Q%c?KOW*@d&W>K}b@pAfeevgo>o=M$
zd#ZjY)glai$5LHe>Z4hniiHdGA7~A_b`yjDfxYXGrgzWFg$(!zz=B)NY4g&}`-A<4
zDWt{Xu7#Z7O%|U`Z;S6!e7C_Pqtc0OEOz$1Ww5&H`|W)0%mU%i0!k(m6Pk#;`{(_}
z(C>Ye>Q;U6^rde$d0i%c(Nzk*FicQ5=qZx#qtqZfL@`bUJyTmFXq`3r$NFTwj)GW3
z?I>}m6zum;%ym}QuHBYTySo3pWqC%CWx!db%$~l20-=0`<W{*LPeYGfL+-#CrE7_=
zi`mL)j-2ubVudBMURoM2UTMT|MLrcUIOXW0^%ZXX*re8}q^|wgA(nny8|eRn@z_^W
zsf*Pk#rBI3tsA#S;?zT?hpXeee%o^QoJ1la#$4|SCbsSvFT+iic(y?*>o*RP{nohs
zBql*h2s9z;xbxzv&-nWMmzd1em-jLeqwssyRo;vwyUVEGLp}Sa!-~Fb__^T`XyETx
zsDRMw5R@GEqN0R%bMA*Nx;y8qq~9AS4pKv}e~t~p6@at<!VD0)wbJC%b&71^DU4$6
z%Jq$xAL#2O&g{ht+x?v6o7C{t&iWF=PK7qZ*s)8`h%`5r?zbWb0W>D5AFG%Od#j3q
zLTTF6q5Rtwo+^Z%c4lQaKwsL^{%c;JPFzb@dFxoU)nEZ~v%tWe70ptAg`#x=d*Mpp
zz;9DTNIL@vN;i6tb@bpJ4?K)|g@=d9qSe3!3|9BvMNkI8wG@WEfjOdO#1+w479(0N
zyYgnxs_SVnKhtC6W3{lB-(OM^M2s`841!ky({1M3<A?70T|BviHYu@a{ESES?9NwV
zM|Gu&E2prQ670sgh}V{r108kO9p`Vs5$&1L2X^r<X;Nz%9@|qclNM3I5hr=degT{H
zsiHRCA9i=$5}}sTz4SfqU;fW1N(zXQ*xguQbYCn2b02F+QqpZvjeze<iR^hzPV1HQ
zSTiPPYncVF-P59!_9xvT_VgJBrfOXy`EPIF6}ErbtN$%6|3C4~{+ArM|Jq4!aBz_6
zO&WqbuZLvLoXbNkkZXRr0^3HQNwQ<O_Auc-hp@it(@!wAGzPTDBfOu5FC(a)zJHPt
zMtr$L*sT&C{olU7B7(G<svpM!hblm+&En@5gQtl=MZ(1kO7<+4UezhH%}p}T!uMje
zdGE(S^|m1v+o9<Pzea0i`d<nyLXYHW2Amr=<YSYa`7ifQ^y^ogxSJ(`f2;EX5+)6M
z>krr_tyhya+Sf-H%VF}+7CBG8j*oqvwUx*L&3jjM$*{P4N9SpUvw1Gd@6N1?H0$J^
zcfYhYxeNDLCy(hE9lSIRi8&%ootv{$(0+2w7ES=CTdP`E=tA@?;DNngOI-b?(cO3g
zuXFoC>1UAZEMLw|G2>voFL?-5M0~B7F_rvt5BTZ+eKcShG13a9Cs_8LVI)UF$93?c
zg-cDsslsjcO8J|vOT`6s@OYeFd|RR;tNRDDbKlF|`+)ywR-9lxZ4zCVC7>e66TX$`
zhQZ^u^V)i?I5(SD96{r@KgpRtM>zw7TaTY&3ah4IywyQmqBaC((!F4e3U6;vR-DkQ
zaidPY!is_b5?1xy>2xBkMBZYGZMl@ERCz4d$|}4vp>nC1;6--Coc}3@tHyrssEaV?
zoO+8*yL!Qel~|%awb9uELZh%(u;!$@j7Gt!g_uMuW^3%ycF^<7SLXBIYeYYx=Al83
z?!cDwJgm88+DVPNlWZ#37pI4W^frTY>ZyI0#pY2wU{`nxxZ+KblZhN7S1Rrc)gTQo
z`UjCWvSag+H4F{I+Hf~m7i?n+-fcoa4Cgcd`f0#`33M~yq(*Nl<Z<qCzT?7_a?fxS
z&_Yy_CDd4c0$o?0Uc^*SjV896+BRn<?VDUwizslice6O}7cwdly`Z;ituYs_sXLC`
zrgA>yWH2^O%(|@H-kS!Q^OgjWRQ)2TrP$NTuKB57a+(EdXD24CJy-LP)n;#KsUs!-
zOco$pTr#RnkREM0DJEJ^FLiRzvtEMUXH-LGS63lw0p33xKdKhJ!yXJCgJ+wQ=xn@o
z5YaB%!!AE0*v^ct^8Lu9Mo;63WW2Sgu^AyZk&CaWF`2~q<$!bdEpe4%A%R~_s3j`*
z*!;`hN((-Zf+|}X{$`iR$FrLComnm9JwG51+WZd;)hA}puuqjdvUFfY$%D!oMP#h1
zGyRw5DO|1;)vY)@U-D}PuM=tl`meO!l^2$2Gi+n#)x?OC6Y)Y?!=I23cOHe(!K=+E
z=fiq7HMQ&(PA~DCU<_9BwRyCMvoXKg9q78ApCCUICi-0gP2=|O@wY*L8h_>C@9Jgg
z>d2Xt-rmq974fhZ@sp9O_UUGz*Z`#{#3puXI5d_qa0BiRQeYi4`i)rMFv~XC3?fgr
zr{y+S^opbEoB3(SD$^Vq9+<Zd6zd+ZWrgj#bRkS1nTv#0V$<}%@zv1n`ly%n?d{~X
za;)pU-X<~gg!!GJj1^}YApn59mT74qnS*|A;xYJ9IPq|K2{eF(_&KHmxQGy!QvGF%
z>cUSuLNA^DA5l|t^|!3|BOZiAo)>jZj#nL~69WLc5FOp%OE(P8(=LHCH-u~QD5xH3
zL=ei{4x7@BK>FUI^XlEiuTYKFW3P-)gE&(zr}Y-a$c?#Z7fR#PuR!I3Hrn&;n;yF0
zD?@W{-pTZu?uGr5h+>C(No8LbYL(ub>LnFUHvN)@L@Pc9E!Pk%B1=xDm=04`{TW^&
zbKuqYOnh22SgnO!RpaKCv!*M%qg(j{_X;<53RCWS+eTn1Bf0QDLoRhx84S-q81`09
z9K8}Jd**$98Ae-nWEQOknvf8uV$y8ARCxQgwyJrLElcw#SVBVv!R|J(c<reB!eY8a
zrO>=;yU!r|Ah3x=sbrgkVaAUlZ6x?qlL@oWZpuH()K6w+xVl;Pim;@=d-wuxmih&H
zS%kn7s3A#3E9ZX_izTiXZ$6rXE0oDEg-K;DokmE{2Un1cT{u2yvAu}-E>%1$F!t~Y
z;gI!W{{VetwDLCnwa3MQditx*=bqYJH(1TCO<j<lorcXn(+3rpJ`#O0EFBCk{5Qvo
zN`>CGfW?Sz6<6;aZOnG$^2vav(RGuUh7T=I38$6;GZ@vYN$kSQ{Q(nwUfYt!vjo<w
z^h%n&?$y=XW?oc=?yLFRP7$Z~;hTi@ZtRMMKhRJ50+xhUt30fv9_v|6V0FIK@~BXD
zyH)YQf988GYC>wmfLZz}6fsz*tV?Op6qmSB1P5M`LzY=zw7`rrCEM#CouVQ3Qa_o&
z5@r>ng0l&abCy=8R#WEad~k1y0N0!lQPcR=+1O33={%)|i&q{HHysy0nYtw%^Ag_b
zt%)ZiFud`TKTt83M;5SOWG0s$CehXI<s%|I)~J`E1ll7tdO@es9P$tH`(k8si1H)!
zE)=4>3ai=+d*-_V6&5npOGH1F?8i!6aO6a}swCs&n;yOrz9>iBt(8Ess=L1ILTIe2
zCI|{Gt1FmpxE-8?6RlDxzO-naG7zz8=VTpi$?MJBS5O}w$*<`~<3C-zhNkTDV1xoH
zvy4u~mzwGLCfU`Z^FcjTIV}038di2ek*{ZZbn{58r?A}J15L*pC6x`>T|y@U)Tl0r
zWH<}R9G7kcCZ0f}fWg-sdEGR}A(Pr?g6We*(%P8?+IV#miWE4Ad*wWywJy*EHlEbj
zp;nQHu<wN(S_}Ee0Lux+nzcjLXUHS-`o1U?@jPtdMBYC79tC21&>hL4o_wW<#PV8S
z@oPh`SD#3WGIY(5GrvP*n7|n+H}FnFsxyISAJk9iG$S}uND*!kwX#PpbI>R;FPu!H
z2vsD!IMP`96)^od^oLUCXCs8>2nvz=v|jTV;wNO&>Zm_6BmrNom5u2avw#@)WN=<R
zx*y-h2AQ4Cr7m5mS8wHK!)aGIqdYC-;OW#dQS(e!ebE|8BAQ!6QLTx-Jd2BM_)QMc
z=E9*dYKd2Kjaa>vRc02|kyMj=x<6_{&oc)}*XkL<iL(7L(M!z@tdIgWwG(N!#V+s-
z$<B0zM@@_Ktj`zqGh=jIS-Ho#vA<)a;VyY}=b;zX&_hUofs{T|U&0e;a`Hkhx+>mh
z_%_#6JIYx;$&``VBDnWH2ecF+H5Y0>2h!$x#Jb>RQjV212ut^Vns>H^Z=Mh?F_;hU
z>Q`KMEk@muqm`lZ4s@XUyX(COd)$PzivSninG?!5JmLB(K7OXk!@(e13p+5rml)#J
zw<onX9}R>D;K^{yjpKau$&ft-SKB}1atcF(5UBdFNjK`uWiD2}0rsmS1Dq!=$gPcN
zui|@x(&l#4Oj3IW-lO_;hLu$UugoSPdR6&d8Xyzxqk;V&6lC<T5BmR$=lQ?ShyCAn
dCKADW?-i+}lO)*+KVZ;c#6+ZpO9XYl{vXw%P3`~y

literal 0
HcmV?d00001

diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve.png b/windows/deployment/do/images/mcc-isp-diagnose-solve.png
new file mode 100644
index 0000000000000000000000000000000000000000..7691dfe8ac212df5ba71319498c991528bdad2de
GIT binary patch
literal 26735
zcmce-bx@o^urHe6L4&(Pa1U<5-Q7J9++6|$cM>GHyTjtJxJz(naR|0q+<D76=f0{_
z_tvXd_r1D*Y)ySz-_FkT^!&Q}*WFR7$}(ukM9A;ny+f0el~jNC4u<jFyZ5h12+(hQ
zm~I-N!+SS%8S!^DQzU<(4{+9EN@DNc)hD1lnZZM!KRC<kxxIUb-v9P_KkQUy`R<(!
zoSdYXrnm9g28ut<!iLB{I!V@o_0PH=C0D+GVqgrZRUM?@CO*ncK^Cjb!|hBQz=L^3
zn1@+KZo-|#hjGdrP=Fxlx0SViv%uS@dI-UVpP@nSKtd3Ua*Z;CX?vRf&EF{4F&a+O
zfdVT83M>(HJ7{RkO!c`CwEm<9fQgKZEYmB1<5s}@Bi@CDiHWI)9*X=n;QhBjdqj-(
zdcT&V`bZG4N4>TuKt)AWa3Da(#3<#2Z@yHMZ5suhsp>cjm2p%e!tB`(%u)3bI?Fl(
z3L|2?mc<rGIMVmj&Efc81Xk6Ci*EI`2kxj`4e*rBWT*0(uF2CPw}<u9rGUlb5Rvc!
zSvW3q{umSm)%&^QfXyCL#fC`=iLtt%Q^}Sa7PZI2T-!O26A<V2$*sktRTpwk8GAZs
zY!D=IdpYAam8Rce7<jL<0ofTw>|7g9yqLNnuYZl=b9k<O^cVmm-`JiI#h8UfMvkoZ
zVQB`67B%vIC-`a4WxwKvikrfHXD5%p08=zzL?1Hl;~jK}xd0RU^vy5!@0wUHesHm0
zM5^}@P~h7*uhAynnL$g>6zniyi&|pr2Qi!UFwe}YZ`;PX1YL%vRuX~sn@moAxj+9R
ztr8c+<P^vO`w0@VTZR?ib;vL5)cQqSeq3rx0f~ge%GgQLm-h+3GGA&tTV5ASk|-ej
zE)j6uL-IUZFHVKdGs37Wr<#;6p{;4zgY?T;&W?M@o3nG|W8>E++(50Y(4ffStsMNa
zYNEpx>l|rALm`9>|3+I%s2nT#XvOwdYaE)QqkT|EcP0@bW-Dsd3Z><i+y~*~t2;?S
zL6sh`+)K%WY=tJk7gPpGNl82p`H*N-ys%r7nm9_1c3U!*Cp>WR^#E?RenoZ0SI-Mt
z{Ux<h(Ny1rm0ySxqlr|o^1zp8EtEISQPQl=JD4WC2zGLTK#pd1T^Gb9CFh0ILNbbx
z_~_o$O0AW>OmdOo@59^jY|#<kPP>8m|L{;%rY|-*M>z3Q5Gx*j&{nRl*g~$C=1MC@
z4EHOgS%U@(5(A1_mV*w8M~ah+`MurvzeU8sf2YDl`oW$??bJM*@h)>@!CjfQpP4|Y
zhqG3?FJNx^n_q<m`hb=gF|RchGjc&#jc|{pwdQ?Fk30WgM+z?mYt$vv9<2^nnu;W3
zF^d(yBahspu;!Vi-Z3#+GbNzdwUpiGp_};xGZcL;@`rUjZ^Mi7vZAyeL;xmIX`Qn4
zA1uUdtyU1BF6=M!fmsc`E{)RLO$m7%xx#SD3rMUC7R_fWd@baR79u2dvDQSBLxOMj
z@(28xsi*`_*vqm!Rtt^j?vIC(_w4|wd7f;;7h1O6l*KU|jsv=TP8FJH)tGK)rbQzE
zkPd`W;`kF(`i_#&QIAM>O}5Kehms*J7VC4F+Z$XZY*;e!{WxtP4X#9=X?i}#SSdvV
zfLLA;p>B(Bmk7(`@D(I<Mp)lOtL>XeiRjrP{!vxq*K6CSZ48yNVvWO0r|y|gR1FB8
z&snq+Mxs0hUfx1hUz%X~4I0dJ@Nd3k9u}K6b^gI1h<s1XYg%ZJdiqdq9HZA#WG2_v
zz1$uoaB-m0_njc1jq)Ui<j0lHe7wUWmBaQc)#Z@%sm=LAc_~vxfhkOKgJD@BO4nSy
z|31xto!yZ==Sx1~OpTFXlO4zyE>*N*am1j(vi?TE_ln>w<;ZgR8e6ZbEGrBP0aaR%
zU*qh@rP3=aQSPKO?$JVIw@WYEWhVXvBpm1J_YYdO&#XnJ<NgyI;_~h=ocO@i*2Gz)
zGxczbx{Tpw&PZ8l>)+AQ$fqlfh(XV}K8Zku?6I*i116om`$YpNSSq(@;AwV0bR*lf
zXqm6j$qc%~y*@k<MBnD9+A&l)wxSg}JXF~YUOcevRi>G(I6{aVWGcE~kK?!&?CSl?
zX8^PK8V9A+BC;Nz{<QBaY^hxa(6N2d&(cSVhz{+(Jli0(MXFILCZ1Zc*lxYorx_TI
z`m0ZaP9CGjw6V!b-zcAea<At_2|;M97C|FO4si)`=^e2VN%@C!U^WEHAbaX$UrQb|
z<VLJ&Y&{W+qOrh%ExqRh#LhK6*%%?uU)^mS(2l6%;6)o<^)rqktX%jif1f&-PCGpc
z=2{OcXFB$bO9`q&(f||vcpos|%!}H0R3){nd)uFb$5~Vq7lgDsT>5Q1=xO(7DRb2b
zEBXCP1UjktEk=@*q)?fE_aWSisxy+tCST;M(IfTCJp}W~ZBC7O)tNwr55w$KK{W5n
z4?N`3Zduau^V^jx9z)K=JN_U0OsRj3==#H{0bPr_OOGe2O(v5Vgkfse8<QHf0Ns|c
zNUYE#U+Zjo%;e;>G}G*i7PPiO;F?T)shoW8d>U_$hT}l8{4b}q@3aX;Tg~4p#$_R$
zoOn0CK8!Fd$GXl%M|U~euOHoDIJ-_v!nX8r_=uziZAsr_F4V*Wh5VSYB9tS>@22`n
zureFLL#^<3Y9(FPw2WO*Cm#*xk`uj`6q%C__ihP!`tO7JiAej}>7>$qwix(Y(h<0I
zep$HnY7p>VvF@c+G|vqnF?fN5iCWOeYxJ+{)G7NUiu%VgxGP=86De0|4x^5)Vr*1>
zZpSUs&xImcK$-;=C3so@ZVzJ&vdZ2@a!u3l<@0|o=xHC)&b{K*Ei`y6?(H%GJhfd;
zz2#^H4hi$W5FDj8_iv2n9b7*6dZ}BSvV^X+>fXl7h!=WQ$?SX4gA8hva+Fw^ef?>q
ziCfIPh{Gljm3U2cTG@B=fBRZde5K&L)Y<--td8TPAN*I&w?$(m`dhkQ*^bO0=ibC-
zo{p0FX?pjSM8M;8bKcQDp==yC1{z-QRuUxrI@s9LhLjh1&V*Gp)E}RUMJ=p;V?2@H
z$0fa^aNscTh2k`!wude^>Js~q&pN$Z8X<iG_jtqn!Tf5swyzvbgtaHRbT-N6*x^!0
z81HZG5iZ`^h&?liCV^JO?uD;Q-P4lGm8`P%7+bHQa-T;A`Qf%h*$)ks!L`efj)|lN
zwOa}hu1x0Dsoe%qQaL=_ZC(qvn@b*yIjKr}{5VsNTc3Ba!b`^<qy%qkYc~jY2GH*s
z+c&wki-}>2y<rV{m~`2TJY!H?rKNU>6gkm*NNs_kOu_9e#>fK1Nms0vh(s{@U;kKS
z$^18fr6-`%80m<;+Ni8OiIZ!Q$isjB`+J*0j2htv8N|!7UymKdQv+%B>C~Tj$yJhh
zXfntc1!L8(MXBfLzA>p{1I+_zDn-io9rkwVL>VJ0LHta>>dBf+i}dY_1v{4?i6#b7
z-9GsUgK7Y^Yt>YP9>Inv9*2?n$GKrv@fqZa&)ws3{N9^SVG+R&r>|6p=WtCtUR`I#
zKlrE1YqALtUA4QT|9ahqDdlLS>0XhFeDF!ApkS2vjrlKpqK~POG;-;@2`iTyg1M)t
z9bD`F8;Sklw49<}#`DI|q3*OKLA2LkDnx)%3f<AD(Ua8J=Q>xvnA&jfas8kb&E!|=
zPO5>U*y`Qqr|a6+(8`*2`Akb(ndVUslR!vVbM^gtpIBfZ;rEFR#ru1oRm(Cb;sQ6h
zfsnCr^5;lfJ#G#qUc*gfe3L&gue8SCV-TJwcthXtUGN<%3*Z{;7r#BJ(sk{QEaz7g
zPg1NSb_0Y@Yl-e69M?I*P4$LgfaS=Mti?7WgyXa5Nb2rsDR_AT^H^8A&YZ87th)*j
zEqdN@10A_|Msy5>u$ul+;fRD?`LO<iyU)$F-WAaL_7QZ_e;v1gdFE9HHu#Z`mZ^jR
zLeXPBjc*raNI=SxuAUINcUg{`R?m&g+*Z$@$T80<Rk_VXs8H1oN6S2pw~P9vz}AJM
zB6`W3<GthJPucgqb9~tJ2Tt4OI+-%3_sH(}ZL(P2>-AD4_n!mc-33Z@L-Oktml+0w
z@lG1xr|krfq;+{D9IhVeO6MbA1%NSHWOQtFkMazXz=3b^@CSX>v#=KUt~Tx@7KjRt
zyfhG7J1<T^w>zOn4Ubh1wN<iE*JkU-I*VSzkKe9${X}no0m}P@<%KN(XJ7KZX05rO
zbWCDp?`*U|@arYxo^WCwcM7hh*%kGRh0=f(@%i+8RcDtT8a=m)2Fk*NE%zt+A8F+Y
z3A4H5>PF!nDk@)WU-?j5Ed)~S)fTV^pNlbt2CPwd_N1%WwS7Dn2nldtFw2e!V^0N3
z;b;s=?emhR8Yl6y4D~#K#K7Rr{HM+gF>SWJ4PoG8&`&@e)o49qL&e9@MDs*28%U-b
zRFWW~Uj665N;WBlq)my2KuoEdXm)lMFscgTkvvSUgHIu6vP<fC`FQU0jXd!70mJu8
zIYddz+$RQ!ZT7?<e(QD$3;|DL*zKxY)+JeJ?Rg?5X!jdUbp-eIe=hS(L6O=SJ7-i4
zrY*+|wWxh6cgj0Pbn4&FMGcAJG19GE>fOH}PF@wN?x5y4@!2an3S}Kb`DAKOKz6g}
zxXg@G?Snf9CX75k&UeGjW$CZ#K<I_+t$t^hO!}0YZLX;em1`0@1H!!sC&?&dbX66>
z0`7`u#Z++QF@9=ZgArWJ3|nACac06+ro;kO(a3RR#(?j=?;|(<R)&JX&NFGs-FDA=
zq4it(o4}xVC&I&~9d|<OZqH$SKrIx9$Fs+Zrd{=;b`0W*cCW?0dsnioii)kW(kBxc
zr-)h<D<C%4D}nAH(kDEI&6;Ql=czzWMX$c5i03G}#0rGSROa+3+RZ*GUiXvgue+am
z87kSuO6~8^C{sgKONA2(F!p=YL2l+kwTfc#M0T@X5o!U95_)w>4SqL1h%-Yb-(nrV
zh22P}DPD8Tw+XNMS9)N3oSV-(5%JLt8j`wARDuN|O5<EaHBDiesGk}#s45xt^fa34
zs459{jD3n%sV??3oB@IX1C{<k{J+;CkFGxOm-#n5@|~MBU?3)F6;?=VOYM;gdzb`q
zm65XAZ@~DWYi&ozbFX%1uSN!~4K~=5FSM`-m=F{@ye7m&`~!kXXWJ9#B{$TQGK!`h
zpVs^XvcyZ(oZ)~g!$pEaapbVOLzsGlt$rEUIS*vgRII%@DRW7MWTT(}djx4eFL$cT
zoWIVCKx#%|<%#q|bp^VasrYj2h26~xUeiT;ElP2inv=?QQF)N<=66;8NFEN-nArDa
zRO0>@ZN`8ou;3rT7t4E;n62_TVX9RVqpB%dyeQb%m;f(#9?rgIwB?U~s5Ng&=A81}
zG_KB^1WJLqdtkEbvqRE^J;QJQ)}^`pMI-09{OFP>OuOU)#VX-OU0=DI1MZ7kI!2F>
zleI|O;v<!F6GP>vRzqKKak$aq>|$2pV>-wCFK%t~4@z<z{#`8EJlXl-G@sk$vw*A1
zq>l^0st+3<9M&2_7rd{3l0!1B_Pr<WVFRn?L(#Y+zNuEXC$5|mgbfIUiiOH%1wTbS
zEPotrq(X@&Ml`$X=Sq5w)-b%nqYm;Uk_P$1k|Z$qI~Ee)2@}la{@x>YKh_H`XW*rP
z)O?;8Gh)7RGnYG8ECO*O!D=+rb$*Z#Sl!^j{T(phcg&w|oVP@S1@1EO&}yr<d6J#*
zwrac?#<miwU}lpUZI?>F{z8Q3Fvo+{Yld0!b-(vokDqbDOQQ`)pnxnogFoQqwV|T5
zB})>aXu*CyRLbr-p~$?lx9F7pG7*;b84`Hxi^t`Pbq>_dP0P3HiIcWjiEaD&)fTMN
zy%aaerr7g**<{u=$wjl_rJOq{bNuha2ph9@i(AYtkQ2M`wE!j$scKhUGtoepwEP=Y
z)7WKVXao~R{(2+f)H-vK$jV3$0YWh4U>=%t+}_rL??{ClG};9~=v|p3v-Ucxj?;&$
zp>6~IEa)N0%zSed_PbEXlLF!n_ig;t-GM3YgUKS1(OPZ<;JmQ4!A)Vk<4$ld{y28i
z-1woj3hTN3q{U&RV(jd7`NWIl(k`fe12ou;lXdU(JTlu2$wJ%EpJ?YmQ)oI*gR`tL
z4E|i0DJd`tT1*;CjgC1cH|k#V2`#(a>`0}&eEEAV<j(s2K7iOoWcdn*<d%6B@%vD$
z_!RKUAVtBLEavm>3jH-_K;Y%$JhgPESFpE}6aLBz+Q{$3uMfMi9)s)jAscfRPhjL#
zw(d|G2<g0=jM~$HySoWRU$SAMk#=oqWrx$=&u<!ug~Hz_gR^?h8T$hvja@QN_Mvee
zJV8NpYud;+0W#lF8FuGpsd-cZ^?TkpK94SS2Dw&|ZR%Onh>hy(PX?k%xav~-q8;)1
z?b2Fm^C$SA>>ie`so{*X;eT{Xfh<*;nu|L<Gej(2d@%_&+fv~;gxbdUcQTlo6*J9N
zD8Sux6VY|8s1}jKjW3hD1o49NPS?*)64CrcpVe;#@d}RmaYugh$v-lUo+;w*K;!j7
zaH324%LU`a6^g7l1}4?!X2|~KCrYiC6icv{i4A_}`4ak2>#&K`%;_g%l1FQbxw4PH
z*!m}Y9!#R+frmb=$PFBhvL?V=ThckwW?~siw@t%XZjqq0U|CZBkIk$lf?rq1+*~8i
zkheG^aLVVtSa$zIPZbgwdKF{`UmAXqO%jL#Z(ZBR;^l&tWnOUq&X*$B(d?Gy3tN}W
znJSvJZTcy1T12@e=X#BiN{>pZuCb2I28C}r6hbKj0}~n%c36eZ4dWzyT{(Uu%Xi<7
z?wMUlC6H(SVyjD8Ezf~$7C!b1Kd(_f525RJJ=0H#LSSp!Tj7nFzlHrB&4wIUM?k!{
zZ&y9jJozwQ1CP|#?{|zb?TL8N_aDYrx7tjM3f@Sjs$krd5#;g$*R6Dyhy;IaWM{Dx
zJl}*kT}R45N0x#ouEb6$J;&SYVC*9<FZ^g=_0<|k*NHjP1Sm3MkP4*$r?@HMQ#LtR
zTnb906#=VuQ+|*2<|hdRvmGovzgh;}a$Ce~LFjk?PAt;(>s0(6s(c=Mmckdo>(hBq
zlE}U014Ef1s8A_;OlF<7y6({w_Y?YYBwhGW-i|KXj+8;2yqtx}qsgLl7Za3e%4QNL
zDpY?ub9vfnYw!gx`cU1QyMvv{$n<X<x=u15d|%N>|NVG2um2(`X-P^_h^0pfkNbB8
z17in6s@DktEyA<fAnz!D+*xn<QWHvDC2>P(DJat^m2r2_a(9?IB7AajZ{jh?R@454
z<&D`w43)PGqb-wtWqig22J9M;An$5euC+J@r=7Rs@EW;vzwvDicnDA#8mK1inS2R!
z8pgEW@IyTT3aqB*(_MEPZxjP~_;=RwB{CCpFH|HYaX3&JlW-URbN6PdQOv1KZ)9J?
z)OqySk^*G;r_`pXs@L_hH9O=Jz&U*Ndeve?3gN}y8e?I{DPT&%dz%a3EXVnEq8s+w
zY31F0*ZzCL$(6LoBa;4TdCP17F0PMQ(9x){tj__VP+>`6N1Az>evt23-|V*pv%gEW
z9L$Rry%HGtc_*mg!+=ku%Xi)SO3;%)5Kssm^X=R|j(*Jf9Vu2JMdW_CVnDfkt^fXJ
z+4@dLpS1(lD{C8<2Ffh8WM><Rg4uc`$glgkejlXou<7DQZ32=*0u7A6%y_+=?1_+@
z1d;!HLRn_KJ#otg3qQ60uHgxz(G&h%POi}Edy4A*oaVIR7n}DuE+6G9I+J4$3Qah1
ze;&CVfuDVi6=c;=3VfR0E;_7k4^*#tCSYsb%OIc;Jr``g?}+(;DkCX*NZ|P_nU2b6
zotgdW-*ht*bgrr3(Z&1PyNY-SEKR*Si?ecg>6NiFSu18)=)QSGv~ydutGs$9n<!ss
z@vr3>UUpov10=k>aMuGGM27u@+Eg~&l7_iAC6L;IFE8EC`+kdFLMx70OQY$awJXAj
zz5Ddd;iu=3X$yaH4-rJn8GczKWd`x7v6@`6jrIb6mAV=Fj=IB+N|)U7)!E%C9K+|8
zVcptPi&Mf1-#@UhHF3Q;8{HO0!i#0@sNz78{Xd&um&kqv>HPSOA^am^@9If=t3!Av
zdvSMnx<-0zlo4I*7XL8X($f2u{KwiEhwWw+V!Lqzq8|~_B~_*3D#Xf4D*N`4+`=yR
z*Fz<H+TCW$@bm-a5MM6%d-ZhX<!ADk$VhsasVNRd;dZJa93kZoE7|5mt&g#%tPlD>
zA{5$r91Rugo)?b8NAuL<6JFV5%@Zm2O^i4sNFTdJd@pM@{65YB$~Sl#h)3LW%mwDa
zMNr!IL_jcf%*u<Rcv`!YebPT|nw5DnY5byqb#edBJeDM~9iSqr#qbS*g#dTHE9S7_
z{ZRzfUbkm*a=+Y7&~5;r3Jr_LvH6DA#*%X@BMN@g0UlFzuK|_jAHpZS{h6;#@*fP_
zlv*EUF(jp!l)u5zP!+f>>phd;^0RxE-1a$=eI#OUZJILG2bpSJHi)Dz>WKX_NYz4F
zu`0Yn_?>~+KUPB>;0JCagf$2~BWGU*y!199yxv}*Wn7ad`T>w!%5FQK5$Ak!3wK&b
z{%sIGmeE500S$3Z8jn2x?RvsMFSCFh`JFVB6t@=nKTJ{o7bX55Of~PyqKfEXJD}2K
zZv+#{sK+fdI~dTQlZ8~)wn+m%&itmAS8c?34~1VK%Y@i*ncz&ZozB~P0Iz8>W|JGD
zKrTv+xA!8&XdA?jACgjV!f^@?l3qb(+{uw;W+a8;lBxAWZUnojXG4kB-RdkoEGj|8
zfKd-g_j5B<N-BlB{t7VrXd8a0pYiu`!RCRdTi{X&lK^0Tb%=GNngx5NEleydl6f0%
z4Sw}=bCApgusQ~b^|48AYMiI-JX*PWe$kz=E?P?4c`Rh?KzNvar`SlJaEX4Oj8D6I
z5o@MRUR!<foG-RJt+`j<!|ZhV6A@xg<lHBIw$UI7OAjeyAvayUD875}<r!N*^|OJJ
zyFhkw-i5SF*iFKWkc>_hVNe*4)uua#V-Up7AMpBPbu6UYIC_{&|NFIVQe>Y(IQl)f
z|0Gw(2G}zagdg&oW^weKyzRO38f4cyh-C<rc?AIrC(peP9Krs&_Ca`skI!V_ia`xI
z1j&0Rz|#tQ)t|raZ+Q`hY0!+)qr=Fb7CYi6%5ttx{I_MP2sXjnltPw@{ITeg!JGPR
zSh%>jtDXKS<Jz}RC9wMMeuIxfCb2C5tYmWWT7UTu6&x~{4`|zz9jRNMC1z>U+4{yt
z&wAXvOd?*M73VglqqS{O@4-!&+8F{OvM3JE=R<C5S`y#Af~Irfxs?Y(qo3mBZdi!-
z4Y*bUw`}6{k;TJ*(TPd}hjV+mrjO<VjBZWSpiu5Bo3skBD-HW~dfL`%HS)1~a?Dao
z((^IBBiKro-?@n>H&T_V^x53_rNJU`4dHyQj!)=mm2UZ}KEv4OqwoTe06%rr2t=Gy
zmuFB*=Y7ztj4*D=+4RneICoIS=lz*?{;@rOJ>(e~N!Nbd@uXe#e;=RkWIvh`{39_5
zds5$H;NXL*0MwrBdmz!k{kp2|)S7gb(ABI7nqG4hnUc``*S%Qg7ZeQUt2#&=B%s`H
z-tO<Bq-C;;#?!A-)|TBP710p_C;^VN@c6%LzqnG<>BVKgzF^q0G&$7b;!pFQUq3Vb
zF<f=Ju9)R~AbbU#h1U8Z&T0C+QfzP@1eCUE78ZHz!|5G*t@n5&SD<e^SLr*75I()!
zO?6AFIN|A-MpjoZ!p|4gU0fP)RQ<~q0L^r~-VytLeL|obPQMEZbi&sc-Y{v<-+lgl
z7f>1p{$!BIg>eG%Q(=LpYe`z0{fiCBqe2|1hRo+m6LX8~{|CfPRPj=rLTxPDI}0tq
zJ|yt&PR>Gc)Ym`uQ4{woLh>MotI6ep*_e^vAC;O+7KsE@hJ#(2{#$~MYVYmBz|EWV
zY2>HAk28PWKSkh33}2pT8>oCOy=$SK@4dS)=Y?OXm~DV*=@y(NMh~g|X-0|SJy!N-
zJ=%-xzNI-q#|&?iuwW5*LwxEzu=HGS0YGdaTF5R94DOSOMXBtR&5UQdY5aC30)7dk
zdD+y+nq$JKNc}Ssk<9x|{gL}jInMxMI)pA{hwiJ-y^r6zP`gzcR4d4-T?W3!j(nv(
zF)LcCZoRGu+9h>zUJLdbO!GYXsE3aYTFVBfcWao+Q+NFQ^i^3}P0cLSOseMR+K9v7
zt0-^PBp~JnRdTE1{?`lg-=kB)t9&Wp*FB_-xtK}2VePnax1f&@YQh#!QL0s0n<d7L
zjhK1j9r+SPwH}#84}ing7~cYDWS`&p%F%q&hJoER+y?7KaM?<9OE^3eZxSzj>P3Z&
z!vEd#l6Uyu0(F;Gj0oN!K^oO)4TZ&NG)+s&hFE~xdd0q_JmgjoHb^4~aryuT0~A!*
z{lRzVP&A=GzIKncCfK9K`k&Vm0><hBqYGsY3rs|=*-E-Y75JKhj6^%yOZy~kDhK2F
z1IE?t*Y}Ur1SMa$eG$XnKMHRJVBltXJ|T?1SY~P1>=ERaD7L&d2`@&Q@PSX3)GD31
zrKTx&vfOeZ+5(<cc%YymiMuxa#WJwRjYPL{TQ2C8IB9AVGr#|-5wjUc9Vp(ibGYNT
z4w-1&@xunC+zUSU&6VX*y)G^mCMcm0X~!l~{omU6m}gb4`stz@WnJGi=@n@-DDV6P
zBu892OAyL=Z5x57tGK~;SA)bA=lDC~Yr&DAN#ZipkKAO<{9WVPRZrI82^Lda8v2#w
zmv=&In>qqxNh_6{f~zN$w1A_h#euM(pG{&)&KItPo_a=+TI+qR;J~?x`oJcNZ-YNQ
z^nsvor)&8UF<q^#_|81yaPP$T#(tI{Ek}5FKFjiab0maAQNs8~?J=RQ1jiF`P+IS|
zgTI6Z)URmdR4-jGR^lB{9go9XjE#;&4HkyvF(i7!2iA5CG$51eFVBd_9P_k;u8eTL
z`UELIc(ua{hM;bt;V@UR7wIZULP3!H?u_lcj~IBKU+l_HVdp&EOqF+3c<Y4!+V4~$
z_Pc@j(8B(6yU7E=hG4gxwzQ?}?>4%@HJ<)+6SWVTQ=A{N^QZResF-Lk9I@`l$31rN
z2`!#NQ9qdoyB6~hQvRp<zTQoFt!{|t-@_jeZ5Jy?ely)bccGj={JaUe3SF)*#1XDd
zOw%G%&k36(&S(h0#qGsUhKX|XsVGHKE`8zIPn3wJs-zZtfiQ0d9O#`QRh1CHbnDpT
zkL#>leVIMcUT5qEdRcKxc@qDwP}2F`9&_~<*CebM6Q&<oBKlgAxh!2GnuME`5cq*`
zJnrHJ<~6w5#A#r72<;v3b^k(c*A~!t1yH)KNxKpjXAq*J>HAbgZay)5@5_+7=%z?j
z$=Mf;N++$W*XRpa{A#6dC20tU7_%g`nzypm(lh39DQT00KPgrCMDF#+eW#Bua6DHX
z%%wu4Tk65`gf{IvtT2KsR-U1QoO`{IeDWY%LV&OBvyGd!kuxNv>3LhGr^nG+!9LFW
z-Lr!){8kw5F}IG{0<k2k&$?pd+(+*oox8}UDG$P{ILbYg3a1J>`8=nKr^lZZ>T+Fe
zb(?V4{0c$$MD180cE55g1|fFAx7SaYg;5UrQekNxqcBW*&Yc}Suoc?LD6UqI1r3p|
z8hr_6hd?Y(eKwnnJy6ibIx&olxU~FOZwzO@NbNTW{<FSx8SqPYWTFzF9;q`&El8=A
z_O2IjK>g85FlLY(S7Yjvbb2+c?!bvKIp%>FzhF~4<e7hWpR2vKO?u!63(8yCI&mDd
zclcg4^MdYJ%_S{mC}drBop9RIU;8Wvth@33*a)c0UyLI8TU{3Ep)fJrrSYTa`-#tV
zgmJGSVctMn7V-uDIPZBE^HpNO-zda$e9%uHp(t`lS726LP8;>YtuJZLSsRRkqLHLN
zJ;PJWi)|t(Q`<oul$n)r-y=-@rr#=>)g(f*if*|NTqQym>G~H*&tqmE7$mLROkc?b
z@JFMg{6BZ2vQ}<9P+!yXFKZ)UuWV4~8WQ`aVW@daeXvcXqM*XXU8$W&6qi(@gdI7#
zz4;>^?e89JnEJD-Y{bBPUjXU?x~U9+p@kT>%=akqr?!c(V6=-~$A&oI)5q*g0?q#j
zM*nLNM`m=jyxJ6wyE_?{)Qos~MF+D|P}%CrdOh1eUujesbYukSC6^Ie%F2-l!ReT|
z#o1C8aAATUqN)-@pk*I3ZShdwlTR92dK1YU1N9aE=OOf46ur5;y!<@L%nB1FWpL;>
z>d3bj>ESw0=o$*TLANZ>0+Mg6(QT5Gm}(XrWs-QqWza&SBrA^p%^~c0w8?}VuK6^s
zFKu6~wJLz6CiZ>J*;oV!EBnKprG7!l?$2-3OjTn0&qh6>JPRzd>+^+px3|{1lnnw1
zxCJE^s!>&S9?z$OFna+=B(*hSx5_MkzzwN)Cz0{3Z8}W;cW8A5x(?pqtM`4O1fS1o
zPc_G(!32&ErH-cMm;0qOz+IW*)VPF{*&e_Fa=BRz*>4%<*sDNs1}i)|2fDN135X+Q
z=cGBm225`$0FVr$AZ$W0CTsIlm|?NFZwruuI`kD~{$2#>Phi_lHTAfLXd+GRrMx-#
zo~~Dq_lp5ONCASRJ&%I%=1+0>wkO#p^R|zlSB~j8j=BM@`(YlsuQ?gU1hL$=v^%2<
zw#3k|PT=GRj^>4EMc<1Bck5jU9)XLJL8mWB<xi;{lh9=lZXKO_Px!@6D<qod?j$3W
z&sZaL{Z-Sf4_L9a0{TTYB_MQvSJS?Lz1DR%{8NtJSIu+ybRcFIMm(mf$GgLJfWuLF
zfWpD|Bb#rNbU<ci?m$d~flQU3Yd(_X`wc<6*D`XQlZX3VfdxjJN1|bWEW0?K%NI^l
z!V{V{dl3XE7sE|oly{NqRN+!350`>su=Oymzx~Vx9G-0EaSjTC;RllraBoZv?}mxm
zq~Nt}a6t3}i-=-)bjqne_Z@T7A9E9go}BCux}qev)DG%T?-Tfsr_k#kqP!ObVMDf3
zB@JuB(*O4SJdlrN5HiJGG!1V)hkO`<%rjy-FV@KSZBg3JD8P}sg&oS7W}wnHORiJJ
z+n)m6@SUw{jh4$(mud{c_68&af}uLD%m`g-{|u4l;(VUcI6XxL-U9bRYn}&=C%Hgy
z9~;K*jTFeHc3-BV>CDnJY3`U*35jtQH!Y?|EqB~SijCXr($w%irK(z1u--Fngn>7v
zOB?vT6!P($t1lcCyX4<Hn(gk#*g`sU=h?K65i_HSzuZv}Dy90T@QrcKfHzv+O+8Jp
zCQ+AdPtk1k2f{w@JkVQuIyx^aAD~1iCMG<#y6XL3S~dM*%kdnGWo_dyF&&Q~M8O2J
zM%_gwdf!1QZS~G^^X|EOB@*BX8bz?@PUV@fa~mq^fo(V{olbhlz>PKg(3+APTh68<
zGWB}|x=-a}6Uv=;JFKxlURij{1$Pf2ekB>qtAEtDuj*v$jp%kYt?)p+_ws&RZLvA6
z;%Cax3qgkuT?cq`Mn7!ex!*-G$d6pzWHpZ8uKQM7nX%GN>9Tv@uKn}2L)V6&?TX?F
z9w+Nd!=p^C@%&$Nxr}|{AC)D;p;|n9kJb9rn<@w~6h_K@DHz>2&WhaOL(4&j=!TTj
zy`KCvs^h*oIByE1Ei1O4rUMuN2QCt^6kfk;ID6b(t*pv`^CO)vgePmO2MCB;(Cl<0
z2A2*7`5^YnyP8&zSPJeMg9lAKUri@bbnVW~XF~d~KCP3|bOdReohkH&hTVuvPhE+U
zv#pQ<P}n+K6>fAtTzEe;EaFN*w-|@lOg9&3q!zk?Xg9C^jNmD%GRYl^r>I>H&+wrU
z<R@hM6iLG8$ClG=j<+akR#65g5?Z_@q1!17M^YVtc#a|zj~SxqMKszGIOKnA2XcX(
zmeF>Y7jRhP4!yojL|bhxJM@pL3Y%7=v=tDMp>61UX$g!xni$LzpLc)b8P%8GPF#)V
ze-|vJ7LaXopemgasZtWhto`4t!+*CG|4&bS7d<V!JOObmf<dYZXdU1KUBj7saR5|6
z?q7FdK~zk8c@3Ux7~Z~T%8DJ&whLJ6-2osAk5S_%C`493t-;a6P#%=bMNEm%IqmB%
zL$@tA1I7ssy^*NaxNq#MPpo|Por;GNi|qi7N!+L|4=~4b?IMv#6zhI%-t}Wm6(5ad
z+r0Xvx2sIJKPt48)y)V>`ywP(91~@!)@pH^bF$>JvqZ>u+zngj&!h#hq^CE7v*Y(^
znGzQbSP;#oS*2W>jZEk##QP$Jysv2A5Hn01ov}gRwX*`DT7TYj`wzNqI`gM9K-Y~x
zlQomWGo->6Ami4S*wTX_6OCOXz5v~>q&47AsJuh9Hg|bVP47Nw!HFWbZC6#rkD`AL
zd>Y~A%E_=(TG#WMmiyEq%1U}v6OsGdmufI{oKgn1HEXqfR2^PTJZ$(S2vu{8d_S|l
z{PpJ>;3&asPZAaHKK8SLspRRkStC5ezuT<nkgLwrKN7@$+pC^#d!Vun?oa(#JvC$N
z)qftv`sDhmF4eAmNtTG=XkmpEOF>ytsI)(Wv!K;IF{AwTY0Ip{gG_XkWa!laKGIdI
zy4Lu?r9~tAC$nl|vL1If_JmBTLeuXDltMH}ET-yomw#eEg(O>RVX|}dI|17z|9#A7
z@XQGe9HfPpWtE2@kP$|5)~i-Cg#|3YVb($wie3me<(TMHR3B~nWw+$-4=>}I+6r{D
z*s*4zJzPFh@=y4ub)`6kHYv4K`C;ikE1Pwu<FcZ1&L1te7&g#%={G6dv6_o42Rb$w
zw_3Nc_-Xk^Md9Et_70*yHmSmqE_~N5Dke;!Tq%aPEV<uY%jr@bV1gbR@;Cu*wYj=c
zwU&}4ebPAHK*LJ~+xYb)Z6zLUiEV_i1J+h`c;ufg<uCUAdii9W|H>e&oJehSlpDk}
zM1R)eEpd8jnFQ7h%~=U=exgpL>{vM1Do34JAq(*=6S@3{VkvpI2ijhJDcIPcrURU2
z&%0iZR7i2CviAyxOA!013y}M4)>93BTzdNSb3?SDBHsf<vnFL|gQ|yC{|z_0<Wy$|
zz13-?i<Fki=<lQN7KfLWgPR|dFjRRC8|pMQo8+Ulxz%dLQZtL$@%jG@M-o`@?d@gR
z#Nw*$N`HDp$n|x-B;x(3MGU^+xsYV!)4Po$uQ#z*W4(yBm&G7>R41?QkcDFbQ5f=G
zT*lRW>SAJ|19=VA`12#BL(fILwrsxQuvjzq3BbR%oOI_~f%h<ILaxb#*d;*c+tlG_
zIXI|Bvm5hAkn}G@Nk`!EpN^ocbA)!Ma4QPzAtTWWrE`3yo0w~If8t;Mf#YLx&MG|T
zr*gr9O6XGyI%|z6iGOdjVh!cq*hfj4uqUKv6A_(|$wz~V;_&Cr=ayA++D_W;7+Zd~
z(X}Wex$Zhl?F;RL@}BjjIpP&kD5jR8kmr-XK>@BocYguK_+ZjNh>$vLE!UaRpWBO=
zfj&ak0x@xsN?LfSQFsr>@=s988k%OQN(>!qlfuB{Fa9uM=yM?h;Z3cYvcxNcXRyi#
zW4=K1Mc<%!3B}F-qJWWo*xxchYDMh-n{MX+d&CVR(L^UH?;W}K`?Is@P^a{QJPq`c
zt$r(&MphaTvl{4ha&}12F7qkp-OOG@3o?WVFa9FYvU@AQ&tQW>XY&<(4uMZSPmq+N
zLTp!?@M0>-%v)|QQXDgtgR$XpnBq{dDNb9#y}hkrCo$thTj33fQlS#Tre^Ki(zEhD
z1-PzfcIXfna`M!7>7!H=+gwh`18|5`&Shx^tb2=7rvn}L5+eKO#Q_BGIY($LN1Zgg
zmt^;x=GFoX(}_$>mS@(k15WB$Fv`ulJkMAC1BRh;x7F2UWc0((-VXDK`1g_~<FX>f
z0$J$B*8lRC-zS3StJV4(Xy-79@v^e>b2f?(ioJ6Y-*)s?*kcwIjAV`<R@RE=f@&Ha
zFa9|WqUv6V4B(!IVl&&o>7C2|v`kcn4A`AH*IGjPr45@S3JNIDXyp<G!)76w?Z7zL
z>17FFx--YybzbVuW3#1|Er`uH*PTII<s@F^>upc1lVdGfr$cjJ%eEq6G`}1=pU#3?
zFVlp0$P=1LrlM9F#hI^%G$6AQrUL6@YnQf<>RE4xx@L-)(x!YQh~xQoX-c9K2)>iv
z7b9bW=P&;5)?h=PR0<E@#YCqPM82^22SQBM50`vaSH9oA?u;9yG|QP7OVxS|hee$H
zQz~2!_g^66JFAj1t8dGye8|Tb+|VQGg}UIz-r$dT#U5hA&E5U$o3G+c4)BI+h1?Iu
zoB9B8V#^L6oy(5zhLu^)G*O_Zla8%Xc22?(1_r76^ek+@?4}L1U#O+F)4gyWF8JG~
z-k8Zc$7h4ID~SLE!cR~D2Bern(cF_Dh*MYb-9dSPj&ewMiqL`o0MXfh0yTJwA^n|B
za`z^`S{7K7@XKjBb@OB_EQu><X|5}{z_QnKdB47?S(*fBOhtlAL&0C(JzZe$7Ui9c
z>Ic?cmZB)Hr7|BM`EnX!=<+%D0XC8J=9hUZaaul98$Ux+6>E<sTlngz@qzd|k^p@q
z#Cu}jVAvZoS25t$@1U3^@d+VeP1)vHcZcp5PbfY~`DK9noK#%%23YK{c?O0Sy3$vD
zqgkXZHfk`it9Kedx;44s_?A*DO^nxI13fWKW@lk4#7nN<EJK<jzBQrY(*P>i+IAii
z+R(dbFuB-I!q;@k=)K04c(ga&A0_03D}z9RID7KJt-k()GuTv}lB!?`g`td~g%<Il
zx{F#KSbjw;$<z_$7$s=J!W{>-aPsQmzHC!BO>!k1*i>Iyu?M774cI>{*37kQ#GWUQ
zD&tBHNWEN#eb+y%mPZ{A=W0VjZ>yf!!0Ku2553cUB?`$`_OoXjKtvJgve2R}fn>P*
z_w#s#n#p32ltjlM8UGa<Li`;>wwjKok@yAyQnF&S1bSBYYs(7kdn#6~S1n|Q0%nL8
zAmKa@Z0>9lI<+c~1n<znfA{nZ*$F~mDK6bK@wyv0OWzK!`Mop!BqP=aB?LTBHe+)v
z?y9H0=?B-+7~_=kO63keL3zoL3em;SMvd`74PR)OBzGRi32VCDIIQp@zo(g~sQ#q<
zr2Qgv^?v$VOXCf0sHw!Hv{eExpS)IEe=)=>-vzyHV8Z%k*P@j;TvU&RwT<-BfW5IS
zT$L47H;7%Iex&ExlhJ3=9T3~{4h4TM`nK`KcWDF;_`d1hyj!^g$yk5sCy5g_LOv-7
zR;4S{V1c7^*EseYB}wr$TE#-gbk<Kg8`zxCuEsT^*yS8l4rpJAw;2Ybll=oGzY}=r
z{N}fpinSuy;s-t8(GRKJppXeOQh-59rfX&ci8YqVbT-2Sygt-=Rgz9cky%!No=BxQ
zyFahzU<;an$JBlX=BL4$$2H^N(Bj)zh(4WvOb&HZf;H&cV`*ig>veEvK+|!;TV{<v
zQD)+fWB3+H<YeA{QX2o292neN?fTK7oa57oBB*q8EjGf6f{XS2?{B^4(VHnaRZQ{F
zHY*V|Ku87#%KhmtsojpP)Vqh_!jZ#@5xOO1to$%#E+2zSO;g8!UZ(XuQr*h%g4ST`
z=8u@!QUB4L^>HyedZrqixkwgx8brCdepRSnFee|!@`2~zlf5NH#_6}bRj94f1lH-i
zIptHdRnSTXNrbt#j;=7+|JKU&-y6IBe|^$^>-_0IzVwKww|;a1z^%JmBW49rx<MC_
zZS<e}NXl#YYl5pQ@F?gI_*%blG}{8h9kIH58{=rM3%zWO$ZsVU!rV~8vk4qY9OTam
z&$3G1_xLK5r~hWclv%5AQ+g6-w+n0x7l81Ll?izs?!<=cXX2=V^wQN(M_k~tz5q+l
z423b6ve;-C@96bX+h&CmIc2!A4*1~LWWNB@<!clj*y5pWkZt%9$+!2b0{-V+6ufQ@
zX60K6j55Ys0HL7z0hIyYGqP_XRDY}Uav<am^6Y&_Z(d^?>d7&)40$noI>vxJge$$-
zxc(OEE*fIbH;>-E9ZE@Qk638JNXRR;=+mt0#vNxcYLbZtkBu=l3Dwd@gVti=YQfSG
zG1EE*;j##6cYHKu-)!@3ms;5uI#^L^`k0}i$*~?UG*Z#zf(lMg8EW&pzJ0eZtyyTj
zs@Ubz_7PV+SlVs9+d*G-H(vV(r!rk}CTpx0y@SOu>DI%q2Z!YlM|@BH>D}dgdvd<B
zlBccRag9N6)21!%|CsLy)Showt8Eh`hs#<|IyY1}!YE(2G+ygadxILsLcNC12@L}z
zCJUf0W%`dRGh0H>2~06*d=!JKNG8E`+uu+*RWa}7QRT*Pp7P=sXe1z$q%8cj7!K`z
zVZK(s>hAuz%B6Y0n)QL*_EUx~rtG{ug`em9<QVm)XLUD1-T(MG^R!x9nH|%7Q<+rp
z=`o}-?=BS)<iWp#@Z)6Bl2F|h(+=7<$9$!wNz+11#?9p8nVx2zbkn{rgTee_VE~<C
zL>}6{Ct%|FURo($2HJF{%|A0#Y*R~B7P(a9=S#J19S5YnFKTYv4oBlDJSqL>U?L^u
z37aw{lf(PHHL)d6cQUh{_-&qJ=sZQaSFIl{$hwHsX1;f>$<!8Q^{@?H4=scS7BnOO
z-29s^I1{Q^cw&vKh>I(DP?ZIDYguS;<gnajp}A+OUnq?JTX)2|{;lOvclmX3n%6{Y
z>n|a(%c(5x`Q6#Vk!Vq-zS{#d+%!i%;QaLwQ*9Z-4~@r@MCDu8+>k{5z2I~(P7Cyv
zsn5h*q-2dp4U(WP%oBko6%&=%{#7!p!!sDhb%JS-1bj9IRkQ7WX#8vamX)Ux@OXR6
z9!i`-x6&8)pR8)7^3wEen#%yg%wK27(i6&WNoy)-eGDEGBlO3XdZ_=K!(<>dE-sLp
z=X-j^nOTYZpE&?3BF#<jU9_hieBhTB$BjSr7BUV*f}U0SZ!YG1T_k*p=<EHoKE0fR
zf`pvhhrs)B6DnF-_-WBsq5ik7Q*L=EW}R<z;JdiE++EG7%oNICtb2h1%F4=mqH&p;
z5~-M25Yb6g4Y0E}_|j94PKSD%pi+z;>i~CGYN=St`rK_t)cf5!vJ@4Sl#G#=tukgo
z9a8d$@-SOS)+b;LGX!MT0KKx?LdNO;!~1>D9C!}BxvrQW7zMq~C38grn(iUH!@GqE
zBI4@mSgS2g30YYrO%7|?21|Tzey>Cb64k+|=&xmt(jpwU@N%iQ@So|2aM`ca)SXFQ
zkfghNQ}cR@lS!3cBLcM8nHG;lzevkqXLlFi5tsITBBhuf&rC8G59X(o>F5sl?Le&?
z>kx1W)%OT~`JJ~RYLqH#Rr~7RKZ0J*je@{kw-wxzv`q9U+w>z+-HX+19fHyoK4MJw
zh?U((8<G$0%&o|cox#ID1=TatHa<M~&T()b1Pt!s|C%_Nc!amZ*bA~Z@d~%cf5goY
z(fIP^G8;VF4kU7mH?QD*cbvik+#Lt|NRkPyitmb8Z-AHm6|eQ&2B#&Ph(W>4Dxt$S
z=@pK>Ai*R43f2OD@Z-^mKlmg_5qMdC+X1B$oIe<-a)^(FVu(b7UT#_{aPQ`FUy3%~
zyDu4enQiq1n{}QHqx;EoL~AdQ=5FZ$NJpjNzvjSBjSlg_`_yN@o8V&PlGx5TonQ3E
zRs7B*X9CVb+Ee6a9eC(IkAk-asqdMFw5KDGdBM*%L4LkJWBRG~S!g6Zs;@<9O$i21
zk;8~2Cg~@}#6mm^>?$01(8%~RSG{VN6T@lcCyFg>2DDs@=iG5-yqi5ZKAroi&Bh8O
z+2;PmU(*b~yDjeZHhxZueeu`6Rdv|7h}DI3S@zcVgp+tUUXylMim|fGROiw)SKoH2
zc*ZN^nAJ2ZKek~c^y6GMK!C75B2uHyV-_O}Yc*%knz<y*)I9SaIMihXUnkOoQ<!vY
zFZ&}fWL#W09D&cC4*VqM7TEJyq6X5<?MNv7;eGjE)zX<*`+g>#la8AYlVDmt6)|7M
zd(_j?Qg^#|v<`f*1+`u5lrPUo=Fz)Gq3AN(7p!zqZ|#uX1$Ldu#$WbWJe;lD={7sX
z#x-YWEYVQ7DYqlRC8OF5`9W!>cO#0IM$Bg`R3l|RLH{X(+?#;bjm@otWPVz?@TgDz
z%A;4Lg<b-)&oHHTRh!e)eNx@n@jfd%8ceG<%B_ki*>_QHN}^y?%c1+)rK~FwQdu2P
z@C`p~THGt?z|F-ZHm2GDG+K>Kgq9x?6qS}%YMYMzVsLIV)Q8`%A13QRnkjVoTbxz_
z*xvTUr*19<!<<;KLJ&0x%m?8OCUZ2wx-LGvAJ%nhbnsdJ%RJm(RZ9Pwis<)aWf);#
z!8@#8yiWo`GFvnzum54#KuHy^Tf2X5_FHcEN%&q+@`dgEqK`at8wDxuCCdXIC956I
z$2V~A#selTjcnu?w~ya9DzC{u2PtBegQ$!M8o=v9gDU8PZRhC~)7ixUFu=zR@V`wz
z@Ha{+5fxf0Xsd2*&-)GtaYGs^LtErEdN*1byEhYzz;t|1yBI9Y%^(l&x=WX4dX&`a
z$;I;(`xdEJ(#}aLM@hRE-DqMmj8{gz(tA$gX8^n=>mGmkN_$9_MQHB0qUY<E%D`4_
z{%u)K55LdHZi{T*TfdIOqrzM8a|exh*KNf4WJLQLuAi+;A@MU%Pe>Mtp==_HU&C+5
zURyiW_B~m^m0IWP%OfTRLwWxp_2N3M=^xhl5=M#bweINXQv@ua)}c=ayycQyeTL`<
z02oJuwl780ByNVC%cFiIKyg<t<g&-ew!PKSEx#-{Iyyl_nT`&0>(?bzip5QC*u&3r
z?Dp4^7b)6x+ci_%yil}shZK$l=PPC7W)DNT3&$phw7Bqlt#~z#ML*Y43dGSmMD5=h
zzVUIrjucb{k<cIs2M5PyLm-?k$6LGum;Z@U$}l#9nAVR24HSQ63PihA9$t?k)5^e~
zW8{D6F&!px_*ddm)nbMLEzJEDSgLjk({&=L>{Ac_@Li>v%AABtnRvaT1+hCf{rDNp
zFg_(I^veQ|MhkUwl1c9A)Tq14KQd4Xj(w~=>><IG+k(W&i%TD&pyuf}o6|#0b;;%5
z70sE<f!a(bAF`rZEa0;aa!YR-Z$Tn~=4`F=z7AVwCqv$3jh}KX*e_T)EMB*zWF5EG
zp;p(OQds;|2l$ZUc~Xzc)M!0DWZ=|=yCN?SH`4KSZ-Z2fZ30L8;?c8}YpT4%>JBNO
zppp1LI4CX6m;33U9Vig~d0}kmEId?1VQ3&W8-wvUe6wv(N6zbcgfaRFHZ%sGO$1gv
z`reU3uRU$oF!nI&Erq!txmQbvorLi!D&_8Jv7}-dW~lbY`b6XWXW3!ZSFh)fYTorH
z5l0gPHMt|^Qva(A>i;sW`oH?Ja_Z-s&rk-rvt0fEI@kX)nL8dLHW*e8agm+$sI;nd
zp$?KH!D=x459g7JmRYQLc6Xo(QJp<6q4j%AVv@52a!C!dj-3iVF8z)MyVp-!b)hzD
zDZkW6$<kyO5f|r)wW?KrMs3AEzz$5Ge`U>X3kQcoeH^JESZIhtS*D4jJnYclSoaj+
zy)Mc^?3Ob&bmao+=?=AxnVXE0N)Qd3T(F&i5mHDq%Ld*5GFw5$U-hu9O`Udll;`QO
zNO`^gh&l5OS6>y{XwI*~DxtT7+L~%beddTr(oaf|O$jp&TW=mJq06iC<mn%(_Kh$~
zuM*?$qkKnJy2}!UA>Gn-+xx!?N?PgUJQUWaXsdxsXxZpXfeZ2Szl74l_g*g2m#FTy
zh3v0tDrE{tZ=Pe=FP#P}^2zpDCjux&{mA0KTWDA1L}{LJjocc9m;)1M1}+IX38EgM
z^)jr7_Ily_nGaNpUmqNa9?qdCrPXA`svCQizhryza}KX?fUnkJoPFWW7~sZPT?uW~
zk65toGGlgam>b}sP68@b<AVmP1h2qG-G{LuoB(l;(MjVyBT-X(GWoG3-?Um{4(t;m
zh}$faK6c_|gFcAv!(X-&QF5KsJ41N$5_b`ji)ZFFcv&dlDsCfY1wa|U^%`zP9HRK7
z54c~6kicK&I9b4`hlCy`Eh-t(l<u2m8v;xW?}jYRe6Cd|^xDZzj3*`iQ@~3{$vUa9
zgs&l7L8$f}sb&v-0DZsTt*ymVYlx4XT6cS0{xs*m6I>G5B*L1T$^NhAzB;JQ@68vA
z6fYXIP^37t&_Z!26fMQwAy{#z6nFO`#S6tXKyY_yOH&9A!KGMnhkeuUZ)WG-ncdml
znZ0xW$_xof-jj14`N;F`g@Gqu3XixHGZt$=KS$Q^+4iAx3Yp6)1^UrK^!s^Oo`rct
zF1AyUuy77^puVW_ITapiz7+N`Gnfcv&Q;bY%1T193Uti;&dnksUyv{>&1X$@u}?bX
zZ9$QJO^~Wg9TU7`$zT<V!z-?lKQ~>xe6=J+`dz8-HBtRWTYh+#d)**-vgM2-+xUst
zjsOj!#J`&A)R5GDn6&#nZWf7f0V@Z-p#H?iFJJ$Fr*kgS&T^&&=t`wrVIO-quEt8;
zcs4|;J#DjZyq!%K7GXmiI)U4f44=OL=yrkdI?sMoBu6~@7~h)@-%0e(#cKnK&?+3Z
zk`E$BjY}W;&f#f0QK8@)iW4YQwp9tuS>GiHi}hju!R!k8c~HMo>Z5^^Vymu27EB)B
zfhWff2<g)6>A^(7CzuU=Fu6E1_OsEqS=1Pg4k%$3CJJVr^>LIDu%q<yS5ozuaBd6!
zA_6v<JMgh@3Pv!N{@W4h>5nHwOtUA)>52R*1|jRA8a@L->(e@-6rcU6f-ksvB07c9
zO55Qb--U7s0M84~o)%Yc?Sh$VNbov?$q@g2T<#JgyIV|4eDlIv=5-(Dr#)48JnBj-
zO=>{8(jLrr&B=b@3l8N2L#KAFD&IzRVlWYyI))9rH_J`6*DBYQ9=TH2V2_{aVeo3w
z{zQ|{&ePna{=$p$Ad>!(^<eGOA_i5TXE_VkZ@}OV@>Z<iVAGwX09Y?czYFC^-#M&B
z9Z#qc6b*a)Q`ZN<V-Jmu1UwLAYAO)-9p<|^w8qk&rE21w6lMC`Dki2!&8Tr09s6m@
z3Vlz@Jw>W^zEVA?Z_UfjQ14(TIbd4cdBJ0xhnW*4FKl_r<C~c`%jkZ_$>cCf(p@rr
zV0JL0^~$cluP@?WECeSpc3!yuqjL`S;`sYm{>9&_FUG8fSYsOO!(0og$sD<RUFI>b
z386nYE<CNQAFK2q?IsP&vLXVc#|L^6KZW$&kt|K<_hUL#&ap4vm=;*D|J+7M^SFfV
z<Vt&tSzl-L81AHY>=j<<WM<g@KK~`Obh9vho00(_9cq$0SKH!*Xnh!#mvvPiTZP!Q
z%)1YVWZe7(=-%Rpg}CNlRO&_Uac?xH<TZ6X4z8u=R|-iNK2kMMv&pFKKiFh}y(ire
z<Dq!!pBeYG$n;Ue;!&1@idhR$ahrihvYU(|dET|MS-)4y@|jTuhx0dK#QgDg^hBbs
z>WV>#ActYif-|-GyY7lF2UVt-iLMBpwY^60{wT-NY&{_X6f@0J*7I=1<62TVR1q9i
zS&aACm&YRIvhEWAI;*!DOI`>9S@ClSNTVgDTf-TZi@Z~?c%F|WT1#k|bUbOEQ_=TF
ztnd1j<HeqyC(2n>|B<IJxtzWl?@GZGgOwWXq}RyuOg)xhb(Y<dIp^*$_6md8!xvhh
z0-x$x$M>t41`VxXZcAnm*ekG9h^H?O#$%y#l2%-Q%zAIfW4Yld@oh*|&f#GnFl2<H
zsb-0YMd7Rk!hJ0-a?tMBaJe}yy3UXHhqL!6mZ5%LxAEZbRbH!fsJGQS#7+tjjB#-I
zE^xsZbQZBb7-a|F#9motcXYj!SugtH<Te{49ls-<eAM3W1jN}_+(pik*Md+7gi%PZ
za?R^3DGL+r#{ed#E{V%7=`(;sY7zh1u3ta>Is%K;Y{aV)FWcKQY%fkRW?wz*1`=#?
zzaZ3i!l#Mxv3T`zlbQYtC;2v8@Y2u+-1Y2!=}RWN)m)h$3wt$Z@r;QA=7ef2?Xj!k
z+ZB^Jir!z9G6PXJxWl))(>nyHOJR=m>RGZYhJvirNwH6rXTO}D;iU)q2s*jBgVd7u
z2lBV(6u}yj0=e9c-SiJ*nPYocXM#a_-3L{#89s;#Q9Pb}M?TnzD+q@)DOCnW7!=eU
z^R(#mxYV!u1-&_@Nb&Ia=5s~Fw0j$V_Cj8fDmrVSvYuU0J@m*`q3zfY&$<;<*C!YQ
z3QPkaN<$<ZTI{Ma<LXH-*ot3N?MGX1yAKSO${&b8j>M4|A|n&3Yr0Dc%aUvtF8b;u
zW;rw$nM~6ZOApjNoDpOxt}#9$w<kCFe};JK?ZH1i<uEP3(FT9G&-4PynnWGd$iM!H
zd_ut01#0y}B0aVLnJnS|d`|LX+(^;8%n2HzY=YbCb8S}u+xr7xHvJDffNdKZ04Uj}
zPo;p?J@qe3_&<06TwiK;VEiZrcGW9;vN)PeG)JHwV|{7r9dd_D9lwOgr6Y4alJ9{w
zt@T*nT%Hj$<&oubDgt1^Gcif=+8#Ak-R4tPEjz)O0zk1)HfiKZD-h_}AyCv%lWy-N
z7dsa8mP;>|#gj?Rbpbh^Yik||hciZg55PwA;aTnvoiE<-`H84LWxmv_<f?Y3>rY)6
zgin5PF}3lbA#O{?2$C^P_234K|Fvl%+B=v)DVqNRU>_{jt->L<;j4NQr3t9(O|)t;
z>!-$#yDti_|2XRw&K7*Gmw1kvt_{GEe3iQxX=G&t&e%@MmaM@4M};H=jj$kSdb>wR
z1XOej+l`!6@n!np42M?)AD$P!plz$f^~*jYv8xn)R3+7wfwOc=7x*q5j!Fd-lF6b&
z2D(v#y&B0A!jD~f&7it7n#66tR*WML%l%5CBKR#npYtBPK;ovZzGg3;d*%y>ciy65
zXaqlKgtz2Rv=Dh=#TfhLj<r>LiEB9l>%mE?rqbM?&p{(%6e~3-twL1Im0xx!aX;Bq
z27X(=HG#t=loigO{X+_V37dAOangQJI2e#5#rGR4R^@^}%XzrwTx-<5Y1xIPx0Ibr
zkWES5Isvs?BT`oo`(u4#pGSGv$GKHp7tJR??Hl5iYfg&qD1biAyTLFn`Xz_^iM)7@
zw^^W{h*w;?2~{w|4`+a%lO`OW978<<k(Rp$VX4P4jBg(AQ`Z>F^Y32KB4MIfU;%^C
zgt`)cg7{SV1XR3e==Mb80DLL$_E5p@cFff0cm{CJxS;oE609D_pKQN?-9fEwlcsg1
zC+rL%a-&M;RgEly6IoBBltv_tpB4e_f14)dLzh~3VSD4_Vds9Q(H(!&Dl9YrmROLj
zI_?@*(Ui{V&5}R$L@izYt_i0b&f&*qb?Ii@5N&Q=p?Q&DiO%C3=gPudf<feRl<oBO
z(!Ybaaeh2ZXEh7hbU)MpnlH{i|4`9J+ei3TfhL<Q-d?@B=W;VQ{)=`__&sQ9y-7)x
z!r#!gUeqY~pi?w37?Fz-mn(724F?vQscPWp7tN<;T&r4jz9_;PfHa$4A{vxMr#Fs6
zQP}KV-cyr*t@NJpK_KXPkQ*unX5}Izf@@)aZ$)rMP>6+kGhYmVJtCY=t|TQY%R4iG
z6YFLPG^-QE_Hzx>nrz%1X)@pmzRiL`X_#D76=v?~1#0HAThyJ|`+(CyKMnm?JvCpP
zK7qQ)D)Q;26#Sk!PRSjLs7p)#EPwRwQ>}`7@db0|A<t{{y$3jWdUNwmgQrIxQW!Y}
zbN0WlUI+1u4IcOyy<+F|_y(IbHxV4xp+X)bmFeK9liSx%4i8%Y{L%M@I7|_7-u@x9
zd#JaZv;Y%0e2;(T^HI`%hQi~kGP+CHLxYIMbyJ%vEEM5B=|v5QQ{|DShMoLy#IxrZ
z4<X8T!|acEDL$XSCoaIXe$Zz11*7sZ-K<4wI7OUJuEBP*BDa7?OonhXT{~~1|8RGB
zrB3;~ZBu?9(6}=Qy_IGvaT5`zGTsvpY`eck4R-ZhI=!dqseSY)|IaZU#NF{})z*ZX
z{fq#>7qaG9k(l;RVDOU3jS-?sYx2Z+kSmg<EN<&`s9`>Yj{RZq+7rhX-bg=B9FIuG
zz#!@5VNR;}$oXbBi1gs_$PBk;o}!Ln40bcKw#mEqOx#<kqM2i4Yl8<N|0yVcEl5Vw
z7YNfon1B%Imxnf32DzjL<hiyY;nD){3o%GnQ-D)z*Co3ptJU|9pcom38GikZ!=wcN
z1z5XH6yPoZF|la#WrM>4m2qszX29&Ei(nalSxXVdfbmrEn58{hAhKU(MaN_Re!N|r
zd)t5somtr#myCMdmqc|~skG<)F1K^U0@;-#lgrD6;#|M0y4eyCT}l5(X}HWxb@N7X
z`9C^mB{m|peYLvRa2a?^QuW_&=%xUFAO*LRs<;1}akeyU`)ZO|?WzBE`9e^e!-fo7
z3H!tw$AA7%m~W%sR%RJo{vM*y@mGEVV{_kwVp9`_A|@v%Y1Q9Z!X@_BY^!g#g<S$0
zSxAuCsgdOsB9%+ON>by*)vO_9QB9vDboOw{!1a6a74P2>d~!(I;46}i(-iPKS!*>u
z8wYLCl2;-*uphKYvEVNXvdaR&3&TBm7666F-v9uqbXy)c9LkEgW%Nk>w7PUItAX@k
zs~(4Hsj5~d-B3#cV|_3>7Wca2_GsZYTsiZJaukUV4`%E~rI1NwMV7%o(}odvw^6Lh
z{CuOrsNnFQwf0<bnzs?hvmuTmQ5+lurOggdbG7t!Iw7j=RLFz=>f+v_RKv^Tz(@>M
zZe4)JDuY1Qu5IZD(`%R1%9RT95P+r;ru$@#hdrzeEHRaPgWl=;8}p4ObRa%Fu8i*s
zghfzAZLN$%4ylv)dMPRE+J6?K=^9(CX~~Qx__UB=t>isz!te+l5*`e-h*5CYBojmE
z1wD)E?5PcXdeO4W!E+zl!K(pawyJvQX@V$rqf$mlox)Xq1v^CwzOj3EXeqD2+V7M{
zGgTNdoVw>uNU(z!7iH5Nf`|}b9y9Z@`O;A=vjZwCR$!Pd=B$ZKNWyQm`2`39T=TJ>
zU0%@+cz+)IesD2+NxAb4wRqp_+R?WDQcP+%h!nOjti9LXK9{>Y4P<~xvec*%2zb!h
zXh&~CM%#33iVPT(6ugznrJ~PBxA4G6|C*<xLZ`rS-rQqaJxaBH#8dUOf?ZO6M1_lW
zDB6V?R5l`mWa1P9^C$%Ozs$C*Q*MmNbN(`VCar|Cl+JSIeS3bP>GB|}+z0Ze;~}%<
zML1FS&0^r+aPwh~nnL9{Y88{FGmzx=hh?l2=)n)3AoTUqV)B<aR7jl`Lme|4ve7xy
z8RAy2@ecLQQ*e|*b)BqVmn9-KK(#dqK??8Oxys7>++I>moix+l!w+QUf8I0WwcS~s
zwC%F{%$YGZFfT-$>s#jind7`^Uc0iy0C{IL33#{q1JW6?-bAKnqugs;D7@n_(}cLK
zSTy^OWlH3qSK6k7c;_9)y-|kcPmPCG!NG0<r*ULfCP}q~t{U)%?c<3K=v6%iYbM0M
z+IM!50QzdB4|>*ljorBOT7yjo0a3tFHiOUSGSS&<q2;5n#sPm8V8x5|BVJ1@YIYfo
zseWp^M^g~{^RBS4@M3@9{nkP$hMBOmt@=T<UY^Mq$;FutNo(j@Kjm>E%d>_#16E$+
zHH%P_rfU5@NFK%0{USVwX8pN}q2jDJQ!lM~fc?)^N7vrRQ={S)>3svtC4yf7pk;CY
zGwIqVkks1OCnpZHh=#IeBkUF5i3$e96!{|ZY|?zeAk%#(XcQdXnjLR6WgN12ds?d9
z8SS)<FALl5VYDXOqjvVb^HQ}A?PZ<m)PufEHDXINe4&@7SiA5tVscr$L{n+zdnrX9
z1K0N=O_ARn;mX<jk4Y-^<-UfPp!qE9n<17KNDEp=UU`)>`vGQ-K;iGxRVbfdbFix|
zbgiCuAPbR%1P*q%W>-hHY|WmyxXGOCRlV={Bi8a8@rlU^Uv_(3SbcH+Hk$ouKteQ|
zpCPZyO%%!JS(KUQ6#S$R>E<DhT6)px3w(G=66N!sT5&0`fv|L`Bmv_CiOC*Lb1Jle
zb(G~GY}8=e;6nhlE=wA+QT_?cQ*=vyw+VXw2aqOiDH4B_UVp>Iy$2`27T<}v$nAgP
zm-pc@MQ{#G3UaR!JNv8nMuN;?JGCk`LxMU}H6|&5n-ZWIco#@C8Y8m4c{aaH!4iWg
z34nL#IBjdJ(s~48j6G3@InGX`PkSjpu&5~TKG(E=p=;OqOUDs_tDPzx@0Z3xh~|Ef
zpbl*<X0$wp6h%ex`whBH0i!Zv5Y0%SyXzQ921<pT$YM{m8$>!Pl;6-6I-Y4FWMQ>a
z*G*r+xEiCa{%6_+TpvwWPT#^olZ=imsh+<l5cuOC^g{cyVc#5Bfp<{<6HhDyNYwj}
z53%{k=hFreJ#i%E&acBka$7g928h!%n^=rtt71irjf@<lIRj*7*~COj7uZU&L{Cu5
z|0)}2Vg|RTf`M$dHQxm=#(&cfy$MqO_>VM1n)rWR8uE`OWMwZ{b6Qn5n!7UJNq_K|
zuyPhz8_N8h35%t#BB+I?2#j-i7hbN3>+~6m<9@sV->&lV1z`8DBS9)cDtA~m=T<Ma
z2HAn_mDkXsm+3((7PwnmV1tXyO+^3)se8L%szE0h^}As3L_SkI>J*{1G+0IjCF2VP
zdLZJJ)r98^k7(h5k>8CQczG#r&+u|VNm6nad9n}w)Dw!^o@|UXy$0G>N3wmUHed8A
zdP7TN#r(;SKq#L%-m2bw6tXKr)*lAM4SBpxw_XhCLpD)H^01BmlRDf2*nXQ+TWp)t
z+>)Gg57|qsEPK0}Q>{ASsBGo|bIK|JOcrXdzXd0)%y&UI)Yn*rg#5U|ESxD>xM~tZ
z(1bene&!{0O`>tCDl2AIO)vCJwoWd!A^N&7SDF9rFM>;`kFF(ZpxeP7nWg;Q{e23_
zJ$U3+EkPYefF=4&#%&5+bh1I@>wt2A`VEVEeep&MbT2p;P>{f8*Z{CSzXhbcSJ@L-
zm1bscplvV?B?&wG9i*gv);CJV<+O5)-32)(bYBkbnpA{pkN+jAYSEAhFJZ?&G1b(Z
zH$h!3%8W;l<xJ>(D>(4`oKYJurF8FYue_83XzhXPiLa~LoAjY1?^%EpNBQg=0M5~w
z8rskJ7!MbIJo*;YLx0CO=IkY7H?#?Kux`vaf+a%<M?cRPb#(pk5VWF!VunIy9{2lA
z<=R%e0tTV8j-Z0|Fa2H1(30CL<*tsj0DD*XVr)IvBQFes>F{9;;a#?VR=q-PN+zzp
zZ=)bvw||!j-p*M(mvfX%Q@iPFmQy$6J!5*f<nhY8#&$K1>`D-*kFp~Ht-fnVnZ)p2
zZ;6;*WCnQfPcB`Yq*%tfG2$^S^{tJW^VfI!5DT*W{PKX~vcNdslWgi?fH{83Ce=><
z-g}lQZ>W%aYo%u&P=;4Dm=ISOmd(*pXQG@F7+<`vpEionuA{g8qhl&!g)H~q0A2Gr
zguP<gOQN-IFnw{xmoQve!?d@NZ1!j~yt=EM>>h<%OgYyt1J~^?6tJB%Ewi&@;xJzf
zSmEWyC;hq{I@ThIvY^kWjdk>FjV79_Thss(S*;+iC6pN`;%t;dwfK0-*amit#jXjw
zA6=Dk=4u-R-qY;Fk7N)?43a`U8Ob&n9wsln9Iz}I7UX%2UltoGs{2j(EOzS8+D7E%
zK;yM1*9;-G)o(SnZ<3aQ8RGUz9zT$gz8GjZryicNN3}g}R#?d3OcP&dML6nqOlqN2
z65K@;iD^j3y@*t9n4(O#d8;7PMx|jpszV<XE!!$3qh&xNee`Sb;w)r&F44#=<~~AN
zFGH%+Rkli>k5n-BhgOkq?@dBO*ceciZ|#x-^Rqr*!jwdek1A6|*XV?v(+%nH8|Ci5
z#C-+5q1n8@0q0pfgaJA?w~bW<(p7lRx_s~JDgli4WDn#PF^DP`ZbTEh(|`hWTK45%
zU5r1n;NLRnL;6J!Il$I?L(2AF=o9{bdWn^W3LA$H&I^~Rd`YhGD!i)Q?IB}dIWFMG
zPfQ7+(3l^hBMJ|>5D?g~*RmHQ<6ySlA(mO|E|`^sc#rGrboih}K?_})XghHu<6G+s
zH`sayUZt5{%G^c(t6|P%T3+%YmAkja2Aap#TT8}WzcXRP74Fbgf68ifiiK(Y_TlnO
z3+1|OeW)c>#P&f-{uV6o9|ahb$ZLxs6Q+G*%;M%Ihy`V;<L_u4eThbeW?WY~xgPi0
zU%xgn1!#Zt4&2%-0I@0R>>EaOqS%REB~@}(1I1Hzl;+x)-!T<HsZ*@+611h6SsLmR
zt?;QWDRhGRgni8Y6(W=p!@?z01|g1H_baLIDsc$0(W3z|1l%w6e$1fnw2`R3eLnYz
z=@$DS_S5XC0LU@Vx#_A8P$#hx_mF7J&YCJe$if(HTb1Q+&HBR>D``Uxf1+94UqM7t
zvz72z5Mu|j4_EAS$c}eTChsL@d1LaS8n3_=(S7tj*x6}8ajgQ2Mv6EZGA0u5+}>~Z
z3$H@Io%Tf-ip8^H`qN?jEitc9YYvGY&*H&elZNR~CB$3x7S!;t&Zw0nGP&gIhwQ%8
znf7%mHN12M-lX8+T?6ZEy`y=$j7axASw`ioYmRemv*61n<hJxM{e86^Fp*gB(*e%Q
zImZR+m-cPOBCq{ky=n!;eLK<$o-c@h0s{r7i-Dgr+CQm*g}Qsg`Gb5bI>hdBR4F)9
zN6*s1F;(u0R`v0zFVdbAy~Ue_dK4^u$L~szPj~kWvW}KE(_)tKWFOSGo%}5<zu?fj
z^@#$i62DlGz<u6`Kd`liZsJKfVlK_HG;bdnZ<1w*02<*421Yxu#&dI08NfE*{3{km
zP=c(nTkK7xy2#vG9{ev;RhUjeNk#Cb$BjeTmQq4dq}BXNkn+)dE^0#)dc8WAgs0mb
zwu<vslOAZ+{m&!i!2G#9Xa;<5z#(3sr5I2=<**<@Rqcx)oGS)*bK_3}<fcCq$n8Am
z!`?s#Om?!L+_j=VEusz?86EBS_mqigjxN!)i`Zj)ApIV)eYVcKd#%-%!krCwIi6{8
zC%Nb9`N{9A8&)nwkG}>mCHcwNU=^akCrCtpXwFyKx_MmV<8wR+*iDfVbi2-0ar~*^
zrmjEzb0;bfqb&W5Hs<@U1hoPTE@PM#bKY1f5z-^i9zH1F1YdFVvm$l|T6SqT1wRE$
z7*D!#zk~Zf!F<ySS$pO+-PB0)v|3T>hYb|a`$jM@RJ_J8bO>gYZ$kp<x&c_Ez~Dr3
zD@ML6F7qNh$$y98-!1UPk_FH0Q-$t(lQa4b;ip3t&<njmCa}KT9#Kao;_$Ce#^IEo
z$3%_q^Ja>E^J3zH;$EMxTvEJR(=vCUigE6pK;DrdDgrsvUOoAfDNIy8-Fp$Q!rLz<
z0y)l$JL)f_{s9;>&quyd^gVp1&gIhqSD5Xh8|N(gbU0!F@QA-5rLQP?Icv%J(S+)V
zzeQD*%Q1c*_qsP8ys?0d>WPhXaEAZ`;>?h`LmX6~E(5d(z=i$?UT!3a@_#?a@pZGr
zZnj?jI}vRAXQ#hEpDf_u$pt2}`7BWb?Kc(>v!e~gk#Xt2FH$V#ETOskf|*N3)7xmQ
zRSH5DhGE&Yd9|0{8860;aN06GRgjs1h;R23Mhb~$7X-{_J)Wpc1@xu)1K74IGmvEg
zgBda>f0a@_H<muLiOb66bUz*$5x+zmC^ORh5;GJmi;TO#*gXKezxko+bL;iA0rXgt
zt0g;EYxTyX%L03|G_?rX{~Mq!1F*n9@`rUy05Y)gNu6dC&<E(A&K!bFJ>;j3v)BOw
z`gd{Bz0iHq(BB}KfJW85>P7(>bh;Tz<@}0|<tqg-Vf^I~hekAW&b)yDTm<<3*@itJ
z4KX&6KqGNsI`G}58D87*1D}fx><?mMaeQOidFtd#q4Av(^PgTlxBI~kl^thd5neJN
z)4_G7cMQb;OhPhIo3E*~l92bVEJ!UqGz2geGMK$9YJ9+0&cm3P%Q0EX4;0*^Ct@z0
zUEufEl=f!#_IixS6RHb{kzKn@+fMFB4sWLh+clFNoVf_+sxgfG%pdW09HJ@FObu4}
zKsFQ3W;x|4huk)=LLXFSB=M4ZKr2Y-&5#z9)cmG5ipK$pGxjez|K%!Ni#S`SgxFl0
ztu=+)%w5frQmQda%^6jBD(ya{ve2GDH^~w58^-y1I{6B~qVoR$)nnW7H`Lt)KRlK=
z4YSiKI#Yj#Vt)6%g$J6Nd?i&?(xa0$s|kHQIh>MG9jbdyy_!stavA=Lu->;}&qVO3
zab&kWAnwnx-Q!H10N*3evpMPzJIZY{F%W;E)x0nj4|5o>c_oQmRGLjELbs;5sI(U+
zWb}=ox3W$C0&)E04P6I_7Me%mu54Gg`PmKJ8Vxac0yv9WhJwvQk$f1$bwSug`x)3y
zJ!s0wtyc4Ynn(z#Rm>B2XOIR+SRA6{H9+^jncxJRYYWbmu>C-#i!$(n)b|fNBsXKS
zx!srYpKY*H9&eL~4vo6giz7(tiHXG_67HiRv!d#Fp6!B6p!e0ItG@#+Y(#^7ki3x_
z@K){NWx%}S_|m8T9It$1cZ0^@Y9FSPk^(VE5`xXAcd+TMuGmZ|me^Y}h?lZ<TeD}9
zGdHuR{;Hr^lYpAI*x<nJYcWb({gW{vqMfv{I(n-n*eN6PDmSgY@v)&ee)5=xv(kz6
z+~}%6l=(~5F?Ut_&pJAugxtu@A&r#(XIk8~h93@3u{fQd+W*YgBn!I(vwSp~z{z22
zch;PwzHm99Z#!+x1rK)6@f`L);yKB9t17@Jk5o{)Sw{bh`Adm@W*zud0AVlMc{w9}
zaZt`Zv9YIZ9EF%(t@o1uaegK54F%Q@&=dnW1n{`YtEIuP^Nkv5BYd-o_m5!e|MeY3
h{->YEx^#~=;-KxWBar~y90&zPURvo*m840~zX4a58a)62

literal 0
HcmV?d00001

diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md
index f1a81788a0..435d884a51 100644
--- a/windows/deployment/do/mcc-enterprise-prerequisites.md
+++ b/windows/deployment/do/mcc-enterprise-prerequisites.md
@@ -18,6 +18,8 @@ ms.collection: tier3
 - Windows 10
 - Windows 11
 
+> [!NOTE]
+> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup)
 ## Enterprise requirements for MCC
 
 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services.
diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md
index ca3e78f917..b073f994f7 100644
--- a/windows/deployment/do/mcc-isp-signup.md
+++ b/windows/deployment/do/mcc-isp-signup.md
@@ -20,6 +20,9 @@ ms.collection: tier3
 
 This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). 
 
+ > [!NOTE]
+ > Microsoft Connected Cache is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions below.
+
 ## Prerequisites
 
 Before you begin sign up, ensure you have the following components:
diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index 5fb2e95dbe..cebdb5a480 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -19,27 +19,41 @@ ms.collection: tier3
 - Windows 11
 
 This article provides information on how to troubleshoot common issues with Microsoft Connected Cache for ISPs.
-## Sign up errors
 
-### Cannot verify account
+## Common issues
+This section details a few common issues that customers face during the sign up process.
+### Sign up errors
+
+#### Cannot verify account
 
 During sign-up, we verify the information you provide against what is present in [Peering DB](https://www.peeringdb.com/). Make sure the information for your ISP entry on [Peering DB](https://www.peeringdb.com/) is up to date and matches what you provide during sign-up.
 
-### Invalid verification code
+#### Invalid verification code
 
 During sign-up, a verification code is sent to your NOC email address present in [Peering DB](https://www.peeringdb.com/). This code expires in 24 hours. If it's expired, you'll need to request a new verification code to complete the sign-up.  
 
-## Cache Node Errors  
+### Cache Node Errors  
 
-### Cannot find my cache node
+#### Cannot find my cache node
 
 Did you previously had access to your cache nodes but it's now no longer accessible? If so, it may be because you had a trial subscription, and its trial period ended. To resolve this issue, complete the following two steps:
 
 1. Create a new Azure Pay-As-You-Go subscription  
 1. Recreate the cache nodes using the new subscription
 
-## Steps to obtain an Azure subscription ID
+## Diagnose and Solve Problems
 
+If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
+ 
+You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below:
+:::image type="content" source="./images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="./images/mcc-isp-diagnose-solve.png":::
+
+Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.
+
+:::image type="content" source="./images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="./images/mcc-isp-diagnose-solve-troubleshoot.png":::
+
+## Steps to obtain an Azure subscription ID
+To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. 
 <!--Using include file, get-azure-subscription.md, for shared content-->
 [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)]
 
diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md
index 3f99fd1880..b8df6ad349 100644
--- a/windows/deployment/do/waas-microsoft-connected-cache.md
+++ b/windows/deployment/do/waas-microsoft-connected-cache.md
@@ -20,14 +20,22 @@ ms.collection: tier3
 - Windows 11
 
 > [!IMPORTANT]
-> Microsoft Connected Cache is currently a preview feature. To view our Microsoft Connected Cache for ISPs early preview documentation, visit [Microsoft Connected Cache for Internet Service Providers (ISPs)](mcc-isp.md). For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
+> Microsoft Connected Cache is currently a preview feature. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
 
 Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: 1) Microsoft Connected Cache for Internet Service Providers and 2) Microsoft Connected Cache for Enterprise and Education (early preview). Both products are created and managed in the cloud portal.
 
 ## Microsoft Connected Cache for ISPs (preview)
+
+> [!NOTE]
+> Microsoft Connected Cache for Internet Service Providers is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions on [Operator sign up and service onboarding for Microsoft Connected Cache](mcc-isp-signup.md).
+
 Microsoft Connected Cache (MCC) for Internet Service Providers is currently in preview. MCC can be deployed to as many bare-metal servers or VMs as needed and is managed from a cloud portal. When deployed, MCC can help to reduce your network bandwidth usage for Microsoft software content and updates. Cache nodes are created in the cloud portal and are configured to deliver traffic to customers by manual CIDR or BGP routing.
 
 ## Microsoft Connected Cache for Enterprise and Education (early preview)
+
+> [!NOTE]
+> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup)
+
 Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune.
 
 MCC is a hybrid (mix of on-premises and cloud resources) SaaS solution built as an Azure IoT Edge module and Docker compatible Linux container deployed to your Windows devices. The Delivery Optimization team chose IoT Edge for Linux on Windows (EFLOW) as a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. MCC will be a Linux IoT Edge module running on the Windows Host OS.  

From 51fe7c8a8f5bdf8a964086304cd46899f7c32d7c Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Mar 2023 17:07:16 -0400
Subject: [PATCH 34/64] metadata

---
 .../hello-for-business/feature-multifactor-unlock.md          | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md
index 1ca04993a0..c4e5d43423 100644
--- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md
+++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md
@@ -1,9 +1,7 @@
 ---
 title: Multi-factor unlock
 description: Learn how Windows offers multi-factor device unlock by extending Windows Hello with trusted signals.
-ms.date: 03/09/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
+ms.date: 03/30/2023
 ms.topic: how-to
 ---
 # Multi-factor unlock

From c8df04f1f625fe2f4f03d51c17145e67a7bc7f32 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Mar 2023 17:13:25 -0400
Subject: [PATCH 35/64] update

---
 windows/security/docfx.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 47e61524e9..7062e4187c 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -77,7 +77,7 @@
         "threat-protection/windows-firewall/*.md": "aaroncz"
       },
       "appliesto":{
-        "identity-protection/**/*.md": "- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>"
+        "identity-protection/**/*.md": "- ✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later\"</a>"
       },
       "ms.reviewer":{
         "identity-protection/hello-for-business/*.md": "erikdau",

From 7a17494c0082d064b915f2bc09fdb53d724a7785 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Mar 2023 17:16:38 -0400
Subject: [PATCH 36/64] update

---
 windows/security/docfx.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 7062e4187c..a8966ea82c 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -76,8 +76,11 @@
         "identity-protection/**/*.md": "paoloma",
         "threat-protection/windows-firewall/*.md": "aaroncz"
       },
-      "appliesto":{
-        "identity-protection/**/*.md": "- ✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later\"</a>"
+      "ms.appliesto":{
+        "identity-protection/**/*.md": [
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>"
+        ]
       },
       "ms.reviewer":{
         "identity-protection/hello-for-business/*.md": "erikdau",

From 9de2d2b59e4d8b91c75c3e4a43583b20ab40796e Mon Sep 17 00:00:00 2001
From: Amy Zhou <amyzhou@microsoft.com>
Date: Thu, 30 Mar 2023 14:17:31 -0700
Subject: [PATCH 37/64] fixed broken image

---
 windows/deployment/do/mcc-isp-support.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index cebdb5a480..2c19b5a82f 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -50,7 +50,7 @@ You can find **Diagnose and solve problems** on the left pane within your MCC re
 
 Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.
 
-:::image type="content" source="./images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="./images/mcc-isp-diagnose-solve-troubleshoot.png":::
+:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png":::
 
 ## Steps to obtain an Azure subscription ID
 To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. 

From 33c51ce6ba73f7125b64c5adc18cabce943f88c9 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 30 Mar 2023 17:23:09 -0400
Subject: [PATCH 38/64] update

---
 windows/security/docfx.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index a8966ea82c..a4d2ab7dcb 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -76,7 +76,7 @@
         "identity-protection/**/*.md": "paoloma",
         "threat-protection/windows-firewall/*.md": "aaroncz"
       },
-      "ms.appliesto":{
+      "appliesto":{
         "identity-protection/**/*.md": [
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>"

From c606c04e501818db1bb7bebb63803ce7acb5904a Mon Sep 17 00:00:00 2001
From: Amy Zhou <amyzhou@microsoft.com>
Date: Thu, 30 Mar 2023 14:26:35 -0700
Subject: [PATCH 39/64] photo address

---
 windows/deployment/do/mcc-isp-support.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index 2c19b5a82f..9821249267 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -46,7 +46,7 @@ Did you previously had access to your cache nodes but it's now no longer accessi
 If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
  
 You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below:
-:::image type="content" source="./images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="./images/mcc-isp-diagnose-solve.png":::
+:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png":::
 
 Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.
 

From 5a1803e73bf23c478adcafbddf684f74d2dd441b Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Thu, 30 Mar 2023 16:15:40 -0700
Subject: [PATCH 40/64] Update event-id-explanations.md

---
 .../event-id-explanations.md                     | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
index 7b259c98da..ea059768e5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
@@ -65,7 +65,7 @@ These events are found in the **AppLocker – MSI and Script** event log.
 
 ## WDAC policy activation events
 
-These events are found in the **CodeIntegrity - Operational** event log, unless otherwise noted.
+These events are found in the **CodeIntegrity - Operational** event log.
 
 | Event ID | Explanation |
 |--------|-----------|
@@ -78,28 +78,26 @@ These events are found in the **CodeIntegrity - Operational** event log, unless
 | 3102 | Application Control policy refresh finished for *N* policies. |
 | 3103 | The system is ignoring the Application Control policy refresh. For example, an inbox Windows policy that doesn't meet the conditions for activation. |
 | 3105 | The system is attempting to refresh the Application Control policy with the specified ID. |
-| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL aren't related to WDAC. |
 
 ## Diagnostic events for Intelligent Security Graph (ISG) and Managed Installer (MI)
 
 > [!NOTE]
 > When Managed Installer is enabled, customers using LogAnalytics should be aware that Managed Installer may fire many 3091 events.  Customers may need to filter out these events to avoid high LogAnalytics costs.
 
-### WDAC diagnostic events 3090, 3091, and 3092
+The following events provide helpful diagnostic information when a WDAC policy includes the ISG or MI option. These events can help you debug why something was allowed/denied based on managed installer or ISG. Events 3090, 3091, and 3092 don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077.
 
-Events 3090, 3091 and 3092 provide helpful diagnostic information when a WDAC policy includes the ISG or MI option. These events can help you debug why something was allowed/denied based on managed installer or ISG. These events don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077.
-
-These events are found in the **CodeIntegrity - Operational** event log.
+These events are found in the **CodeIntegrity - Operational** event log, unless otherwise noted.
 
 | Event ID | Explanation |
 |--------|---------|
 | 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. |
 | 3091 | This event indicates that a file didn't have ISG or managed installer authorization and the Application Control policy is in audit mode. |
 | 3092 | This event is the enforcement mode equivalent of 3091. |
+| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL aren't related to WDAC. |
 
-The above events are reported per active policy on the system, so you may see multiple events for the same file.
+Events 3090, 3091, and 3092 are reported per active policy on the system, so you may see multiple events for the same file.
 
-#### ISG and MI diagnostic event details
+### ISG and MI diagnostic event details
 
 The following information is found in the details for 3090, 3091, and 3092 events.
 
@@ -114,7 +112,7 @@ These events are found in either the **CodeIntegrity - Operational** event log o
 | AuditEnabled | True if the Application Control policy is in audit mode, otherwise it is in enforce mode |
 | PolicyName | The name of the Application Control policy to which the event applies |
 
-#### Enabling ISG and MI diagnostic events
+### Enabling ISG and MI diagnostic events
 
 To enable 3090 allow events, create a TestFlags regkey with a value of 0x300 as shown in the following PowerShell command. Then restart your computer.
 

From 05dc54a00b4993de5a0cc5e9129519a8348c9873 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Thu, 30 Mar 2023 16:19:26 -0700
Subject: [PATCH 41/64] Update event-id-explanations.md

---
 .../event-id-explanations.md                                  | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
index ea059768e5..5151709c18 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
@@ -86,7 +86,7 @@ These events are found in the **CodeIntegrity - Operational** event log.
 
 The following events provide helpful diagnostic information when a WDAC policy includes the ISG or MI option. These events can help you debug why something was allowed/denied based on managed installer or ISG. Events 3090, 3091, and 3092 don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077.
 
-These events are found in the **CodeIntegrity - Operational** event log, unless otherwise noted.
+Unless otherwise noted, these events are found in either the **CodeIntegrity - Operational** event log or the **CodeIntegrity - Verbose** event log depending on your version of Windows.
 
 | Event ID | Explanation |
 |--------|---------|
@@ -101,8 +101,6 @@ Events 3090, 3091, and 3092 are reported per active policy on the system, so you
 
 The following information is found in the details for 3090, 3091, and 3092 events.
 
-These events are found in either the **CodeIntegrity - Operational** event log or the **CodeIntegrity - Verbose** event log, depending on your version of Windows.
-
 | Name | Explanation |
 |------|------|
 | ManagedInstallerEnabled | Indicates whether the specified policy enables managed installer trust |

From c58754b5220cf7adaa84d60d8200919a96242406 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Thu, 30 Mar 2023 16:22:09 -0700
Subject: [PATCH 42/64] Update event-id-explanations.md

---
 .../event-id-explanations.md                                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
index 5151709c18..e82c78d118 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
@@ -34,7 +34,7 @@ WDAC events are generated under two locations in the Windows Event Viewer:
 Most app and script failures that occur when WDAC is active can be diagnosed using these two event logs. This article describes in greater detail the events that exist in these logs. To understand the meaning of different data elements, or tags, found in the details of these events, see [Understanding Application Control event tags](event-tag-explanations.md).
 
 > [!NOTE]
-> These event IDs are not included on Windows Server Core edition.
+> **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script** events are not included on Windows Server Core edition.
 
 ## WDAC block events for executables, dlls, and drivers
 

From 5daf84c54d223d507949dc6ac19d3d73fc9cbf5c Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Thu, 30 Mar 2023 16:29:04 -0700
Subject: [PATCH 43/64] Fixed issues

---
 .../event-id-explanations.md                                    | 2 +-
 .../operations/wdac-debugging-and-troubleshooting.md            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
index e82c78d118..1b123b517a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md
@@ -43,7 +43,7 @@ These events are found in the **CodeIntegrity - Operational** event log.
 | Event ID | Explanation |
 |--------|-----------|
 | 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required. <br><br> This event is also seen for kernel- or user-mode code that the developer opted-in to [/INTEGRITYCHECK](/cpp/build/reference/integritycheck-require-signature-check) but isn't signed correctly. |
-| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where WDAC blocks files due to an expired signature. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a rule (for example, hash) that doesn't rely on the revoked or expired cert. <br><br> This event also occurs if code compiled with [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard) tries to load other code that doesn't meet the CIG requirements. |
+| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where WDAC blocks files due to an expired signature. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a rule (for example, hash) that doesn't rely on the revoked or expired cert. <br><br> This event also occurs if code compiled with [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference#code-integrity-guard) tries to load other code that doesn't meet the CIG requirements. |
 | 3034 | This event isn't common. It's the audit mode equivalent of event 3033. |
 | 3076 | This event is the main Application Control block event for audit mode policies. It indicates that the file would have been blocked if the policy was enforced. |
 | 3077 | This event is the main Application Control block event for enforced policies. It indicates that the file didn't pass your policy and was blocked. |
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index 42d02bf001..ecf51b29ac 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -20,7 +20,7 @@ ms.technology: itpro-security
 - Windows Server 2016 and above
 
 > [!NOTE]
-> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
+> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
 
 This article describes how to debug and troubleshoot app and script failures when using Windows Defender Application Control (WDAC).
 

From 6ae0e1db3ba080c375ee34904ec48d05f4b0c141 Mon Sep 17 00:00:00 2001
From: Amy Zhou <amyzhou@microsoft.com>
Date: Thu, 30 Mar 2023 20:25:11 -0700
Subject: [PATCH 44/64] removed lightbox

---
 windows/deployment/do/mcc-isp-support.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index 9821249267..7e13c62584 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -46,11 +46,11 @@ Did you previously had access to your cache nodes but it's now no longer accessi
 If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
  
 You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below:
-:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png":::
+:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal.":::
 
 Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.
 
-:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png":::
+:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache.":::
 
 ## Steps to obtain an Azure subscription ID
 To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. 

From f90c3972d016988bebaf9548ae19d5c5d57d2fa0 Mon Sep 17 00:00:00 2001
From: Amy Zhou <amyzhou@microsoft.com>
Date: Thu, 30 Mar 2023 20:40:52 -0700
Subject: [PATCH 45/64] removed double quotes!

---
 windows/deployment/do/mcc-isp-support.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index 7e13c62584..8a532f9d32 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -46,11 +46,11 @@ Did you previously had access to your cache nodes but it's now no longer accessi
 If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
  
 You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below:
-:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal.":::
+:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png":::
 
 Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.
 
-:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select "Troubleshoot" to continue troubleshooting common issues related to the installation of Microsoft Connected Cache.":::
+:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png":::
 
 ## Steps to obtain an Azure subscription ID
 To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. 

From 09f6a363b38222b051c7f038590b147a1d4919d2 Mon Sep 17 00:00:00 2001
From: Amy Zhou <amyzhou@microsoft.com>
Date: Thu, 30 Mar 2023 21:08:39 -0700
Subject: [PATCH 46/64] fixed spacing

---
 windows/deployment/do/mcc-isp-support.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index 8a532f9d32..f8a3a71e1c 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -46,6 +46,7 @@ Did you previously had access to your cache nodes but it's now no longer accessi
 If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
  
 You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below:
+
 :::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png":::
 
 Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.

From 7070f823489092363946fdb7a93990e6b6c6588a Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 31 Mar 2023 08:07:40 -0400
Subject: [PATCH 47/64] updates

---
 windows/security/docfx.json                   |  32 +++-
 .../access-control/access-control.md          |  11 +-
 .../access-control/local-accounts.md          |  12 +-
 .../identity-protection/configure-s-mime.md   |  25 +--
 .../additional-mitigations.md                 |   5 +-
 .../credential-guard-considerations.md        |   5 +-
 .../credential-guard-how-it-works.md          |   5 +-
 .../credential-guard-known-issues.md          |   5 +-
 .../credential-guard-manage.md                |   3 -
 .../credential-guard-protection-limits.md     |   3 -
 .../credential-guard-requirements.md          |   3 -
 .../credential-guard/credential-guard.md      |   3 -
 .../enterprise-certificate-pinning.md         |  31 ++--
 .../hello-aad-join-cloud-only-deploy.md       |   2 -
 .../hello-adequate-domain-controllers.md      |   7 +-
 .../hello-and-password-changes.md             |   2 -
 .../hello-biometrics-in-enterprise.md         |   2 -
 .../hello-cert-trust-adfs.md                  |   7 +-
 .../hello-cert-trust-policy-settings.md       |  11 +-
 .../hello-cert-trust-validate-ad-prereq.md    |   7 +-
 .../hello-cert-trust-validate-deploy-mfa.md   |   7 +-
 .../hello-cert-trust-validate-pki.md          |   7 +-
 .../hello-deployment-cert-trust.md            |   7 +-
 .../hello-deployment-guide.md                 |   2 -
 .../hello-deployment-issues.md                |   2 -
 .../hello-deployment-key-trust.md             |   6 -
 .../hello-deployment-rdp-certs.md             |   2 -
 .../hello-errors-during-pin-creation.md       |   8 +-
 .../hello-for-business/hello-faq.yml          |   2 -
 .../hello-feature-dual-enrollment.md          |   2 -
 .../hello-feature-dynamic-lock.md             |   2 -
 .../hello-feature-pin-reset.md                |   2 -
 .../hello-feature-remote-desktop.md           |   2 -
 .../hello-how-it-works-authentication.md      |   2 -
 .../hello-how-it-works-provisioning.md        |   2 -
 .../hello-how-it-works-technology.md          |   2 -
 .../hello-for-business/hello-how-it-works.md  |   2 -
 .../hello-hybrid-aadj-sso-cert.md             |   2 -
 .../hello-hybrid-aadj-sso.md                  |   2 -
 .../hello-hybrid-cert-trust-validate-pki.md   |   7 +-
 .../hello-hybrid-cert-trust.md                |   7 +-
 .../hello-hybrid-cert-whfb-provision.md       |   2 -
 .../hello-hybrid-cert-whfb-settings-adfs.md   |   7 +-
 .../hello-hybrid-key-trust-provision.md       |   2 -
 .../hello-hybrid-key-trust-validate-pki.md    |   7 +-
 .../hello-hybrid-key-trust.md                 |   7 +-
 .../hello-identity-verification.md            |  15 +-
 .../hello-key-trust-adfs.md                   |   9 +-
 .../hello-key-trust-policy-settings.md        |   9 +-
 .../hello-key-trust-validate-ad-prereq.md     |   7 +-
 .../hello-key-trust-validate-deploy-mfa.md    |   7 +-
 .../hello-key-trust-validate-pki.md           |   7 +-
 .../hello-manage-in-organization.md           |   2 -
 .../hello-for-business/hello-overview.md      |   2 -
 .../hello-planning-guide.md                   |   2 -
 .../hello-prepare-people-to-use.md            |   2 -
 .../hello-for-business/hello-videos.md        |   2 -
 .../hello-why-pin-is-better-than-password.md  |   2 -
 .../hello-for-business/index.yml              |   5 -
 .../passwordless-strategy.md                  |   2 -
 .../hello-for-business/webauthn-apis.md       |   2 -
 windows/security/identity-protection/index.md |  11 +-
 .../password-support-policy.md                |  11 +-
 .../remote-credential-guard.md                |  17 +-
 .../smart-card-and-remote-desktop-services.md |  16 +-
 .../smart-cards/smart-card-architecture.md    |  14 +-
 ...rt-card-certificate-propagation-service.md |  12 --
 ...ertificate-requirements-and-enumeration.md |  14 +-
 .../smart-card-debugging-information.md       |  12 --
 .../smart-cards/smart-card-events.md          |  12 --
 ...card-group-policy-and-registry-settings.md |  22 +--
 ...how-smart-card-sign-in-works-in-windows.md |  12 --
 .../smart-card-removal-policy-service.md      |  12 --
 ...rt-card-smart-cards-for-windows-service.md |  12 --
 .../smart-card-tools-and-settings.md          |  12 --
 ...-windows-smart-card-technical-reference.md |   4 -
 .../how-user-account-control-works.md         |   4 -
 ...-group-policy-and-registry-key-settings.md |   3 -
 .../user-account-control-overview.md          |   3 -
 ...ccount-control-security-policy-settings.md |   3 -
 ...l-smart-card-deploy-virtual-smart-cards.md |   3 -
 .../virtual-smart-card-evaluate-security.md   |   3 -
 .../virtual-smart-card-get-started.md         |   3 -
 .../virtual-smart-card-overview.md            |   3 -
 .../virtual-smart-card-tpmvscmgr.md           |   3 -
 ...smart-card-understanding-and-evaluating.md |   3 -
 ...tual-smart-card-use-virtual-smart-cards.md |   3 -
 ...man-protocol-over-ikev2-vpn-connections.md |  14 +-
 ...n-on-sso-over-vpn-and-wi-fi-connections.md |  11 +-
 .../vpn/vpn-authentication.md                 |  10 --
 .../vpn/vpn-auto-trigger-profile.md           |  14 +-
 .../vpn/vpn-conditional-access.md             |  20 +--
 .../vpn/vpn-connection-type.md                |  12 +-
 .../identity-protection/vpn/vpn-guide.md      |  10 --
 .../vpn/vpn-name-resolution.md                |  12 +-
 .../vpn/vpn-office-365-optimization.md        |  14 +-
 .../vpn/vpn-profile-options.md                | 148 ++++++++----------
 .../identity-protection/vpn/vpn-routing.md    |  16 +-
 .../vpn/vpn-security-features.md              |  10 --
 ...dential-theft-mitigation-guide-abstract.md |  15 +-
 100 files changed, 272 insertions(+), 619 deletions(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index a4d2ab7dcb..dc952e8060 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -80,13 +80,43 @@
         "identity-protection/**/*.md": [
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>"
+        ],
+        "identity-protection/credential-guard/**/*.md": [
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
+        ],
+        "identity-protection/smart-cards/**/*.md": [
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
+        ],
+        "identity-protection/user-account-control/**/*.md": [
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
+        ],
+        "identity-protection/virtual-smart-cards/**/*.md": [
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
         ]
       },
+      },
       "ms.reviewer":{
         "identity-protection/hello-for-business/*.md": "erikdau",
         "identity-protection/credential-guard/*.md": "zwhittington",
         "identity-protection/access-control/*.md": "sulahiri",
-        "threat-protection/windows-firewall/*.md": "paoloma"
+        "threat-protection/windows-firewall/*.md": "paoloma",
+        "identity-protection/vpn/*.md": "pesmith"
       },
       "ms.collection":{
         "identity-protection/hello-for-business/*.md": "tier1",
diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md
index 4ddce5cb4e..6bec9ee14c 100644
--- a/windows/security/identity-protection/access-control/access-control.md
+++ b/windows/security/identity-protection/access-control/access-control.md
@@ -1,13 +1,14 @@
 ---
+ms.date: 11/22/2022
 title: Access Control Overview
 description: Description of the access controls in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer.
-ms.prod: windows-client
 ms.topic: article
-ms.date: 11/22/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
-ms.technology: itpro-security
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ---
 
 # Access Control Overview
diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md
index f6baab162b..35a5ec849f 100644
--- a/windows/security/identity-protection/access-control/local-accounts.md
+++ b/windows/security/identity-protection/access-control/local-accounts.md
@@ -1,15 +1,17 @@
 ---
+ms.date: 12/05/2022
 title: Local Accounts
 description: Learn how to secure and manage access to the resources on a standalone or member server for services or users.
-ms.date: 12/05/2022
+ms.topic: conceptual
 ms.collection: 
   - highpri
   - tier2
-ms.topic: article
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
-ms.technology: itpro-security
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ---
 
 # Local Accounts
diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md
index e7d4d83f53..317ef89a50 100644
--- a/windows/security/identity-protection/configure-s-mime.md
+++ b/windows/security/identity-protection/configure-s-mime.md
@@ -1,26 +1,13 @@
 ---
 title: Configure S/MIME for Windows
 description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, also known as a certificate, can read them.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 07/27/2017
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ---
 
 
 # Configure S/MIME for Windows
 
-**Applies to**
-- Windows 10
-- Windows 11
-
 S/MIME stands for Secure/Multipurpose Internet Mail Extensions, and provides an added layer of security for email sent to and from an Exchange ActiveSync (EAS) account. S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with.
 
 ## About message encryption
@@ -31,11 +18,11 @@ Encrypted messages can be read only by recipients who have a certificate. If you
 
 ## About digital signatures
 
-A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they’re using an email client that supports S/MIME.
+A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they're using an email client that supports S/MIME.
 
 ## Prerequisites
 
--   [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can’t use S/MIME signing and encryption with a personal account such as Outlook.com.
+-   [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can't use S/MIME signing and encryption with a personal account such as Outlook.com.
 -   Valid Personal Information Exchange (PFX) certificates are installed on the device.
 
     -   [How to Create PFX Certificate Profiles in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/mt131410(v=technet.10))
@@ -49,11 +36,11 @@ On the device, perform the following steps: (add select certificate)
 
 2.  Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone.
 
-	:::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png":::
+    :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png":::
 
 3.  Tap **Email security**.
 
-	:::image type="content" alt-text="email security settings." source="images/emailsecurity.png":::
+    :::image type="content" alt-text="email security settings." source="images/emailsecurity.png":::
 
 4.  In **Select an account**, select the account for which you want to configure S/MIME options.
 
@@ -74,7 +61,7 @@ On the device, perform the following steps: (add select certificate)
 
 2.  Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message.
 
-	:::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png":::
+    :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png":::
 
 ## Read signed or encrypted messages
 
@@ -90,5 +77,5 @@ When you receive a signed email, the app provides a feature to install correspon
 
 3.  Tap **Install.**
 
-	:::image type="content" alt-text="message security information." source="images/installcert.png":::
+    :::image type="content" alt-text="message security information." source="images/installcert.png":::
  
diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md
index c8ed1adc92..ca9c7acd52 100644
--- a/windows/security/identity-protection/credential-guard/additional-mitigations.md
+++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md
@@ -1,11 +1,8 @@
 ---
+ms.date: 08/17/2017
 title: Additional mitigations
 description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard.
-ms.date: 08/17/2017
 ms.topic: article
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Additional mitigations
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
index bde6066c0c..d48686101c 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
@@ -1,11 +1,8 @@
 ---
+ms.date: 01/06/2023
 title: Considerations when using Windows Defender Credential Guard
 description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard.
-ms.date: 01/06/2023
 ms.topic: article
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Considerations when using Windows Defender Credential Guard
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md
index c9ed9e42c7..f6fafc39c0 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md
@@ -1,11 +1,8 @@
 ---
+ms.date: 08/17/2017
 title: How Windows Defender Credential Guard works
 description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them.
-ms.date: 08/17/2017
 ms.topic: conceptual
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # How Windows Defender Credential Guard works
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
index 07d9647887..f05c26620f 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
@@ -1,11 +1,8 @@
 ---
+ms.date: 11/28/2022
 title: Windows Defender Credential Guard - Known issues
 description: Windows Defender Credential Guard - Known issues in Windows Enterprise
 ms.topic: article
-ms.date: 11/28/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 # Windows Defender Credential Guard: Known issues
 
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md
index a4f523f78b..eb38ab1250 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md
@@ -6,9 +6,6 @@ ms.collection:
   - highpri
   - tier2
 ms.topic: article
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Manage Windows Defender Credential Guard
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md
index 42fbe2a663..6b9dbeadc9 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md
@@ -3,9 +3,6 @@ title: Windows Defender Credential Guard protection limits (Windows)
 description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows. Learn more with this guide.
 ms.date: 08/17/2017
 ms.topic: article
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 # Windows Defender Credential Guard protection limits
 
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
index 164f0f776e..ea7bf02bae 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
@@ -3,9 +3,6 @@ title: Windows Defender Credential Guard requirements
 description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security.
 ms.date: 12/27/2021
 ms.topic: article
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Windows Defender Credential Guard requirements
diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md
index 0ab05c22ab..af00a1aef1 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard.md
@@ -6,9 +6,6 @@ ms.topic: article
 ms.collection: 
   - highpri
   - tier2
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Protect derived domain credentials with Windows Defender Credential Guard
diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md
index 6b2de2aa60..d4f8cceb8d 100644
--- a/windows/security/identity-protection/enterprise-certificate-pinning.md
+++ b/windows/security/identity-protection/enterprise-certificate-pinning.md
@@ -1,17 +1,8 @@
 ---
 title: Enterprise Certificate Pinning
 description: Enterprise certificate pinning is a Windows feature for remembering; or pinning a root issuing certificate authority, or end entity certificate to a given domain name.
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
-ms.topic: article
-ms.prod: windows-client
-ms.technology: itpro-security
-ms.localizationpriority: medium
+ms.topic: conceptual
 ms.date: 07/27/2017
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
 ---
 
 # Enterprise Certificate Pinning
@@ -22,7 +13,7 @@ Enterprise certificate pinning helps reduce man-in-the-middle attacks by enablin
 > [!NOTE]
 > External domain names, where the certificate issued to these domains is issued by a public certificate authority, are not ideal for enterprise certificate pinning.
 
-Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site’s chain that authenticates servers matches a restricted set of certificates. 
+Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site's chain that authenticates servers matches a restricted set of certificates. 
 These restrictions are encapsulated in a Pin Rules Certificate Trust List (CTL) that is configured and deployed to Windows 10 computers. 
 Any site certificate that triggers a name mismatch causes Windows to write an event to the CAPI2 event log and prevents the user from navigating to the web site using Microsoft Edge or Internet Explorer.
 
@@ -97,7 +88,7 @@ The **Certificate** element can have the following attributes.
 | **File**  | Path to a file containing one or more certificates.  Where the certificate(s) can be encoded as: <br>- single certificate <br>- p7b <br>- sst <br> These files can also be Base64 formatted.  All **Site** elements included in the same **PinRule** element can match any of these certificates. | Yes (File, Directory, or Base64 must be present). |
 | **Directory** | Path to a directory containing one or more of the above certificate files. Skips any files not containing any certificates. | Yes (File, Directory, or Base64 must be present). | 
 | **Base64** | Base64 encoded certificate(s). Where the certificate(s) can be encoded as: <br>- single certificate <br>- p7b <br> - sst <br> This allows the certificates to be included in the XML file without a file directory dependency. <br> Note: <br> You can use **certutil -encode** to convert a .cer file into base64. You can then use Notepad to copy and paste the base64 encoded certificate into the pin rule.  | Yes (File, Directory, or Base64 must be present). |
-| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule. <br>If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element’s certificates.<br> If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL.<br> For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.|
+| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule. <br>If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element's certificates.<br> If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL.<br> For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.|
 
 #### Site element
 
@@ -154,7 +145,7 @@ Use **certutil.exe** to apply your certificate pinning rules to your reference c
 The **setreg** argument takes a secondary argument that determines the location of where certutil writes the certificate pining rules. 
 This secondary argument is **chain\PinRules**. 
 The last argument you provide is the name of file that contains your certificate pinning rules in certificate trust list format (.stl). 
-You’ll pass the name of the file as the last argument; however, you need to prefix the file name with the '@' symbol as shown in the following example. 
+You'll pass the name of the file as the last argument; however, you need to prefix the file name with the '@' symbol as shown in the following example. 
 You need to perform this command from an elevated command prompt.
 
 ```code
@@ -174,7 +165,7 @@ Certutil writes the binary information to the following registration location:
 
 ### Deploying Enterprise Pin Rule Settings using Group Policy
 
-You’ve successfully created a certificate pinning rules XML file. 
+You've successfully created a certificate pinning rules XML file. 
 From the XML file you've created a certificate pinning trust list file, and you've applied the contents of that file to your reference computer from which you can run the Group Policy Management Console. 
 Now you need to configure a Group Policy object to include the applied certificate pin rule settings and deploy it to your environment.
 
@@ -182,7 +173,7 @@ Sign-in to the reference computer using domain administrator equivalent credenti
 
 1.  Start the **Group Policy Management Console** (gpmc.msc)
 2.  In the navigation pane, expand the forest node and then expand the domain node.
-3.  Expand the node that contains your Active Directory’s domain name
+3.  Expand the node that contains your Active Directory's domain name
 4.  Select the **Group Policy objects** node.  Right-click the **Group Policy objects** node and click **New**.
 5.  In the **New GPO** dialog box, type _Enterprise Certificate Pinning Rules_ in the **Name** text box and click **OK**.
 6.  In the content pane, right-click the **Enterprise Certificate Pinning Rules** Group Policy object and click **Edit**.
@@ -227,16 +218,16 @@ icacls %PinRulesLogDir% /grant *S-1-5-12:(OI)(CI)(F)
 icacls %PinRulesLogDir% /inheritance:e /setintegritylevel (OI)(CI)L
 ```
 
-Whenever an application verifies a TLS/SSL certificate chain that contains a server name matching a DNS name in the server certificate, Windows writes a .p7b file consisting of all the certificates in the server’s chain to one of three child folders:
+Whenever an application verifies a TLS/SSL certificate chain that contains a server name matching a DNS name in the server certificate, Windows writes a .p7b file consisting of all the certificates in the server's chain to one of three child folders:
 
 - AdminPinRules
     Matched a site in the enterprise certificate pinning rules.
 - AutoUpdatePinRules
     Matched a site in the certificate pinning rules managed by Microsoft.
 - NoPinRules
-    Didn’t match any site in the certificate pin rules.
+    Didn't match any site in the certificate pin rules.
 
-The output file name consists of the leading eight ASCII hex digits of the root’s SHA1 thumbprint followed by the server name. 
+The output file name consists of the leading eight ASCII hex digits of the root's SHA1 thumbprint followed by the server name. 
 For example:
 
 - `D4DE20D0_xsi.outlook.com.p7b`
@@ -255,7 +246,7 @@ You can then copy and paste the output of the cmdlet into the XML file.
 ![Representing a date.](images/enterprise-certificate-pinning-representing-a-date.png)
 
 For simplicity, you can truncate decimal point (.) and the numbers after it. 
-However, be certain to append the uppercase “Z” to the end of the XML date string.
+However, be certain to append the uppercase "Z" to the end of the XML date string.
 
 ```code
 2015-05-11T07:00:00.2655691Z
@@ -264,7 +255,7 @@ However, be certain to append the uppercase “Z” to the end of the XML date s
 
 ## Converting an XML Date
 
-You can also use Windows PowerShell to validate and convert an XML date into a human readable date to validate it’s the correct date.
+You can also use Windows PowerShell to validate and convert an XML date into a human readable date to validate it's the correct date.
 
 ![Converting an XML date.](images/enterprise-certificate-pinning-converting-an-xml-date.png)
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
index fa405ca079..8838fb1b97 100644
--- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
+++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
@@ -2,8 +2,6 @@
 title: Windows Hello for Business cloud-only deployment
 description: Learn how to configure Windows Hello for Business in a cloud-only deployment scenario.
 ms.date: 06/23/2021
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Cloud-only deployment
diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
index 6607d17abb..f825873fc9 100644
--- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
+++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
@@ -3,8 +3,11 @@ title: Plan an adequate number of Domain Controllers for Windows Hello for Busin
 description: Learn how to plan for an adequate number of Domain Controllers to support Windows Hello for Business deployments.
 ms.date: 03/10/2023
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: conceptual
 ---
 # Plan an adequate number of Domain Controllers for Windows Hello for Business deployments
diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md
index 5d311af3bb..2b3a033a16 100644
--- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md
+++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md
@@ -2,8 +2,6 @@
 title: Windows Hello and password changes
 description: Learn the impact of changing a password when using Windows Hello.
 ms.date: 03/15/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: conceptual
 ---
 # Windows Hello and password changes
diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md
index e6a01bb2b8..f1a275279e 100644
--- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md
+++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md
@@ -2,8 +2,6 @@
 title: Windows Hello biometrics in the enterprise (Windows)
 description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition.
 ms.date: 01/12/2021
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md
index c765eb789e..744816323d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md
@@ -3,8 +3,11 @@ title: Prepare and deploy Active Directory Federation Services in an on-premises
 description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business on-premises certificate trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Prepare and deploy Active Directory Federation Services - on-premises certificate trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
index 5d92d9dcb7..2655617fd3 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
@@ -2,12 +2,15 @@
 title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust
 description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario
 ms.collection: 
-  - highpri
-  - tier1
+- highpri
+- tier1
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure Windows Hello for Business group policy settings - on-premises certificate Trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md
index 629e59b1e2..455d4055a2 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md
@@ -3,8 +3,11 @@ title: Validate Active Directory prerequisites in an on-premises certificate tru
 description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a certificate trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Validate Active Directory prerequisites - on-premises certificate trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md
index c7c5b09a61..c7b67abec3 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md
@@ -3,8 +3,11 @@ title: Validate and Deploy MFA for Windows Hello for Business with certificate t
 description: Validate and deploy multi-factor authentication (MFA) for Windows Hello for Business in an on-premises certificate trust model.
 ms.date: 12/13/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md
index 27f2375bae..6174ed348a 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md
@@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an on-premises ce
 description: Configure and validate the Public Key Infrastructure the Public Key Infrastructure when deploying Windows Hello for Business in a certificate trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure and validate the Public Key Infrastructure - on-premises certificate trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md
index 0775ea4e9d..70a5ee4feb 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md
@@ -3,8 +3,11 @@ title: Windows Hello for Business deployment guide for the on-premises certifica
 description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Deployment guide overview - on-premises certificate trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md
index 22f170e86e..9646f16b66 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md
@@ -2,8 +2,6 @@
 title: Windows Hello for Business Deployment Overview
 description: Use this deployment guide to successfully deploy Windows Hello for Business in an existing environment.
 ms.date: 02/15/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Windows Hello for Business Deployment Overview
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
index 8c8fd3b65d..655c8961da 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md
@@ -2,8 +2,6 @@
 title: Windows Hello for Business Deployment Known Issues
 description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues
 ms.date: 05/03/2021
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Windows Hello for Business Known Deployment Issues
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md
index 193fb414f2..56d613052d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md
@@ -2,12 +2,6 @@
 title: Windows Hello for Business deployment guide for the on-premises key trust model
 description: Learn how to deploy Windows Hello for Business in an on-premises, key trust model.
 ms.date: 12/12/2022
-appliesto:  
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a> 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Deployment guide overview - on-premises key trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md
index 7d4f20063d..0b255e1d93 100644
--- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md
@@ -6,8 +6,6 @@ ms.collection:
   - tier1
 ms.topic: article
 ms.date: 03/15/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ---
 
 # Deploy certificates for remote desktop (RDP) sign-in
diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
index e1b28aec6f..23537daa14 100644
--- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
+++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
@@ -1,10 +1,8 @@
 ---
-title: Windows Hello errors during PIN creation (Windows)
-description: When you set up Windows Hello in Windows 10/11, you may get an error during the Create a work PIN step.
+title: Windows Hello errors during PIN creation
+description: When you set up Windows Hello, you may get an error during the Create a work PIN step.
 ms.topic: troubleshooting
-ms.date: 05/05/2018
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
+ms.date: 03/31/2023
 ---
 
 # Windows Hello errors during PIN creation
diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml
index bb59a07821..0a5083fd99 100644
--- a/windows/security/identity-protection/hello-for-business/hello-faq.yml
+++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml
@@ -9,8 +9,6 @@ metadata:
     - tier1
   ms.topic: faq
   ms.date: 03/09/2023
-  appliesto: 
-    - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 
 title: Common questions about Windows Hello for Business
 summary: Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This Frequently Asked Questions (FAQ) article is intended to help you learn more about Windows Hello for Business.
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md
index d6d35b189a..2f6540362a 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md
@@ -2,8 +2,6 @@
 title: Dual Enrollment
 description: Learn how to configure Windows Hello for Business dual enrollment. Also, learn how to configure Active Directory to support Domain Administrator enrollment.
 ms.date: 09/09/2019
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md
index 5fea59fc25..28401253c2 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md
@@ -2,8 +2,6 @@
 title: Dynamic lock
 description: Learn how to configure dynamic lock on Windows devices via group policies. This feature locks a device when a Bluetooth signal falls below a set value.
 ms.date: 03/10/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: how-to
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
index ea7e72e5d4..916a8890bf 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
@@ -5,8 +5,6 @@ ms.collection:
   - highpri
   - tier1
 ms.date: 03/10/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: how-to
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
index 2f1c460668..45fc8c784f 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
@@ -2,8 +2,6 @@
 title: Remote Desktop
 description: Learn how Windows Hello for Business supports using biometrics with remote desktop
 ms.date: 02/24/2021
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ms.collection:
   - tier1
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md
index 27dde9400e..f25bac5b47 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md
@@ -2,8 +2,6 @@
 title: How Windows Hello for Business works - Authentication
 description: Learn about the authentication flow for  Windows Hello for Business.
 ms.date: 02/15/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Windows Hello for Business and Authentication
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md
index 6d250848d5..219e82d35c 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md
@@ -2,8 +2,6 @@
 title: How Windows Hello for Business works - Provisioning
 description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments.
 ms.date: 2/15/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Windows Hello for Business Provisioning
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
index b3765851fa..76368b1c12 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
@@ -2,8 +2,6 @@
 title: How Windows Hello for Business works - technology and terms
 description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works.
 ms.date: 10/08/2018
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md
index 40e094e6c7..93bfd6d56a 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md
@@ -2,8 +2,6 @@
 title: How Windows Hello for Business works
 description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services.
 ms.date: 05/05/2018
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # How Windows Hello for Business works in Windows Devices
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md
index fbed200f77..3eeb4f536d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md
@@ -2,8 +2,6 @@
 title: Use Certificates to enable SSO for Azure AD join devices
 description: If you want to use certificates for on-premises single-sign on for Azure Active Directory-joined devices, then follow these additional steps.
 ms.date: 08/19/2018
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: how-to
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md
index d0aa2590f7..9a5646c257 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md
@@ -2,8 +2,6 @@
 title: Configure single sign-on (SSO) for Azure AD joined devices
 description: Learn how to configure single sign-on to on-premises resources for Azure AD-joined devices, using Windows Hello for Business.
 ms.date: 12/30/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Configure single sign-on for Azure AD joined devices
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md
index 788cd8af15..662e259872 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md
@@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an hybrid certifi
 description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model.
 ms.date: 01/03/2023
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure and validate the Public Key Infrastructure - hybrid certificate trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md
index 02c36f3fbe..eabb6ec24d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md
@@ -3,8 +3,11 @@ title: Windows Hello for Business hybrid certificate trust deployment
 description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario.
 ms.date: 03/16/2023
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: how-to
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md
index a1a88d6f2e..629d9c561e 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md
@@ -2,8 +2,6 @@
 title: Windows Hello for Business hybrid certificate trust clients configuration and enrollment
 description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario.
 ms.date: 01/03/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: tutorial
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md
index ca0662ddde..2a40af9e7f 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md
@@ -3,8 +3,11 @@ title: Configure Active Directory Federation Services in a hybrid certificate tr
 description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business hybrid certificate trust model.
 ms.date: 01/03/2023
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure Active Directory Federation Services - hybrid certificate trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md
index 73c27e5835..31e4fb9ee2 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md
@@ -2,8 +2,6 @@
 title: Windows Hello for Business hybrid key trust clients configuration and enrollment
 description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid key trust scenario.
 ms.date: 01/03/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: tutorial
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md
index 19c9df7d89..c4248ffb62 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md
@@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an hybrid key tru
 description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in an hybrid key trust model.
 ms.date: 01/03/2023
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure and validate the Public Key Infrastructure - hybrid key trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md
index 042fe747a8..8ab43e5406 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md
@@ -3,8 +3,11 @@ title: Windows Hello for Business hybrid key trust deployment
 description: Learn how to deploy Windows Hello for Business in a hybrid key trust scenario.
 ms.date: 12/28/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: how-to
 ---
 # Hybrid key trust deployment
diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
index 518283865d..9c4a5f6165 100644
--- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
+++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
@@ -1,14 +1,17 @@
 ---
+ms.date: 12/13/2022
 title: Windows Hello for Business Deployment Prerequisite Overview
 description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models
-ms.collection: 
+ms.topic: article
+ms.collection:
 - highpri
 - tier1
-ms.date: 12/13/2022
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
-ms.topic: article
+appliesto: 
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ---
 
 # Windows Hello for Business Deployment Prerequisite Overview
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
index b0cf1c66b8..be437d043f 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
@@ -1,10 +1,13 @@
 ---
+ms.date: 12/12/2022
 title: Prepare and deploy Active Directory Federation Services in an on-premises key trust
 description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business key trust model.
-ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Prepare and deploy Active Directory Federation Services - on-premises key trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md
index d9446b6eec..b82f904d68 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md
@@ -1,10 +1,13 @@
 ---
+ms.date: 12/12/2022
 title: Configure Windows Hello for Business Policy settings in an on-premises key trust
 description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises key trust scenario
-ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure Windows Hello for Business group policy settings - on-premises key trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
index 07673151d3..19fe709d3f 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
@@ -3,8 +3,11 @@ title: Validate Active Directory prerequisites in an on-premises key trust
 description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a key trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Validate Active Directory prerequisites - on-premises key trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md
index 65f12b5274..4d089851ff 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md
@@ -3,8 +3,11 @@ title: Validate and Deploy MFA for Windows Hello for Business with key trust
 description: Validate and deploy multi-factor authentication (MFA) for Windows Hello for Business in an on-premises key trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
index 96505087ec..e2f7510aac 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
@@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an on-premises ke
 description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a key trust model.
 ms.date: 12/12/2022
 appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure and validate the Public Key Infrastructure - on-premises key trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
index e666aa4beb..2676f0066f 100644
--- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
+++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
@@ -5,8 +5,6 @@ ms.collection:
   - highpri
   - tier1
 ms.date: 2/15/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 
diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md
index d6e6de308d..005fb6c685 100644
--- a/windows/security/identity-protection/hello-for-business/hello-overview.md
+++ b/windows/security/identity-protection/hello-for-business/hello-overview.md
@@ -5,8 +5,6 @@ ms.collection:
   - highpri
   - tier1
 ms.topic: conceptual
-appliesto: 
-  - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.date: 12/31/2017
 ---
 # Windows Hello for Business Overview
diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md
index f3e0b27534..b941c37a84 100644
--- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md
+++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md
@@ -2,8 +2,6 @@
 title: Planning a Windows Hello for Business Deployment
 description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
 ms.date: 09/16/2020
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Planning a Windows Hello for Business Deployment
diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md
index 1d36c9e14c..90bd5ec677 100644
--- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md
+++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md
@@ -2,8 +2,6 @@
 title: Prepare people to use Windows Hello (Windows)
 description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization.
 ms.date: 08/19/2018
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Prepare people to use Windows Hello
diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md
index 1afbc43168..0963b04163 100644
--- a/windows/security/identity-protection/hello-for-business/hello-videos.md
+++ b/windows/security/identity-protection/hello-for-business/hello-videos.md
@@ -2,8 +2,6 @@
 title: Windows Hello for Business Videos
 description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10 and Windows 11.
 ms.date: 03/09/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # Windows Hello for Business Videos
diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md
index 80c0b844fc..9c3cd5a067 100644
--- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md
+++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md
@@ -5,8 +5,6 @@ ms.collection:
   - highpri
   - tier1
 ms.date: 03/15/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: conceptual
 ---
 # Why a PIN is better than an online password
diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml
index 4d8789f403..e888c0e2f7 100644
--- a/windows/security/identity-protection/hello-for-business/index.yml
+++ b/windows/security/identity-protection/hello-for-business/index.yml
@@ -6,12 +6,7 @@ summary: Learn how to manage and deploy Windows Hello for Business.
 metadata:
   title: Windows Hello for Business documentation
   description: Learn how to manage and deploy Windows Hello for Business.
-  ms.prod: windows-client
-  ms.technology: itpro-security
   ms.topic: landing-page
-  author: paolomatarazzo
-  ms.author: paoloma
-  manager: aaroncz
   ms.date: 03/09/2023  
   ms.collection:
     - highpri
diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md
index 4b2daf06b4..3ad9597e77 100644
--- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md
+++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md
@@ -3,8 +3,6 @@ title: Password-less strategy
 description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10 and Windows 11.
 ms.topic: conceptual
 ms.date: 05/24/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ---
 
 # Password-less strategy
diff --git a/windows/security/identity-protection/hello-for-business/webauthn-apis.md b/windows/security/identity-protection/hello-for-business/webauthn-apis.md
index 654302f210..f2aa96a5ea 100644
--- a/windows/security/identity-protection/hello-for-business/webauthn-apis.md
+++ b/windows/security/identity-protection/hello-for-business/webauthn-apis.md
@@ -2,8 +2,6 @@
 title: WebAuthn APIs
 description: Learn how to use WebAuthn APIs to enable passwordless authentication for your sites and apps.
 ms.date: 03/09/2023
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
 ms.topic: article
 ---
 # WebAuthn APIs for passwordless authentication on Windows
diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md
index dc71f52903..c16e630bed 100644
--- a/windows/security/identity-protection/index.md
+++ b/windows/security/identity-protection/index.md
@@ -1,17 +1,8 @@
 ---
-title: Identity and access management (Windows 10)
+title: Identity and access management
 description: Learn more about identity and access protection technologies in Windows.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 02/05/2018
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ---
 
 # Identity and access management
diff --git a/windows/security/identity-protection/password-support-policy.md b/windows/security/identity-protection/password-support-policy.md
index fe76412c23..46e3507908 100644
--- a/windows/security/identity-protection/password-support-policy.md
+++ b/windows/security/identity-protection/password-support-policy.md
@@ -1,22 +1,13 @@
 ---
 title: Technical support policy for lost or forgotten passwords
 description: Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so.
-ms.custom: 
-  - CI ID 110060
-  - CSSTroubleshoot
-ms.prod: windows-client
 ms.topic: article
-ms.localizationpriority: medium
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
 ms.date: 11/20/2019
-ms.technology: itpro-security
 ---
 
 # Technical support policy for lost or forgotten passwords
 
-Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. If these options don’t work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password.
+Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. If these options don't work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password.
 
 If you lose or forget a password, you can use the links in this article to find published support information that will help you reset the password.
 
diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md
index 63c2e03d67..64e9869d2a 100644
--- a/windows/security/identity-protection/remote-credential-guard.md
+++ b/windows/security/identity-protection/remote-credential-guard.md
@@ -1,20 +1,17 @@
 ---
 title: Protect Remote Desktop credentials with Windows Defender Remote Credential Guard (Windows 10)
 description: Windows Defender Remote Credential Guard helps to secure your Remote Desktop credentials by never sending them to the target device.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
 ms.collection: 
-  - highpri
-  - tier2
+- highpri
+- tier2
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 01/12/2018
 appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows Server 2016</b>
-ms.technology: itpro-security
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ---
 # Protect Remote Desktop credentials with Windows Defender Remote Credential Guard
 
diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
index 7c25e23d15..b736e1c5a4 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
@@ -1,21 +1,9 @@
 ---
+ms.date: 09/24/2021
 title: Smart Card and Remote Desktop Services (Windows)
 description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
-ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
+ms.reviewer: ardenw
 ---
 # Smart Card and Remote Desktop Services
 
diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md
index 0b300b959d..2359e2a96b 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md
@@ -1,21 +1,9 @@
 ---
 title: Smart Card Architecture (Windows)
 description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Card Architecture
@@ -94,7 +82,7 @@ Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Ca
 
 ### Caching with Base CSP and smart card KSP
 
-Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user’s access to a PIN.
+Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user's access to a PIN.
 
 -   [Data caching](#data-caching): The data cache provides for a single process to minimize smart card I/O operations.
 
diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md
index ad23803395..bbdab0c142 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md
@@ -1,21 +1,9 @@
 ---
 title: Certificate Propagation Service (Windows)
 description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 08/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Certificate Propagation Service
diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
index 4d2926242d..ba41b7a493 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
@@ -1,21 +1,9 @@
 ---
 title: Certificate Requirements and Enumeration (Windows)
 description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Certificate Requirements and Enumeration
@@ -131,7 +119,7 @@ Following are the steps that are performed during a smart card sign-in:
 
 12. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store.
 
-13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT’s authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member.
+13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member.
 
 14. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response.
 
diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
index 10b6bda518..72b31805ae 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
@@ -1,24 +1,12 @@
 ---
 title: Smart Card Troubleshooting (Windows)
 description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.collection: 
   - highpri
   - tier2
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Card Troubleshooting
diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md
index ed07b57089..50e701debe 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-events.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-events.md
@@ -1,21 +1,9 @@
 ---
 title: Smart Card Events (Windows)
 description: This topic for the IT professional and smart card developer describes events that are related to smart card deployment and development.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Card Events
diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md
index 26f06f48c2..78fe0f4b8a 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md
@@ -1,21 +1,9 @@
 ---
 title: Smart Card Group Policy and Registry Settings (Windows)
 description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 11/02/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Card Group Policy and Registry Settings
@@ -222,7 +210,7 @@ You can use this policy setting to change the default message that a user sees i
 
 When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. 
 
-When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system’s default message when the smart card is blocked.
+When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system's default message when the smart card is blocked.
 
 | **Item**          | **Description**             |
 |--------------------------------------|-------------------------|
@@ -236,7 +224,7 @@ When this policy setting isn't turned on (and the integrated unblock feature is
 You can use this policy setting to configure which valid sign-in certificates are displayed. 
 
 > [!NOTE]
-> During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet.
+> During the certificate renewal period, a user's smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet.
 > 
 > If two certificates are issued from the same template with the same major version and they are for the same user (this is determined by their UPN), they are determined to be the same.  
 
@@ -288,7 +276,7 @@ When this setting isn't turned on, the user doesn't see a smart card device driv
 You can use this policy setting to prevent Credential Manager from returning plaintext PINs. 
 
 > [!NOTE]
-> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. 
+> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user's profile. 
 
 When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. 
 
@@ -310,7 +298,7 @@ You can use this policy setting to control the way the subject name appears duri
 
 When this policy setting is turned on, the subject name during sign-in appears reversed from the way that it's stored in the certificate.
 
-When this policy setting isn’t turned on, the subject name appears the same as it’s stored in the certificate.
+When this policy setting isn't turned on, the subject name appears the same as it's stored in the certificate.
 
 
 | **Item**          | **Description**                 |
@@ -346,7 +334,7 @@ You can use this policy setting to manage the root certificate propagation that
 
 When this policy setting is turned on, root certificate propagation occurs when the user inserts the smart card.
 
-When this policy setting isn’t turned on, root certificate propagation doesn’t occur when the user inserts the smart card.
+When this policy setting isn't turned on, root certificate propagation doesn't occur when the user inserts the smart card.
 
 | **Item**          | **Description**   |
 |--------------------------------------|---------------------------------------------------------------------------------------------------------|
diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
index b0989b839d..a44e2533fc 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
@@ -1,21 +1,9 @@
 ---
 title: How Smart Card Sign-in Works in Windows
 description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # How Smart Card Sign-in Works in Windows
diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md
index 1df09c74c0..40f781ce63 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md
@@ -1,21 +1,9 @@
 ---
 title: Smart Card Removal Policy Service (Windows)
 description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Card Removal Policy Service
diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md
index 187d0bc8a9..170dfa5cf4 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md
@@ -1,21 +1,9 @@
 ---
 title: Smart Cards for Windows Service (Windows)
 description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Cards for Windows Service
diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md
index c543380fcd..bb1e4d8fb6 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md
@@ -1,21 +1,9 @@
 ---
 title: Smart Card Tools and Settings (Windows)
 description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
 ms.reviewer: ardenw
-manager: aaroncz
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/24/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-  - ✅ <b>Windows Server 2016</b>
-  - ✅ <b>Windows Server 2019</b>
-  - ✅ <b>Windows Server 2022</b>
-ms.technology: itpro-security
 ---
 
 # Smart Card Tools and Settings
diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md
index d5912c3e8d..3b74397463 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md
@@ -4,10 +4,6 @@ description: Learn about the Windows smart card infrastructure for physical smar
 ms.reviewer: ardenw
 ms.topic: article
 ms.date: 09/24/2021
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
-ms.technology: itpro-security
 ---
 
 # Smart Card Technical Reference
diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md
index 8037f68045..0e56328a44 100644
--- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md
+++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md
@@ -5,11 +5,7 @@ ms.collection:
   - highpri
   - tier2
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # How User Account Control works
diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
index 979a7ae1f1..08e9ce3e06 100644
--- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
+++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
@@ -6,9 +6,6 @@ ms.collection:
   - tier2
 ms.topic: article
 ms.date: 04/19/2017
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # User Account Control Group Policy and registry key settings
diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md
index 93502be3e3..e85aae3ab9 100644
--- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md
+++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md
@@ -6,9 +6,6 @@ ms.collection:
   - tier2
 ms.topic: article
 ms.date: 09/24/2011
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # User Account Control
diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md
index 28f209a22e..ffdb4e4a3f 100644
--- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md
+++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md
@@ -3,9 +3,6 @@ title: User Account Control security policy settings (Windows)
 description: You can use security policies to configure how User Account Control works in your organization.
 ms.topic: article
 ms.date: 09/24/2021
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # User Account Control security policy settings
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md
index 63ac28b3e9..b20f03522b 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md
@@ -3,9 +3,6 @@ title: Deploy Virtual Smart Cards
 description: Learn about what to consider when deploying a virtual smart card authentication solution
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Deploy Virtual Smart Cards
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md
index b2afb7673e..d86c288331 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md
@@ -3,9 +3,6 @@ title: Evaluate Virtual Smart Card Security
 description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards.
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Evaluate Virtual Smart Card Security
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md
index ab3569f8ab..9d8e125298 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md
@@ -3,9 +3,6 @@ title: Get Started with Virtual Smart Cards - Walkthrough Guide (Windows 10)
 description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards.
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Get Started with Virtual Smart Cards: Walkthrough Guide
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md
index 05598bf6ee..1445f06ad2 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md
@@ -3,9 +3,6 @@ title: Virtual Smart Card Overview
 description: Learn about virtual smart card technology for Windows.
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Virtual Smart Card Overview
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md
index 5f39e38b48..5eca1fae1e 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md
@@ -3,9 +3,6 @@ title: Tpmvscmgr
 description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer.
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Tpmvscmgr
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md
index dfde051a1a..77e78baaf2 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md
@@ -4,9 +4,6 @@ description: Learn how smart card technology can fit into your authentication de
 ms.prod: windows-client
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Understand and Evaluate Virtual Smart Cards
diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md
index eb4d234c61..ddb91270e5 100644
--- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md
+++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md
@@ -3,9 +3,6 @@ title: Use Virtual Smart Cards
 description: Learn about the requirements for virtual smart cards, how to use and manage them.
 ms.topic: conceptual
 ms.date: 02/22/2023
-appliesto:
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10 and later</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016 and later</a>
 ---
 
 # Use Virtual Smart Cards
diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
index 188fe97442..ae5e2174e2 100644
--- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
+++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
@@ -1,17 +1,7 @@
 ---
-title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10 and Windows 11)
+title: How to configure Diffie Hellman protocol over IKEv2 VPN connections
 description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-manager: aaroncz
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: how-to
 ---
 
@@ -31,7 +21,7 @@ For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-V
 Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy
 ```
 
-On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn’t have `-TunnelType`, the configuration applies to all tunnel types on the server.
+On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn't have `-TunnelType`, the configuration applies to all tunnel types on the server.
 
 ```powershell
 Set-VpnServerIPsecConfiguration -CustomPolicy
diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
index e44a13a1a8..08b4c532c8 100644
--- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
+++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
@@ -1,16 +1,7 @@
 ---
 title: How to use Single Sign-On (SSO) over VPN and Wi-Fi connections
 description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections.
-ms.prod: windows-client
-author: paolomatarazzo
 ms.date: 12/28/2022
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: how-to
 ---
 
@@ -95,7 +86,7 @@ For more information, see [Configure certificate infrastructure for SCEP](/mem/i
 
 You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well.
 
-Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store.
+Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC's certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store.
 
 Domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication.
 This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server.
diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md
index f14e959f6b..c74740f325 100644
--- a/windows/security/identity-protection/vpn/vpn-authentication.md
+++ b/windows/security/identity-protection/vpn/vpn-authentication.md
@@ -1,17 +1,7 @@
 ---
 title: VPN authentication options (Windows 10 and Windows 11)
 description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md
index 61044232d2..51c5aebb16 100644
--- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md
+++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md
@@ -1,23 +1,13 @@
 ---
 title: VPN auto-triggered profile options (Windows 10 and Windows 11)
 description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
 # VPN auto-triggered profile options
 
-In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won’t have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: 
+In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won't have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: 
 
 - App trigger
 - Name-based trigger
@@ -64,7 +54,7 @@ When a device has multiple profiles with Always On triggers, the user can specif
 
 ## Preserving user Always On preference
 
-Windows has a feature to preserve a user’s AlwaysOn preference.  In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**.  
+Windows has a feature to preserve a user's AlwaysOn preference.  In the event that a user manually unchecks the "Connect automatically" checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**.  
 
 Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference.
 
diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md
index 4e7d339c66..1027a6e678 100644
--- a/windows/security/identity-protection/vpn/vpn-conditional-access.md
+++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md
@@ -1,17 +1,7 @@
 ---
 title: VPN and conditional access (Windows 10 and Windows 11)
 description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-ms.reviewer: pesmith
-manager: aaroncz
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
@@ -78,7 +68,7 @@ Two client-side configuration service providers are leveraged for VPN device com
    - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
    
 > [!NOTE]
-> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user’s VPN profile. This will enable the user to access on-premises resources.
+> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user's VPN profile. This will enable the user to access on-premises resources.
 > 
 > In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero).
 
@@ -91,13 +81,13 @@ The VPN client side connection flow works as follows:
  
 When a VPNv2 Profile is configured with \<DeviceCompliance> \<Enabled>true<\/Enabled> the VPN client uses this connection flow:
 
-1.	 The VPN client calls into Windows 10’s or Windows 11’s Azure AD Token Broker, identifying itself as a VPN client.
+1.     The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client.
 
-2.	 The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies.
+2.     The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies.
 
-3.	 If compliant, Azure AD requests a short-lived certificate.
+3.     If compliant, Azure AD requests a short-lived certificate.
 
-4.	 Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection  processing.
+4.     Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection  processing.
 
 5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server.
 
diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md
index e9eecdbbb9..0ae1626c8b 100644
--- a/windows/security/identity-protection/vpn/vpn-connection-type.md
+++ b/windows/security/identity-protection/vpn/vpn-connection-type.md
@@ -1,23 +1,13 @@
 ---
 title: VPN connection types (Windows 10 and Windows 11)
 description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 08/23/2021
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
 # VPN connection types
 
-Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network.
+Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization's private network.
 
 There are many options for VPN clients. In Windows 10 and Windows 11, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. 
 
diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md
index f8cf27d242..15f788082b 100644
--- a/windows/security/identity-protection/vpn/vpn-guide.md
+++ b/windows/security/identity-protection/vpn/vpn-guide.md
@@ -1,17 +1,7 @@
 ---
 title: Windows VPN technical guide (Windows 10 and Windows 11)
 description: Learn about decisions to make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 02/21/2022
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md
index 34f201d00a..2c6402477a 100644
--- a/windows/security/identity-protection/vpn/vpn-name-resolution.md
+++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md
@@ -1,17 +1,7 @@
 ---
 title: VPN name resolution (Windows 10 and Windows 11)
 description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
@@ -23,7 +13,7 @@ The name resolution setting in the VPN profile configures how name resolution sh
 
 ## Name Resolution Policy table (NRPT)
  
-The NRPT is a table of namespaces that determines the DNS client’s behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache.
+The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache.
 
 There are 3 types of name matches that can  set up for NRPT:
 
diff --git a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md
index 6e45c35a7e..8eb30c7bce 100644
--- a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md
+++ b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md
@@ -1,18 +1,8 @@
 ---
-title: Optimizing Office 365 traffic for remote workers with the native Windows 10 or Windows 11 VPN client
-description: tbd
-ms.prod: windows-client
+title: Optimizing Office 365 traffic for remote workers with the native Windows VPN client
+description: Learn how to optimize Office 365 traffic for remote workers with the native Windows VPN client
 ms.topic: article
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ---
 # Optimizing Office 365 traffic for remote workers with the native Windows 10 and Windows 11 VPN client
 
diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md
index a6330f4ad8..2ebbff5348 100644
--- a/windows/security/identity-protection/vpn/vpn-profile-options.md
+++ b/windows/security/identity-protection/vpn/vpn-profile-options.md
@@ -1,17 +1,7 @@
 ---
 title: VPN profile options (Windows 10 and Windows 11)
 description: Windows adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network.
-manager: aaroncz
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-ms.reviewer: pesmith
-ms.localizationpriority: medium
 ms.date: 05/17/2018
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
@@ -221,75 +211,75 @@ The following sample is a sample plug-in VPN profile. This blob would fall under
 
 ```xml
 <VPNProfile>
-	<ProfileName>TestVpnProfile</ProfileName>
-	<PluginProfile>
-		<ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
-		<PluginPackageFamilyName>JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy</PluginPackageFamilyName>
-		<CustomConfiguration>&lt;pulse-schema&gt;&lt;isSingleSignOnCredential&gt;true&lt;/isSingleSignOnCredential&gt;&lt;/pulse-schema&gt;</CustomConfiguration>
-	</PluginProfile>
-	<Route>
-		<Address>192.168.0.0</Address>
-		<PrefixSize>24</PrefixSize>
-	</Route>
-	<Route>
-		<Address>10.10.0.0</Address>
-		<PrefixSize>16</PrefixSize>
-	</Route>
-	<AppTrigger>
-		<App>
-			<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
-		</App>
-	</AppTrigger>
-	<AppTrigger>
-		<App>
-			<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
-		</App>
-	</AppTrigger>
-	<TrafficFilter>
-		<App>
-			<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
-		</App>
-		<Protocol>6</Protocol>
-		<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
-		<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
-		<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
-		<!--<RoutingPolicyType>ForceTunnel</RoutingPolicyType>-->
-	</TrafficFilter>
-	<TrafficFilter>
-		<App>
-			<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
-		</App>
-		<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
-	</TrafficFilter>
-	<TrafficFilter>
-		<App>
-			<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
-		</App>
-		<Claims>O:SYG:SYD:(A;;CC;;;AU)</Claims>
-		<!--<RoutingPolicyType>SplitTunnel</RoutingPolicyType>-->
-	</TrafficFilter>
-	<DomainNameInformation>
-		<DomainName>corp.contoso.com</DomainName>
-		<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
-		<WebProxyServers>5.5.5.5</WebProxyServers>
-		<AutoTrigger>false</AutoTrigger>
-	</DomainNameInformation>
-	<DomainNameInformation>
-		<DomainName>corp.contoso.com</DomainName>
-		<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
-		<WebProxyServers>100.100.100.100</WebProxyServers>
-	</DomainNameInformation>
-	<!--<EdpModeId>corp.contoso.com</EdpModeId>-->
-	<RememberCredentials>true</RememberCredentials>
-	<AlwaysOn>false</AlwaysOn>
-	<DnsSuffix>corp.contoso.com</DnsSuffix>
-	<TrustedNetworkDetection>contoso.com,test.corp.contoso.com</TrustedNetworkDetection>
-	<Proxy>
-		<Manual>
-			<Server>HelloServer</Server>
-		</Manual>
-		<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
-	</Proxy>
+    <ProfileName>TestVpnProfile</ProfileName>
+    <PluginProfile>
+        <ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
+        <PluginPackageFamilyName>JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy</PluginPackageFamilyName>
+        <CustomConfiguration>&lt;pulse-schema&gt;&lt;isSingleSignOnCredential&gt;true&lt;/isSingleSignOnCredential&gt;&lt;/pulse-schema&gt;</CustomConfiguration>
+    </PluginProfile>
+    <Route>
+        <Address>192.168.0.0</Address>
+        <PrefixSize>24</PrefixSize>
+    </Route>
+    <Route>
+        <Address>10.10.0.0</Address>
+        <PrefixSize>16</PrefixSize>
+    </Route>
+    <AppTrigger>
+        <App>
+            <Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
+        </App>
+    </AppTrigger>
+    <AppTrigger>
+        <App>
+            <Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
+        </App>
+    </AppTrigger>
+    <TrafficFilter>
+        <App>
+            <Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
+        </App>
+        <Protocol>6</Protocol>
+        <LocalPortRanges>10,20-50,100-200</LocalPortRanges>
+        <RemotePortRanges>20-50,100-200,300</RemotePortRanges>
+        <RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
+        <!--<RoutingPolicyType>ForceTunnel</RoutingPolicyType>-->
+    </TrafficFilter>
+    <TrafficFilter>
+        <App>
+            <Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
+        </App>
+        <LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
+    </TrafficFilter>
+    <TrafficFilter>
+        <App>
+            <Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
+        </App>
+        <Claims>O:SYG:SYD:(A;;CC;;;AU)</Claims>
+        <!--<RoutingPolicyType>SplitTunnel</RoutingPolicyType>-->
+    </TrafficFilter>
+    <DomainNameInformation>
+        <DomainName>corp.contoso.com</DomainName>
+        <DnsServers>1.2.3.4,5.6.7.8</DnsServers>
+        <WebProxyServers>5.5.5.5</WebProxyServers>
+        <AutoTrigger>false</AutoTrigger>
+    </DomainNameInformation>
+    <DomainNameInformation>
+        <DomainName>corp.contoso.com</DomainName>
+        <DnsServers>10.10.10.10,20.20.20.20</DnsServers>
+        <WebProxyServers>100.100.100.100</WebProxyServers>
+    </DomainNameInformation>
+    <!--<EdpModeId>corp.contoso.com</EdpModeId>-->
+    <RememberCredentials>true</RememberCredentials>
+    <AlwaysOn>false</AlwaysOn>
+    <DnsSuffix>corp.contoso.com</DnsSuffix>
+    <TrustedNetworkDetection>contoso.com,test.corp.contoso.com</TrustedNetworkDetection>
+    <Proxy>
+        <Manual>
+            <Server>HelloServer</Server>
+        </Manual>
+        <AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
+    </Proxy>
 </VPNProfile>  
 ```
 
diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md
index be5bc1caf0..925b124da9 100644
--- a/windows/security/identity-protection/vpn/vpn-routing.md
+++ b/windows/security/identity-protection/vpn/vpn-routing.md
@@ -1,17 +1,7 @@
 ---
-title: VPN routing decisions (Windows 10 and Windows 10)
-description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 09/23/2021
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
+title: VPN routing decisions
+description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
 ms.topic: conceptual
 ---
 # VPN routing decisions
@@ -38,7 +28,7 @@ Routes can also be added at connect time through the server for UWP VPN apps.
 
 In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified. 
 
-The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the physical interface itself. 
+The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn't a specific route on the physical interface itself. 
 
 For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**.
 
diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md
index f8fb6861a0..c4d9da3ec4 100644
--- a/windows/security/identity-protection/vpn/vpn-security-features.md
+++ b/windows/security/identity-protection/vpn/vpn-security-features.md
@@ -1,17 +1,7 @@
 ---
 title: VPN security features
 description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.localizationpriority: medium
 ms.date: 07/21/2022
-manager: aaroncz
-ms.author: paoloma
-ms.reviewer: pesmith
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
 ms.topic: conceptual
 ---
 
diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
index aee7a82d2d..5cbde2e21f 100644
--- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
+++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
@@ -1,17 +1,8 @@
 ---
 title: Windows Credential Theft Mitigation Guide Abstract
 description: Provides a summary of the Windows credential theft mitigation guide.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
-ms.topic: article
-ms.localizationpriority: medium
-ms.date: 04/19/2017
-appliesto: 
-  - ✅ <b>Windows 10</b>
-  - ✅ <b>Windows 11</b>
-ms.technology: itpro-security
+ms.topic: conceptual
+ms.date: 03/31/2023
 ---
 
 # Windows Credential Theft Mitigation Guide Abstract
@@ -65,5 +56,3 @@ This sections covers how to detect the use of stolen credentials and how to coll
 ## Responding to suspicious activity
 
 Learn Microsoft's recommendations for responding to incidents, including how to recover control of compromised accounts, how to investigate attacks, and how to recover from a breach.
-
-

From dd438c8611bc154916fe585d07b8581012958b58 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 31 Mar 2023 08:13:55 -0400
Subject: [PATCH 48/64] updates

---
 windows/security/docfx.json                                  | 1 -
 .../identity-protection/access-control/local-accounts.md     | 2 +-
 .../smart-cards/smart-card-and-remote-desktop-services.md    | 5 +++--
 .../smart-cards/smart-card-architecture.md                   | 2 --
 .../smart-card-certificate-requirements-and-enumeration.md   | 2 +-
 ...ure-diffie-hellman-protocol-over-ikev2-vpn-connections.md | 2 --
 6 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index dc952e8060..03b5fbffd6 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -110,7 +110,6 @@
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
         ]
       },
-      },
       "ms.reviewer":{
         "identity-protection/hello-for-business/*.md": "erikdau",
         "identity-protection/credential-guard/*.md": "zwhittington",
diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md
index 35a5ec849f..a2c64c37a0 100644
--- a/windows/security/identity-protection/access-control/local-accounts.md
+++ b/windows/security/identity-protection/access-control/local-accounts.md
@@ -62,7 +62,7 @@ Group Policy can be used to control the use of the local Administrators group au
 
 > [!IMPORTANT]
 > 
-> - Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic.
+> - Blank passwords are not allowed.
 >
 > - Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. 
 
diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
index b736e1c5a4..365f168f07 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
@@ -9,7 +9,7 @@ ms.reviewer: ardenw
 
 This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in.
 
-The content in this topic applies to the versions of Windows that are designated in the **Applies To** list at the beginning of this topic. In these versions, smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process.
+Smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process.
 
 Smart card support is required to enable many Remote Desktop Services scenarios. These include:
 
@@ -83,7 +83,8 @@ Where &lt;*CertFile*&gt; is the root certificate of the KDC certificate issuer.
 
 For information about this option for the command-line tool, see [-addstore](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_addstore).
 
-> **Note**&nbsp;&nbsp;If you use the credential SSP on computers running the supported versions of the operating system that are designated in the **Applies To** list at the beginning of this topic: To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller.
+> [!NOTE]
+> To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller.
 
 Sign-in to Remote Desktop Services across a domain works only if the UPN in the certificate uses the following form: <*ClientName*>@<*DomainDNSName*>
 
diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md
index 2359e2a96b..5a810263fc 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md
@@ -308,8 +308,6 @@ Figure 4 shows the Cryptography architecture that is used by the Windows operat
 
 ### Base CSP and smart card KSP properties in Windows
 
-The following properties are supported in versions of Windows designated in the **Applies To** list at the beginning of this topic.
-
 > **Note**&nbsp;&nbsp;The API definitions are located in WinCrypt.h and WinSCard.h.
 
 | **Property**          | **Description**  |
diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
index ba41b7a493..e52b7eeabd 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
@@ -69,7 +69,7 @@ The following table lists the certificate support in older Windows operating sys
 
 Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) does not reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change.
 
-In the supported versions of Windows designated in the **Applies To** list at the beginning of this topic, client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card.
+Client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card.
 
 Support for multiple certificates on the same card is enabled by default. New certificate types must be enabled through Group Policy.
 
diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
index ae5e2174e2..834f56a321 100644
--- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
+++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
@@ -7,8 +7,6 @@ ms.topic: how-to
 
 # How to configure Diffie Hellman protocol over IKEv2 VPN connections
 
->Applies To: Windows Server (General Availability Channel), Windows Server 2016, Windows 10, Windows 11
-
 In IKEv2 VPN connections, the default configuration for Diffie Hellman group is Group 2, which is not secure for IKE exchanges.
 
 To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets.

From 12ced2b935a40ab3316129ad39aceff9a1091f99 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 31 Mar 2023 08:30:00 -0400
Subject: [PATCH 49/64] updates

---
 .../identity-protection/vpn/vpn-conditional-access.md        | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md
index 1027a6e678..57e7acde2a 100644
--- a/windows/security/identity-protection/vpn/vpn-conditional-access.md
+++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md
@@ -76,9 +76,8 @@ Two client-side configuration service providers are leveraged for VPN device com
 
 The VPN client side connection flow works as follows:
 
-> [!div class="mx-imgBorder"]
-> ![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png)
- 
+![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png)
+
 When a VPNv2 Profile is configured with \<DeviceCompliance> \<Enabled>true<\/Enabled> the VPN client uses this connection flow:
 
 1.     The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client.

From 0b7eac5837a53f60ab1c4c66f1fef7ec00fdba5f Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 31 Mar 2023 09:01:58 -0400
Subject: [PATCH 50/64] update

---
 windows/security/docfx.json                   | 12 +++---
 .../hello-cert-trust-policy-settings.md       |  6 ---
 .../hello-key-trust-policy-settings.md        |  3 --
 .../vpn/vpn-conditional-access.md             | 38 ++++++++-----------
 4 files changed, 21 insertions(+), 38 deletions(-)

diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 03b5fbffd6..5d4dda26a8 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -78,33 +78,33 @@
       },
       "appliesto":{
         "identity-protection/**/*.md": [
-        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
-        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>"
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>"
         ],
         "identity-protection/credential-guard/**/*.md": [
-        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
         ],
         "identity-protection/smart-cards/**/*.md": [
-        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
         ],
         "identity-protection/user-account-control/**/*.md": [
-        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
         ],
         "identity-protection/virtual-smart-cards/**/*.md": [
-        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2022</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2019</a>",
         "✅ <a href=\"https://learn.microsoft.com/windows/release-health/windows-server-release-info\" target=\"_blank\">Windows Server 2016</a>"
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
index 2655617fd3..b3059ee0c0 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
@@ -5,12 +5,6 @@ ms.collection:
 - highpri
 - tier1
 ms.date: 12/12/2022
-appliesto: 
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure Windows Hello for Business group policy settings - on-premises certificate Trust
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md
index b82f904d68..3fd25ec607 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md
@@ -5,9 +5,6 @@ description: Configure Windows Hello for Business Policy settings for Windows He
 appliesto: 
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
-- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
 ms.topic: tutorial
 ---
 # Configure Windows Hello for Business group policy settings - on-premises key trust
diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md
index 57e7acde2a..392b5cf099 100644
--- a/windows/security/identity-protection/vpn/vpn-conditional-access.md
+++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md
@@ -53,23 +53,19 @@ After the server side is set up, VPN admins can add the policy settings for cond
 Two client-side configuration service providers are leveraged for VPN device compliance.
 
 - VPNv2 CSP DeviceCompliance settings:
-
-   - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD.
-   - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication.
-   - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication.
-   - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication.
-   - **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication.
-   
+  - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD.
+  - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication.
+  - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication.
+  - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication.
+  - **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication.
 - HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include:
+  - Collects TPM data used to verify health states
+  - Forwards the data to the Health Attestation Service (HAS)
+  - Provisions the Health Attestation Certificate received from the HAS
+  - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
 
-   - Collects TPM data used to verify health states
-   - Forwards the data to the Health Attestation Service (HAS)
-   - Provisions the Health Attestation Certificate received from the HAS
-   - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
-   
 > [!NOTE]
-> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user's VPN profile. This will enable the user to access on-premises resources.
-> 
+> It's required that certificates used for obtaining Kerberos tickets to be issued from an on-premises CA, and that SSO to be enabled in the user's VPN profile. This will enable the user to access on-premises resources.
 > In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero).
 
 ## Client connection flow
@@ -80,15 +76,11 @@ The VPN client side connection flow works as follows:
 
 When a VPNv2 Profile is configured with \<DeviceCompliance> \<Enabled>true<\/Enabled> the VPN client uses this connection flow:
 
-1.     The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client.
-
-2.     The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies.
-
-3.     If compliant, Azure AD requests a short-lived certificate.
-
-4.     Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection  processing.
-
-5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server.
+1. The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client.
+1. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies.
+1. If compliant, Azure AD requests a short-lived certificate.
+1. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection  processing.
+1. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server.
 
 ## Configure conditional access
 

From 8387d08061d95cddcdf69de6792f81fda56d7045 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 31 Mar 2023 09:48:10 -0400
Subject: [PATCH 51/64] adding EDU

---
 education/docfx.json                                     | 9 +++++++++
 education/windows/autopilot-reset.md                     | 2 +-
 education/windows/change-home-to-edu.md                  | 2 --
 education/windows/configure-aad-google-trust.md          | 1 +
 education/windows/edu-take-a-test-kiosk-mode.md          | 2 --
 education/windows/edu-themes.md                          | 1 +
 education/windows/federated-sign-in.md                   | 1 +
 education/windows/get-minecraft-for-education.md         | 2 --
 education/windows/includes/intune-custom-settings-1.md   | 2 --
 education/windows/includes/intune-custom-settings-2.md   | 2 --
 .../windows/includes/intune-custom-settings-info.md      | 2 --
 education/windows/set-up-school-pcs-whats-new.md         | 2 --
 education/windows/take-a-test-app-technical.md           | 4 +---
 education/windows/take-tests-in-windows.md               | 4 +---
 .../tutorial-school-deployment/configure-device-apps.md  | 2 --
 .../configure-device-settings.md                         | 2 --
 .../configure-devices-overview.md                        | 2 --
 .../windows/tutorial-school-deployment/enroll-aadj.md    | 2 --
 .../tutorial-school-deployment/enroll-autopilot.md       | 2 --
 .../tutorial-school-deployment/enroll-overview.md        | 2 --
 .../windows/tutorial-school-deployment/enroll-package.md | 2 --
 education/windows/tutorial-school-deployment/index.md    | 2 --
 .../tutorial-school-deployment/manage-overview.md        | 2 --
 .../windows/tutorial-school-deployment/reset-wipe.md     | 2 --
 .../tutorial-school-deployment/set-up-azure-ad.md        | 1 +
 .../set-up-microsoft-intune.md                           | 1 +
 .../tutorial-school-deployment/troubleshoot-overview.md  | 2 --
 27 files changed, 17 insertions(+), 43 deletions(-)

diff --git a/education/docfx.json b/education/docfx.json
index 8662cf333f..9297b1ed0d 100644
--- a/education/docfx.json
+++ b/education/docfx.json
@@ -67,6 +67,15 @@
         "v-stsavell"
       ]
     },
+    "fileMetadata": {
+      "appliesto":{
+        "windows/**/*.md": [
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 11 SE</a>",
+        "✅ <a href=\"https://learn.microsoft.com/windows/release-health/supported-versions-windows-client\" target=\"_blank\">Windows 10</a>"
+        ]
+      }
+    },
     "externalReference": [],
     "template": "op.html",
     "dest": "education",
diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md
index c6fc526cd0..adc2f3d815 100644
--- a/education/windows/autopilot-reset.md
+++ b/education/windows/autopilot-reset.md
@@ -15,7 +15,7 @@ ms.collection:
 
 IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state.
 
-To enable Autopilot Reset in Windows 10, version 1709 (Fall Creators Update), you must:
+To enable Autopilot Reset you must:
 
 1. [Enable the policy for the feature](#enable-autopilot-reset)
 2. [Trigger a reset for each device](#trigger-autopilot-reset)
diff --git a/education/windows/change-home-to-edu.md b/education/windows/change-home-to-edu.md
index f92de780a3..df5e41eb07 100644
--- a/education/windows/change-home-to-edu.md
+++ b/education/windows/change-home-to-edu.md
@@ -10,8 +10,6 @@ manager: jeffbu
 ms.collection:
   - tier3
   - education
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Upgrade Windows Home to Windows Education on student-owned devices
diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md
index 2afa86f4c1..b6d4229e8f 100644
--- a/education/windows/configure-aad-google-trust.md
+++ b/education/windows/configure-aad-google-trust.md
@@ -3,6 +3,7 @@ title: Configure federation between Google Workspace and Azure AD
 description: Configuration of a federated trust between Google Workspace and Azure AD, with Google Workspace acting as an identity provider (IdP) for Azure AD.
 ms.date: 02/24/2023
 ms.topic: how-to
+appliesto:
 ---
 
 # Configure federation between Google Workspace and Azure AD
diff --git a/education/windows/edu-take-a-test-kiosk-mode.md b/education/windows/edu-take-a-test-kiosk-mode.md
index 5b6c073fcd..10c843fc0b 100644
--- a/education/windows/edu-take-a-test-kiosk-mode.md
+++ b/education/windows/edu-take-a-test-kiosk-mode.md
@@ -3,8 +3,6 @@ title: Configure Take a Test in kiosk mode
 description: Learn how to configure Windows to execute the Take a Test app in kiosk mode, using Intune and provisioning packages.
 ms.date: 09/30/2022
 ms.topic: how-to
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Configure Take a Test in kiosk mode
diff --git a/education/windows/edu-themes.md b/education/windows/edu-themes.md
index f76298ef68..bd941025f7 100644
--- a/education/windows/edu-themes.md
+++ b/education/windows/edu-themes.md
@@ -5,6 +5,7 @@ ms.date: 09/15/2022
 ms.topic: how-to
 appliesto:
   - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
+  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11 SE</a>
 ---
 
 # Configure education themes for Windows 11
diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md
index 4799a4d3cc..28ba477eec 100644
--- a/education/windows/federated-sign-in.md
+++ b/education/windows/federated-sign-in.md
@@ -5,6 +5,7 @@ ms.date: 03/15/2023
 ms.topic: how-to
 appliesto:
   - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
+  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11 SE</a>
 ms.collection:
   - highpri
   - tier1
diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md
index ca7f319eb1..3fb0972c89 100644
--- a/education/windows/get-minecraft-for-education.md
+++ b/education/windows/get-minecraft-for-education.md
@@ -3,8 +3,6 @@ title: Get and deploy Minecraft Education
 description: Learn how to obtain and distribute Minecraft Education to Windows devices.
 ms.topic: how-to
 ms.date: 02/23/2023
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ms.collection:
   - highpri
   - education
diff --git a/education/windows/includes/intune-custom-settings-1.md b/education/windows/includes/intune-custom-settings-1.md
index 5be4cd1204..d911751e75 100644
--- a/education/windows/includes/intune-custom-settings-1.md
+++ b/education/windows/includes/intune-custom-settings-1.md
@@ -1,6 +1,4 @@
 ---
-author: paolomatarazzo
-ms.author: paoloma
 ms.date: 02/22/2022
 ms.topic: include
 ---
diff --git a/education/windows/includes/intune-custom-settings-2.md b/education/windows/includes/intune-custom-settings-2.md
index d623773324..1a601acaa7 100644
--- a/education/windows/includes/intune-custom-settings-2.md
+++ b/education/windows/includes/intune-custom-settings-2.md
@@ -1,6 +1,4 @@
 ---
-author: paolomatarazzo
-ms.author: paoloma
 ms.date: 11/08/2022
 ms.topic: include
 ---
diff --git a/education/windows/includes/intune-custom-settings-info.md b/education/windows/includes/intune-custom-settings-info.md
index a7376ee4ff..8ff9da4294 100644
--- a/education/windows/includes/intune-custom-settings-info.md
+++ b/education/windows/includes/intune-custom-settings-info.md
@@ -1,6 +1,4 @@
 ---
-author: paolomatarazzo
-ms.author: paoloma
 ms.date: 11/08/2022
 ms.topic: include
 ---
diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md
index 2b46d073f5..97988171bf 100644
--- a/education/windows/set-up-school-pcs-whats-new.md
+++ b/education/windows/set-up-school-pcs-whats-new.md
@@ -3,8 +3,6 @@ title: What's new in the Windows Set up School PCs app
 description: Find out about app updates and new features in Set up School PCs.
 ms.topic: whats-new
 ms.date: 08/10/2022
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---  
 
 # What's new in Set up School PCs
diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md
index daab02821c..da1540090d 100644
--- a/education/windows/take-a-test-app-technical.md
+++ b/education/windows/take-a-test-app-technical.md
@@ -1,10 +1,8 @@
 ---
 title: Take a Test app technical reference
 description: List of policies and settings applied by the Take a Test app.
-ms.date: 09/30/2022
+ms.date: 03/31/2023
 ms.topic: reference
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Take a Test app technical reference
diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md
index 1eea480188..2533467fca 100644
--- a/education/windows/take-tests-in-windows.md
+++ b/education/windows/take-tests-in-windows.md
@@ -1,10 +1,8 @@
 ---
 title: Take tests and assessments in Windows
 description: Learn about the built-in Take a Test app for Windows and how to use it.
-ms.date: 09/30/2022
+ms.date: 03/31/2023
 ms.topic: conceptual
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Take tests and assessments in Windows
diff --git a/education/windows/tutorial-school-deployment/configure-device-apps.md b/education/windows/tutorial-school-deployment/configure-device-apps.md
index 89eb913446..9b34e2d7cf 100644
--- a/education/windows/tutorial-school-deployment/configure-device-apps.md
+++ b/education/windows/tutorial-school-deployment/configure-device-apps.md
@@ -3,8 +3,6 @@ title: Configure applications with Microsoft Intune
 description: Learn how to configure applications with Microsoft Intune in preparation for device deployment.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Configure applications with Microsoft Intune
diff --git a/education/windows/tutorial-school-deployment/configure-device-settings.md b/education/windows/tutorial-school-deployment/configure-device-settings.md
index 5b63ea0b0b..f9d1d2046f 100644
--- a/education/windows/tutorial-school-deployment/configure-device-settings.md
+++ b/education/windows/tutorial-school-deployment/configure-device-settings.md
@@ -3,8 +3,6 @@ title: Configure and secure devices with Microsoft Intune
 description: Learn how to configure policies with Microsoft Intune in preparation for device deployment.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Configure and secure devices with Microsoft Intune
diff --git a/education/windows/tutorial-school-deployment/configure-devices-overview.md b/education/windows/tutorial-school-deployment/configure-devices-overview.md
index 60bc205647..075d9fe6d3 100644
--- a/education/windows/tutorial-school-deployment/configure-devices-overview.md
+++ b/education/windows/tutorial-school-deployment/configure-devices-overview.md
@@ -3,8 +3,6 @@ title: Configure devices with Microsoft Intune
 description: Learn how to configure policies and applications in preparation for device deployment.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Configure settings and applications with Microsoft Intune
diff --git a/education/windows/tutorial-school-deployment/enroll-aadj.md b/education/windows/tutorial-school-deployment/enroll-aadj.md
index ddcb5d2bb8..1dc7d9beeb 100644
--- a/education/windows/tutorial-school-deployment/enroll-aadj.md
+++ b/education/windows/tutorial-school-deployment/enroll-aadj.md
@@ -3,8 +3,6 @@ title: Enrollment in Intune with standard out-of-box experience (OOBE)
 description: Learn how to join devices to Azure AD from OOBE and automatically get them enrolled in Intune.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 # Automatic Intune enrollment via Azure AD join
 
diff --git a/education/windows/tutorial-school-deployment/enroll-autopilot.md b/education/windows/tutorial-school-deployment/enroll-autopilot.md
index 32ff8c37ed..88cec25ed6 100644
--- a/education/windows/tutorial-school-deployment/enroll-autopilot.md
+++ b/education/windows/tutorial-school-deployment/enroll-autopilot.md
@@ -3,8 +3,6 @@ title: Enrollment in Intune with Windows Autopilot
 description: Learn how to join Azure AD and enroll in Intune using Windows Autopilot.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Windows Autopilot
diff --git a/education/windows/tutorial-school-deployment/enroll-overview.md b/education/windows/tutorial-school-deployment/enroll-overview.md
index d816ed1b94..6537b7ea3a 100644
--- a/education/windows/tutorial-school-deployment/enroll-overview.md
+++ b/education/windows/tutorial-school-deployment/enroll-overview.md
@@ -3,8 +3,6 @@ title: Device enrollment overview
 description: Learn about the different options to enroll Windows devices in Microsoft Intune
 ms.date: 08/31/2022
 ms.topic: overview
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Device enrollment overview
diff --git a/education/windows/tutorial-school-deployment/enroll-package.md b/education/windows/tutorial-school-deployment/enroll-package.md
index 9f96234636..e73ef21957 100644
--- a/education/windows/tutorial-school-deployment/enroll-package.md
+++ b/education/windows/tutorial-school-deployment/enroll-package.md
@@ -3,8 +3,6 @@ title: Enrollment of Windows devices with provisioning packages
 description: Learn about how to enroll Windows devices with provisioning packages using SUSPCs and Windows Configuration Designer.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Enrollment with provisioning packages
diff --git a/education/windows/tutorial-school-deployment/index.md b/education/windows/tutorial-school-deployment/index.md
index a23afe72b0..b91d83d780 100644
--- a/education/windows/tutorial-school-deployment/index.md
+++ b/education/windows/tutorial-school-deployment/index.md
@@ -3,8 +3,6 @@ title: Introduction to the tutorial deploy and manage Windows devices in a schoo
 description: Introduction to deployment and management of Windows devices in education environments.
 ms.date: 08/31/2022
 ms.topic: conceptual
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Tutorial: deploy and manage Windows devices in a school
diff --git a/education/windows/tutorial-school-deployment/manage-overview.md b/education/windows/tutorial-school-deployment/manage-overview.md
index 00559d4384..ff0997fad9 100644
--- a/education/windows/tutorial-school-deployment/manage-overview.md
+++ b/education/windows/tutorial-school-deployment/manage-overview.md
@@ -3,8 +3,6 @@ title: Manage devices with Microsoft Intune
 description: Overview of device management capabilities in Intune for Education, including remote actions, remote assistance and inventory/reporting.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Manage devices with Microsoft Intune
diff --git a/education/windows/tutorial-school-deployment/reset-wipe.md b/education/windows/tutorial-school-deployment/reset-wipe.md
index b9a1f80094..488d2513f1 100644
--- a/education/windows/tutorial-school-deployment/reset-wipe.md
+++ b/education/windows/tutorial-school-deployment/reset-wipe.md
@@ -3,8 +3,6 @@ title: Reset and wipe Windows devices
 description: Learn about the reset and wipe options for Windows devices using Intune for Education, including scenarios when to delete devices.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Device reset options
diff --git a/education/windows/tutorial-school-deployment/set-up-azure-ad.md b/education/windows/tutorial-school-deployment/set-up-azure-ad.md
index 899b8298dd..6aaea36211 100644
--- a/education/windows/tutorial-school-deployment/set-up-azure-ad.md
+++ b/education/windows/tutorial-school-deployment/set-up-azure-ad.md
@@ -3,6 +3,7 @@ title: Set up Azure Active Directory
 description: Learn how to create and prepare your Azure AD tenant for an education environment.
 ms.date: 08/31/2022
 ms.topic: tutorial
+appliesto:
 ---
 
 # Set up Azure Active Directory
diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md
index 8d1b84254e..f55a5262c3 100644
--- a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md
+++ b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md
@@ -3,6 +3,7 @@ title: Set up device management
 description: Learn how to configure the Intune service and set up the environment for education.
 ms.date: 08/31/2022
 ms.topic: tutorial
+appliesto:
 ---
 
 # Set up Microsoft Intune
diff --git a/education/windows/tutorial-school-deployment/troubleshoot-overview.md b/education/windows/tutorial-school-deployment/troubleshoot-overview.md
index a58a7f2d9a..5e27915802 100644
--- a/education/windows/tutorial-school-deployment/troubleshoot-overview.md
+++ b/education/windows/tutorial-school-deployment/troubleshoot-overview.md
@@ -3,8 +3,6 @@ title: Troubleshoot Windows devices
 description: Learn how to troubleshoot Windows devices from Intune and contact Microsoft Support for issues related to Intune and other services.
 ms.date: 08/31/2022
 ms.topic: tutorial
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a>
 ---
 
 # Troubleshoot Windows devices

From ae14eb41cb6b305fb39a081e992251cee28ba4c6 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 31 Mar 2023 11:15:13 -0400
Subject: [PATCH 52/64] Update
 windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md

---
 .../operations/wdac-debugging-and-troubleshooting.md            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index ecf51b29ac..420cb9eb34 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -17,7 +17,7 @@ ms.technology: itpro-security
 
 - Windows 10
 - Windows 11
-- Windows Server 2016 and above
+- Windows Server 2016 and later
 
 > [!NOTE]
 > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).

From d3f56648f149249644590b6c9fd0dc0ce443073e Mon Sep 17 00:00:00 2001
From: Aaron Czechowski <aczechowski@users.noreply.github.com>
Date: Fri, 31 Mar 2023 09:18:42 -0700
Subject: [PATCH 53/64] Update
 windows/deployment/do/delivery-optimization-endpoints.md

Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
 windows/deployment/do/delivery-optimization-endpoints.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md
index 9ead54c1bf..d051d334e6 100644
--- a/windows/deployment/do/delivery-optimization-endpoints.md
+++ b/windows/deployment/do/delivery-optimization-endpoints.md
@@ -23,7 +23,7 @@ _Applies to:_
 > [!NOTE]
 > All ports are outbound.
 
-This article lists the content and services endpoints to allow in your Firewall to be used by Microsoft Connected Cache. 
+This article lists the content and services endpoints to allow in your firewall to be used by Microsoft Connected Cache. 
 Use the table below to reference any particular content types or services endpoints that are required for [Connected Cache on a Configuration Manager Distribution Point](/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache) or for [Connected Cache Managed in Azure](../do/waas-microsoft-connected-cache), or both.
 
 |Domain Name  |Protocol/Port(s)  | Content Type | Additional Information | Microsoft Connected Cache Version |

From 14e1c9c460396210a9805ae1ed186cea0dc6c1e0 Mon Sep 17 00:00:00 2001
From: Aaron Czechowski <aczechowski@users.noreply.github.com>
Date: Fri, 31 Mar 2023 09:28:47 -0700
Subject: [PATCH 54/64] fix link

---
 windows/deployment/do/delivery-optimization-endpoints.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md
index d051d334e6..b6ead30f95 100644
--- a/windows/deployment/do/delivery-optimization-endpoints.md
+++ b/windows/deployment/do/delivery-optimization-endpoints.md
@@ -1,7 +1,7 @@
 ---
 title: Microsoft Connected Cache content and services endpoints
 description: List of fully qualified domain names, ports, and associated content types to use Delivery Optimization and Microsoft Connected Cache.
-ms.date: 07/26/2022
+ms.date: 03/31/2023
 ms.prod: windows-client
 ms.technology: itpro-updates
 ms.topic: reference
@@ -24,7 +24,7 @@ _Applies to:_
 > All ports are outbound.
 
 This article lists the content and services endpoints to allow in your firewall to be used by Microsoft Connected Cache. 
-Use the table below to reference any particular content types or services endpoints that are required for [Connected Cache on a Configuration Manager Distribution Point](/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache) or for [Connected Cache Managed in Azure](../do/waas-microsoft-connected-cache), or both.
+Use the table below to reference any particular content types or services endpoints that are required for [Connected Cache on a Configuration Manager distribution point](/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache), [Connected Cache managed in Azure](waas-microsoft-connected-cache.md), or both.
 
 |Domain Name  |Protocol/Port(s)  | Content Type | Additional Information | Microsoft Connected Cache Version |
 |---------|---------|---------------|-------------------|-----------------|

From f4e982d8b7d416d840931f29ad00f91f29b77160 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Fri, 31 Mar 2023 10:31:26 -0700
Subject: [PATCH 55/64] Addressed feedback

---
 .../event-tag-explanations.md                 |  2 +-
 .../example-wdac-base-policies.md             |  6 +-
 .../wdac-debugging-and-troubleshooting.md     | 63 ++-----------------
 3 files changed, 10 insertions(+), 61 deletions(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index dff2b89907..04be400ff9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -151,7 +151,7 @@ The rule means trust anything signed by a certificate that chains to this root C
 | 0| None |
 | 1| Unknown |
 | 2 | Self-Signed |
-| 3 | Authenticode |
+| 3 | Microsoft Authenticode(tm) Root Authority |
 | 4 | Microsoft Product Root 1997 |
 | 5 | Microsoft Product Root 2001 |
 | 6 | Microsoft Product Root 2010 |
diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
index 3bd14575c5..0a01c17fa3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
@@ -8,7 +8,7 @@ author: jsuther1974
 ms.reviewer: jogeurte
 ms.author: vinpa
 manager: aaroncz
-ms.date: 03/16/2023
+ms.date: 03/31/2023
 ms.technology: itpro-security
 ---
 
@@ -23,7 +23,7 @@ ms.technology: itpro-security
 > [!NOTE]
 > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. For more information, see [Windows Defender Application Control feature availability](feature-availability.md).
 
-When you create policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that you can use.
+When you create policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that you can use. These example policies are provided "as-is". You should thoroughly test the policies you deploy using safe deployment methods.
 
 | **Example Base Policy** | **Description** | **Where it can be found** |
 |-------------------------|---------------------------------------------------------------|--------|
@@ -31,7 +31,7 @@ When you create policies for use with Windows Defender Application Control (WDAC
 | **AllowMicrosoft.xml** | This example policy includes the rules from DefaultWindows and adds rules to trust apps signed by the Microsoft product root certificate. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml <br> %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\AllowMicrosoft.xml |
 | **AllowAll.xml** | This example policy is useful when creating a blocklist. All block policies should include rules allowing all other code to run and then add the DENY rules for your organization's needs. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml |
 | **AllowAll_EnableHVCI.xml** | This example policy can be used to enable [memory integrity](https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78) (also known as hypervisor-protected code integrity) using WDAC. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll_EnableHVCI.xml |
-| **DenyAllAudit.xml** | ***Warning: May cause long boot time on Windows Server 2019.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml |
+| **DenyAllAudit.xml** | ***Warning: May cause boot issues on Windows Server 2019 and earlier.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml |
 | **Microsoft Configuration Manager** | Customers who use Configuration Manager can deploy a policy with Configuration Manager's built-in WDAC integration, and then use the generated policy XML as an example base policy. | %OSDrive%\Windows\CCM\DeviceGuard on a managed endpoint |
 | **SmartAppControl.xml** | This example policy includes rules based on [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) that are well-suited for lightly managed systems. This policy includes a rule that is unsupported for enterprise WDAC policies and must be removed. For more information about using this example policy, see [Create a custom base policy using an example base policy](create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy). | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml <br>%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\SignedReputable.xml |
 | **Example supplemental policy** | This example policy shows how to use supplemental policy to expand the DefaultWindows_Audit.xml allow a single Microsoft-signed file. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Supplemental.xml |
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
index 420cb9eb34..81ed21b671 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md
@@ -28,10 +28,6 @@ This article describes how to debug and troubleshoot app and script failures whe
 
 Before debugging and troubleshooting WDAC issues, you must collect information from a device exhibiting the problem behavior.
 
-<br>
-<details>
-  <summary><b>Expand here for instructions on collecting WDAC diagnostic data.</b></summary>
-
 Run the following commands from an elevated PowerShell window to collect the diagnostic information you may need:
 
 1. Gather general WDAC diagnostic data and copy it to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag:
@@ -43,9 +39,9 @@ Run the following commands from an elevated PowerShell window to collect the dia
     If CiDiag.exe isn't present in your version of Windows, gather this information manually:
 
     - WDAC policy binaries from the [Windows and EFI system partitions](known-issues.md#wdac-policy-file-locations)
-    - WDAC event logs
-    - AppLocker event logs
-    - Other event logs that may contain useful information from other Windows apps and services
+    - [WDAC event logs](#core-wdac-event-logs)
+    - [AppLocker event logs](#core-wdac-event-logs)
+    - [Other event logs that may contain useful information](#other-windows-event-logs-that-may-be-useful) from other Windows apps and services
 
 2. Save the device's System Information to the CiDiag folder:
 
@@ -65,6 +61,9 @@ Run the following commands from an elevated PowerShell window to collect the dia
     reg.exe query HKLM\Software\Policies\Microsoft\Windows\SrpV2 /s > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt; reg.exe query HKLM\Software\Policies\Microsoft\Windows\AppidPlugins /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt; reg.exe query HKLM\System\CurrentControlSet\Control\Srp\ /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt
     ```
 
+   > [!NOTE]
+   > You may see an error that the system was unable to find the specified registry key or value. This error doesn't indicate a problem and can be ignored.
+
 5. Copy any AppLocker policy files from  %windir%System32\AppLocker to the CiDiag folder:
 
     ```powershell
@@ -113,16 +112,10 @@ Sometimes, you may be able to supplement the information contained in the core W
 - *Windows - Application*
 - *Windows - System*
 
-</details>
-
 ## 2 - Use the diagnostic and log data to identify problems
 
 Having gathered the necessary diagnostic information from a device, you're ready to begin your analysis of the diagnostic data collected in the previous section.
 
-<br>
-<details>
-  <summary><b>Expand here for steps on analyzing WDAC diagnostic data.</b></summary>
-
 1. Verify the set of WDAC policies that are active and enforced. Confirm that only those policies you expect to be active are currently active. Be aware of the [Windows inbox policies](inbox-wdac-policies.md) that may also be active. You can use either of these methods:
 
     - Review the output from *CiTool.exe -lp*, if applicable, which was saved to the CIDiag output directory as CiToolOutput.json. See [use Microsoft Edge to view the formatted json file](/microsoft-edge/devtools-guide-chromium/json-viewer/json-viewer).
@@ -139,10 +132,6 @@ Here's an example of detailed EventData from a typical WDAC enforcement mode blo
 
 #### Event 3077 - WDAC enforcement block event
 
-<br>
-<details>
-  <summary>Expand here to explore an example 3077 WDAC block event.</summary>
-
 ![Example 3077 block event for PowerShell.exe.](/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png)
 
 | Element name | Description |
@@ -169,14 +158,8 @@ Here's an example of detailed EventData from a typical WDAC enforcement mode blo
 | UserWriteable | A boolean value indicating if the file was in a user-writeable location. This information is useful for diagnosing issues when allowing by FilePath rules. |
 | PackageFamilyName | The Package Family Name for the packaged app (MSIX) that includes the blocked file. |
 
-</details>
-
 #### Event 3089 - WDAC signature information event
 
-<br>
-<details>
-  <summary>Expand here to explore an example 3089 WDAC signature information event.</summary>
-
 ![Example 3089 signature information event for PowerShell.exe.](/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png)
 
 | Element name | Description |
@@ -193,8 +176,6 @@ Here's an example of detailed EventData from a typical WDAC enforcement mode blo
 | PublisherTBSHash | The TBS hash of the leaf certificate. |
 | IssuerTBSHash | The TBS hash of the highest available certificate in the certificate chain. This level is typically one certificate below the root. |
 
-</details>
-
 #### Step-by-step walkthrough of the example 3077 and 3089 events
 
 Now let's walk through how to use the event data in the example 3077 and 3089 events to understand why the WDAC policy blocked this file.
@@ -220,27 +201,15 @@ It's important to review the information for each correlated 3089 event as each
 >
 > In the case of the 3089 event, on the other hand, ValidatedSigningLevel tells us the potential **maximum** level the signature could receive. We must use the VerificationError to understand why the signature was rejected.
 
-</details>
-
 ## 3 - Resolve common problems
 
 Having analyzed the WDAC diagnostic data, you can take steps to resolve the issue or do more debugging steps. Following are some common problems and steps you can try to resolve or further isolate the root issue:
 
-<br>
-<details>
-  <summary><b>Issue: A file was blocked that you want to allow.</b></summary>
-
 ### Issue: A file was blocked that you want to allow
 
 - Use data from the core WDAC event logs to add rules to allow the blocked file.
 - Redeploy the file or app using a managed installer if your policy trusts managed installers.
 
-</details>
-
-<br>
-<details>
-  <summary><b>Issue: A policy is active that is unexpected.</b></summary>
-
 ### Issue: A policy is active that is unexpected
 
 This condition may exist if:
@@ -253,12 +222,6 @@ This condition may exist if:
 
 To resolve such an issue, follow the instructions to [Remove WDAC policies](/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies) for the identified policy.
 
-</details>
-
-<br>
-<details>
-  <summary><b>Issue: An unhandled app failure is occurring and no WDAC events are observed.</b></summary>
-
 ### Issue: An unhandled app failure is occurring and no WDAC events are observed
 
 Some apps alter their behavior when a user mode WDAC policy is active, which can result in unexpected failures. It can also be a side-effect of script enforcement for apps that don't properly handle the enforcement behaviors implemented by the script hosts.
@@ -270,12 +233,6 @@ Try to isolate the root cause by doing the following actions:
 - Temporarily replace the WDAC policy with another policy that [allows all COM objects](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy) and retest.
 - Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-policy-rules) and retest.
 
-</details>
-
-<br>
-<details>
-  <summary><b>Issue: An app deployed by a managed installer is not working.</b></summary>
-
 ### Issue: An app deployed by a managed installer isn't working
 
 To debug issues using managed installer, try these steps:
@@ -290,12 +247,6 @@ To debug issues using managed installer, try these steps:
 - Add another managed installer to your AppLocker policy and test installation using the other managed installer.
 - Check if the app is encountering a [known limitation with managed installer](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer#known-limitations-with-managed-installer). If so, you must authorize the app using other means.
 
-</details>
-
-<br>
-<details>
-  <summary><b>Issue: An app you expected the ISG to allow is not working.</b></summary>
-
 ### Issue: An app you expected the Intelligent Security Graph (ISG) to allow isn't working
 
 To debug issues using ISG, try these steps:
@@ -304,5 +255,3 @@ To debug issues using ISG, try these steps:
 - Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article.
 - [Use fsutil.exe](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, redeploy the files with the managed installer and check again.
 - Check if the app is encountering a [known limitation with ISG](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph#known-limitations-with-using-the-isg).
-
-</details>

From 9a08a319e9009304a0706712a7714c5a0a8019f2 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Mar 2023 10:59:03 -0700
Subject: [PATCH 56/64] Update windows/deployment/do/mcc-isp-support.md

---
 windows/deployment/do/mcc-isp-support.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index f8a3a71e1c..16ce235fe6 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -54,7 +54,7 @@ Within **Diagnose and solve problems**, select **Troubleshoot** under the type o
 :::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png":::
 
 ## Steps to obtain an Azure subscription ID
-To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID. 
+To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID:
 <!--Using include file, get-azure-subscription.md, for shared content-->
 [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)]
 

From bed0a7fab210eb2df5e1328c7392e62fe6b91b4a Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Mar 2023 11:01:23 -0700
Subject: [PATCH 57/64] Update
 windows/deployment/do/waas-microsoft-connected-cache.md

---
 windows/deployment/do/waas-microsoft-connected-cache.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md
index b8df6ad349..d3371a6134 100644
--- a/windows/deployment/do/waas-microsoft-connected-cache.md
+++ b/windows/deployment/do/waas-microsoft-connected-cache.md
@@ -34,7 +34,7 @@ Microsoft Connected Cache (MCC) for Internet Service Providers is currently in p
 ## Microsoft Connected Cache for Enterprise and Education (early preview)
 
 > [!NOTE]
-> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup)
+> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup)
 
 Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune.
 

From d1d1873b70dea0803ddda0f6bd36eb0965f97c92 Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Mar 2023 11:02:15 -0700
Subject: [PATCH 58/64] Update
 windows/deployment/do/waas-microsoft-connected-cache.md

---
 windows/deployment/do/waas-microsoft-connected-cache.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md
index d3371a6134..4624dfd2bc 100644
--- a/windows/deployment/do/waas-microsoft-connected-cache.md
+++ b/windows/deployment/do/waas-microsoft-connected-cache.md
@@ -34,7 +34,7 @@ Microsoft Connected Cache (MCC) for Internet Service Providers is currently in p
 ## Microsoft Connected Cache for Enterprise and Education (early preview)
 
 > [!NOTE]
-> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup)
+> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
 
 Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune.
 

From 0a4dbc1735209654bf012864b02e12ad0c694543 Mon Sep 17 00:00:00 2001
From: jsuther1974 <jsuther@microsoft.com>
Date: Fri, 31 Mar 2023 11:15:00 -0700
Subject: [PATCH 59/64] Update example-wdac-base-policies.md

---
 .../example-wdac-base-policies.md                               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
index 0a01c17fa3..fdbd1d7ecc 100644
--- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md
@@ -31,7 +31,7 @@ When you create policies for use with Windows Defender Application Control (WDAC
 | **AllowMicrosoft.xml** | This example policy includes the rules from DefaultWindows and adds rules to trust apps signed by the Microsoft product root certificate. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml <br> %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\AllowMicrosoft.xml |
 | **AllowAll.xml** | This example policy is useful when creating a blocklist. All block policies should include rules allowing all other code to run and then add the DENY rules for your organization's needs. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml |
 | **AllowAll_EnableHVCI.xml** | This example policy can be used to enable [memory integrity](https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78) (also known as hypervisor-protected code integrity) using WDAC. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll_EnableHVCI.xml |
-| **DenyAllAudit.xml** | ***Warning: May cause boot issues on Windows Server 2019 and earlier.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml |
+| **DenyAllAudit.xml** | ***Warning: Will cause boot issues on Windows Server 2019 and earlier. Do not use on those operating systems.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml |
 | **Microsoft Configuration Manager** | Customers who use Configuration Manager can deploy a policy with Configuration Manager's built-in WDAC integration, and then use the generated policy XML as an example base policy. | %OSDrive%\Windows\CCM\DeviceGuard on a managed endpoint |
 | **SmartAppControl.xml** | This example policy includes rules based on [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) that are well-suited for lightly managed systems. This policy includes a rule that is unsupported for enterprise WDAC policies and must be removed. For more information about using this example policy, see [Create a custom base policy using an example base policy](create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy). | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml <br>%ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\SignedReputable.xml |
 | **Example supplemental policy** | This example policy shows how to use supplemental policy to expand the DefaultWindows_Audit.xml allow a single Microsoft-signed file. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Supplemental.xml |

From 7fef2a17832a3de8726fd08c94a8897b1e05bdad Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Mar 2023 11:26:11 -0700
Subject: [PATCH 60/64] edits

---
 .../do/images/mcc-isp-diagnose-solve.png      | Bin 26735 -> 24845 bytes
 .../do/mcc-enterprise-prerequisites.md        |   2 +-
 windows/deployment/do/mcc-isp-signup.md       |   2 +-
 windows/deployment/do/mcc-isp-support.md      |  11 +++++++----
 .../do/waas-microsoft-connected-cache.md      |   4 ++--
 5 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve.png b/windows/deployment/do/images/mcc-isp-diagnose-solve.png
index 7691dfe8ac212df5ba71319498c991528bdad2de..6fa1dcc336ee09d090ffa49538f1677ace13897f 100644
GIT binary patch
literal 24845
zcmb@tcTkg2v^^?FkuK7^fPjKD>0Kazf(S^JDov0gy_bL}y^08e5CQ4Egd!#ME=76`
zRZ4(_nm|JGi+A3<d*{u4GxxrEe|(eqGUuF0&e>=0wbx!dPXDDA6*(*Uty{OKo<9S;
zx^;^Hh<~tmNbukImQu6gKL~tYX{p_+9%tXjzYsa8>Z;zlRhL46u_ea8lX*US?Q`oE
zNA$mkz^Z^Q^46_41<wJhMuFBxt7M@@v-v6rE&!u}G!-L}!P}?l^g<u>D(zCG>GnpS
ze)?fNN$&UDj*AFORq9yBP|I-2No1|d19oO;tS^;)XHPP^dD<1PHv52F;tq*w9AVt!
z$j3OJW2Jz<;|}}}#)t@!$S}}yD{{s0_(dM1VfCYlA7O0l&@1x_Qy!lByU{ANX~g1~
zxY)-JHxYVaCpu#fuQlDThM%;i#KxL)>NH^z)*koeDYeZq(xzRQJ;9{Mq;x5GKz@@)
z#6E^4e!}H%Nww_16E#=5ENk+`T9HW~%NJZ;$HZ;(AZ<<tCr<ji)6HAGULp{mgFs%P
z_DO6&8lhV}^_8U`ap^D`l-h!s!#7nDTrA{JbK<4DJ~D>OWpujPCOHJ#By+!ZKGZx?
z{6^s&+T+lV`+5v#DU`V^iY;KmUT<(iPoAKlOIJ$N%A6%fxScK$lx}ypyN!Jv;eDQp
zcx@EU-%Q4)lr7=0gc~$~J;NA`f`2(KCwdmwW@bdfw7$BkWlSdaHzrps{Harzl@Vcw
zd~<gcZpwJMb7zElZ>CzxpG!X9nEwe%U^Vp7uf~+A%h9b%lkaY?U^aHdPXQ*rn$ck+
z)TV`ncaBAvuAwiZn-0n7frdregck>)1e?FWRI-DfduCO4u3e^l9-duDI*8^2EOkt%
zb^Xrw3=S7NwA^WFb8+L(P^0%Vg@G(f-S<RXOXgVhOzza%Eg&Y12|AK`Aqj(%%1mX2
zth*CBAXQ6C#pspb3PEljd0cK90#dCNQnlm3nQqg0B(^51P)xNenQ<t!5~x9{c$!iJ
z=Ke7aw!2DTmi4?F1&V#VoA?nz3G1=3DoYw>>y=Dl3{PsFzFse{cAqiOl@Psp;=WJ{
zgX@INyN!ru46kSAt9VY{H&z2UaD2s7<eg@=Z*Fc)wIMUgKgJH3qXcsCMzfbliM~r~
zFxrC<;Hkg=pT-osp$BkKr3CWuP}rg9XkXv$1;q}1V8#LfjD7#xp;(FJT{4ejW?3et
z3gPar$qdAXVo%+pjk7*|EE559|9q_K)uiq|W7@g;X||@ahYilq+Xhj~AmnI6eo$JA
zjFaGuEG!X}6oQh>j~JWXq)<J){90JAnGukvA-YVnktIekt$F@u)PI}XZ-(c~o<*dc
zJa-fBf?4jpJby}kVXh#5L9y*9E_BDwe#;-sX+mtml=T6^y_1vXGvW8FU5G-?RhpCt
zV$=$uT%Hq+Lfad^DSb5f^;5vcwFSKAyuYH>G3F7fXvF)AJ2ci2rluJdCdE)dcyCbU
z^M{<{VfDBxbHI!<CGPB{fbXH8jgnbiaG}Y)xwTodj+a$3KYiu+lk*}lRmSB%IP7ZJ
z;%CrY-I$Vkao{C=BHLEqdU#!=@JY5^W#FFwi_o`hp-uzTPdBsTviK)LTo|9gStxdY
z`}g_llM?A<f6|3Pr!q6HvaTle&*P^8jNPq1ewzq9r;>-enL#)q=+!M3*x1!UMNQ*Q
z=%6j=>|@Zv;9D4RO*3Vz7mrhjG`ryAD0hpj4_;3cNueLREu`%e9#e8&mMzA%HW%4y
zw017O*OxzK)a_n33v1)f$z%R-o;ef8L2}=H7{_z=SM$3w=OvjqrSWSqvgfbg8;vA|
z@0)e_lW&5Re3gUtx=APN?6rIkXPz4oLQIQ(d-TWeEWuj5w!rge3>Mhk{Eyx0QwG&D
zE$hKbo`C}%Y%9dU6+ureQF|**ft{kLDImFtBD7_F@KPhog9!M7@JS|QrDfgYWAdXy
zF{3JbEf#>3*6z2F5$(g}W*Xd$3I+FaiBml(VqgjE*>MuRBoEB3L*O=-UEEd-J{fay
z(2W{kZl<>$t^r>i6_x(-dN8nfZj8*H&F}TP5v*JivbJY`=I5(9B&gPSZCWE4ZA|iJ
zslc}{W?zG7xiOfy-6gDRrvF)jA={LG&;k&06RfIBhc*sc&z2z=x2RE93;k|Zt-e`G
zmen@5#TNdg;`CP<$dBos$Ctr_(RJHLStu=;#Nde<^0gktv0p00aZ!m|7qE$7e~A&;
zZ`BrYD=P_G-#oa&2}LtB3Nux%sI0?o94XxT?%CYhnf#b}4YlD&v*@5@kRAbOL*#{x
zA<(Q6)8UvEK7W_;xF)&7>&}3qaPQY^uFJ~QZqVgqRN!8|q&pf30d6K5-|}wJ>I7<N
z^arV&PakgJ_B+#2R;t9s9sbO?wv!OdQEwq?dCuOf>FN$=fbp9i3TXaQBO-d;+o|%J
zO1ljgx-E`Fq@`U4QWfX6>9mEZOV5QW;j6k2<xA&clKL0)^-exE(&o&uoG8+l1<WPv
z#(rsUA<UWi<-Xt^sjloD&hv<P+Gd5)qm}l;_#w28MTqlx_YjLq%d?YCNrL1r&xal@
zM0-yskKAy&EpC!k((kYj+^Br=IpC=bpNKjwEVr}*`dtz|pazjOpX6%jGBi0tlj0I&
z3SNXv2pV0v)RDJ1J>Wj6mNVmqKU$Y?i-IZn_!&m(>cx_8VoTPS-e(8aJRWTNP$K4q
zvKkUKc65rP#RNc=sCl)LUKIrs>pvoFZ54{3Vw>A)vh8ius0K}BOJQ(VS6*Yj90Qj%
z<@#0@F$cevf@@+@<~Jwc#&%z2kB7)!ssMCq6b8%du<m9zBhpo4PB=EtcXS=Oso8(J
z>~ljDJAX9x^X;iWPpX4Za`N6n_w(jY2}J8(P>monT@wN-*hb%`bjxm~&E?srT}ABM
z&S}fMRg%^6=pI=6IEL{<mHwpfx0rwP_OtS~QPW$Jzx3tLYAio}4=MnQ%-eHhwVsCE
zp!Avw_xfKy1Lu^~XbdTz-u>HIB9pS*pVU9bL@@(6zxR``ocujp(BY*O=T82^lU9%d
z<=~+dYLCtfxXHPjGKn10=JrVnZeAc@mO(qVG?JYXRt5@k#1*GW!zJiav7guIYLkWs
z4ysPgHyi%y&4l=BHFNLQ>35|6<%@Z(DQ_s|yneCd>WLV=@dmlYL8Z^7jalV_R%04D
zqk%#EDqOr;$$!2wjAqU+i%!VdNLrwPr?bx=FX_jbPg&8))pX32nzr5~L~?lU_ltKP
z0fByma+`tipOc55u@~0_n|5xvKGJa{_Sj2rYw~(#JoxdI!M+Ew$#wdpz=31)>nfh&
zFo%iFnjBu`!MpBWYZ7D>CX9uG#dMqSq3DV?BJ9QSj>{m81k2I43j89$FDV?3Iustf
zSt$s5Hk<dMJi^sI&AKd(ylBk%hMMz}*Nwvd;9#SAjp~-TKnTyw9!u?wXhFb_0gdgI
z!SYsSnW5x`<GR=*_+5tItYhMxqr!55<Csrck?uV>p50@jMhTj>Bdh4EiE`UqGXd|p
z&cts4G!eRMh5-sBiP<08wTyQ}gyakVuuC(E{`TRq4(ZVjo$J#|l`u9gD5?My{iw+!
zdotP3z~oH#%R&Wn$D@V(fEe;UVzt(b&N}$Y!#qLJd>ftUo80GARMc|Rv<yh$rNZ4n
zaZ#?-t(q1N9_n9*!$82xZ~m26YXz#|;jhcGVzN%p&Kmpg9%MN?Hz9y0QE&rZ3uN)m
zfY9>hp9J$Ql|GnNl>EBD%~G5`!Dd_Y)FlL_lsu0+g6S9n02Se5W*y*g1XW9zlGzlU
zSs{{WvmYk`I?e1d|6$GhmUq`nz>NSLPinDdsJbvguzNpjR^aVJ5*ia&PLpjzC^*hK
z&V>8UCq3@4d^SE?EOesHG2MkW0e-Qe@55Dqp}q)9Ab)!%JuSMTF-9HJfYloj67(w6
z+s%?^quy%xSntTTQeNQmlNq@`5Br*9q+uHU+X6O0Cz&}a3Spmkd?UdL43$=<BM<@|
zi!*nNB6CIypGUX0cZQ0xR7bsUQ9X)m!Y=ND-YG?3oW5!*p~3*SQD0bnUeHPDphitF
zO&tON9h;`h3ymg32{r5^BoRU{5fd<%%ofnA5$I?qgYhzAvRq(X@)8a81T1SAh`Ci}
zqok5fYHU6+n8#B^_<XUd{^$rh;@TEHk+c=-dYk=mwT>?DSvakZ^1-7RyQV7jwHq>X
zgV(Bz14{Q~{Y4Az=IPCphZ-5_24`pPe{umPW!v9l=s91szksrpKI$!Y;^+3$XD5M*
z(+M?Im~?Jlt=#cBS?tlZjpY~+f#(I&3De%qFp4Gf!71_G-&pdblaYs010A==%W<nj
zFQm0j&*Z7<GlW40SHE#N<;J%@v!gSspnoaDqe6jK%BMF?;fP4VPfa3GHkY#7;=j8~
zG20c~!opS-l=;bV(WReoNMpaDuo6OKyXP%P(1n81xrXbSS$Y4ZzXA8Nn)fR4&|jVX
zD#}U)NoS)YYRNaFThv??ktN^t2sC2eZ3g7BY48ZI5|`h5=F&%WJgai9SKNu@Ux|Fj
zW}Wz`(nY%ah&oGJN$Dt<TO200{c|sBVTU+fjGG*?KI_$IN$(!WA^~qD>zEPEHV&^R
z_kpt#?$WVE2{OC9KV1wjB)!jd;dZ<(GlWcINOn6K<&2o3NOg2N;2dwnCm}Cs=eDrd
zR3`5g;%fw50EkhOcJsdQt6+4BNKcB0M^r$7@kX0^3<42hzkoa9Zr@U(UM^x<&tnr|
ztisJLohZ;4xy~02U9gH<QXRQ{g!L=77{TUQ3Sc&RDkVVF_74i5aITdl>cM1ssF((^
z<yl_rA3Cwz^+1f*&+_MEpZk4kd*-{2<MM81Tvq5?96Y!WKPN@JdoO1oza>ZCAu6D9
z0~uTod&lZMvk+FZrYTxR>A3OM2g!lZJs+@fA7gCP5U`ikJeNICa&ZZF1IPXHleuQ0
zT1mG%?w4bVzJ7@rJxGiW`8dVjYu$A12vZSq%{CzzGC|Io+EgVwho3gbfdxYQDnfy+
zS)=1xv@tlX0x4Vt11Vs%gJc$5e<1?eF2h~JxH-JM+U6Ea4U#H;&A9CPyNhB&XqW3l
z4<o4e{Jn&ZP!PAWE?lQoJ{5<-$KYZfspmGUrzINKEgtiAp3%Ue!Jkb0%95M|w|VQq
zVMt1*_I%E-Om%;)6zJp*CN$2oQzN}P>8ys@o%k*D^#B?3pI%d}y1?k=<;BA4uNi8x
ze`hJ^T{xshz(`B;Q~t=j^!W4Y<vD+`{WtOFf_7JhdKYUNn24Ovt*Z)<4T(obKCJ=v
z)Z0(g{{gi$VI$Komew|V32D+Kl8laH@~lLUc!H=G$n*0@*zu`|$j&Q{dGjp=1@u_A
zXpG5r%P$iG#q)KR8>;0CwmJL3T@X4tJJI(3B03fQZ-;>61HF;LVPMJ>SVYjcPUtf4
zDbkgpUpQ=Ot3Smafy}K!oJ7toU1CRAe~O?<ilE<Tl7$s4qcT;lIU&}@$%B^A4YXiK
z{f}weY?SfFn>PE$_h7na(P^?2SLqjZ{=;qj6yrHDZ&rGJQgNSkh=#qlCv<vSEIdA*
zr5P`{`Yzc;+x`9X2peYr7kr`DN*fnYWc&Wu+bfSk$b0wxO*MDRBR-0X95KM!N%H>C
zVU6_M#NZfV$I<sdc+HGh2I(j#Yt(B|_i5~{+)D5Akx_&CcPxL`K+%p0jZpw*(cbe)
z#TJ!ES{c{x%c&XdH8!-aqfy7zxP0=HzPKSt{={a*Ph?vfHTD%+K*|d`8Sg)R=(5CE
z4hdq&ua`EN4BhKFN%3#k7+-uV?6A2Cr)g4BA%mEg>MDWqZ1=Gt*ABF=v~<<NZR>(1
zO)POma?D6A<Fa_ou0DEWxoS|{jO5haR3x`RONF5R@hXYwd&XBFX9qrZ;_hybNq*ZL
zpAS+*i@&&Jol~VdMF;10c;+49y^1uR%5i%h=%EPfmXo{pYbLcHZ%QGP-=hvZrAVx%
zsFmccB9ij#TYg!vt+Zj-wv&&d!|klDYb(ibhwP`g4$a|?fQww79A~imUMtg^mgEzd
z<}iomwLogiW?CPQm%Zffdwc}nT<7oqX68wIdD86rvp$2TG#q}Z!pfrAfm~}K{|3os
z*<||tAq(0}i;Sw$>kdkBjvT#Ms2jR!!!9@tC(xz7Rczz>yniNhUQ+nU>|~92vm>n6
zo>Yd{=~ebV&B`oONJHsk5DOPda#Hn#<3Sw!eqTD^Bz=0ywXQT`JDR;ZSjtMtj~Cc0
zLoBx>Y9*IOr)cCT`!Ku-84Gf6xe7c(29(<uc|rpuQoC{b=D`iR#nNBdp_wV((IJUO
zCX}WLA&HkCVT+6gqd1$8<U&o!5%63`@Xd?HH4j(_xAdW6vcM`SnEXe5Idx3(tjp_T
zLFIDeJ5NxK#E3sJ&;&${YK(N%?P~k*FrXg88tRK4L2hTh=UTowC`yy3pB<Al154(6
z7!0KH=1-Z$20LjPwhTjdRNgEA#zMU~{t_9<t9j6ldAuJy_+*$Whzl+eeNKGUjKL?h
zaSb+_Q|<gD<3A`JScMl)jk6l`aTLWTNJY{BRcU@|wz~-HBfF4p|1&cO5z7d&fn9ib
z`X0k7kww6C`V)?ACAoetV$Yl?n}cAwCm<k&(AyLm4E5NqA{#yCmFWpbdv=o7<{8`W
z5afOKwGn}d14gVK8nq`FY~~6*SxtwVZ{}_9=K9A>N!^{P8?8SF<-^UcJRY30NA#hc
zY(IGnRa_A_qb3+x4ybOh5i0?m#1MLeQDC2h&ATf9UZp5`o}0hpW{@*x5ydNx>efan
ztoa{CiS)LO3%%qw{u|9pUYP-%w{U?7@0F|hn}T}hl@=_OY2#o6q~!&k1u}TR<8s9%
z|6XyC7qmkv;xcc}RYkj8WdXjY^QMD`3;AU*ENJh+wdg|BW=#d*xXdNn^51z;nzIu<
zo&x8%hZuB!Q}^(adELyr8aWTHzU&mpU~M=@ZEO4OyqiX)SERlJXdBMK^AER|JWjGx
zXu{o{amP`3cIH1Od+e=tT2m+;*EcPMw6Lbf_;zpg+8YG5GoBPYwoK@(tBI<1u35{7
zjpbpO$^xFu3m_VtM%9#y&H_)1_GYgL6<ZEqspy>R>k2l7Ew8~MyQqIdPgJ&0yGWX?
z0F4c<%7p0TBlE(&ZXr*NObR11T3QVrL0mL^dmb_XZIXe)DV324oTx=9rZQn3o_Hgp
z9-HfseI%-8zEe|!9>~_5?tB9AoZo5LDW@?0H(PzC$L2He+u4zo*2xKWD{wc#K8a<7
z<|^17>A$p@2#*~<;>A+X0|4|7%JEDTV3$O?;vZXud4C0Ly_ce7u#M)mnSW^(KipiJ
z<TI0J%Be2$1QDYUQt|mId|NSgHwid(Q13979YCtawRr2QV~2pH#7BfSmu`IdD}-{G
z6tocYrAVjFNcc9gx{ni#J6wv&kl^ec5uJT&)E?DOqa6Ezvmq1|@J_yV#|oSiJG8Ax
zg$qDrw~-!O$g`*$#Yt|DpEdKf?Pd@j`izku(pq|v9?K4f$OC2+$0uw-0Zd!nG$eNK
zisi0ve`4dDiZOmA=7~Ogc+Kw#QrzujJHDM4!pSvyb`9MHrbKWTyXrEexa~|#)$my=
z*fIuVRv|}inhR%+3DzB;hkE{py)hTjVcQ|wg!{lQ4%5<tTaif55wuCK@}v2%*xglc
zy~m%O&^7MZW4kCJb{=_|A%qI_5W8IHmx6U~UMhzlY0%6l)$X~2i?}@8Twyed=ExCF
z_ln~TsIq?MS#pz(3Ow?={LN4^%sX-Gvi%iu&%=gRO9;M=suq|i1B#yh8VI>#J24N1
z0y{$|^ykxe2EuaVuR3%=-7nTs_QS@YDHz28qygOL?v&hCJNxDSY6IyA@)O%CG%5@l
z%UE4zI*A^qw?q%e6eLw8_&JoCy!W8&6k$YPUf1{?5fy4E6WvB<s)yt#q4lx4w0{**
z_c_0e`V{11e=DE7gs=DNRcnltnGe`bFd^d|98lw2AC@@=R1#h1*px(;W5TF@a}TYh
z`iCvv)<@nP$Dmq(+Iwps_D-1L%jm(|w5}^DdrG00@4xiUz_EMZy~C5QkjIf`hFKt5
z?}z=8t?fqC3}KH5uj)CIa-8l2bS|xmv0!&l2wcz4T1qSg+4b1(2t5M<wmHF-`!1ai
zQj^#TpRAUcjb8|q##ZiOC~-o^PqlF=Cm71JX{C_bCtB}Ef6$}7F~(8fAK$d#p3WAi
zP?<X#>f`ovg-Go0$ETu49%T=d$l|~OvrW=z?usp}&O=!aT}q@0VT0s6=Q~Z5K`24)
zMYbuEMn<KTR^7mZXEhG-bKj?2GGep4gKoY<zPIOYQRtlgbetq|?jW<leJl^M03j}#
zeQ!58!py1XA7bP5&puYMOaDnhuI7keu^wZ7kS$Kqbw+m~PxTH-Ub5N<32J_9hj)?L
zKz*<T%c{^^ujD130-xKs_S^WfLT)o;TLS>t_>c0!|DTNTfAY)^3xESBTR<FJj&$|l
zR3V<xr<F2^q2@@H^<}QUnMyGtoBBp)fWp0dPW@_dE$&z;xbz;6OXUsv()Oa<6ajnw
zt^DKOSe)~MRuhT^11QnLHuqXf<O;K&2^28eM<MU<S1%>l>Ol1Qy4)v1^D~CS=#}t(
z(}gy?`Izm6*U>+6eq%($y>@Ta1H6N0(i`i^gpe-F^c?>&>V1RNPhmO|zwUyxRSiea
zrxx449;c(L50*?gbkpSRHz4j%uf%ZMl(|n5zr13S=Sw>P4#xHU5U+V!%9eH|>GJ$s
zkt2K0y%SmYG}z~{yNeX5y()5t1c1ZDk2u%<j3t`D{035KMc<4jhc)j<?{Tn9)aLqg
zKO>6s9c{(Sb-VUL>9~i#98yO^123kvs|+6caDRVf2V%cY8x#%QwWxaHOuGW<{{ihR
zsya3gZuU?T^vAMnkzg5dMmbZynmsloIG=#?85j572+pIEwx92_HkV4YS$}*&L<LTo
zc{2|Jy4TFw7&9_5mVSk1EDNvtSkS!7?;Kj>Sms{_Z*V+MzCnJ&wKlzAfPG#ONJ$&S
zitImme2<~4?5L+9z$QiYw(jUEkg;gya6{D9U(UqIcXiC+D&HRLB1Fl8(F=`@Y{<0R
ze-+kRGpKxM&=&WMCcMmkFxed8<RseV-W&bSQTUr%$0#?~*<JiSQy+9eq}>T_Wv7SL
z6TC|uBmqs=$|_<;v=*-O&8>rPh0SmZDewy8M2>hvb4E$*5DYF>%-*{kdsTCh0ksSB
zLV=V*5TpJc1-at2p2Un!a`mq&mm}IYiZ-oR@-%iQZRYvMtNmD5?YydRA}t0_1)dTE
zP39!4c%1hgbgY#ZeP#_6jN;bVQq$Y(yB{*ix!~;rK4a}XXgy!3WZgCoA}oP{AQ#9x
z1Hx2?G#{Zz#<!)Xs<zP%W4q&?6>87f2FMyj*MD`RAIv7uDrG(!9%)?cwRySehKR;$
zeAP@s+K4mXHuxyVtsX#QG9GAsPHJ59=JIJM>Z7<Oj#{}dth`x_VtA9awFZTz*f|bk
zeu(^?&Jaf#e&+Xi12+rC`xnyNVLNpodLkn+fYWp<J0@C$X^x9QHe;1XfhX(@AbCPh
zz3G6qvRe-)H^9`gfgHXyPMG&3_?}9?MG8h;VX#Du!h^~XZF42%ujDP0w^{~Y0<R^2
zSUXZn!lQe%5=YcYAp5^I6?06EkrUA5?&+{TrMNsDNy!k@Xf|5ff)s<Tx?K(s0D2l)
zp&Pw$(H8?8XJ6x)ft}%_=+$|^Pl2sVi<zd%hyT2?xhzfh_87N$UHiZ~%x?CV$edT3
ztXdFKJ#+=9{NmDTmwLsva?5<h$x^E=T<+3qEbgJ;_5*lRP4ZTP)^*vvFgGakZsxXF
zsyNgAVf!8Z$q4ooLAi`qieV)XjVisN&QB`4gfzH=l56h0C=liWbz5huFoxu^HFNVF
zhLuKkMg&8D28bnPPD=_Jz;@ECN75Drx^}Gj?47Nrw?Jx|$YsOhX<ZnOoAsG}*KRtI
z`WaKzHukgW14<g2<KO=MXK|&)q;#N~bC+F;3E2==B_<y#Q(7T?3}se-a$(YHLY5Wn
ziAdUGz`xRrt4_&aJ=e}g>^nEI<&M2O#6Bv8Ai0~g?0=<pOl>^@YtIl4F+v`M+^PqQ
zTHMrMc)Y+g`JQs8uFI*)<uAW>v$>erU9$Vaa!#_N(Q*@$YcyO&lyrqAl&pQloMRC`
z;UA>eQKJXq|IKo~PggSc;B4|GBe`)|rCIep-O8K{=C<DGi1SO|T|qpT?TCP4=amAF
zGCRQ8n#!AUje4ZC*VmOdM`XJ2Z0g}J>atvR3F7BG=7-ml$-p$>Ko*S8Wf5xRtsJ2R
zwtHmpdx_6Xt0ln@V+W?nYVm%%wIsEpy1{2#TtBa=YXU9C8>FboiAFbfPUYQ;ADgJ{
zD!qGPOi6XP3>I2{$KBC<cdgp0XwN4j(VYbYjQ(v(>xj0%et>L}@gMJ$DHlA6KjsDf
zX2kwo&rI>t)=YADlNo7CxGi7<S@}Sd6o<1Q*<8}gqgkmrTr_>}@*Cd$^=QKa+W}O(
zTlW_h+Imk&-7>wj=!xJh7L+D&t?f;4RVClFIii48)~H=%n%}=yrSlO|n4Y0~qW@%c
zfJ9k-%~z#gPYZK<T1`0}+NCUKbhZdWI6)mM*?9zwVcHv@Fni2tz^!5iETu|@x~zg@
z5qB`vKy3>9fk8!B^bP$y{o5;npn!PSEP+rCJv-w8krxS@61d;@u=yWwjjP@Yc+|!`
zN1JfDu*>Bcb9p{-_eEZAV%WsD%L?v%?r+Han2=<_iT=(}R_7}lFH-EA&g4Lv=`B3C
zC3;Q3OxJNbTYA@AUQY17(5<V$5^>7MyF_i+P9uxNIIC9p<caywtgOgAl^|~_&b5pk
zwj~zHNfmLnaHyWRUQVCX2((8JmUNZC+4C5TOS1|@WeA+my<S5Sj7<|-9?|(V)a-~}
zR*BglUmBbcC7qlHA^0ArW_)hRbarMKhMw6VX1K(T(gtU~g4jzEv=MZ<yFE8D4jT22
zqBysxO3JyAa~0(MVKQ5mOYc%GEQ#lKuhIi4ol%?QX>n9s=_7|yNU(>8Flxts-P=N>
zen%Ae+UVFGp{3WLa-<HJF{__?2rSc4X17a)jPZ>w{74k}uMhwMpUjWCOwp$^m>$OY
zZv)i<PU-+XbSMT6w4WZhz-X1my^Ny7_T~3_9;Jl;)Q%nh9@_(ojUCs;hxz}eZ2cX<
zSMb*G)vJQJ(jwb`)oc9<51P>5_`3CPzB)|FLFEVg|79VY{sM})ITfo70}6#&uaTSj
zmiNxqb@?fwbov0hgxKgBKY$blx_TSq=z25WC)@!;RH#<oiZz#yhWG*87k0Z0?!&{@
z0lLD$e(p(;rj6ael;aN;=%#+O4S{R?Y~*g~>V!%JH=Rw_d$2CRS0tfjM^qgL2hDFp
zJ!usYoh7%ghDCtRU1KI7%8|D7mLEfGWFsi-4{G}swN>_g18ur$j`8kcmfur~GZ;I8
zD$;eoXVABB+MFC~j)k%l6k`iXYBFYiRMs;Z7tBI0c-Gf&Eq8L1Yq}z;V-UyH_JMnU
z6Tmms69<hx*={#<%-&GVl}ikN`&pBD9#=dSl5aEa;((cl$E7j0M+Fz<!menYpd;#%
zG^KJ7kqJi=TqB(mig2c6T53*iBJhtnH7+T*HBV*%7uPg&jmwMc5UF<3oIi^T9|hjR
z%b+98s|gUrw2uXlk^HPx6s+$@{L@SN&|b++)@FXY*e1mYNHAFKCd&fUWwVo-ynyVx
zXE02Jr)M!8;a2$VMCKTk{m6B-JR@_H92wgk)gE0C7<NCC!kfhB*dCmX&Fp$0_zo_?
zVk=r`X>)Y~(qGkdi3kn3hfl5tQi82x7e7JYDG>&(c%7JsH<FAt8CM8N_FPjvJW!xl
zSEqtgwowf$$k-JkwJAG}T<G0TNnyv$8ry4MV}-!+w)}{Xt%GmK9V&ZC#{OLX&U3KT
zJGz%KFyQx`S^kClb?ivr3SAIk7PmU|YwU7gM$%aToS^!+jkIm{azGcB`aP@E<1THk
z2JI(Yz@Uo(pZWRGawDPnY<_VQ2@}}$QwM{90qTl&rSnke2#j$C`+u(_+O7{brR%Zz
zb)ZeVnQs|aaa|6!h}k?4b>Mosl$68<xP%Iho8uJox}#bq?s&3H7C$BV><JAUn57e!
z-1mtc-E-(q_hpMN*X=#t#R-l8_u+BQ8IvNR+{e2k70QFr%{#<1N-HGL%VSYB;|BnM
zlQm!i*E?$dPWbu=ooufaBo%ErO$9$vPIkAm@Yshb-Co>8x+h#zGf8_TFESl;`)?)W
zc6b$0+WJ&jkYJ6AJ=a?4x5CsVk(=Lgiz8^BNQytdxDQC#s0l$#cG#L9z}}X_h8_9i
zf0#Zz#Z2t<cjVM=lrJN63?9An;BTHHH7%Qtiybe<AEpYr-&r_lB0xaw?Dy?wVYZ@w
zJy3J=JvHTJ5>@DC;7kXZ2aIjWVEOG*YAS81_nwxA<2;-7^K2OCp~>i>r?BT$I7~Vg
znQqJRw&i)tbtKb=>axEN67h%9V|>c#RuE9obYc6Dr=UT!0D-%ba!2HFHLK?^E6oIi
zhNy*PRG~d<)PtJ`cx9RmO`Q_~E67`jL=+bkQ1w7SZwG*=3<--Aj0vyZ2y&C8sd2Vd
zY#`Gk9?l2(Euhp;wR3B`6F!9SK`m;HqwceUdCv_0`u4oeDk^naTJS9cG!;}-$h8jX
zS+zudRBX*u3ZDM)=|&#R&1bu|+z>UewX=QP5%^bd>JM;b=9C7@5!p#&clE^Jo%2qc
zrwzg{F~0x&V_N8v6NU+LZX<&VcYv!MO((C483Act|KLcti`1E^N5}zTvDeT`?gAgC
zUZ^||>m@fn#iRS53wrb`<W;NaXwx)mcmBtspofBx?Te*3(Yi2XfJ=ofa@A$fcvZy2
z0s!!p2C!q<0zzY)q>l#@murmqHaKJv!gHC2gYW^%67AU7J-1j{43~8SDXF=ii3Jt9
zre*6N)x~&!QyeFM0+a&#l`<rRN-^3mV}j?7hSXg!%-eANW!sj9&D7K#6N{3;90mSO
z*SoY*nX$b#(ZPPY!Y|9`56tVbn)I@pc#DW#LK#^(%FGvXlHr-jvwW_pb9(ME8$%)*
zcpVb-;h0*_o?_sIFi*jmTHl7K#f3n*>r|7U@K;KBBHysxl(oXUnqG9{>?NqQ+Q8|%
zh|DSD^7;#}ZmZIG{BLgraAN)Z%we6HjmI^I?1mm?#%O%ehUb$<PsS7Wv-IztRTNW~
znZoBNS#a!J=L#qI4xcBt;g_Pn!Gytt-p*P=XI}Qflgd>k;<LnGL_Qc=+6U*8UKQ?C
zgh%tY1kfh?fA<1*!>gjRXFB&kVMDliT&N9LF6GL=hcK~l-JlM~vrJ<bpu+~-diR6G
zFhL?SwUg@m^_C9G>$0aWpFfK4-^^YyWzS671RLI^DKY7k@2#eulLPR*dbNE?vs*f%
zL3Qcu#^S2qK1tT68>wSykG-S7K1@cCkrH4<D<;Rg-hK_pN{Aoo)Q3PeKNCJ+Dnbd;
zz8-e4i(4`!AN=*aU<4l}l&9WZC79fF+e;xh6>ZI5UeE1d53=tJU^FV^YP!e<@3d}2
z@D?#^z%as2Rd!}sM-*=?G_N1^n5AYs+keSydSWb6@<vBnvt8?)yiu5Dg$JFUPAK&C
z&Dx5kLEU58j2OWPj(6`gX*8*w2)@0;BK;jiX^k0a4bI|5vLJKyHDy!g$R~R{m(S~}
zAP39dxc$#nuzQ9TD{0ci2=J1|-H>~4JY<3Dsdy?yB{d_#iTqF4#!5su^@GAY?-$P&
zHW*!pJ-^!#zK(BRp2@a@yOsmoYNa+=0f4D{xwas4rEPFY@OD8{Si+LBQoWxQCH;%j
zq&QdmtD=O|UA7R>=%Fe8baj>biz=$s2MPcpnP@lga$}yB;keKVk&@{4V%$9g`~BVE
z4JjJ?BLpfK?{R-~3kn0P`fI?)v#wc3)334;*!S#@2eMi$Ez^_g0;H%_W>r)Ve*bn|
zaVV1pB8r_aK*4+b5wa83UlQ7R*#1QQy{9%69S_*q0X@9DuL5O$`zNN(`}8K@a6FT4
z7Qep0=~rNGa319EOihV;a{pkAvlT3|Tn{r6_j=x;=F%wTkVRG_$}(X)eE*rAxYChf
zit_o^sic^%1kdenVtJPaj;D%kvJ;%Ls_b7eHy^-;>)%`yr_u@avcEr_3s9)1NZmg{
zx~)9_$GrSyH~|Hqt{V6j{A-hzTo&}?!>Vp<o0m7+Dn9#UhDuK7Zqp!2Kc{?pNy^xs
zy*8AO_rJw)vY2@{9LeaKD3j?uwo`4Y_Hi%Y!3ZHyTDIMmw^UA7ZA6bAYKxR20|jXf
z8UZ_c@)j|iV{%1gLzW>2Ds)q3^-O86e@OrQ!iQB6RRzpY{)bwT{^X-5UZolG|4q91
zpD6Xe&|mSg7#fbM{wxjj<n<ayt?musM2A)WC0<6U!{CKVu|_de!&Vu=qUXITPUn5_
z`OpL^zQGx5{I!VVp~fW@4I)rkI^c^6yX7}MRk^iw+oesq0D!Qe(Ew&=GDWpI;P`G~
z)1F&8PTA9?`k%&hA3tqS%jQGA&nRL+Xs1Oc03!WYg}W|&iNgJk^YXDEn1KbauYAzw
z)Lqpy0X*eOOzAyW120lK?4+jhK@6^}?NcG@qDUY6;LuWXfav@Lm8}-%tN!q#HSmT0
zJbyt0pP(@ACZ^&9Q%v5Dz7n_edd?Q=wf>XwI;{Bk&)-}8%4bsHrw*^5(&X>23|Y8E
zN%Rv3NJQrs#p;iry@(WA&L=-O`}?;ieUm7D1yTM4Lev-HtsebL0Z6MoBY$0Ff1$?a
zeOhJcP6zhI!=8d3b@K{r1F`8w1rFTZR!ft|96}cU4Jmaz3QaLBu}r>@2;L|R>Npv-
zP<WT#TT+G4ZFv=KAO4xH+K*f9r<l$;IY7tA;zdW4*iNvhT1JjVO?f|SX#1R+$<9WM
zfsw13a3^C(m(=Zv`D68V2<}>w;<dF9v0PDvYxzU2+>%c<%8BVEkQ71Jy=$s8f+Po0
zH<vbLniY-B)J96Y3pftu_E7h(FJ+n|?f{h=Ju#eVlC+ckPMj}9&Le-uLyp^pR(I7m
z9`F6>27X&6wMwLRkAwv`_eKaUm%VbP>t4S6jzy$|<Wh`3m{Ox+;CZrMLMX>q^pG*Z
z)f;N~RUzT?#;YB<te=F2M8~B(4{Byd6Ljjim;0Xlkf;M>WZ3ydTeZEo&oY-D@#$a%
zZ1{tVucq~me_{L2Tf-WUBGu)H)7M}ALALQHpmRmkS0k@B7sh0}9!-Qvtup=LO9<%U
zt|`ip+PvnDBQLp6F#J4UIibE+m`8;rIow|sFcjm`y8PtH8=LP!)qk0Oz4Gcxdqt_Y
zb->5t@)mzKM^Pf=cfzB5*862&7fKhXHa(#D?wOd%795*pkz?Lpt54%H{57q*Dn<l(
zU&ZE2$yM(RcQ73v=VEkIH>at}54W(sw1Qe}ZA{#p#On`NOG@N7f71Bpc50tLZ7sd`
z=g)^=(c+t?pALPQ$MgX#)|hQdsFTagMQ?rgoL*J*8)~nkPVzO%J3+aapqA8KnEQ}+
zf86<9hM%i>w<bi2RSb0Q8lc!x0!h%KT1;QUjTywIgkoafC$#CiOC{k0l=iD=G~q;=
zbiX8tu-an!{SO+;Vq~V()6uUI^FNn~FdXy9+E@{mhIP)J#k#e8PFVjk$f_=^+TPY4
z+f3TzM|ClB6h_Nc{e-sakYs6-TWbG0nj?=yh*_ymSLwFFx1yMD9^yE~Mma*moqtyr
zu)&plNQHUV<H&sJz#@VZ6%_$BQe5E_e^Sv(<+2Be%tdR4+A6uwYHKrbPcQ*CqUm}v
z1ny7EG!`;KYvbA9r#aT&L#X82jhYp5lo%7*=6Ozq&|J(4ArAp@r5S3b47vg4^D4%C
zydh6E(W5Lyoj!FAjIr7hDu5jUA(A#s&|dm!zWEJcre5-&wh3DULTj?^g8m-H<B%XL
zPeUjLm<-CVa`_q`PhOlPO|aoj@B`~o>eiH9Sb5MB8NEswqxXpwGC$v`KfSIU`Wf+j
zEws+M#?t8RQf>NoNbHB9YWOFaZKBFw(H@-LW?#Erv$|}Wa>@JX=Kj<ji3xE^DPg`;
zu4Ili|4<r(bG3kIjpvYpOF|jfrl}0Id^P4Ke%URmt33T1E3#w{(hb@+OkN(03FOhB
zQ3~5MZ5pvk?-()?HgZa<yvHgsK`U(R&a5RI960jaqVO@X#xU`cS#VdnsyE@H<kbN$
zmy@LeF{i!kyDz~F>)u{gdgf*C5<9tFFl*<HdP*f>HzfRTb^sn_;)8a@AiC4E-?S`4
ziF8Wkjh<6AG`yeKqInA>DvWb~%oVCBFGCLVk6VP5&rzMB$2M3J1ib<6<ZFH|+Fa_#
zcZ|Pj<b<BOta{SRAQXrJzJCGW9S_R=j}+niyHO$ou!4Z6!V#<$G%_)?QuUv|2?oEh
z4Z#m9*66?^WPq?u!wb|syr_QQf2)-LZ^O-h(cfnuars>NPSYMP2dTLeG_NeOFj<fN
zijFPibN-5eUL&<Dzax|IS}&BfFPDDYQv6HQQN4v3!QFqkhMt`dLWeXt7=d;&ocv`-
zymqt9ZLEz?^$d;hbYD00>NB&YM5$D{OLBqLixA7DGds#KF_R-cd}hSwvcbiU;b?0d
z_yKCv$dRtn_bXr}b?wy1X{wrPhVL-T*5}9{%$#Zsa+esnXZ7icbRAH(E%D%kdaO2z
zloZ#WYq7D!UFFqHY*)yDxJk2*?I>1~9~gKu-=>8~fcC>krTdc=e<m-*oqu+dHKN4_
z?7Y}POjMLglM~0i_tmPp?qKH=5Wv`2YRPhvq~8NR_|+6ya8|@r&dd8iC<-O}pwuxq
zUvR!fe6?AW;<)GW1BX`iL$)XkM|oE4kQzRI2E0gbu?m@4KXrY%9yt5FF3U!5{f~}<
z>nJe?!1O+OJItRa$o)~gPG9{b*}M_$=@KW+sg@ogV|f@~??&FipUW9&Gs(M~84-L(
z1RkkyT^s71?=3Utic}0ZHf=4TI^B+9LOM==y*wBjT6j`_)2)P$7%mK-T8Fynf2Qa!
zd%o!`W%u=8I4mGv*fCfJ0OshuP@}t-T9|7)-y^Fy`}zzZ2Cy*CRbrhSF5_$Lq&cD(
zDnX{XY;DiPU1Jg@hX+`eUkY+Fvq!ZfVk;jBPF&giDHL|Gn2-B<^PHW=c^};zv*yRQ
zNumW4*JHu7*0S{~^XXuOfx}yord8T&R)2*R{#a-1?qxh(w<MrVlLGKz+N`{22VN#=
zxmU<neX2=1bFJaQ^t=913QI+74XCUIX)7oqVw*aCGhaRmora!fsz3b)a4G!oDGyVH
zp9D3289xm^OcB?4C-W9p2V<4pee)a51l)sg={l}zj?>$IMqkc#20sj2JFxaD!``@D
zDTo1&=mU#c)zv(DHrUQG={hxo*q_vWga|zae5JpD9G%TFWdy#RV`Nt`Pg20b%qdyt
z43FeO+FR|#s3@4v0RZg=jBRtr8hI%4w}EAdVSuqW<2wku$;WMQXk~ir(B$I{p#Sjj
zdRGbXJB5xo6uBpWx2BkXB7%~8U@{vX9{B*Vf9+DGYqb;2rk*BW_S{;|b+8$#@;(cv
z{~eo%&prQNnqYoRW2tPg(mV!R2*@Lsxc@R;$`u8<TyjM%PJ~D2DTNg1WQr_3vF#xO
zXW}WUuWu=EDwqu#^U0E;qWqsfiBxb`6KS76f7s0nNoKf3JN0_*F<mDb3D>f;WXImX
zfrSC^wHA0MTL1OyI4RdT=WfvuB7BYXl@?ttRCYs0*r1^iuUwx1x>SX-U}#h@VwcCO
z6~sUn7eRBdOHpz>{}udlz&1F4sZsLE${`Mybnl90UF$5^;O}_6`ag(C{B8sJ(pMTU
zkA<&wu-%}M^K)Fmd)%RjZqjGk+G-^)b5qmPqo_ILozbj=_)Z0{XLmQ=TN6gDMPBh?
zw3gyxS%nTZY|PE$=WT!-;^N{<mk|WFYi)Z;EW<8l&6?c4%?ZV(q|9GRSra~)|5{*1
z)ZY1+pg3OpeuBF^Pr)?pEF!a8bnqPBy36?jq->ROz|b|Vr*gCmgm)mzl}dD)&NI7S
zrzV8DXBkoZB^tm!%&pSQ>rBSPo`=2mWO{ogNQ;NR?pD-%duZMHnXCy0ou@nYYfj3d
zmO-^$uIQL24z02^ljq+)2rA)j@?7>R#E}obre>6{-KJ>i#N=u1c2~Gd9{bGUl7G(|
zfuu|^F95A49L~Fvf$lYB0nFHr-nBwj&JkosO6LTwGjg7?1(XV9n38+?5|y2SJXkK}
zGkgC0`RaOi6zr>rRk^nB+27w4A*aIvu<(-vn;F03mDXdtT+=v&)z!&r?WhoTs%)CW
zuK{T-em^#?uw%a3D2o%%D*<k)V7VY=2`T6#S+&pezlz^4sWeil<^||lVLZ+|@=CN4
z>~GNEqh%kM;?mdfYHYYX4ozw^f7b{b^nR5Y+CfB%WC{F!5;UW9eXI_pZqf3?eQp=P
z?c&XmQynPM?K{y8=WA9E$C4;JAp+P>8?x7U5xW9JRu;JSVjND4i_6pPHnOw|t<vC?
zLa;o56s>`yUrW9$#f7U01DswNnPW8*tVL)P5fOsKZ+~Zh0=v$;zzQ{!)V#dJ-$QQv
z-4$35FNwg6LtoR9B)13>XnQw|Djtq$P#51{m65q0e3v3D#P5+#s1ND?1p(cyRdd_!
z_f{XJv%fQp;AwUaShA(-&$CjcOX-HsPeg9ZiniyQ7xUKN_~7-}E>`IgV^{mN?_kuj
zuM&~oydL7I-~LWsK1+6+;(Y~+WbGWB1PP^Hh6O5?uiOrxP5u60+;wF4%L}OZbrG-9
zKf)mqeGfE?3<7xYLWy^K+)m0Ejsi3H>dM@?!%qpPClqdf^NK`Em9%RK{Fx2-5jMW=
zzJ;SX47-5=c57pMp?9z+TZ6nxN>&+!)5W?`%SUs0FyLX`pxFBrS<CRN9TyMZK*j!A
z<Vnm|P-}<^nTT<DUBX?XijtWL5uWJ>D9ctG;z-`Me?WdIghVmy)vr4*p&dW(mo%EK
zG%qoADb@+681{1$nFLEOup%GWqC(u(eTY*d<9J#e-;9WXolxq{Q=o=U&x{rk)ivu|
zL7^SmV_G%aYVqrwVSt^6;QUfguq)y@-pgswV>J;e914u-{JO7-x;(<q*xGL{m(3BQ
zyEi%baJ$VQyCG)ot^5S#V~f<iOA7uNCTyA;VCso(B2eA6iy_Tx=`8<H%X?&e6&~Dm
zJy541G_PV%C3*qU{@e}1=lxzUBAq+RtxD);dcGomn!qT0QmDd3B=Bref#H4g{bRoZ
zjl6BR7ye>JGj`s~JRtS$9ZZ<mEVHq7=4lzcRghVnD=I_){Z2a7%2$8@NjN26=Cr+j
z{kohe@O(<^<hTtk9fBxHHYaKelI{BO2~;L!i7JNdh{i+!V4@R}-C4~oW>ugM@&Vap
z{fFZ=L=O}`1m7#(U<i8I{nPM8kG6H7wr(W2H>rTc92@R^r<7Ul3VT`7jt>Kz){{!o
z2R{4Tckje|Z(L>xu4w{a_RAQE(!b@FaNrXe9^ogbE-PmAkJW}a)U|MdkALSzvrnmb
z5h0_qgHw{ax$n!z;P;o9n0P5QdE;b|Yn~I97>-DYU~}}H?|<SV@TV8N1ZWQJcBnb{
zn&6nr{##1+KO*0@eZdk|X5$X$8I2CGXQ<PROFB&_uj5t)*lVK;sxj1e&zKVvZb!EG
z>WdGJG|uUJC*7rHc$oJ?foX~1fUtm9E#f$mWAVdXa#gl#uWm;!k#R}MOCP~U1%%(K
zlXC>aO<dKDHsgiusVx73N-i5{6qUohZCYl-ckND;I$g$6vZPKpd(-q{Sawqc)x2*b
zU(S5iIN#;?=ck-gyhh01thEOPZY9ZNH}^v+x9vlwYww3H7#I!1m-mOCdNuj+qyyI?
z%?t2lB_MhkidYMQzXMhoDi8Zq6GPb5vYO14>hKMx+_Wl3ycX!wlty8jP7M2<@H4}w
z^~)l=RC6eh88=V;9ehtH;CCWU*FcBfYxG|!@1H7%heH0ymWwA|gc?2ht?%pq-P!zK
zxR?I|hX0?8&McbhUv$US{m)tI|9)ZfH>fsoC1vWeR!;EhpTJZVd1|uP|52Aaj?+e&
z23ci=0Le*^O!*H#C~OSSzp$~WzRVLA{JCXV`=&zh6&|Vpg1(l%9e=PDzPWDMqMLDL
zT>b4QFre^k-Pq9te6&dB`EnikbmluAmX7p%W0n)7sKB=g*SvMG#~LnX$%%8ydYW-~
zH3ikWT^cT!6iQp%f{z$4(0i&lnt=zBlC2cV++7v)>si*mp5l}NyJbT?khi>lRqDtc
z;~LhjGm;wHay^s1?JT29iH@5SZVT4F%XjWybw0l{@aFiM{KoQK3Pr;)>j&6QCsu|h
ztf;IRvHEuVMT>y~{CY!TL%DRs;L~TP=~TsM)@Sk$RKCXucZP94kYAT=q4dETRg$Yc
z46yIMdESZkB(ZAnzG46A0#faSlGBqC1<=8r7W5x*S`ufrF4u)In0Rp9YWsb@DtW$&
z=jqEIj#{>}@AuYBUka26YsGolD45v(I_YphIxLwQCNj`eOayNcZ9A02*$><Y#w>|;
zCbS0ZLEAznUK2aI#IPpkG><g{Yn^j5zj&Ox+o%LnOG|C;{zSI(bMI<^A;5coY-WJU
z$B$21$@{eTd1QCc;Drs90v`*94ai#3ENO`C=FJu@Tj2;H`_q06>ann^Ft;GM+|LX8
zZV6t}obBo;o)-fNoa(<l$84^sr8~aIp<IAIHQPnAPY0kIBV07gdB$0-4uvMx{Di!I
z8w9e9)xBCCyS!ddo)_Oc$TODK?#d_ktgujj*%=4CEEANVV^~<3O0TW#iTqA@qkPDf
z;QG=^WNE8sZ6{0dog6h~-ltg@RBgNpy3Wh{@Do2&kJNyLkD!_mC%(KQ5|}=~18x(X
zltipPI&K~n6F~}B=84nC$oy6vXEl}!HT{%FmluidKpIGj(#B})Na6T8>{cb=++(XV
zWLu{ceNMTtbQb4u<HF8_g5z%mPnM|Xx8FY;(N-V#2irV+gt^-^h^y`pXnL%6fUs=L
zIsc6H5wuFan%Gx2FTq-`EHnbyPs!)rye%l*`@8c7yzotSi(`x)N^`B-SAPM&k5gWZ
zy<gy*@DS5sy=b1Gg}D{hrmXOtCTZ}N1-=hDm`;;lAa+va@zTeF$k(;()u;JcS7VQ5
zuLpUWaDfhMM>v{}`Hzc3?Cca4o3alE<K~d6ENq<g?VT*lX_4>ZIwnOf`4iLUEg@6|
zl9kDi&cwpZ#80^_wmk^g0K`oNmPT(<ls^D+!nqp$yua7Y-}^jt;KS^~D+&5<ddXU$
zNV7g@Zsbh(!OHY6(D*YB2}X|js-E%=J3Qs)Lc3J|*mF_<6X4|eViGQg&8xd>kXRp9
zo}p|On#p_b?lPDzIEkg`sG{@>Lj~Kh=?EC^Z(hJr*OZ?n-JPFXFx8nrln8pP>>A@=
z`)>Z?%`_trw(PG(G7tyKJjrABhxiLy*a_b2M{cf$Jf)ZZ8{!p9?*Gtjl}_xvQNe<U
z`ZtvFl3$WWv%j50vBa-9xI$BuzZk8?YruvFY|#)?!^CN*BdgEQ?g~=7wtD`I)1UWy
z!i~BpS4J%J9#aaet^C7%4$*_sxi6w4eF|~NYd|Ga>99ea^L(XTH5Z+Uz|ZlVgg%a-
zg8E0)cl6=O*9>NEZj~q~xl#P}K!e306Y|@7Tduz|9JcfQ?+qnef>)EfXVt}z(+gv>
zq%==TLv&~lFd*7rwL=)r`8wy$PEMWM0Fi9^=TuqedzQgvvR#E#ulsXU+!9}y=VGns
zd7ZvsUvEz)`d63rxXlj$+vz=;%fQ9qqDLQ&p;7;*wX+V2x()liB8Y?_jf4nDH#~HS
zETx1<HxdGiC@sCxOD!dh#G-V=0@A&pbc1vVl8e+*yYCO*nRCvZc+Yue&Y#OHGcd#N
z;=aG1&-L9Fi$XmXuxI@JOX5a?;2ubA33iu6azOhVup^^VmowdUZm5ltGfh<5(W*Kl
z-;sX)l3}~M@@-|5`BS9yA8pfDVB=~f=|7Z>u$~}fIDB18q^k3u=(jr@2SvDS`S{M?
ze{4KZ6Yut<k&R=5F7}a-%Cz1p?Q~hX_`NuMYjlk1Bl)!OfW;1V+3)x`CySb})}}Bg
z#UX!+xDO+Ncmm~tzB}X+laEYiiCVg&kZTpH+_v`%W-j_3GktW}8OZ)hSt61ybxhtd
z4B%)eFlaBm)M;{c`Hj7}J`8qLBlt(tJzgulqt2J#=?HXfVVkQmv$Mo1mtqR!-QTM9
zLt|&5nOxp8>wMuKc7)fP-HZEWZ)h3|?WXk<AbK4bY?i&9|6+-hrnc0y5(0_|j7Pf|
zXlYEsY$1Nnn_~ZHC0lD^-gLtrM%j$c#WML(SgrJ~s+e-l9(3gIa-cE~9(IqnWt(%c
z3eE5sUz>oGob9e%{{E7TPtV^Sj%n7Gy5KCPOkIQ<TY+r-YwT0nWSGuPj)$e(svHKe
z$t%vD3t_f3C)sM}7^{X&KB81R`^>%o%{?g(a;klm8Q%R|Zm(1r6wXqOqFEK0%Hi~t
z*-d(H*}=+k+>>zh{9)tC4!dz}8trr&@i|3U`(cI#l+hC0a{2=4Hms@e%!q$XC#*f~
z@b34fh#YCWpNhkeH}_#P=u0701~J?soyG15CU+fQt*;cX>;^h5kDL_;UJjUM#Z07%
z$8qhm9+oqFy8oj$l7nGH+2`)?v)0Uc)9lcRFHKdvZ@xGT$Om2imLu1ctV;Wb+InNl
zDDG}s)7^;gyQ8^V%?|ku7_+{jsx==3KAes|<#ViyY*c)n*%|ATbmWz^l;CEXN?avY
zU~c${kOPkEY2Bm`kp@-&FxTOb#cSvAm{gwq*O~U92inJoVu}eVqnEQaADAVZWZ#rS
zNY-$&!~i^O)XfKxs&BxihGjnU=gj}&O!lT<MI<qkwttzUnzHVSPZ{$&B<(z7CF!V{
z(MrhD@a~&I`dD;(xEFLw2KhG}Bmvqt{_o`)WU`xW9*!gOuoob^i5!LC2|Dd@R7x`x
z$_wq1`*)Qbl#?g{Y%8@An;z$NBb|yCiY7b)YFu1+?H#^Z&v3Kj$v$Nq@s%XSj3HQl
ze(@m<A_)kqCK5njH`-3utPN|f@4@t@Bfl#9F8FUfS-jY7kb;NK#)nU!c^f9*yjUA#
z44yEJ1+u@$R%j>0?p!SzyK{T}tyDBCha>8`A6(TpP3PpBw@F)fAe#$=eWD*<TZ>yZ
zF@EYr^Ty#!xaFnOWuLFpw<IDmZO}^FX(H>)`2qpoF^}z5_DJy3Ou%MTo|pZ`Z9hZ(
zuR{_V#(kPN)XDG$5TD~^=K{Gg(uDw}ZaYHp_eO!;Dp`{-^&k%~E=Ek3@E7%LHAp>K
z9C=9k#l7neYtvc^mwY?YgQnf=_S-_-#p_2iJ|MFkZ4i%7F-@A|3n54dcLIQ}0>aEp
zlDeL(_~Hi2hJDm;1b=gUk$ld3BzeQssKTv=+k^U7F*rk{)Dw;ba{BaPuP&80nH!!H
zq5Xcj4Q^HyD1bBoW??a1!$%S|70^RKhFL{;l+ew~7c!Rr9=luCRHw8vM3dt`P4v?L
zHSuZYEgATomp%-fMTL3>_930(E0Hh4^0Md3k$37j9`aAJ_Nlp~1sR5w7a=P>36Hm*
zkt56K_jzIk`t+C&6fpKjlKq@?lg^cM!qkt)MYy_Av0p5PMZP_4%W76p7moQI<;$QK
zVx#@d;d1kicU07*oPzGlA(rvYqtEp2=4xUL7Y~7?j8YpdFW4ZGNx=B>XR&@QMr%3v
znq#EV!_i$zJ2V#SfotLKirZAjq*P_U4Y>$x^<(+oMro^IRo|7bzf;4?C%sU=6u++P
z7*s0pDjDrd46l#-wIeGLpIEk9oqea@r3clg&No1HTN>|otJ}JqK=XYBW<z!$o7@Mj
zV)j08`>QIfmg{Ley?NFC;2_mmYT!S4t`uhtmaai_52#dHiH2(1hYeQa?dB}S_tT(-
z5df0|Jp0Oj5csWG-lDL<7$ofX^l~SWKsTyHpdAuf8nrV=NNTo3!l*g1`m;i76;;m>
zNWn2$<QvoYj5Q)8(S;`28~vvE1y!Ww!iG|_tRG^9gPR5-7Pa5cBH`b~#ns2<1nL9l
zGQL4`H2m4N3vY2Rc<;5Td$yGho{zfln>%CX&NN851-95S$0yUaCkuseGD^9(XK|C+
zrywnNWBEY`FRbF6{rTj6Uo+O3VHm|cE=Ud-u;z>l_gKTajEr$VG$hv(W3F0TU&pV8
z<|nu1)F))99#bFZQew#kmmVn3tYj~Lcl>)TZ)GlA_C5Ae?~+p;`6Z3Bzp0nUvE1%g
zrml}ukeczBML5C-{bK3SUGnV3;P9oHSPfs8)y5@NB_lZM$7%2KdYfa_!4e#Q#Gd4f
z)?HU+ywIO88TDbRTyEpDU&#pH&uts;0r|o&kSn@J^1J}d{NsDCpJpO$mwe)K6A{n~
z5#o@~kvM-I_0cBWbNE7*?&y9{1F{(h!C$_qN}cWRW8Njp1cbxdHw*V4z6sv7V33Ju
z#$J*rx_wxggy>mLUWRL<f&DNq2o<nPq0BfdQ5P)=S9(uD_0a)sEftr={LBJT7vn0f
z&WF8en9&cblCsl{9~jqpQ08zX>H5&W7$r(TTa#k5<43R?rQ<jKqlU&3A%y?<VDxHs
zeN*_efV?kkL5A3t_%Jp5@pA=jSA{$u4iM<o1g2TBQW5D`xyN%Y?kDaQ3vGX2654ur
z146WFLgfK1%XCn9R}r8%^#AXM)W2v)dI`cNOi#5LtaVrEWC!$+n&cUnM&F>48a{Y3
zq(r}c<^8tix0^~Pa&2_RC9$Ze2j|kItY^xnHB`Nd9vAQfg5nWZlO?(a22sQEm&6wP
zCsxy%72Hlnz{N98P>Qs*>F3QjmUz+~tAHWVQwG`G{?BjlZoqMpnpp8VIcv!AKkhwS
zFmh2HJSpT$>@016{2te&myWV6og`z<b5j6^ohGNj=Kk14QD<+$L4_VeZvtNZoCka8
zbpRAf_uw$KE%!oVWDQ@w9Re)08tc_}olzktvic+vGC8?ir-{7Jq-Zi7FpuTUPUSoi
zQ(nfTR@`wqueiBM5WKj;v%!zyZXiH+a4ar4{EcKom!gSEjb8-`{Ahi!ll@zoRTN++
zUzMCQ6g^ZP{UHSS^N6_Z&a{2trAfy-^_16{CG{h=->Bz|s{QvBFk2Ef)VIouR+~q)
zR!OaVeR2cxmFdX|N7HFG#;JdTP<CCpk^it(ucY&GhxlC+ueA)EQ9JwZVWRziJ<r4V
z<3DozbS|&hze=gS-)6Aa;*ZSUo&(t^X*--V$p_%j)Rriksf(Wa8%5|lfyu`6MYq99
zc+ANaJ96EdN%Y6T83VUfo(n}zod<t!D!<3Z)rCMMDWpWO72}zIT!&NY^ii`SMNEIz
zOLfh6*0b(SzFPlsYbbQJ*#Ht{@r0utF~oH8M;7p^1efuSeDQ18*jQVaH7xGsS(4AI
z725$LUPdS8adL+&LEJ&v-V5bXPB$eA_odMH>9Ef@yjkq!YgppLxsjyeXu_K13GM=A
z^9(327aUblRzy)2P{k0{5qq)p5libO@{Yls=w0KA{_(d}I==-UB00^*hX-~2Pgkam
z(2D){3-kyi#z4#GVF5DEG*n$_Px6LhntPtUNhj+8tO2O6=R+!`AP0-C+T~N|VqhKH
z(j8SzLPpr(sbH|i_3kQ(`m1Ei*6q(Z7E)s|&r1bqBvXUjm*nsh)|ycl##;(!d_Gi|
zoj&VHA6fXT{tpp^gA+WXi_>`Z70=#YeRu}ithm=@!8_R=a3J)l`I7PZ;*r4DuV2x>
zem&fpMu_g3S=WADVk^_GJaF;zZ;nuWCXA}Q=Plgs*`RGhqB)zuxWPp3!q2Z9QNT6c
z9(no*?4{-#Ya`LAjuYO30qz7Y{&#q8Q8dXalo5Q5T0Xu%coVtO!uJUjnN|;(N+K1X
zKRC$Kr#f%N5XM6}$51I{7z#u~?PlnfZx`E^xT?hkNi%NBk{7X=fLvsq5XNYQNWea{
zP9i8Fct=mo`Zu4CByZk*<P&Liik6}F2!n4n*_uD5V732bObJ(D9|fF*d8*ekGsict
zu;<EVSz&Q&wy1FDYYhF$E^i5=b(YmcU_4LX%p|wzwviKf0XY`)YBD6o{+wyXpHdog
z!szLjBOqNL5MEu3RWx(DUfOr!i#*j6^A|QGT`*NAqJ_mD-R8FeCpKscT1o6Gee2_?
zW|p1zYM@i@Cr&3$b|alLZ2GoJcD9r8mT%x$zK|LpM->q}p2n^4wa|iziS(3~gi1b$
zo|>lUg2~9b1X(<#_YbTMBmcoqG6MPiFf<dA1;c*mqr-dAO^ob_H1_ynah?mFpAs>1
z5)BlaGK)^gS)o;_vnTLnFJdP9mYV&}fm=Im#>{zEQEQ8iVfL%D#%UyByVtOU1Yo}q
z2H<eAJxnc!rE$Y79Ctrhwu;@}m6yLd;DuV#L_Y7Kol9?}@YMNXkwFTWXsnPF=H*4@
zJ&+H|pDcbu={S5rti>?2;(5s(%s}ug&7DU|8LbDa)%<1Jtl1ZmhQTCTQT^hjx+=9Y
ze@4~MLo~OTQ+vmKaI&Ju8G--{%bYB<?W`*i%-1}u)f{NXF}(&KDvKZ4<7mi54o_xL
ztIGY9XEe0D;9DN=L2<y7dEqE|$W~(Uf2wA5kZopM0MsLF{w9`@_MJCOPvh^4|013I
z7dw<n*9Yfq-VJn3#oHq-PCU`OuD7jpC4s@upiP8bL$t5U>dp9kQBJyL03}?8_|%7&
znehNEe;_`Ei7<cHR=GgZ)(T}aC%$bkxYqV8KCzEqIv@6!1)j_TUTMQ*uog=C5Q`#V
zJ5hB3#0P$65eFqo^&ivKG1Bb>hc2qLpYbcWSy>{1Ru~9^46OpoHRg9U<NYIQoJi<H
z`vx$~Odg$+b|7zfVkt7_cT6h;z`=Kb6SMXeSn6%@CnzT!oEoDjZT7emC@eXlZmZ)@
zX0l)ihS7l5oNQ?4Zd_SLG1Fmjv6+h^Jr+1;q%qpg%#EvjXT<pZi6b92Z)>#iZY-Po
zI4S3#@&dBv<YZhM&2GxoB_!WZFx~jTX|t2p9||&2FWV8^Xl15ydI)fSaJU3ZgU9~R
zpZZ@LKHzc_#}#~Yovf6g%vbHAdY{Ct3fXrNKtrHt0J-TZR#?d!z@E}_SF#jjq8hrL
zZPocCT6-0}xsOt;)lEsS3RMh<4}LP5RqO}T@R+Qv7bJdMd!IMiLvx48uDB+>w`B;=
zF5wQX5W`T=eEV|ZZF#CbE-s}iL({~|tm=6#A2Ma{!#Nwu7((K!uur^0c)xZwe?hZU
z-z3Y71H=@sFZxa<QBSKf$z({gew%wKzY$IWTHZUhL}Zt2NrWuk2+)p$u^pdPs_L#J
zTID>+ubVz}G%K_?8!Ww>@%TdLVZo=85xLPGA5(bwM{T*C2yWZ-^z(u$oGsH}Im9|-
z-WhPZqTwDsj)r60VWG2Du|xk&*^;j`4Ri9L2uob$5O|tS2XldD-IK{0&x&)JN3gWn
zv9Q!YyC4{vBu+^$Tv254OW!LA%*ldKp9LfOQd|YGmtZUnt2=lMD^)H@1uqBD<-CAg
zuPgs4=Xs{~9Z=FG$MSC}y`xHC;guz*jOumCao%`!?b;-JJIf41_;qyGpR7Wkb!r&_
z_ZkM-cmuxK;@YHP&1KvvD7LB@aV7}MEbaYO!GqY-iZu=O<-y{Z`UJLK3DRtxig<+f
zqT0=LZ(Q5h53$A}31doqM+l!N+hEC%-W1;(>PBFsQ~O|ZRh9xUF}2YZKMjfy`!V`$
zhZjh#)(%V;X0g2>$za6-iJx0sS7U!tP*_7>bn~AICq-zgjCy(<SM<;^oYkmQ>m(N9
z>vq)bv-aaoc+%TSWLlUGVNIM-&eU+a&VmS;_Be<VWASJTARMDZ;FHvXdCVCm`1a2~
zh;nj!U$pN(C%F*GcTCy4h2q}e8;v;~jj$~xOA0jb6;?ha&QucSr?<!w1TfKy=tFnu
zv9Zhx3TfA+#+5z?cYj+c@$YS^lc>Lcn;^(fyCM9hL(~3g<E$TTi`K1iRZh)v;~xC)
z9FDm7ulmEE(vRK&9_||URr%dhhy~-Ad2pBfOpnTQ7pHpI(-fv+asY~$z%e&<pM@Jy
zXl*Uv_1Rwq;(w1n{%5Z8FDBQ&ed|^xA-1}+K#=DHEBB=5`uF9btca@<DlpKuK*vH1
z0Sp`@GqW7YQ0PzHG>eUNwYk=iQEyanwd(G|#a;c1#b_(15{CWR56mugCO@TQZD;;m
zaF;H^E#jel-0-PCXXU1$8lqrDoiIJe`K=j5;v8&#`Qbs1*8(eTsS{(^*_sole6dqz
zeum)D-YZI3pTs$Kmg=yr5Nu_xs!RhRzZ<JxlfCv0#Ne}6{W>3mcgC^eGt0UKVa+7n
zeEmZK@gC4<mArqgZm2Q^e4cVt)ii;T>lHQBM4N}~x&TKET}tY$mZ;yMf1uo-nm>h3
z(4Q>!ozyRe0zktxTv=Y8$Zb5K8za=Ww9@PDVhS!t)<Q^<2kC=5u6r(Wgi;+Jk#nCc
zO)nEfRW83?1CHK9e4_+d5)z4oTLvB6OI}xE^+bzbs#N#N3BRPrq)PjcC+kVX>7Z`l
z1;HgUO3-E7byN%G)@Byw^6mZWljvNDW(N}2DcsoppF*#HyQR)(m9h_Z=ARr`P6>`q
zdkNhy(t4|0QRE0Ry6qYefKyVl-#M>wVU#{LSV(&!9Qk7Eu|^hC>9NM!nn9(GIlt%~
zvuLU#*WCN|{k{-q5-|_Da2b~af$L(zjKOI(7O8NM!%Tt5D`d11(xapjTroqb@XZ*v
zju#Mlj1GDu|Cpzuw^&tcdv1`x!1E@8nbqF>>uuT&A%!I-$gm+X)lb{Y0lnaIv$x{z
zk?}k!%yquJQguf;%O`_y8eu%Q1I-7vo=@J`TA5C}HdnpQ3rLu7d(!*0yEx{-MT}CT
z%#s-8S^~w#7F*6l+1MQ4dN#SB2$E|`VEsj7qW4PZEpP8^T?b++__<_6WV|zUsv+$|
zc&1^@4a+czj7d^34SYV%Dzj%(nBjHSN4KHdjPk>oStTFQPP)}HvWNfFwub=0=f2Be
z$cz`|5bFuntEcg8S>0Z|ID6!m4J>v>ZiUL<g(hQeeQHR4jWHH~`ym<xpR=w!q2P1)
zl+%4|`O@3_8+z#-{A>C9Y&rVfYbDhb>WoKtd|iPRN>n2)8FO;}by>1K*hs=R;jMf;
zrIAqf3?PWk;tXrMH~T4`b~h<jGcs~nQ-@+!a3Ij7%GU4{Sy0(;0{b6>V~ATzywnfn
z=E4_Z*5epL-458N>?Pb%i;y${syx3o{ETY1N;u2yB6(650S(bDc4F9}We?L)r7cAA
zxp{hE<_VaIY*doHcqMk9bw!=LLd{x8U+hzG4{^`H#;j_L_nkB@#W*hmlJ8-*);$y?
z<1aO=d#u*YtVbQOu3t!-$lRtQzHesr7>b>Tqj(vDyI*tlxqndnRWlr#HRDvgzgFed
z?{&;=9um<N5IIn$DC80{rvh?^Ip}c|dVtACgTHYQ5b>vmY7EEF=#i0)eq(Lq!ycv6
z6OB;=6jJj08BJG<GkdZV9z&k8Fgju@vnv^r=hRhwY4`Yj6n>KEAMNqm&N4FeZu^?|
ze59bj5VZc=XdLc;lb-@&*nib?oCD1|T59wtF=mC=ydKF>0LK(MpkJ8ZWUc_I{y%tO
z|4Wau9q(1FpFxxsA#81Dxa6h*=QAJhwfdF-O02P21mqW^J{zzZRhL<XlINnkLdH(R
z{ZsUTnr1*2D-6Sy4{|IIm4|G$aO=UPxx`G&W=Mw8Qml@5U+6mgSO*f<zf;i(NTjuO
zyV}rY*62Uu+<vC+>PcIk*rvNQp19?z4NsH)2?h3u*68lpi031b%%anIb@Y|2q(z5D
ztI?>Njh~z28!&pe{3sE?{pXTm)pf72?wQ68t?s8C2=B3>Eu$yIG`PV;lLLL90E%Q;
zrz+N<c>j*y6#N+o1vtPfSnU<H<LkpvTC9A^YQD5U=Ve89$XOS~49b+P(Gx!lixTP9
z@V(Fat3t=_9}U-PK<Dpp^1Rufij$O7aN;p0vN#6n@DRsDHF1J~GY!&<|GmT2XWm7-
zz8UFXtWJO0FWeF<BY-xZ^HxrifQ0L-g4~CIWwClHh7KZZ1;bK+cjt8D!NX~~)4;OB
zRo2VO4a9--pAb2G)NCu^-bw8f+sEUH^bcx{OXO`O7{DeRLEgG#34oH;0OBPIRF|~*
zhlRe!u>krgghCST2YC357SRmD&U=QCG?ripckS9n!1Q`6{3VH^2B3!Sq?9Tc%U?SK
z^F*n81v@pSIMa3{q4}t+^Fns1>u~p-)9=v=(c%(EZ5^F(vAu~7vZ}6l-XMu3`y}6G
ze)5hiYT9d`(6|-Sb-<J2UEqR|aO5tE67PHPOVGTz<fbuEZZxd#V&A?uT&_GI1X#Q;
zfp)(bYXRkyETM*r<kPv+#?MP#M+*eCZ4IIUm%T||UcWbJ(KWESR@GTy;bmSgo%?I+
zEXa3+-ZepL`MK$8&K*SW6T{!gpnS+JNw<krVY@dAT=vuNCqTfdhKRxieGuaq4m<nM
zLu0mW0iL2~T7k%+am!=B>#BWWP|e;|GB2k;KVPimJ4N^7fmPYZa?`B5p1o;ebg1~g
zvz^p_{D5K<xQPHK*tRzKT`c;zVUDoYb0?*bAFb=86wb%>&`^dzQZ<Yfl(TbLp!Awt
zpG1VMU33y_Unnj<TwlKS09cL90K^E9av(_1xn*aZYIoR!nIv-RduU613GMOnQIVd$
zs@3XR7s2w6j>jQ?>_|k}%$F=lzqCy=d<B80LJLD3fzfd?UcHsAf*MWXa5=lbH`?eV
z8iutMzc3x6UUay2)|hfc`$6y)(Sur*JMCwwSJP)gS1Kua&OQlJ8Ng!~1~tK?m`~8D
zxnPjq0oQ9UP}$R_rDf9PEevg*-3~hmrU#e7n&7CLClq)q@bK<Sp7jD=DW}!{$D824
jJx~4jY4+nbM&6Aoiw%~Y8Vr1d!7Vi<O;GtW%b@=N@pQsx

literal 26735
zcmce-bx@o^urHe6L4&(Pa1U<5-Q7J9++6|$cM>GHyTjtJxJz(naR|0q+<D76=f0{_
z_tvXd_r1D*Y)ySz-_FkT^!&Q}*WFR7$}(ukM9A;ny+f0el~jNC4u<jFyZ5h12+(hQ
zm~I-N!+SS%8S!^DQzU<(4{+9EN@DNc)hD1lnZZM!KRC<kxxIUb-v9P_KkQUy`R<(!
zoSdYXrnm9g28ut<!iLB{I!V@o_0PH=C0D+GVqgrZRUM?@CO*ncK^Cjb!|hBQz=L^3
zn1@+KZo-|#hjGdrP=Fxlx0SViv%uS@dI-UVpP@nSKtd3Ua*Z;CX?vRf&EF{4F&a+O
zfdVT83M>(HJ7{RkO!c`CwEm<9fQgKZEYmB1<5s}@Bi@CDiHWI)9*X=n;QhBjdqj-(
zdcT&V`bZG4N4>TuKt)AWa3Da(#3<#2Z@yHMZ5suhsp>cjm2p%e!tB`(%u)3bI?Fl(
z3L|2?mc<rGIMVmj&Efc81Xk6Ci*EI`2kxj`4e*rBWT*0(uF2CPw}<u9rGUlb5Rvc!
zSvW3q{umSm)%&^QfXyCL#fC`=iLtt%Q^}Sa7PZI2T-!O26A<V2$*sktRTpwk8GAZs
zY!D=IdpYAam8Rce7<jL<0ofTw>|7g9yqLNnuYZl=b9k<O^cVmm-`JiI#h8UfMvkoZ
zVQB`67B%vIC-`a4WxwKvikrfHXD5%p08=zzL?1Hl;~jK}xd0RU^vy5!@0wUHesHm0
zM5^}@P~h7*uhAynnL$g>6zniyi&|pr2Qi!UFwe}YZ`;PX1YL%vRuX~sn@moAxj+9R
ztr8c+<P^vO`w0@VTZR?ib;vL5)cQqSeq3rx0f~ge%GgQLm-h+3GGA&tTV5ASk|-ej
zE)j6uL-IUZFHVKdGs37Wr<#;6p{;4zgY?T;&W?M@o3nG|W8>E++(50Y(4ffStsMNa
zYNEpx>l|rALm`9>|3+I%s2nT#XvOwdYaE)QqkT|EcP0@bW-Dsd3Z><i+y~*~t2;?S
zL6sh`+)K%WY=tJk7gPpGNl82p`H*N-ys%r7nm9_1c3U!*Cp>WR^#E?RenoZ0SI-Mt
z{Ux<h(Ny1rm0ySxqlr|o^1zp8EtEISQPQl=JD4WC2zGLTK#pd1T^Gb9CFh0ILNbbx
z_~_o$O0AW>OmdOo@59^jY|#<kPP>8m|L{;%rY|-*M>z3Q5Gx*j&{nRl*g~$C=1MC@
z4EHOgS%U@(5(A1_mV*w8M~ah+`MurvzeU8sf2YDl`oW$??bJM*@h)>@!CjfQpP4|Y
zhqG3?FJNx^n_q<m`hb=gF|RchGjc&#jc|{pwdQ?Fk30WgM+z?mYt$vv9<2^nnu;W3
zF^d(yBahspu;!Vi-Z3#+GbNzdwUpiGp_};xGZcL;@`rUjZ^Mi7vZAyeL;xmIX`Qn4
zA1uUdtyU1BF6=M!fmsc`E{)RLO$m7%xx#SD3rMUC7R_fWd@baR79u2dvDQSBLxOMj
z@(28xsi*`_*vqm!Rtt^j?vIC(_w4|wd7f;;7h1O6l*KU|jsv=TP8FJH)tGK)rbQzE
zkPd`W;`kF(`i_#&QIAM>O}5Kehms*J7VC4F+Z$XZY*;e!{WxtP4X#9=X?i}#SSdvV
zfLLA;p>B(Bmk7(`@D(I<Mp)lOtL>XeiRjrP{!vxq*K6CSZ48yNVvWO0r|y|gR1FB8
z&snq+Mxs0hUfx1hUz%X~4I0dJ@Nd3k9u}K6b^gI1h<s1XYg%ZJdiqdq9HZA#WG2_v
zz1$uoaB-m0_njc1jq)Ui<j0lHe7wUWmBaQc)#Z@%sm=LAc_~vxfhkOKgJD@BO4nSy
z|31xto!yZ==Sx1~OpTFXlO4zyE>*N*am1j(vi?TE_ln>w<;ZgR8e6ZbEGrBP0aaR%
zU*qh@rP3=aQSPKO?$JVIw@WYEWhVXvBpm1J_YYdO&#XnJ<NgyI;_~h=ocO@i*2Gz)
zGxczbx{Tpw&PZ8l>)+AQ$fqlfh(XV}K8Zku?6I*i116om`$YpNSSq(@;AwV0bR*lf
zXqm6j$qc%~y*@k<MBnD9+A&l)wxSg}JXF~YUOcevRi>G(I6{aVWGcE~kK?!&?CSl?
zX8^PK8V9A+BC;Nz{<QBaY^hxa(6N2d&(cSVhz{+(Jli0(MXFILCZ1Zc*lxYorx_TI
z`m0ZaP9CGjw6V!b-zcAea<At_2|;M97C|FO4si)`=^e2VN%@C!U^WEHAbaX$UrQb|
z<VLJ&Y&{W+qOrh%ExqRh#LhK6*%%?uU)^mS(2l6%;6)o<^)rqktX%jif1f&-PCGpc
z=2{OcXFB$bO9`q&(f||vcpos|%!}H0R3){nd)uFb$5~Vq7lgDsT>5Q1=xO(7DRb2b
zEBXCP1UjktEk=@*q)?fE_aWSisxy+tCST;M(IfTCJp}W~ZBC7O)tNwr55w$KK{W5n
z4?N`3Zduau^V^jx9z)K=JN_U0OsRj3==#H{0bPr_OOGe2O(v5Vgkfse8<QHf0Ns|c
zNUYE#U+Zjo%;e;>G}G*i7PPiO;F?T)shoW8d>U_$hT}l8{4b}q@3aX;Tg~4p#$_R$
zoOn0CK8!Fd$GXl%M|U~euOHoDIJ-_v!nX8r_=uziZAsr_F4V*Wh5VSYB9tS>@22`n
zureFLL#^<3Y9(FPw2WO*Cm#*xk`uj`6q%C__ihP!`tO7JiAej}>7>$qwix(Y(h<0I
zep$HnY7p>VvF@c+G|vqnF?fN5iCWOeYxJ+{)G7NUiu%VgxGP=86De0|4x^5)Vr*1>
zZpSUs&xImcK$-;=C3so@ZVzJ&vdZ2@a!u3l<@0|o=xHC)&b{K*Ei`y6?(H%GJhfd;
zz2#^H4hi$W5FDj8_iv2n9b7*6dZ}BSvV^X+>fXl7h!=WQ$?SX4gA8hva+Fw^ef?>q
ziCfIPh{Gljm3U2cTG@B=fBRZde5K&L)Y<--td8TPAN*I&w?$(m`dhkQ*^bO0=ibC-
zo{p0FX?pjSM8M;8bKcQDp==yC1{z-QRuUxrI@s9LhLjh1&V*Gp)E}RUMJ=p;V?2@H
z$0fa^aNscTh2k`!wude^>Js~q&pN$Z8X<iG_jtqn!Tf5swyzvbgtaHRbT-N6*x^!0
z81HZG5iZ`^h&?liCV^JO?uD;Q-P4lGm8`P%7+bHQa-T;A`Qf%h*$)ks!L`efj)|lN
zwOa}hu1x0Dsoe%qQaL=_ZC(qvn@b*yIjKr}{5VsNTc3Ba!b`^<qy%qkYc~jY2GH*s
z+c&wki-}>2y<rV{m~`2TJY!H?rKNU>6gkm*NNs_kOu_9e#>fK1Nms0vh(s{@U;kKS
z$^18fr6-`%80m<;+Ni8OiIZ!Q$isjB`+J*0j2htv8N|!7UymKdQv+%B>C~Tj$yJhh
zXfntc1!L8(MXBfLzA>p{1I+_zDn-io9rkwVL>VJ0LHta>>dBf+i}dY_1v{4?i6#b7
z-9GsUgK7Y^Yt>YP9>Inv9*2?n$GKrv@fqZa&)ws3{N9^SVG+R&r>|6p=WtCtUR`I#
zKlrE1YqALtUA4QT|9ahqDdlLS>0XhFeDF!ApkS2vjrlKpqK~POG;-;@2`iTyg1M)t
z9bD`F8;Sklw49<}#`DI|q3*OKLA2LkDnx)%3f<AD(Ua8J=Q>xvnA&jfas8kb&E!|=
zPO5>U*y`Qqr|a6+(8`*2`Akb(ndVUslR!vVbM^gtpIBfZ;rEFR#ru1oRm(Cb;sQ6h
zfsnCr^5;lfJ#G#qUc*gfe3L&gue8SCV-TJwcthXtUGN<%3*Z{;7r#BJ(sk{QEaz7g
zPg1NSb_0Y@Yl-e69M?I*P4$LgfaS=Mti?7WgyXa5Nb2rsDR_AT^H^8A&YZ87th)*j
zEqdN@10A_|Msy5>u$ul+;fRD?`LO<iyU)$F-WAaL_7QZ_e;v1gdFE9HHu#Z`mZ^jR
zLeXPBjc*raNI=SxuAUINcUg{`R?m&g+*Z$@$T80<Rk_VXs8H1oN6S2pw~P9vz}AJM
zB6`W3<GthJPucgqb9~tJ2Tt4OI+-%3_sH(}ZL(P2>-AD4_n!mc-33Z@L-Oktml+0w
z@lG1xr|krfq;+{D9IhVeO6MbA1%NSHWOQtFkMazXz=3b^@CSX>v#=KUt~Tx@7KjRt
zyfhG7J1<T^w>zOn4Ubh1wN<iE*JkU-I*VSzkKe9${X}no0m}P@<%KN(XJ7KZX05rO
zbWCDp?`*U|@arYxo^WCwcM7hh*%kGRh0=f(@%i+8RcDtT8a=m)2Fk*NE%zt+A8F+Y
z3A4H5>PF!nDk@)WU-?j5Ed)~S)fTV^pNlbt2CPwd_N1%WwS7Dn2nldtFw2e!V^0N3
z;b;s=?emhR8Yl6y4D~#K#K7Rr{HM+gF>SWJ4PoG8&`&@e)o49qL&e9@MDs*28%U-b
zRFWW~Uj665N;WBlq)my2KuoEdXm)lMFscgTkvvSUgHIu6vP<fC`FQU0jXd!70mJu8
zIYddz+$RQ!ZT7?<e(QD$3;|DL*zKxY)+JeJ?Rg?5X!jdUbp-eIe=hS(L6O=SJ7-i4
zrY*+|wWxh6cgj0Pbn4&FMGcAJG19GE>fOH}PF@wN?x5y4@!2an3S}Kb`DAKOKz6g}
zxXg@G?Snf9CX75k&UeGjW$CZ#K<I_+t$t^hO!}0YZLX;em1`0@1H!!sC&?&dbX66>
z0`7`u#Z++QF@9=ZgArWJ3|nACac06+ro;kO(a3RR#(?j=?;|(<R)&JX&NFGs-FDA=
zq4it(o4}xVC&I&~9d|<OZqH$SKrIx9$Fs+Zrd{=;b`0W*cCW?0dsnioii)kW(kBxc
zr-)h<D<C%4D}nAH(kDEI&6;Ql=czzWMX$c5i03G}#0rGSROa+3+RZ*GUiXvgue+am
z87kSuO6~8^C{sgKONA2(F!p=YL2l+kwTfc#M0T@X5o!U95_)w>4SqL1h%-Yb-(nrV
zh22P}DPD8Tw+XNMS9)N3oSV-(5%JLt8j`wARDuN|O5<EaHBDiesGk}#s45xt^fa34
zs459{jD3n%sV??3oB@IX1C{<k{J+;CkFGxOm-#n5@|~MBU?3)F6;?=VOYM;gdzb`q
zm65XAZ@~DWYi&ozbFX%1uSN!~4K~=5FSM`-m=F{@ye7m&`~!kXXWJ9#B{$TQGK!`h
zpVs^XvcyZ(oZ)~g!$pEaapbVOLzsGlt$rEUIS*vgRII%@DRW7MWTT(}djx4eFL$cT
zoWIVCKx#%|<%#q|bp^VasrYj2h26~xUeiT;ElP2inv=?QQF)N<=66;8NFEN-nArDa
zRO0>@ZN`8ou;3rT7t4E;n62_TVX9RVqpB%dyeQb%m;f(#9?rgIwB?U~s5Ng&=A81}
zG_KB^1WJLqdtkEbvqRE^J;QJQ)}^`pMI-09{OFP>OuOU)#VX-OU0=DI1MZ7kI!2F>
zleI|O;v<!F6GP>vRzqKKak$aq>|$2pV>-wCFK%t~4@z<z{#`8EJlXl-G@sk$vw*A1
zq>l^0st+3<9M&2_7rd{3l0!1B_Pr<WVFRn?L(#Y+zNuEXC$5|mgbfIUiiOH%1wTbS
zEPotrq(X@&Ml`$X=Sq5w)-b%nqYm;Uk_P$1k|Z$qI~Ee)2@}la{@x>YKh_H`XW*rP
z)O?;8Gh)7RGnYG8ECO*O!D=+rb$*Z#Sl!^j{T(phcg&w|oVP@S1@1EO&}yr<d6J#*
zwrac?#<miwU}lpUZI?>F{z8Q3Fvo+{Yld0!b-(vokDqbDOQQ`)pnxnogFoQqwV|T5
zB})>aXu*CyRLbr-p~$?lx9F7pG7*;b84`Hxi^t`Pbq>_dP0P3HiIcWjiEaD&)fTMN
zy%aaerr7g**<{u=$wjl_rJOq{bNuha2ph9@i(AYtkQ2M`wE!j$scKhUGtoepwEP=Y
z)7WKVXao~R{(2+f)H-vK$jV3$0YWh4U>=%t+}_rL??{ClG};9~=v|p3v-Ucxj?;&$
zp>6~IEa)N0%zSed_PbEXlLF!n_ig;t-GM3YgUKS1(OPZ<;JmQ4!A)Vk<4$ld{y28i
z-1woj3hTN3q{U&RV(jd7`NWIl(k`fe12ou;lXdU(JTlu2$wJ%EpJ?YmQ)oI*gR`tL
z4E|i0DJd`tT1*;CjgC1cH|k#V2`#(a>`0}&eEEAV<j(s2K7iOoWcdn*<d%6B@%vD$
z_!RKUAVtBLEavm>3jH-_K;Y%$JhgPESFpE}6aLBz+Q{$3uMfMi9)s)jAscfRPhjL#
zw(d|G2<g0=jM~$HySoWRU$SAMk#=oqWrx$=&u<!ug~Hz_gR^?h8T$hvja@QN_Mvee
zJV8NpYud;+0W#lF8FuGpsd-cZ^?TkpK94SS2Dw&|ZR%Onh>hy(PX?k%xav~-q8;)1
z?b2Fm^C$SA>>ie`so{*X;eT{Xfh<*;nu|L<Gej(2d@%_&+fv~;gxbdUcQTlo6*J9N
zD8Sux6VY|8s1}jKjW3hD1o49NPS?*)64CrcpVe;#@d}RmaYugh$v-lUo+;w*K;!j7
zaH324%LU`a6^g7l1}4?!X2|~KCrYiC6icv{i4A_}`4ak2>#&K`%;_g%l1FQbxw4PH
z*!m}Y9!#R+frmb=$PFBhvL?V=ThckwW?~siw@t%XZjqq0U|CZBkIk$lf?rq1+*~8i
zkheG^aLVVtSa$zIPZbgwdKF{`UmAXqO%jL#Z(ZBR;^l&tWnOUq&X*$B(d?Gy3tN}W
znJSvJZTcy1T12@e=X#BiN{>pZuCb2I28C}r6hbKj0}~n%c36eZ4dWzyT{(Uu%Xi<7
z?wMUlC6H(SVyjD8Ezf~$7C!b1Kd(_f525RJJ=0H#LSSp!Tj7nFzlHrB&4wIUM?k!{
zZ&y9jJozwQ1CP|#?{|zb?TL8N_aDYrx7tjM3f@Sjs$krd5#;g$*R6Dyhy;IaWM{Dx
zJl}*kT}R45N0x#ouEb6$J;&SYVC*9<FZ^g=_0<|k*NHjP1Sm3MkP4*$r?@HMQ#LtR
zTnb906#=VuQ+|*2<|hdRvmGovzgh;}a$Ce~LFjk?PAt;(>s0(6s(c=Mmckdo>(hBq
zlE}U014Ef1s8A_;OlF<7y6({w_Y?YYBwhGW-i|KXj+8;2yqtx}qsgLl7Za3e%4QNL
zDpY?ub9vfnYw!gx`cU1QyMvv{$n<X<x=u15d|%N>|NVG2um2(`X-P^_h^0pfkNbB8
z17in6s@DktEyA<fAnz!D+*xn<QWHvDC2>P(DJat^m2r2_a(9?IB7AajZ{jh?R@454
z<&D`w43)PGqb-wtWqig22J9M;An$5euC+J@r=7Rs@EW;vzwvDicnDA#8mK1inS2R!
z8pgEW@IyTT3aqB*(_MEPZxjP~_;=RwB{CCpFH|HYaX3&JlW-URbN6PdQOv1KZ)9J?
z)OqySk^*G;r_`pXs@L_hH9O=Jz&U*Ndeve?3gN}y8e?I{DPT&%dz%a3EXVnEq8s+w
zY31F0*ZzCL$(6LoBa;4TdCP17F0PMQ(9x){tj__VP+>`6N1Az>evt23-|V*pv%gEW
z9L$Rry%HGtc_*mg!+=ku%Xi)SO3;%)5Kssm^X=R|j(*Jf9Vu2JMdW_CVnDfkt^fXJ
z+4@dLpS1(lD{C8<2Ffh8WM><Rg4uc`$glgkejlXou<7DQZ32=*0u7A6%y_+=?1_+@
z1d;!HLRn_KJ#otg3qQ60uHgxz(G&h%POi}Edy4A*oaVIR7n}DuE+6G9I+J4$3Qah1
ze;&CVfuDVi6=c;=3VfR0E;_7k4^*#tCSYsb%OIc;Jr``g?}+(;DkCX*NZ|P_nU2b6
zotgdW-*ht*bgrr3(Z&1PyNY-SEKR*Si?ecg>6NiFSu18)=)QSGv~ydutGs$9n<!ss
z@vr3>UUpov10=k>aMuGGM27u@+Eg~&l7_iAC6L;IFE8EC`+kdFLMx70OQY$awJXAj
zz5Ddd;iu=3X$yaH4-rJn8GczKWd`x7v6@`6jrIb6mAV=Fj=IB+N|)U7)!E%C9K+|8
zVcptPi&Mf1-#@UhHF3Q;8{HO0!i#0@sNz78{Xd&um&kqv>HPSOA^am^@9If=t3!Av
zdvSMnx<-0zlo4I*7XL8X($f2u{KwiEhwWw+V!Lqzq8|~_B~_*3D#Xf4D*N`4+`=yR
z*Fz<H+TCW$@bm-a5MM6%d-ZhX<!ADk$VhsasVNRd;dZJa93kZoE7|5mt&g#%tPlD>
zA{5$r91Rugo)?b8NAuL<6JFV5%@Zm2O^i4sNFTdJd@pM@{65YB$~Sl#h)3LW%mwDa
zMNr!IL_jcf%*u<Rcv`!YebPT|nw5DnY5byqb#edBJeDM~9iSqr#qbS*g#dTHE9S7_
z{ZRzfUbkm*a=+Y7&~5;r3Jr_LvH6DA#*%X@BMN@g0UlFzuK|_jAHpZS{h6;#@*fP_
zlv*EUF(jp!l)u5zP!+f>>phd;^0RxE-1a$=eI#OUZJILG2bpSJHi)Dz>WKX_NYz4F
zu`0Yn_?>~+KUPB>;0JCagf$2~BWGU*y!199yxv}*Wn7ad`T>w!%5FQK5$Ak!3wK&b
z{%sIGmeE500S$3Z8jn2x?RvsMFSCFh`JFVB6t@=nKTJ{o7bX55Of~PyqKfEXJD}2K
zZv+#{sK+fdI~dTQlZ8~)wn+m%&itmAS8c?34~1VK%Y@i*ncz&ZozB~P0Iz8>W|JGD
zKrTv+xA!8&XdA?jACgjV!f^@?l3qb(+{uw;W+a8;lBxAWZUnojXG4kB-RdkoEGj|8
zfKd-g_j5B<N-BlB{t7VrXd8a0pYiu`!RCRdTi{X&lK^0Tb%=GNngx5NEleydl6f0%
z4Sw}=bCApgusQ~b^|48AYMiI-JX*PWe$kz=E?P?4c`Rh?KzNvar`SlJaEX4Oj8D6I
z5o@MRUR!<foG-RJt+`j<!|ZhV6A@xg<lHBIw$UI7OAjeyAvayUD875}<r!N*^|OJJ
zyFhkw-i5SF*iFKWkc>_hVNe*4)uua#V-Up7AMpBPbu6UYIC_{&|NFIVQe>Y(IQl)f
z|0Gw(2G}zagdg&oW^weKyzRO38f4cyh-C<rc?AIrC(peP9Krs&_Ca`skI!V_ia`xI
z1j&0Rz|#tQ)t|raZ+Q`hY0!+)qr=Fb7CYi6%5ttx{I_MP2sXjnltPw@{ITeg!JGPR
zSh%>jtDXKS<Jz}RC9wMMeuIxfCb2C5tYmWWT7UTu6&x~{4`|zz9jRNMC1z>U+4{yt
z&wAXvOd?*M73VglqqS{O@4-!&+8F{OvM3JE=R<C5S`y#Af~Irfxs?Y(qo3mBZdi!-
z4Y*bUw`}6{k;TJ*(TPd}hjV+mrjO<VjBZWSpiu5Bo3skBD-HW~dfL`%HS)1~a?Dao
z((^IBBiKro-?@n>H&T_V^x53_rNJU`4dHyQj!)=mm2UZ}KEv4OqwoTe06%rr2t=Gy
zmuFB*=Y7ztj4*D=+4RneICoIS=lz*?{;@rOJ>(e~N!Nbd@uXe#e;=RkWIvh`{39_5
zds5$H;NXL*0MwrBdmz!k{kp2|)S7gb(ABI7nqG4hnUc``*S%Qg7ZeQUt2#&=B%s`H
z-tO<Bq-C;;#?!A-)|TBP710p_C;^VN@c6%LzqnG<>BVKgzF^q0G&$7b;!pFQUq3Vb
zF<f=Ju9)R~AbbU#h1U8Z&T0C+QfzP@1eCUE78ZHz!|5G*t@n5&SD<e^SLr*75I()!
zO?6AFIN|A-MpjoZ!p|4gU0fP)RQ<~q0L^r~-VytLeL|obPQMEZbi&sc-Y{v<-+lgl
z7f>1p{$!BIg>eG%Q(=LpYe`z0{fiCBqe2|1hRo+m6LX8~{|CfPRPj=rLTxPDI}0tq
zJ|yt&PR>Gc)Ym`uQ4{woLh>MotI6ep*_e^vAC;O+7KsE@hJ#(2{#$~MYVYmBz|EWV
zY2>HAk28PWKSkh33}2pT8>oCOy=$SK@4dS)=Y?OXm~DV*=@y(NMh~g|X-0|SJy!N-
zJ=%-xzNI-q#|&?iuwW5*LwxEzu=HGS0YGdaTF5R94DOSOMXBtR&5UQdY5aC30)7dk
zdD+y+nq$JKNc}Ssk<9x|{gL}jInMxMI)pA{hwiJ-y^r6zP`gzcR4d4-T?W3!j(nv(
zF)LcCZoRGu+9h>zUJLdbO!GYXsE3aYTFVBfcWao+Q+NFQ^i^3}P0cLSOseMR+K9v7
zt0-^PBp~JnRdTE1{?`lg-=kB)t9&Wp*FB_-xtK}2VePnax1f&@YQh#!QL0s0n<d7L
zjhK1j9r+SPwH}#84}ing7~cYDWS`&p%F%q&hJoER+y?7KaM?<9OE^3eZxSzj>P3Z&
z!vEd#l6Uyu0(F;Gj0oN!K^oO)4TZ&NG)+s&hFE~xdd0q_JmgjoHb^4~aryuT0~A!*
z{lRzVP&A=GzIKncCfK9K`k&Vm0><hBqYGsY3rs|=*-E-Y75JKhj6^%yOZy~kDhK2F
z1IE?t*Y}Ur1SMa$eG$XnKMHRJVBltXJ|T?1SY~P1>=ERaD7L&d2`@&Q@PSX3)GD31
zrKTx&vfOeZ+5(<cc%YymiMuxa#WJwRjYPL{TQ2C8IB9AVGr#|-5wjUc9Vp(ibGYNT
z4w-1&@xunC+zUSU&6VX*y)G^mCMcm0X~!l~{omU6m}gb4`stz@WnJGi=@n@-DDV6P
zBu892OAyL=Z5x57tGK~;SA)bA=lDC~Yr&DAN#ZipkKAO<{9WVPRZrI82^Lda8v2#w
zmv=&In>qqxNh_6{f~zN$w1A_h#euM(pG{&)&KItPo_a=+TI+qR;J~?x`oJcNZ-YNQ
z^nsvor)&8UF<q^#_|81yaPP$T#(tI{Ek}5FKFjiab0maAQNs8~?J=RQ1jiF`P+IS|
zgTI6Z)URmdR4-jGR^lB{9go9XjE#;&4HkyvF(i7!2iA5CG$51eFVBd_9P_k;u8eTL
z`UELIc(ua{hM;bt;V@UR7wIZULP3!H?u_lcj~IBKU+l_HVdp&EOqF+3c<Y4!+V4~$
z_Pc@j(8B(6yU7E=hG4gxwzQ?}?>4%@HJ<)+6SWVTQ=A{N^QZResF-Lk9I@`l$31rN
z2`!#NQ9qdoyB6~hQvRp<zTQoFt!{|t-@_jeZ5Jy?ely)bccGj={JaUe3SF)*#1XDd
zOw%G%&k36(&S(h0#qGsUhKX|XsVGHKE`8zIPn3wJs-zZtfiQ0d9O#`QRh1CHbnDpT
zkL#>leVIMcUT5qEdRcKxc@qDwP}2F`9&_~<*CebM6Q&<oBKlgAxh!2GnuME`5cq*`
zJnrHJ<~6w5#A#r72<;v3b^k(c*A~!t1yH)KNxKpjXAq*J>HAbgZay)5@5_+7=%z?j
z$=Mf;N++$W*XRpa{A#6dC20tU7_%g`nzypm(lh39DQT00KPgrCMDF#+eW#Bua6DHX
z%%wu4Tk65`gf{IvtT2KsR-U1QoO`{IeDWY%LV&OBvyGd!kuxNv>3LhGr^nG+!9LFW
z-Lr!){8kw5F}IG{0<k2k&$?pd+(+*oox8}UDG$P{ILbYg3a1J>`8=nKr^lZZ>T+Fe
zb(?V4{0c$$MD180cE55g1|fFAx7SaYg;5UrQekNxqcBW*&Yc}Suoc?LD6UqI1r3p|
z8hr_6hd?Y(eKwnnJy6ibIx&olxU~FOZwzO@NbNTW{<FSx8SqPYWTFzF9;q`&El8=A
z_O2IjK>g85FlLY(S7Yjvbb2+c?!bvKIp%>FzhF~4<e7hWpR2vKO?u!63(8yCI&mDd
zclcg4^MdYJ%_S{mC}drBop9RIU;8Wvth@33*a)c0UyLI8TU{3Ep)fJrrSYTa`-#tV
zgmJGSVctMn7V-uDIPZBE^HpNO-zda$e9%uHp(t`lS726LP8;>YtuJZLSsRRkqLHLN
zJ;PJWi)|t(Q`<oul$n)r-y=-@rr#=>)g(f*if*|NTqQym>G~H*&tqmE7$mLROkc?b
z@JFMg{6BZ2vQ}<9P+!yXFKZ)UuWV4~8WQ`aVW@daeXvcXqM*XXU8$W&6qi(@gdI7#
zz4;>^?e89JnEJD-Y{bBPUjXU?x~U9+p@kT>%=akqr?!c(V6=-~$A&oI)5q*g0?q#j
zM*nLNM`m=jyxJ6wyE_?{)Qos~MF+D|P}%CrdOh1eUujesbYukSC6^Ie%F2-l!ReT|
z#o1C8aAATUqN)-@pk*I3ZShdwlTR92dK1YU1N9aE=OOf46ur5;y!<@L%nB1FWpL;>
z>d3bj>ESw0=o$*TLANZ>0+Mg6(QT5Gm}(XrWs-QqWza&SBrA^p%^~c0w8?}VuK6^s
zFKu6~wJLz6CiZ>J*;oV!EBnKprG7!l?$2-3OjTn0&qh6>JPRzd>+^+px3|{1lnnw1
zxCJE^s!>&S9?z$OFna+=B(*hSx5_MkzzwN)Cz0{3Z8}W;cW8A5x(?pqtM`4O1fS1o
zPc_G(!32&ErH-cMm;0qOz+IW*)VPF{*&e_Fa=BRz*>4%<*sDNs1}i)|2fDN135X+Q
z=cGBm225`$0FVr$AZ$W0CTsIlm|?NFZwruuI`kD~{$2#>Phi_lHTAfLXd+GRrMx-#
zo~~Dq_lp5ONCASRJ&%I%=1+0>wkO#p^R|zlSB~j8j=BM@`(YlsuQ?gU1hL$=v^%2<
zw#3k|PT=GRj^>4EMc<1Bck5jU9)XLJL8mWB<xi;{lh9=lZXKO_Px!@6D<qod?j$3W
z&sZaL{Z-Sf4_L9a0{TTYB_MQvSJS?Lz1DR%{8NtJSIu+ybRcFIMm(mf$GgLJfWuLF
zfWpD|Bb#rNbU<ci?m$d~flQU3Yd(_X`wc<6*D`XQlZX3VfdxjJN1|bWEW0?K%NI^l
z!V{V{dl3XE7sE|oly{NqRN+!350`>su=Oymzx~Vx9G-0EaSjTC;RllraBoZv?}mxm
zq~Nt}a6t3}i-=-)bjqne_Z@T7A9E9go}BCux}qev)DG%T?-Tfsr_k#kqP!ObVMDf3
zB@JuB(*O4SJdlrN5HiJGG!1V)hkO`<%rjy-FV@KSZBg3JD8P}sg&oS7W}wnHORiJJ
z+n)m6@SUw{jh4$(mud{c_68&af}uLD%m`g-{|u4l;(VUcI6XxL-U9bRYn}&=C%Hgy
z9~;K*jTFeHc3-BV>CDnJY3`U*35jtQH!Y?|EqB~SijCXr($w%irK(z1u--Fngn>7v
zOB?vT6!P($t1lcCyX4<Hn(gk#*g`sU=h?K65i_HSzuZv}Dy90T@QrcKfHzv+O+8Jp
zCQ+AdPtk1k2f{w@JkVQuIyx^aAD~1iCMG<#y6XL3S~dM*%kdnGWo_dyF&&Q~M8O2J
zM%_gwdf!1QZS~G^^X|EOB@*BX8bz?@PUV@fa~mq^fo(V{olbhlz>PKg(3+APTh68<
zGWB}|x=-a}6Uv=;JFKxlURij{1$Pf2ekB>qtAEtDuj*v$jp%kYt?)p+_ws&RZLvA6
z;%Cax3qgkuT?cq`Mn7!ex!*-G$d6pzWHpZ8uKQM7nX%GN>9Tv@uKn}2L)V6&?TX?F
z9w+Nd!=p^C@%&$Nxr}|{AC)D;p;|n9kJb9rn<@w~6h_K@DHz>2&WhaOL(4&j=!TTj
zy`KCvs^h*oIByE1Ei1O4rUMuN2QCt^6kfk;ID6b(t*pv`^CO)vgePmO2MCB;(Cl<0
z2A2*7`5^YnyP8&zSPJeMg9lAKUri@bbnVW~XF~d~KCP3|bOdReohkH&hTVuvPhE+U
zv#pQ<P}n+K6>fAtTzEe;EaFN*w-|@lOg9&3q!zk?Xg9C^jNmD%GRYl^r>I>H&+wrU
z<R@hM6iLG8$ClG=j<+akR#65g5?Z_@q1!17M^YVtc#a|zj~SxqMKszGIOKnA2XcX(
zmeF>Y7jRhP4!yojL|bhxJM@pL3Y%7=v=tDMp>61UX$g!xni$LzpLc)b8P%8GPF#)V
ze-|vJ7LaXopemgasZtWhto`4t!+*CG|4&bS7d<V!JOObmf<dYZXdU1KUBj7saR5|6
z?q7FdK~zk8c@3Ux7~Z~T%8DJ&whLJ6-2osAk5S_%C`493t-;a6P#%=bMNEm%IqmB%
zL$@tA1I7ssy^*NaxNq#MPpo|Por;GNi|qi7N!+L|4=~4b?IMv#6zhI%-t}Wm6(5ad
z+r0Xvx2sIJKPt48)y)V>`ywP(91~@!)@pH^bF$>JvqZ>u+zngj&!h#hq^CE7v*Y(^
znGzQbSP;#oS*2W>jZEk##QP$Jysv2A5Hn01ov}gRwX*`DT7TYj`wzNqI`gM9K-Y~x
zlQomWGo->6Ami4S*wTX_6OCOXz5v~>q&47AsJuh9Hg|bVP47Nw!HFWbZC6#rkD`AL
zd>Y~A%E_=(TG#WMmiyEq%1U}v6OsGdmufI{oKgn1HEXqfR2^PTJZ$(S2vu{8d_S|l
z{PpJ>;3&asPZAaHKK8SLspRRkStC5ezuT<nkgLwrKN7@$+pC^#d!Vun?oa(#JvC$N
z)qftv`sDhmF4eAmNtTG=XkmpEOF>ytsI)(Wv!K;IF{AwTY0Ip{gG_XkWa!laKGIdI
zy4Lu?r9~tAC$nl|vL1If_JmBTLeuXDltMH}ET-yomw#eEg(O>RVX|}dI|17z|9#A7
z@XQGe9HfPpWtE2@kP$|5)~i-Cg#|3YVb($wie3me<(TMHR3B~nWw+$-4=>}I+6r{D
z*s*4zJzPFh@=y4ub)`6kHYv4K`C;ikE1Pwu<FcZ1&L1te7&g#%={G6dv6_o42Rb$w
zw_3Nc_-Xk^Md9Et_70*yHmSmqE_~N5Dke;!Tq%aPEV<uY%jr@bV1gbR@;Cu*wYj=c
zwU&}4ebPAHK*LJ~+xYb)Z6zLUiEV_i1J+h`c;ufg<uCUAdii9W|H>e&oJehSlpDk}
zM1R)eEpd8jnFQ7h%~=U=exgpL>{vM1Do34JAq(*=6S@3{VkvpI2ijhJDcIPcrURU2
z&%0iZR7i2CviAyxOA!013y}M4)>93BTzdNSb3?SDBHsf<vnFL|gQ|yC{|z_0<Wy$|
zz13-?i<Fki=<lQN7KfLWgPR|dFjRRC8|pMQo8+Ulxz%dLQZtL$@%jG@M-o`@?d@gR
z#Nw*$N`HDp$n|x-B;x(3MGU^+xsYV!)4Po$uQ#z*W4(yBm&G7>R41?QkcDFbQ5f=G
zT*lRW>SAJ|19=VA`12#BL(fILwrsxQuvjzq3BbR%oOI_~f%h<ILaxb#*d;*c+tlG_
zIXI|Bvm5hAkn}G@Nk`!EpN^ocbA)!Ma4QPzAtTWWrE`3yo0w~If8t;Mf#YLx&MG|T
zr*gr9O6XGyI%|z6iGOdjVh!cq*hfj4uqUKv6A_(|$wz~V;_&Cr=ayA++D_W;7+Zd~
z(X}Wex$Zhl?F;RL@}BjjIpP&kD5jR8kmr-XK>@BocYguK_+ZjNh>$vLE!UaRpWBO=
zfj&ak0x@xsN?LfSQFsr>@=s988k%OQN(>!qlfuB{Fa9uM=yM?h;Z3cYvcxNcXRyi#
zW4=K1Mc<%!3B}F-qJWWo*xxchYDMh-n{MX+d&CVR(L^UH?;W}K`?Is@P^a{QJPq`c
zt$r(&MphaTvl{4ha&}12F7qkp-OOG@3o?WVFa9FYvU@AQ&tQW>XY&<(4uMZSPmq+N
zLTp!?@M0>-%v)|QQXDgtgR$XpnBq{dDNb9#y}hkrCo$thTj33fQlS#Tre^Ki(zEhD
z1-PzfcIXfna`M!7>7!H=+gwh`18|5`&Shx^tb2=7rvn}L5+eKO#Q_BGIY($LN1Zgg
zmt^;x=GFoX(}_$>mS@(k15WB$Fv`ulJkMAC1BRh;x7F2UWc0((-VXDK`1g_~<FX>f
z0$J$B*8lRC-zS3StJV4(Xy-79@v^e>b2f?(ioJ6Y-*)s?*kcwIjAV`<R@RE=f@&Ha
zFa9|WqUv6V4B(!IVl&&o>7C2|v`kcn4A`AH*IGjPr45@S3JNIDXyp<G!)76w?Z7zL
z>17FFx--YybzbVuW3#1|Er`uH*PTII<s@F^>upc1lVdGfr$cjJ%eEq6G`}1=pU#3?
zFVlp0$P=1LrlM9F#hI^%G$6AQrUL6@YnQf<>RE4xx@L-)(x!YQh~xQoX-c9K2)>iv
z7b9bW=P&;5)?h=PR0<E@#YCqPM82^22SQBM50`vaSH9oA?u;9yG|QP7OVxS|hee$H
zQz~2!_g^66JFAj1t8dGye8|Tb+|VQGg}UIz-r$dT#U5hA&E5U$o3G+c4)BI+h1?Iu
zoB9B8V#^L6oy(5zhLu^)G*O_Zla8%Xc22?(1_r76^ek+@?4}L1U#O+F)4gyWF8JG~
z-k8Zc$7h4ID~SLE!cR~D2Bern(cF_Dh*MYb-9dSPj&ewMiqL`o0MXfh0yTJwA^n|B
za`z^`S{7K7@XKjBb@OB_EQu><X|5}{z_QnKdB47?S(*fBOhtlAL&0C(JzZe$7Ui9c
z>Ic?cmZB)Hr7|BM`EnX!=<+%D0XC8J=9hUZaaul98$Ux+6>E<sTlngz@qzd|k^p@q
z#Cu}jVAvZoS25t$@1U3^@d+VeP1)vHcZcp5PbfY~`DK9noK#%%23YK{c?O0Sy3$vD
zqgkXZHfk`it9Kedx;44s_?A*DO^nxI13fWKW@lk4#7nN<EJK<jzBQrY(*P>i+IAii
z+R(dbFuB-I!q;@k=)K04c(ga&A0_03D}z9RID7KJt-k()GuTv}lB!?`g`td~g%<Il
zx{F#KSbjw;$<z_$7$s=J!W{>-aPsQmzHC!BO>!k1*i>Iyu?M774cI>{*37kQ#GWUQ
zD&tBHNWEN#eb+y%mPZ{A=W0VjZ>yf!!0Ku2553cUB?`$`_OoXjKtvJgve2R}fn>P*
z_w#s#n#p32ltjlM8UGa<Li`;>wwjKok@yAyQnF&S1bSBYYs(7kdn#6~S1n|Q0%nL8
zAmKa@Z0>9lI<+c~1n<znfA{nZ*$F~mDK6bK@wyv0OWzK!`Mop!BqP=aB?LTBHe+)v
z?y9H0=?B-+7~_=kO63keL3zoL3em;SMvd`74PR)OBzGRi32VCDIIQp@zo(g~sQ#q<
zr2Qgv^?v$VOXCf0sHw!Hv{eExpS)IEe=)=>-vzyHV8Z%k*P@j;TvU&RwT<-BfW5IS
zT$L47H;7%Iex&ExlhJ3=9T3~{4h4TM`nK`KcWDF;_`d1hyj!^g$yk5sCy5g_LOv-7
zR;4S{V1c7^*EseYB}wr$TE#-gbk<Kg8`zxCuEsT^*yS8l4rpJAw;2Ybll=oGzY}=r
z{N}fpinSuy;s-t8(GRKJppXeOQh-59rfX&ci8YqVbT-2Sygt-=Rgz9cky%!No=BxQ
zyFahzU<;an$JBlX=BL4$$2H^N(Bj)zh(4WvOb&HZf;H&cV`*ig>veEvK+|!;TV{<v
zQD)+fWB3+H<YeA{QX2o292neN?fTK7oa57oBB*q8EjGf6f{XS2?{B^4(VHnaRZQ{F
zHY*V|Ku87#%KhmtsojpP)Vqh_!jZ#@5xOO1to$%#E+2zSO;g8!UZ(XuQr*h%g4ST`
z=8u@!QUB4L^>HyedZrqixkwgx8brCdepRSnFee|!@`2~zlf5NH#_6}bRj94f1lH-i
zIptHdRnSTXNrbt#j;=7+|JKU&-y6IBe|^$^>-_0IzVwKww|;a1z^%JmBW49rx<MC_
zZS<e}NXl#YYl5pQ@F?gI_*%blG}{8h9kIH58{=rM3%zWO$ZsVU!rV~8vk4qY9OTam
z&$3G1_xLK5r~hWclv%5AQ+g6-w+n0x7l81Ll?izs?!<=cXX2=V^wQN(M_k~tz5q+l
z423b6ve;-C@96bX+h&CmIc2!A4*1~LWWNB@<!clj*y5pWkZt%9$+!2b0{-V+6ufQ@
zX60K6j55Ys0HL7z0hIyYGqP_XRDY}Uav<am^6Y&_Z(d^?>d7&)40$noI>vxJge$$-
zxc(OEE*fIbH;>-E9ZE@Qk638JNXRR;=+mt0#vNxcYLbZtkBu=l3Dwd@gVti=YQfSG
zG1EE*;j##6cYHKu-)!@3ms;5uI#^L^`k0}i$*~?UG*Z#zf(lMg8EW&pzJ0eZtyyTj
zs@Ubz_7PV+SlVs9+d*G-H(vV(r!rk}CTpx0y@SOu>DI%q2Z!YlM|@BH>D}dgdvd<B
zlBccRag9N6)21!%|CsLy)Showt8Eh`hs#<|IyY1}!YE(2G+ygadxILsLcNC12@L}z
zCJUf0W%`dRGh0H>2~06*d=!JKNG8E`+uu+*RWa}7QRT*Pp7P=sXe1z$q%8cj7!K`z
zVZK(s>hAuz%B6Y0n)QL*_EUx~rtG{ug`em9<QVm)XLUD1-T(MG^R!x9nH|%7Q<+rp
z=`o}-?=BS)<iWp#@Z)6Bl2F|h(+=7<$9$!wNz+11#?9p8nVx2zbkn{rgTee_VE~<C
zL>}6{Ct%|FURo($2HJF{%|A0#Y*R~B7P(a9=S#J19S5YnFKTYv4oBlDJSqL>U?L^u
z37aw{lf(PHHL)d6cQUh{_-&qJ=sZQaSFIl{$hwHsX1;f>$<!8Q^{@?H4=scS7BnOO
z-29s^I1{Q^cw&vKh>I(DP?ZIDYguS;<gnajp}A+OUnq?JTX)2|{;lOvclmX3n%6{Y
z>n|a(%c(5x`Q6#Vk!Vq-zS{#d+%!i%;QaLwQ*9Z-4~@r@MCDu8+>k{5z2I~(P7Cyv
zsn5h*q-2dp4U(WP%oBko6%&=%{#7!p!!sDhb%JS-1bj9IRkQ7WX#8vamX)Ux@OXR6
z9!i`-x6&8)pR8)7^3wEen#%yg%wK27(i6&WNoy)-eGDEGBlO3XdZ_=K!(<>dE-sLp
z=X-j^nOTYZpE&?3BF#<jU9_hieBhTB$BjSr7BUV*f}U0SZ!YG1T_k*p=<EHoKE0fR
zf`pvhhrs)B6DnF-_-WBsq5ik7Q*L=EW}R<z;JdiE++EG7%oNICtb2h1%F4=mqH&p;
z5~-M25Yb6g4Y0E}_|j94PKSD%pi+z;>i~CGYN=St`rK_t)cf5!vJ@4Sl#G#=tukgo
z9a8d$@-SOS)+b;LGX!MT0KKx?LdNO;!~1>D9C!}BxvrQW7zMq~C38grn(iUH!@GqE
zBI4@mSgS2g30YYrO%7|?21|Tzey>Cb64k+|=&xmt(jpwU@N%iQ@So|2aM`ca)SXFQ
zkfghNQ}cR@lS!3cBLcM8nHG;lzevkqXLlFi5tsITBBhuf&rC8G59X(o>F5sl?Le&?
z>kx1W)%OT~`JJ~RYLqH#Rr~7RKZ0J*je@{kw-wxzv`q9U+w>z+-HX+19fHyoK4MJw
zh?U((8<G$0%&o|cox#ID1=TatHa<M~&T()b1Pt!s|C%_Nc!amZ*bA~Z@d~%cf5goY
z(fIP^G8;VF4kU7mH?QD*cbvik+#Lt|NRkPyitmb8Z-AHm6|eQ&2B#&Ph(W>4Dxt$S
z=@pK>Ai*R43f2OD@Z-^mKlmg_5qMdC+X1B$oIe<-a)^(FVu(b7UT#_{aPQ`FUy3%~
zyDu4enQiq1n{}QHqx;EoL~AdQ=5FZ$NJpjNzvjSBjSlg_`_yN@o8V&PlGx5TonQ3E
zRs7B*X9CVb+Ee6a9eC(IkAk-asqdMFw5KDGdBM*%L4LkJWBRG~S!g6Zs;@<9O$i21
zk;8~2Cg~@}#6mm^>?$01(8%~RSG{VN6T@lcCyFg>2DDs@=iG5-yqi5ZKAroi&Bh8O
z+2;PmU(*b~yDjeZHhxZueeu`6Rdv|7h}DI3S@zcVgp+tUUXylMim|fGROiw)SKoH2
zc*ZN^nAJ2ZKek~c^y6GMK!C75B2uHyV-_O}Yc*%knz<y*)I9SaIMihXUnkOoQ<!vY
zFZ&}fWL#W09D&cC4*VqM7TEJyq6X5<?MNv7;eGjE)zX<*`+g>#la8AYlVDmt6)|7M
zd(_j?Qg^#|v<`f*1+`u5lrPUo=Fz)Gq3AN(7p!zqZ|#uX1$Ldu#$WbWJe;lD={7sX
z#x-YWEYVQ7DYqlRC8OF5`9W!>cO#0IM$Bg`R3l|RLH{X(+?#;bjm@otWPVz?@TgDz
z%A;4Lg<b-)&oHHTRh!e)eNx@n@jfd%8ceG<%B_ki*>_QHN}^y?%c1+)rK~FwQdu2P
z@C`p~THGt?z|F-ZHm2GDG+K>Kgq9x?6qS}%YMYMzVsLIV)Q8`%A13QRnkjVoTbxz_
z*xvTUr*19<!<<;KLJ&0x%m?8OCUZ2wx-LGvAJ%nhbnsdJ%RJm(RZ9Pwis<)aWf);#
z!8@#8yiWo`GFvnzum54#KuHy^Tf2X5_FHcEN%&q+@`dgEqK`at8wDxuCCdXIC956I
z$2V~A#selTjcnu?w~ya9DzC{u2PtBegQ$!M8o=v9gDU8PZRhC~)7ixUFu=zR@V`wz
z@Ha{+5fxf0Xsd2*&-)GtaYGs^LtErEdN*1byEhYzz;t|1yBI9Y%^(l&x=WX4dX&`a
z$;I;(`xdEJ(#}aLM@hRE-DqMmj8{gz(tA$gX8^n=>mGmkN_$9_MQHB0qUY<E%D`4_
z{%u)K55LdHZi{T*TfdIOqrzM8a|exh*KNf4WJLQLuAi+;A@MU%Pe>Mtp==_HU&C+5
zURyiW_B~m^m0IWP%OfTRLwWxp_2N3M=^xhl5=M#bweINXQv@ua)}c=ayycQyeTL`<
z02oJuwl780ByNVC%cFiIKyg<t<g&-ew!PKSEx#-{Iyyl_nT`&0>(?bzip5QC*u&3r
z?Dp4^7b)6x+ci_%yil}shZK$l=PPC7W)DNT3&$phw7Bqlt#~z#ML*Y43dGSmMD5=h
zzVUIrjucb{k<cIs2M5PyLm-?k$6LGum;Z@U$}l#9nAVR24HSQ63PihA9$t?k)5^e~
zW8{D6F&!px_*ddm)nbMLEzJEDSgLjk({&=L>{Ac_@Li>v%AABtnRvaT1+hCf{rDNp
zFg_(I^veQ|MhkUwl1c9A)Tq14KQd4Xj(w~=>><IG+k(W&i%TD&pyuf}o6|#0b;;%5
z70sE<f!a(bAF`rZEa0;aa!YR-Z$Tn~=4`F=z7AVwCqv$3jh}KX*e_T)EMB*zWF5EG
zp;p(OQds;|2l$ZUc~Xzc)M!0DWZ=|=yCN?SH`4KSZ-Z2fZ30L8;?c8}YpT4%>JBNO
zppp1LI4CX6m;33U9Vig~d0}kmEId?1VQ3&W8-wvUe6wv(N6zbcgfaRFHZ%sGO$1gv
z`reU3uRU$oF!nI&Erq!txmQbvorLi!D&_8Jv7}-dW~lbY`b6XWXW3!ZSFh)fYTorH
z5l0gPHMt|^Qva(A>i;sW`oH?Ja_Z-s&rk-rvt0fEI@kX)nL8dLHW*e8agm+$sI;nd
zp$?KH!D=x459g7JmRYQLc6Xo(QJp<6q4j%AVv@52a!C!dj-3iVF8z)MyVp-!b)hzD
zDZkW6$<kyO5f|r)wW?KrMs3AEzz$5Ge`U>X3kQcoeH^JESZIhtS*D4jJnYclSoaj+
zy)Mc^?3Ob&bmao+=?=AxnVXE0N)Qd3T(F&i5mHDq%Ld*5GFw5$U-hu9O`Udll;`QO
zNO`^gh&l5OS6>y{XwI*~DxtT7+L~%beddTr(oaf|O$jp&TW=mJq06iC<mn%(_Kh$~
zuM*?$qkKnJy2}!UA>Gn-+xx!?N?PgUJQUWaXsdxsXxZpXfeZ2Szl74l_g*g2m#FTy
zh3v0tDrE{tZ=Pe=FP#P}^2zpDCjux&{mA0KTWDA1L}{LJjocc9m;)1M1}+IX38EgM
z^)jr7_Ily_nGaNpUmqNa9?qdCrPXA`svCQizhryza}KX?fUnkJoPFWW7~sZPT?uW~
zk65toGGlgam>b}sP68@b<AVmP1h2qG-G{LuoB(l;(MjVyBT-X(GWoG3-?Um{4(t;m
zh}$faK6c_|gFcAv!(X-&QF5KsJ41N$5_b`ji)ZFFcv&dlDsCfY1wa|U^%`zP9HRK7
z54c~6kicK&I9b4`hlCy`Eh-t(l<u2m8v;xW?}jYRe6Cd|^xDZzj3*`iQ@~3{$vUa9
zgs&l7L8$f}sb&v-0DZsTt*ymVYlx4XT6cS0{xs*m6I>G5B*L1T$^NhAzB;JQ@68vA
z6fYXIP^37t&_Z!26fMQwAy{#z6nFO`#S6tXKyY_yOH&9A!KGMnhkeuUZ)WG-ncdml
znZ0xW$_xof-jj14`N;F`g@Gqu3XixHGZt$=KS$Q^+4iAx3Yp6)1^UrK^!s^Oo`rct
zF1AyUuy77^puVW_ITapiz7+N`Gnfcv&Q;bY%1T193Uti;&dnksUyv{>&1X$@u}?bX
zZ9$QJO^~Wg9TU7`$zT<V!z-?lKQ~>xe6=J+`dz8-HBtRWTYh+#d)**-vgM2-+xUst
zjsOj!#J`&A)R5GDn6&#nZWf7f0V@Z-p#H?iFJJ$Fr*kgS&T^&&=t`wrVIO-quEt8;
zcs4|;J#DjZyq!%K7GXmiI)U4f44=OL=yrkdI?sMoBu6~@7~h)@-%0e(#cKnK&?+3Z
zk`E$BjY}W;&f#f0QK8@)iW4YQwp9tuS>GiHi}hju!R!k8c~HMo>Z5^^Vymu27EB)B
zfhWff2<g)6>A^(7CzuU=Fu6E1_OsEqS=1Pg4k%$3CJJVr^>LIDu%q<yS5ozuaBd6!
zA_6v<JMgh@3Pv!N{@W4h>5nHwOtUA)>52R*1|jRA8a@L->(e@-6rcU6f-ksvB07c9
zO55Qb--U7s0M84~o)%Yc?Sh$VNbov?$q@g2T<#JgyIV|4eDlIv=5-(Dr#)48JnBj-
zO=>{8(jLrr&B=b@3l8N2L#KAFD&IzRVlWYyI))9rH_J`6*DBYQ9=TH2V2_{aVeo3w
z{zQ|{&ePna{=$p$Ad>!(^<eGOA_i5TXE_VkZ@}OV@>Z<iVAGwX09Y?czYFC^-#M&B
z9Z#qc6b*a)Q`ZN<V-Jmu1UwLAYAO)-9p<|^w8qk&rE21w6lMC`Dki2!&8Tr09s6m@
z3Vlz@Jw>W^zEVA?Z_UfjQ14(TIbd4cdBJ0xhnW*4FKl_r<C~c`%jkZ_$>cCf(p@rr
zV0JL0^~$cluP@?WECeSpc3!yuqjL`S;`sYm{>9&_FUG8fSYsOO!(0og$sD<RUFI>b
z386nYE<CNQAFK2q?IsP&vLXVc#|L^6KZW$&kt|K<_hUL#&ap4vm=;*D|J+7M^SFfV
z<Vt&tSzl-L81AHY>=j<<WM<g@KK~`Obh9vho00(_9cq$0SKH!*Xnh!#mvvPiTZP!Q
z%)1YVWZe7(=-%Rpg}CNlRO&_Uac?xH<TZ6X4z8u=R|-iNK2kMMv&pFKKiFh}y(ire
z<Dq!!pBeYG$n;Ue;!&1@idhR$ahrihvYU(|dET|MS-)4y@|jTuhx0dK#QgDg^hBbs
z>WV>#ActYif-|-GyY7lF2UVt-iLMBpwY^60{wT-NY&{_X6f@0J*7I=1<62TVR1q9i
zS&aACm&YRIvhEWAI;*!DOI`>9S@ClSNTVgDTf-TZi@Z~?c%F|WT1#k|bUbOEQ_=TF
ztnd1j<HeqyC(2n>|B<IJxtzWl?@GZGgOwWXq}RyuOg)xhb(Y<dIp^*$_6md8!xvhh
z0-x$x$M>t41`VxXZcAnm*ekG9h^H?O#$%y#l2%-Q%zAIfW4Yld@oh*|&f#GnFl2<H
zsb-0YMd7Rk!hJ0-a?tMBaJe}yy3UXHhqL!6mZ5%LxAEZbRbH!fsJGQS#7+tjjB#-I
zE^xsZbQZBb7-a|F#9motcXYj!SugtH<Te{49ls-<eAM3W1jN}_+(pik*Md+7gi%PZ
za?R^3DGL+r#{ed#E{V%7=`(;sY7zh1u3ta>Is%K;Y{aV)FWcKQY%fkRW?wz*1`=#?
zzaZ3i!l#Mxv3T`zlbQYtC;2v8@Y2u+-1Y2!=}RWN)m)h$3wt$Z@r;QA=7ef2?Xj!k
z+ZB^Jir!z9G6PXJxWl))(>nyHOJR=m>RGZYhJvirNwH6rXTO}D;iU)q2s*jBgVd7u
z2lBV(6u}yj0=e9c-SiJ*nPYocXM#a_-3L{#89s;#Q9Pb}M?TnzD+q@)DOCnW7!=eU
z^R(#mxYV!u1-&_@Nb&Ia=5s~Fw0j$V_Cj8fDmrVSvYuU0J@m*`q3zfY&$<;<*C!YQ
z3QPkaN<$<ZTI{Ma<LXH-*ot3N?MGX1yAKSO${&b8j>M4|A|n&3Yr0Dc%aUvtF8b;u
zW;rw$nM~6ZOApjNoDpOxt}#9$w<kCFe};JK?ZH1i<uEP3(FT9G&-4PynnWGd$iM!H
zd_ut01#0y}B0aVLnJnS|d`|LX+(^;8%n2HzY=YbCb8S}u+xr7xHvJDffNdKZ04Uj}
zPo;p?J@qe3_&<06TwiK;VEiZrcGW9;vN)PeG)JHwV|{7r9dd_D9lwOgr6Y4alJ9{w
zt@T*nT%Hj$<&oubDgt1^Gcif=+8#Ak-R4tPEjz)O0zk1)HfiKZD-h_}AyCv%lWy-N
z7dsa8mP;>|#gj?Rbpbh^Yik||hciZg55PwA;aTnvoiE<-`H84LWxmv_<f?Y3>rY)6
zgin5PF}3lbA#O{?2$C^P_234K|Fvl%+B=v)DVqNRU>_{jt->L<;j4NQr3t9(O|)t;
z>!-$#yDti_|2XRw&K7*Gmw1kvt_{GEe3iQxX=G&t&e%@MmaM@4M};H=jj$kSdb>wR
z1XOej+l`!6@n!np42M?)AD$P!plz$f^~*jYv8xn)R3+7wfwOc=7x*q5j!Fd-lF6b&
z2D(v#y&B0A!jD~f&7it7n#66tR*WML%l%5CBKR#npYtBPK;ovZzGg3;d*%y>ciy65
zXaqlKgtz2Rv=Dh=#TfhLj<r>LiEB9l>%mE?rqbM?&p{(%6e~3-twL1Im0xx!aX;Bq
z27X(=HG#t=loigO{X+_V37dAOangQJI2e#5#rGR4R^@^}%XzrwTx-<5Y1xIPx0Ibr
zkWES5Isvs?BT`oo`(u4#pGSGv$GKHp7tJR??Hl5iYfg&qD1biAyTLFn`Xz_^iM)7@
zw^^W{h*w;?2~{w|4`+a%lO`OW978<<k(Rp$VX4P4jBg(AQ`Z>F^Y32KB4MIfU;%^C
zgt`)cg7{SV1XR3e==Mb80DLL$_E5p@cFff0cm{CJxS;oE609D_pKQN?-9fEwlcsg1
zC+rL%a-&M;RgEly6IoBBltv_tpB4e_f14)dLzh~3VSD4_Vds9Q(H(!&Dl9YrmROLj
zI_?@*(Ui{V&5}R$L@izYt_i0b&f&*qb?Ii@5N&Q=p?Q&DiO%C3=gPudf<feRl<oBO
z(!Ybaaeh2ZXEh7hbU)MpnlH{i|4`9J+ei3TfhL<Q-d?@B=W;VQ{)=`__&sQ9y-7)x
z!r#!gUeqY~pi?w37?Fz-mn(724F?vQscPWp7tN<;T&r4jz9_;PfHa$4A{vxMr#Fs6
zQP}KV-cyr*t@NJpK_KXPkQ*unX5}Izf@@)aZ$)rMP>6+kGhYmVJtCY=t|TQY%R4iG
z6YFLPG^-QE_Hzx>nrz%1X)@pmzRiL`X_#D76=v?~1#0HAThyJ|`+(CyKMnm?JvCpP
zK7qQ)D)Q;26#Sk!PRSjLs7p)#EPwRwQ>}`7@db0|A<t{{y$3jWdUNwmgQrIxQW!Y}
zbN0WlUI+1u4IcOyy<+F|_y(IbHxV4xp+X)bmFeK9liSx%4i8%Y{L%M@I7|_7-u@x9
zd#JaZv;Y%0e2;(T^HI`%hQi~kGP+CHLxYIMbyJ%vEEM5B=|v5QQ{|DShMoLy#IxrZ
z4<X8T!|acEDL$XSCoaIXe$Zz11*7sZ-K<4wI7OUJuEBP*BDa7?OonhXT{~~1|8RGB
zrB3;~ZBu?9(6}=Qy_IGvaT5`zGTsvpY`eck4R-ZhI=!dqseSY)|IaZU#NF{})z*ZX
z{fq#>7qaG9k(l;RVDOU3jS-?sYx2Z+kSmg<EN<&`s9`>Yj{RZq+7rhX-bg=B9FIuG
zz#!@5VNR;}$oXbBi1gs_$PBk;o}!Ln40bcKw#mEqOx#<kqM2i4Yl8<N|0yVcEl5Vw
z7YNfon1B%Imxnf32DzjL<hiyY;nD){3o%GnQ-D)z*Co3ptJU|9pcom38GikZ!=wcN
z1z5XH6yPoZF|la#WrM>4m2qszX29&Ei(nalSxXVdfbmrEn58{hAhKU(MaN_Re!N|r
zd)t5somtr#myCMdmqc|~skG<)F1K^U0@;-#lgrD6;#|M0y4eyCT}l5(X}HWxb@N7X
z`9C^mB{m|peYLvRa2a?^QuW_&=%xUFAO*LRs<;1}akeyU`)ZO|?WzBE`9e^e!-fo7
z3H!tw$AA7%m~W%sR%RJo{vM*y@mGEVV{_kwVp9`_A|@v%Y1Q9Z!X@_BY^!g#g<S$0
zSxAuCsgdOsB9%+ON>by*)vO_9QB9vDboOw{!1a6a74P2>d~!(I;46}i(-iPKS!*>u
z8wYLCl2;-*uphKYvEVNXvdaR&3&TBm7666F-v9uqbXy)c9LkEgW%Nk>w7PUItAX@k
zs~(4Hsj5~d-B3#cV|_3>7Wca2_GsZYTsiZJaukUV4`%E~rI1NwMV7%o(}odvw^6Lh
z{CuOrsNnFQwf0<bnzs?hvmuTmQ5+lurOggdbG7t!Iw7j=RLFz=>f+v_RKv^Tz(@>M
zZe4)JDuY1Qu5IZD(`%R1%9RT95P+r;ru$@#hdrzeEHRaPgWl=;8}p4ObRa%Fu8i*s
zghfzAZLN$%4ylv)dMPRE+J6?K=^9(CX~~Qx__UB=t>isz!te+l5*`e-h*5CYBojmE
z1wD)E?5PcXdeO4W!E+zl!K(pawyJvQX@V$rqf$mlox)Xq1v^CwzOj3EXeqD2+V7M{
zGgTNdoVw>uNU(z!7iH5Nf`|}b9y9Z@`O;A=vjZwCR$!Pd=B$ZKNWyQm`2`39T=TJ>
zU0%@+cz+)IesD2+NxAb4wRqp_+R?WDQcP+%h!nOjti9LXK9{>Y4P<~xvec*%2zb!h
zXh&~CM%#33iVPT(6ugznrJ~PBxA4G6|C*<xLZ`rS-rQqaJxaBH#8dUOf?ZO6M1_lW
zDB6V?R5l`mWa1P9^C$%Ozs$C*Q*MmNbN(`VCar|Cl+JSIeS3bP>GB|}+z0Ze;~}%<
zML1FS&0^r+aPwh~nnL9{Y88{FGmzx=hh?l2=)n)3AoTUqV)B<aR7jl`Lme|4ve7xy
z8RAy2@ecLQQ*e|*b)BqVmn9-KK(#dqK??8Oxys7>++I>moix+l!w+QUf8I0WwcS~s
zwC%F{%$YGZFfT-$>s#jind7`^Uc0iy0C{IL33#{q1JW6?-bAKnqugs;D7@n_(}cLK
zSTy^OWlH3qSK6k7c;_9)y-|kcPmPCG!NG0<r*ULfCP}q~t{U)%?c<3K=v6%iYbM0M
z+IM!50QzdB4|>*ljorBOT7yjo0a3tFHiOUSGSS&<q2;5n#sPm8V8x5|BVJ1@YIYfo
zseWp^M^g~{^RBS4@M3@9{nkP$hMBOmt@=T<UY^Mq$;FutNo(j@Kjm>E%d>_#16E$+
zHH%P_rfU5@NFK%0{USVwX8pN}q2jDJQ!lM~fc?)^N7vrRQ={S)>3svtC4yf7pk;CY
zGwIqVkks1OCnpZHh=#IeBkUF5i3$e96!{|ZY|?zeAk%#(XcQdXnjLR6WgN12ds?d9
z8SS)<FALl5VYDXOqjvVb^HQ}A?PZ<m)PufEHDXINe4&@7SiA5tVscr$L{n+zdnrX9
z1K0N=O_ARn;mX<jk4Y-^<-UfPp!qE9n<17KNDEp=UU`)>`vGQ-K;iGxRVbfdbFix|
zbgiCuAPbR%1P*q%W>-hHY|WmyxXGOCRlV={Bi8a8@rlU^Uv_(3SbcH+Hk$ouKteQ|
zpCPZyO%%!JS(KUQ6#S$R>E<DhT6)px3w(G=66N!sT5&0`fv|L`Bmv_CiOC*Lb1Jle
zb(G~GY}8=e;6nhlE=wA+QT_?cQ*=vyw+VXw2aqOiDH4B_UVp>Iy$2`27T<}v$nAgP
zm-pc@MQ{#G3UaR!JNv8nMuN;?JGCk`LxMU}H6|&5n-ZWIco#@C8Y8m4c{aaH!4iWg
z34nL#IBjdJ(s~48j6G3@InGX`PkSjpu&5~TKG(E=p=;OqOUDs_tDPzx@0Z3xh~|Ef
zpbl*<X0$wp6h%ex`whBH0i!Zv5Y0%SyXzQ921<pT$YM{m8$>!Pl;6-6I-Y4FWMQ>a
z*G*r+xEiCa{%6_+TpvwWPT#^olZ=imsh+<l5cuOC^g{cyVc#5Bfp<{<6HhDyNYwj}
z53%{k=hFreJ#i%E&acBka$7g928h!%n^=rtt71irjf@<lIRj*7*~COj7uZU&L{Cu5
z|0)}2Vg|RTf`M$dHQxm=#(&cfy$MqO_>VM1n)rWR8uE`OWMwZ{b6Qn5n!7UJNq_K|
zuyPhz8_N8h35%t#BB+I?2#j-i7hbN3>+~6m<9@sV->&lV1z`8DBS9)cDtA~m=T<Ma
z2HAn_mDkXsm+3((7PwnmV1tXyO+^3)se8L%szE0h^}As3L_SkI>J*{1G+0IjCF2VP
zdLZJJ)r98^k7(h5k>8CQczG#r&+u|VNm6nad9n}w)Dw!^o@|UXy$0G>N3wmUHed8A
zdP7TN#r(;SKq#L%-m2bw6tXKr)*lAM4SBpxw_XhCLpD)H^01BmlRDf2*nXQ+TWp)t
z+>)Gg57|qsEPK0}Q>{ASsBGo|bIK|JOcrXdzXd0)%y&UI)Yn*rg#5U|ESxD>xM~tZ
z(1bene&!{0O`>tCDl2AIO)vCJwoWd!A^N&7SDF9rFM>;`kFF(ZpxeP7nWg;Q{e23_
zJ$U3+EkPYefF=4&#%&5+bh1I@>wt2A`VEVEeep&MbT2p;P>{f8*Z{CSzXhbcSJ@L-
zm1bscplvV?B?&wG9i*gv);CJV<+O5)-32)(bYBkbnpA{pkN+jAYSEAhFJZ?&G1b(Z
zH$h!3%8W;l<xJ>(D>(4`oKYJurF8FYue_83XzhXPiLa~LoAjY1?^%EpNBQg=0M5~w
z8rskJ7!MbIJo*;YLx0CO=IkY7H?#?Kux`vaf+a%<M?cRPb#(pk5VWF!VunIy9{2lA
z<=R%e0tTV8j-Z0|Fa2H1(30CL<*tsj0DD*XVr)IvBQFes>F{9;;a#?VR=q-PN+zzp
zZ=)bvw||!j-p*M(mvfX%Q@iPFmQy$6J!5*f<nhY8#&$K1>`D-*kFp~Ht-fnVnZ)p2
zZ;6;*WCnQfPcB`Yq*%tfG2$^S^{tJW^VfI!5DT*W{PKX~vcNdslWgi?fH{83Ce=><
z-g}lQZ>W%aYo%u&P=;4Dm=ISOmd(*pXQG@F7+<`vpEionuA{g8qhl&!g)H~q0A2Gr
zguP<gOQN-IFnw{xmoQve!?d@NZ1!j~yt=EM>>h<%OgYyt1J~^?6tJB%Ewi&@;xJzf
zSmEWyC;hq{I@ThIvY^kWjdk>FjV79_Thss(S*;+iC6pN`;%t;dwfK0-*amit#jXjw
zA6=Dk=4u-R-qY;Fk7N)?43a`U8Ob&n9wsln9Iz}I7UX%2UltoGs{2j(EOzS8+D7E%
zK;yM1*9;-G)o(SnZ<3aQ8RGUz9zT$gz8GjZryicNN3}g}R#?d3OcP&dML6nqOlqN2
z65K@;iD^j3y@*t9n4(O#d8;7PMx|jpszV<XE!!$3qh&xNee`Sb;w)r&F44#=<~~AN
zFGH%+Rkli>k5n-BhgOkq?@dBO*ceciZ|#x-^Rqr*!jwdek1A6|*XV?v(+%nH8|Ci5
z#C-+5q1n8@0q0pfgaJA?w~bW<(p7lRx_s~JDgli4WDn#PF^DP`ZbTEh(|`hWTK45%
zU5r1n;NLRnL;6J!Il$I?L(2AF=o9{bdWn^W3LA$H&I^~Rd`YhGD!i)Q?IB}dIWFMG
zPfQ7+(3l^hBMJ|>5D?g~*RmHQ<6ySlA(mO|E|`^sc#rGrboih}K?_})XghHu<6G+s
zH`sayUZt5{%G^c(t6|P%T3+%YmAkja2Aap#TT8}WzcXRP74Fbgf68ifiiK(Y_TlnO
z3+1|OeW)c>#P&f-{uV6o9|ahb$ZLxs6Q+G*%;M%Ihy`V;<L_u4eThbeW?WY~xgPi0
zU%xgn1!#Zt4&2%-0I@0R>>EaOqS%REB~@}(1I1Hzl;+x)-!T<HsZ*@+611h6SsLmR
zt?;QWDRhGRgni8Y6(W=p!@?z01|g1H_baLIDsc$0(W3z|1l%w6e$1fnw2`R3eLnYz
z=@$DS_S5XC0LU@Vx#_A8P$#hx_mF7J&YCJe$if(HTb1Q+&HBR>D``Uxf1+94UqM7t
zvz72z5Mu|j4_EAS$c}eTChsL@d1LaS8n3_=(S7tj*x6}8ajgQ2Mv6EZGA0u5+}>~Z
z3$H@Io%Tf-ip8^H`qN?jEitc9YYvGY&*H&elZNR~CB$3x7S!;t&Zw0nGP&gIhwQ%8
znf7%mHN12M-lX8+T?6ZEy`y=$j7axASw`ioYmRemv*61n<hJxM{e86^Fp*gB(*e%Q
zImZR+m-cPOBCq{ky=n!;eLK<$o-c@h0s{r7i-Dgr+CQm*g}Qsg`Gb5bI>hdBR4F)9
zN6*s1F;(u0R`v0zFVdbAy~Ue_dK4^u$L~szPj~kWvW}KE(_)tKWFOSGo%}5<zu?fj
z^@#$i62DlGz<u6`Kd`liZsJKfVlK_HG;bdnZ<1w*02<*421Yxu#&dI08NfE*{3{km
zP=c(nTkK7xy2#vG9{ev;RhUjeNk#Cb$BjeTmQq4dq}BXNkn+)dE^0#)dc8WAgs0mb
zwu<vslOAZ+{m&!i!2G#9Xa;<5z#(3sr5I2=<**<@Rqcx)oGS)*bK_3}<fcCq$n8Am
z!`?s#Om?!L+_j=VEusz?86EBS_mqigjxN!)i`Zj)ApIV)eYVcKd#%-%!krCwIi6{8
zC%Nb9`N{9A8&)nwkG}>mCHcwNU=^akCrCtpXwFyKx_MmV<8wR+*iDfVbi2-0ar~*^
zrmjEzb0;bfqb&W5Hs<@U1hoPTE@PM#bKY1f5z-^i9zH1F1YdFVvm$l|T6SqT1wRE$
z7*D!#zk~Zf!F<ySS$pO+-PB0)v|3T>hYb|a`$jM@RJ_J8bO>gYZ$kp<x&c_Ez~Dr3
zD@ML6F7qNh$$y98-!1UPk_FH0Q-$t(lQa4b;ip3t&<njmCa}KT9#Kao;_$Ce#^IEo
z$3%_q^Ja>E^J3zH;$EMxTvEJR(=vCUigE6pK;DrdDgrsvUOoAfDNIy8-Fp$Q!rLz<
z0y)l$JL)f_{s9;>&quyd^gVp1&gIhqSD5Xh8|N(gbU0!F@QA-5rLQP?Icv%J(S+)V
zzeQD*%Q1c*_qsP8ys?0d>WPhXaEAZ`;>?h`LmX6~E(5d(z=i$?UT!3a@_#?a@pZGr
zZnj?jI}vRAXQ#hEpDf_u$pt2}`7BWb?Kc(>v!e~gk#Xt2FH$V#ETOskf|*N3)7xmQ
zRSH5DhGE&Yd9|0{8860;aN06GRgjs1h;R23Mhb~$7X-{_J)Wpc1@xu)1K74IGmvEg
zgBda>f0a@_H<muLiOb66bUz*$5x+zmC^ORh5;GJmi;TO#*gXKezxko+bL;iA0rXgt
zt0g;EYxTyX%L03|G_?rX{~Mq!1F*n9@`rUy05Y)gNu6dC&<E(A&K!bFJ>;j3v)BOw
z`gd{Bz0iHq(BB}KfJW85>P7(>bh;Tz<@}0|<tqg-Vf^I~hekAW&b)yDTm<<3*@itJ
z4KX&6KqGNsI`G}58D87*1D}fx><?mMaeQOidFtd#q4Av(^PgTlxBI~kl^thd5neJN
z)4_G7cMQb;OhPhIo3E*~l92bVEJ!UqGz2geGMK$9YJ9+0&cm3P%Q0EX4;0*^Ct@z0
zUEufEl=f!#_IixS6RHb{kzKn@+fMFB4sWLh+clFNoVf_+sxgfG%pdW09HJ@FObu4}
zKsFQ3W;x|4huk)=LLXFSB=M4ZKr2Y-&5#z9)cmG5ipK$pGxjez|K%!Ni#S`SgxFl0
ztu=+)%w5frQmQda%^6jBD(ya{ve2GDH^~w58^-y1I{6B~qVoR$)nnW7H`Lt)KRlK=
z4YSiKI#Yj#Vt)6%g$J6Nd?i&?(xa0$s|kHQIh>MG9jbdyy_!stavA=Lu->;}&qVO3
zab&kWAnwnx-Q!H10N*3evpMPzJIZY{F%W;E)x0nj4|5o>c_oQmRGLjELbs;5sI(U+
zWb}=ox3W$C0&)E04P6I_7Me%mu54Gg`PmKJ8Vxac0yv9WhJwvQk$f1$bwSug`x)3y
zJ!s0wtyc4Ynn(z#Rm>B2XOIR+SRA6{H9+^jncxJRYYWbmu>C-#i!$(n)b|fNBsXKS
zx!srYpKY*H9&eL~4vo6giz7(tiHXG_67HiRv!d#Fp6!B6p!e0ItG@#+Y(#^7ki3x_
z@K){NWx%}S_|m8T9It$1cZ0^@Y9FSPk^(VE5`xXAcd+TMuGmZ|me^Y}h?lZ<TeD}9
zGdHuR{;Hr^lYpAI*x<nJYcWb({gW{vqMfv{I(n-n*eN6PDmSgY@v)&ee)5=xv(kz6
z+~}%6l=(~5F?Ut_&pJAugxtu@A&r#(XIk8~h93@3u{fQd+W*YgBn!I(vwSp~z{z22
zch;PwzHm99Z#!+x1rK)6@f`L);yKB9t17@Jk5o{)Sw{bh`Adm@W*zud0AVlMc{w9}
zaZt`Zv9YIZ9EF%(t@o1uaegK54F%Q@&=dnW1n{`YtEIuP^Nkv5BYd-o_m5!e|MeY3
h{->YEx^#~=;-KxWBar~y90&zPURvo*m840~zX4a58a)62

diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md
index 435d884a51..dd24c349f2 100644
--- a/windows/deployment/do/mcc-enterprise-prerequisites.md
+++ b/windows/deployment/do/mcc-enterprise-prerequisites.md
@@ -19,7 +19,7 @@ ms.collection: tier3
 - Windows 11
 
 > [!NOTE]
-> We are still accepting Enterprise/Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup)
+> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
 ## Enterprise requirements for MCC
 
 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services.
diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md
index b073f994f7..960485c7cb 100644
--- a/windows/deployment/do/mcc-isp-signup.md
+++ b/windows/deployment/do/mcc-isp-signup.md
@@ -21,7 +21,7 @@ ms.collection: tier3
 This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). 
 
  > [!NOTE]
- > Microsoft Connected Cache is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions below.
+ > Microsoft Connected Cache is now in public review. Instead of submitting a survey, you can directly onboard by following the instructions in this article.
 
 ## Prerequisites
 
diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md
index 16ce235fe6..2be225b039 100644
--- a/windows/deployment/do/mcc-isp-support.md
+++ b/windows/deployment/do/mcc-isp-support.md
@@ -21,7 +21,9 @@ ms.collection: tier3
 This article provides information on how to troubleshoot common issues with Microsoft Connected Cache for ISPs.
 
 ## Common issues
+
 This section details a few common issues that customers face during the sign up process.
+
 ### Sign up errors
 
 #### Cannot verify account
@@ -43,17 +45,18 @@ Did you previously had access to your cache nodes but it's now no longer accessi
 
 ## Diagnose and Solve Problems
 
-If this page is not resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
- 
-You can find **Diagnose and solve problems** on the left pane within your MCC resource as seen below:
+If this article isn't resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard.
+
+You can find **Diagnose and solve problems** on the left pane within your MCC resource.
 
 :::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png":::
 
-Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you are facing and follow the prompts that narrow down the solution to the issue.
+Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you're facing and follow the prompts that narrow down the solution to the issue.
 
 :::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png":::
 
 ## Steps to obtain an Azure subscription ID
+
 To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID:
 <!--Using include file, get-azure-subscription.md, for shared content-->
 [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)]
diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md
index 4624dfd2bc..1f7147865b 100644
--- a/windows/deployment/do/waas-microsoft-connected-cache.md
+++ b/windows/deployment/do/waas-microsoft-connected-cache.md
@@ -27,14 +27,14 @@ Microsoft Connected Cache is a software-only caching solution that delivers Micr
 ## Microsoft Connected Cache for ISPs (preview)
 
 > [!NOTE]
-> Microsoft Connected Cache for Internet Service Providers is now in Public Preview! Instead of submitting a survey, you can directly onboard onto our product by following the instructions on [Operator sign up and service onboarding for Microsoft Connected Cache](mcc-isp-signup.md).
+> Microsoft Connected Cache for Internet Service Providers is now in public preview. Instead of submitting a survey, you can directly onboard by following the instructions in the [Operator sign up and service onboarding](mcc-isp-signup.md) article.
 
 Microsoft Connected Cache (MCC) for Internet Service Providers is currently in preview. MCC can be deployed to as many bare-metal servers or VMs as needed and is managed from a cloud portal. When deployed, MCC can help to reduce your network bandwidth usage for Microsoft software content and updates. Cache nodes are created in the cloud portal and are configured to deliver traffic to customers by manual CIDR or BGP routing.
 
 ## Microsoft Connected Cache for Enterprise and Education (early preview)
 
 > [!NOTE]
-> We are still accepting Enterprise and Education customers to join the private preview. To register your interest, please fill out our survey here: [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
+> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
 
 Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune.
 

From cc7edeb1a95e81700ca6855567e82f158e90939d Mon Sep 17 00:00:00 2001
From: Meghan Stewart <33289333+mestew@users.noreply.github.com>
Date: Fri, 31 Mar 2023 11:28:30 -0700
Subject: [PATCH 61/64] edits

---
 windows/deployment/do/mcc-enterprise-prerequisites.md   | 2 +-
 windows/deployment/do/mcc-isp-faq.yml                   | 2 +-
 windows/deployment/do/mcc-isp.md                        | 2 +-
 windows/deployment/do/waas-microsoft-connected-cache.md | 8 ++++++--
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md
index dd24c349f2..badea53748 100644
--- a/windows/deployment/do/mcc-enterprise-prerequisites.md
+++ b/windows/deployment/do/mcc-enterprise-prerequisites.md
@@ -19,7 +19,7 @@ ms.collection: tier3
 - Windows 11
 
 > [!NOTE]
-> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
+> We're still accepting Enterprise and Education customers to join the early preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
 ## Enterprise requirements for MCC
 
 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services.
diff --git a/windows/deployment/do/mcc-isp-faq.yml b/windows/deployment/do/mcc-isp-faq.yml
index b07e11c2e1..ddcf91bb1e 100644
--- a/windows/deployment/do/mcc-isp-faq.yml
+++ b/windows/deployment/do/mcc-isp-faq.yml
@@ -86,6 +86,6 @@ sections:
       - question: I signed up for Microsoft Connected Cache, but I'm not receiving the verification email. What should I do?
         answer: First, check that the email under the NOC role is correct in your PeeringDB page. If the email associated with NOC role is correct, search for an email from the sender "microsoft-noreply@microsoft.com" with the email subject - "Here's your Microsoft Connected Cache verification code" in your Spam folders. Still can't find it? Ensure that your email admin rules allow emails from the sender "microsoft-noreply@microsoft.com".
       - question: I have an active MCC, but I'm noticing I hit the message limit for my IoT Hub each day. Does this affect my MCC performance and should I be concerned?
-        answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the private preview and isn't an issue during public preview.
+        answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the early preview and isn't an issue during public preview.
       - question: What do I do if I need more support and have more questions even after reading this FAQ page?
         answer: For further support for Microsoft Connected Cache, visit [Troubleshooting Issues for Microsoft Connected Cache for ISP (public preview)](mcc-isp-support.md).
diff --git a/windows/deployment/do/mcc-isp.md b/windows/deployment/do/mcc-isp.md
index 103077d2f5..9a067c4a51 100644
--- a/windows/deployment/do/mcc-isp.md
+++ b/windows/deployment/do/mcc-isp.md
@@ -565,7 +565,7 @@ To migrate, use the following steps:
 
 1. Navigate to the cache node that you would like to migrate and select **Download Migration Package** using the button at the top of the page.
 1. Follow the instructions under the **Connected Cache Migrate Scripts** section within Azure portal.
-   :::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the private preview to the public preview." lightbox="images/mcc-isp-migrate.png":::
+   :::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the early preview to the public preview." lightbox="images/mcc-isp-migrate.png":::
 1. Go to https://portal.azure.com and navigate to your resource to check your migrated cache nodes.
 
 
diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md
index 1f7147865b..dec5e3708d 100644
--- a/windows/deployment/do/waas-microsoft-connected-cache.md
+++ b/windows/deployment/do/waas-microsoft-connected-cache.md
@@ -22,7 +22,11 @@ ms.collection: tier3
 > [!IMPORTANT]
 > Microsoft Connected Cache is currently a preview feature. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
 
-Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: 1) Microsoft Connected Cache for Internet Service Providers and 2) Microsoft Connected Cache for Enterprise and Education (early preview). Both products are created and managed in the cloud portal.
+Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings:
+- Microsoft Connected Cache for Internet Service Providers 
+- Microsoft Connected Cache for Enterprise and Education (early preview). 
+
+Both products are created and managed in the cloud portal.
 
 ## Microsoft Connected Cache for ISPs (preview)
 
@@ -34,7 +38,7 @@ Microsoft Connected Cache (MCC) for Internet Service Providers is currently in p
 ## Microsoft Connected Cache for Enterprise and Education (early preview)
 
 > [!NOTE]
-> We're still accepting Enterprise and Education customers to join the private preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
+> We're still accepting Enterprise and Education customers to join the early preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup).
 
 Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune.
 

From 3fa61473edf57a7085d676e7c5ce1506d7c56ad9 Mon Sep 17 00:00:00 2001
From: Aaron Czechowski <aczechowski@users.noreply.github.com>
Date: Fri, 31 Mar 2023 14:54:30 -0700
Subject: [PATCH 62/64] create standard include

---
 includes/ai-disclaimer-generic.md | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 includes/ai-disclaimer-generic.md

diff --git a/includes/ai-disclaimer-generic.md b/includes/ai-disclaimer-generic.md
new file mode 100644
index 0000000000..0e190e0e38
--- /dev/null
+++ b/includes/ai-disclaimer-generic.md
@@ -0,0 +1,10 @@
+---
+author: aczechowski
+ms.author: aaroncz
+ms.date: 03/31/2023
+ms.topic: include
+ms.prod: windows-client
+---
+
+> [!NOTE]
+> This article was partially created with the help of artificial intelligence. Before publishing, an author reviewed and revised the content as needed. For more information, see [Our principles for using AI-generated content in Microsoft Learn](/azure/principles-for-ai-generated-content).

From 235ff8862cc662cf95a9bb82a1a1abb70d7cbba9 Mon Sep 17 00:00:00 2001
From: Simanole <125569072+Simanole@users.noreply.github.com>
Date: Mon, 3 Apr 2023 11:19:48 +0300
Subject: [PATCH 63/64] Update policy-csp-admx-ncsi.md

Added information about policy options that apply exclusively to DirectAccess technology.
---
 windows/client-management/mdm/policy-csp-admx-ncsi.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md
index 24975f13e3..3c1530ee1a 100644
--- a/windows/client-management/mdm/policy-csp-admx-ncsi.md
+++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md
@@ -42,7 +42,7 @@ ms.topic: reference
 
 <!-- NCSI_CorpDnsProbeContent-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity.
+This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity. This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpDnsProbeContent-Description-End -->
 
 <!-- NCSI_CorpDnsProbeContent-Editable-Begin -->
@@ -97,7 +97,7 @@ This policy setting enables you to specify the expected address of the host name
 
 <!-- NCSI_CorpDnsProbeHost-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity.
+This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity. This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpDnsProbeHost-Description-End -->
 
 <!-- NCSI_CorpDnsProbeHost-Editable-Begin -->
@@ -152,7 +152,7 @@ This policy setting enables you to specify the host name of a computer known to
 
 <!-- NCSI_CorpSitePrefixes-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity.
+This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity. This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpSitePrefixes-Description-End -->
 
 <!-- NCSI_CorpSitePrefixes-Editable-Begin -->
@@ -207,7 +207,7 @@ This policy setting enables you to specify the list of IPv6 corporate site prefi
 
 <!-- NCSI_CorpWebProbeUrl-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed.
+This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed. This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpWebProbeUrl-Description-End -->
 
 <!-- NCSI_CorpWebProbeUrl-Editable-Begin -->
@@ -262,7 +262,7 @@ This policy setting enables you to specify the URL of the corporate website, aga
 
 <!-- NCSI_DomainLocationDeterminationUrl-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network.
+This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network. This indicates the Network Location Server (NLS) URL and applies exclusively to DirectAccess clients (it does NOT apply for example to VPN clients). For non-DirectAccess scenarios, such as Azure AD only joined devices, please refer to [Policy CSP - NetworkListManager](./policy-csp-networklistmanager.md).
 <!-- NCSI_DomainLocationDeterminationUrl-Description-End -->
 
 <!-- NCSI_DomainLocationDeterminationUrl-Editable-Begin -->

From 68dbabe256fa8a563ac06378747e7cd57c790744 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Mon, 3 Apr 2023 10:46:03 -0400
Subject: [PATCH 64/64] Update policy-csp-admx-ncsi.md

---
 .../mdm/policy-csp-admx-ncsi.md               | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md
index 3c1530ee1a..4fbd4d3169 100644
--- a/windows/client-management/mdm/policy-csp-admx-ncsi.md
+++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md
@@ -42,11 +42,13 @@ ms.topic: reference
 
 <!-- NCSI_CorpDnsProbeContent-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity. This applies exclusively to DirectAccess clients.
+This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity.
 <!-- NCSI_CorpDnsProbeContent-Description-End -->
 
 <!-- NCSI_CorpDnsProbeContent-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+> [!NOTE]
+> This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpDnsProbeContent-Editable-End -->
 
 <!-- NCSI_CorpDnsProbeContent-DFProperties-Begin -->
@@ -97,11 +99,13 @@ This policy setting enables you to specify the expected address of the host name
 
 <!-- NCSI_CorpDnsProbeHost-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity. This applies exclusively to DirectAccess clients.
+This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity.
 <!-- NCSI_CorpDnsProbeHost-Description-End -->
 
 <!-- NCSI_CorpDnsProbeHost-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+> [!NOTE]
+> This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpDnsProbeHost-Editable-End -->
 
 <!-- NCSI_CorpDnsProbeHost-DFProperties-Begin -->
@@ -152,11 +156,13 @@ This policy setting enables you to specify the host name of a computer known to
 
 <!-- NCSI_CorpSitePrefixes-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity. This applies exclusively to DirectAccess clients.
+This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity.
 <!-- NCSI_CorpSitePrefixes-Description-End -->
 
 <!-- NCSI_CorpSitePrefixes-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+> [!NOTE]
+> This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpSitePrefixes-Editable-End -->
 
 <!-- NCSI_CorpSitePrefixes-DFProperties-Begin -->
@@ -207,11 +213,13 @@ This policy setting enables you to specify the list of IPv6 corporate site prefi
 
 <!-- NCSI_CorpWebProbeUrl-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed. This applies exclusively to DirectAccess clients.
+This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed.
 <!-- NCSI_CorpWebProbeUrl-Description-End -->
 
 <!-- NCSI_CorpWebProbeUrl-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+> [!NOTE]
+> This applies exclusively to DirectAccess clients.
 <!-- NCSI_CorpWebProbeUrl-Editable-End -->
 
 <!-- NCSI_CorpWebProbeUrl-DFProperties-Begin -->
@@ -262,11 +270,13 @@ This policy setting enables you to specify the URL of the corporate website, aga
 
 <!-- NCSI_DomainLocationDeterminationUrl-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network. This indicates the Network Location Server (NLS) URL and applies exclusively to DirectAccess clients (it does NOT apply for example to VPN clients). For non-DirectAccess scenarios, such as Azure AD only joined devices, please refer to [Policy CSP - NetworkListManager](./policy-csp-networklistmanager.md).
+This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network.
 <!-- NCSI_DomainLocationDeterminationUrl-Description-End -->
 
 <!-- NCSI_DomainLocationDeterminationUrl-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
+> [!NOTE]
+> This indicates the Network Location Server (NLS) URL and applies exclusively to DirectAccess clients (it does NOT apply for example to VPN clients). For non-DirectAccess scenarios, such as Azure AD only joined devices, please refer to [Policy CSP - NetworkListManager](./policy-csp-networklistmanager.md).
 <!-- NCSI_DomainLocationDeterminationUrl-Editable-End -->
 
 <!-- NCSI_DomainLocationDeterminationUrl-DFProperties-Begin -->