From 30765d8bde8c1448ff0feb1d92f67bb6f2874c7e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 30 May 2018 16:47:23 -0700 Subject: [PATCH 001/102] win 8.1 --- .../windows-defender-atp/TOC.md | 1 + ...ows-defender-advanced-threat-protection.md | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index e69658d82e..a8defba7ee 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -7,6 +7,7 @@ ### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) ## [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md) +### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) ### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) #### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) #### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..875feb88d2 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -0,0 +1,100 @@ +--- +title: Onboard Windows 7 SP 1 machines on Windows Defender ATP +description: Onboard Windows 7 SP 1 machines so that they can send sensor data to the Windows Defender ATP sensor +keywords: Onboard Windows 7 machines, oms, sp1, enterprise, pro, down level +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 06/11/2018 +--- + +# Onboard Windows 7 SP1 machines + +**Applies to:** + +- Windows 7 SP1 Enterprise +- Windows 7 SP1 Pro +- Windows 8.1 +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[!include[Prerelease information](prerelease.md)] + +Windows Defender ATP extends support to also include down-level operating systems, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console. + +To onboard down-level Windows client endpoints to Windows Defender ATP, youll need to: +- Configure and update System Center Endpoint Protection clients. +- Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP as instructed below. + +>[!TIP] +> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md). + +## Configure and update System Center Endpoint Protection clients +>[!IMPORTANT] +>This step is required only if your organization uses System Center Endpoint Protection (SCEP). + +Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. + +The following steps are required to enable this integration: +- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/en-us/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) +- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting + +## Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP + +### Before you begin +Review the following details to verify minimum system requirements: +- Install the [February monthly update rollout](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598) +- Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) +- Meet the Azure Log Analytics agent minimum system requirements. For more information, see [Collect data from computers in you environment with Log Analytics](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-concept-hybrid#prerequisites) + +1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603) or [Windows 32-bit agent](https://go.microsoft.com/fwlink/?LinkId=828604). + +2. Obtain the workspace ID: + - In the Windows Defender ATP navigation pane, select **Settings > Machine management > Onboarding** + - Select **Windows 7 SP1 and 8.1** as the operating system + - Copy the workspace ID and workspace key + +3. Using the Workspace ID and Workspace key choose any of the following installation methods to install the agent: + - Manually install the agent using setup
+ On the **Agent Setup Options** page, select **Connect the agent to Azure Log Analytics (OMS) + - [Install the agent using command line](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#add-a-workspace-using-a-script). + +4. If youre using a proxy server to connect to the Internet see the Configure proxy settings section. + +Once completed, you should see onboarded servers in the portal within an hour. + +### Configure server proxy and Internet connectivity settings + +- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway). +- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service: + +Agent Resource | Ports +:---|:--- +| *.oms.opinsights.azure.com | 443 | +| *.blob.core.windows.net | 443 | +| *.azure-automation.net | 443 | +| *.ods.opinsights.azure.com | 443 | +| winatp-gw-cus.microsoft.com | 443 | +| winatp-gw-eus.microsoft.com | 443 | +| winatp-gw-neu.microsoft.com | 443 | +| winatp-gw-weu.microsoft.com | 443 | +|winatp-gw-uks.microsoft.com | 443 | +|winatp-gw-ukw.microsoft.com | 443 | +| winatp-gw-aus.microsoft.com | 443| +| winatp-gw-aue.microsoft.com |443 | + + +## Offboard client endpoints +To offboard, you can uninstall the MMA agent from the endpoint or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the endpoint will no longer send sensor data to Windows Defender ATP. + +>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevele-belowfoldlink) + + + + + + From af0db775a7d8cefda4fd2bafed457cbe8cefadd5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 30 May 2018 16:47:40 -0700 Subject: [PATCH 002/102] remove --- ...oard-downlevel-windows-defender-advanced-threat-protection.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md index 875feb88d2..fb9fa92c3a 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -19,7 +19,6 @@ ms.date: 06/11/2018 - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro -- Windows 8.1 - Windows Defender Advanced Threat Protection (Windows Defender ATP) [!include[Prerelease information](prerelease.md)] From 883c7e82eef703451c19dbb246df4050bb86a133 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 31 May 2018 10:35:04 -0700 Subject: [PATCH 003/102] add downlevel support in preview features topic --- ...-windows-defender-advanced-threat-protection.md | 14 +++++++------- ...-windows-defender-advanced-threat-protection.md | 9 ++++++++- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md index fb9fa92c3a..a542df63b1 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: Onboard Windows 7 SP 1 machines on Windows Defender ATP -description: Onboard Windows 7 SP 1 machines so that they can send sensor data to the Windows Defender ATP sensor -keywords: Onboard Windows 7 machines, oms, sp1, enterprise, pro, down level +title: Onboard previous versions of Windows on Windows Defender ATP +description: Onboard supported previous versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor +keywords: onboard, windows, 7, 8, oms, sp1, enterprise, pro, down level search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -13,12 +13,14 @@ ms.localizationpriority: high ms.date: 06/11/2018 --- -# Onboard Windows 7 SP1 machines +# Onboard Windows previous versions of Windows **Applies to:** - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro +- Windows 8.1 Enterprise +- Windows 8.1 Pro - Windows Defender Advanced Threat Protection (Windows Defender ATP) [!include[Prerelease information](prerelease.md)] @@ -62,7 +64,7 @@ Review the following details to verify minimum system requirements: On the **Agent Setup Options** page, select **Connect the agent to Azure Log Analytics (OMS) - [Install the agent using command line](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-agent-windows#add-a-workspace-using-a-script). -4. If youre using a proxy server to connect to the Internet see the Configure proxy settings section. +4. If you're using a proxy server to connect to the Internet see the Configure proxy settings section. Once completed, you should see onboarded servers in the portal within an hour. @@ -83,8 +85,6 @@ Agent Resource | Ports | winatp-gw-weu.microsoft.com | 443 | |winatp-gw-uks.microsoft.com | 443 | |winatp-gw-ukw.microsoft.com | 443 | -| winatp-gw-aus.microsoft.com | 443| -| winatp-gw-aue.microsoft.com |443 | ## Offboard client endpoints diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index 4b90b87fb8..90008c037e 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 04/24/2018 +ms.date: 06/11/2018 --- # Windows Defender ATP preview features @@ -42,12 +42,19 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Onboard previous versions of Windows](onboard-downlevel--windows-defender-advanced-threat-protection.md)
+Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor + - Windows 7 SP1 Enterprise + - Windows 7 SP1 Pro + - Windows 8.1 Enterprise + - Windows 8.1 Pro - [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the onboarding of the following servers: - Windows Server 2012 R2 - Windows Server 2016 - Windows Server, version 1803 + - [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the use of Power BI data connectors to enable you to connect and access Windows Defender ATP data using Microsoft Graph. From 7551ecb60a5997c4d6baa36f1e4eedada6f8fdea Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 31 May 2018 10:58:28 -0700 Subject: [PATCH 004/102] fix broken link --- .../preview-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index 90008c037e..13702b6849 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -42,7 +42,7 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: -- [Onboard previous versions of Windows](onboard-downlevel--windows-defender-advanced-threat-protection.md)
+- [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md)
Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro From 204035dad996656cec2d0d76dd0104035c29a6f8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:14:16 -0700 Subject: [PATCH 005/102] fixed issue --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 180c949a49..fad1f39565 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -169,7 +169,7 @@ In the Feedback and Settings page under Privacy Settings you can now delete the ### Security Baselines -A draft of the new [security baseline for Windows 10 version 1803](https://blogs.technet.microsoft.com/secguide/2018/03/27/security-baseline-for-windows-10-v1803-redstone-4-draft/) has been published. +The new [security baseline for Windows 10 version 1803](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10) has been published. ### Windows Defender Antivirus From f7a9d43d7439d8df9e87541e0b9a5779a4211a0b Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:16:28 -0700 Subject: [PATCH 006/102] fixed issue --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index fad1f39565..8107213fac 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay -ms.date: 05/10/2018 +ms.date: 06/08/2018 ms.localizationpriority: high --- From 7ebd39f45254da85432b45ae1d1bdba0861f2817 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:23:19 -0700 Subject: [PATCH 007/102] removed note about autdit mode not available --- .../applocker/configure-an-applocker-policy-for-audit-only.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index 58bfcf7ebb..1127619715 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -21,8 +21,6 @@ This topic for IT professionals describes how to set AppLocker policies to **Aud After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. - ->**Note:**  There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md).   You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). From 4c978edb61c62ef01c0c1be07be776ee33cc34e8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Jun 2018 14:26:22 -0700 Subject: [PATCH 008/102] removed note about audit mode not available --- .../applocker/configure-an-applocker-policy-for-audit-only.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index 1127619715..3330eda208 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: brianlic-msft -ms.date: 09/21/2017 +ms.date: 06/08/2018 --- # Configure an AppLocker policy for audit only From 3bbc5d43d1cc7184c3bb393f94bae28b831b811c Mon Sep 17 00:00:00 2001 From: Dune Desormeaux Date: Fri, 8 Jun 2018 16:14:11 -0700 Subject: [PATCH 009/102] Clarify WDATP + WDAV compatibility wording WDAV won't always be in passive mode if WDATP is enabled. Clarifying this. --- .../windows-defender-antivirus-compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 6d409e7449..eae5b16c1e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -71,7 +71,7 @@ Passive mode | Windows Defender AV will not be used as the antivirus app, and th Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)]] Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your configuration tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. +Passive mode is enabled if you are enrolled in Windows Defender ATP and you are using a third party antimalware product because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware or other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. From 983cfd76af8cfa48f920e94c4b499a19668d1409 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Fri, 8 Jun 2018 23:19:00 +0000 Subject: [PATCH 010/102] Merged PR 8950: small formatting fix --- windows/privacy/manage-windows-endpoints.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/privacy/manage-windows-endpoints.md b/windows/privacy/manage-windows-endpoints.md index d0be3c4145..e43a9ddff4 100644 --- a/windows/privacy/manage-windows-endpoints.md +++ b/windows/privacy/manage-windows-endpoints.md @@ -502,8 +502,7 @@ In addition to the endpoints listed for Windows 10 Enterprise, the following end | *.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. | | *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. | | *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). | -| *prod.do.dsp.mp.microsoft.com | TLSv1.2/ -HTTPS | Used for Windows Update downloads of apps and OS updates. | +| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. | | .g.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. | | telecommand.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. | | 2.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. | @@ -594,8 +593,7 @@ TLSv1.2 | Used to check for updates to maps that have been downloaded for offlin | *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. | | *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. | | *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). | -| *prod.do.dsp.mp.microsoft.com | TLSv1.2/ -HTTPS | Used for Windows Update downloads of apps and OS updates. | +| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. | | 3.dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. | | 3.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. | From 41d5e00c6a519f9c7eedd5553f7addd3706135bc Mon Sep 17 00:00:00 2001 From: Dune Desormeaux Date: Fri, 8 Jun 2018 16:20:59 -0700 Subject: [PATCH 011/102] Dudeso-dd clarity Switch to active voice --- .../windows-defender-antivirus-compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index eae5b16c1e..47d5189976 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -71,7 +71,7 @@ Passive mode | Windows Defender AV will not be used as the antivirus app, and th Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)]] Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your configuration tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Passive mode is enabled if you are enrolled in Windows Defender ATP and you are using a third party antimalware product because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. +If you are enrolled in Windows Defender ATP and you are using a third party antimalware product then passive mode is enabled because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware or other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. From 046155ed06c52330fb5df8df1bab69ca2a4ba7b8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 8 Jun 2018 16:46:29 -0700 Subject: [PATCH 012/102] New round of revisions --- ...ment-configuration-file-with-powershell.md | 47 +++++++------ ...user-configuration-file-with-powershell.md | 34 ++++++---- .../appv-auto-clean-unpublished-packages.md | 67 +++++++------------ .../app-v/appv-available-mdm-settings.md | 23 ++++++- 4 files changed, 95 insertions(+), 76 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index ce1b3601b9..42754ef837 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Apply the Deployment Configuration File by Using Windows PowerShell (Windows 10) -description: How to Apply the Deployment Configuration File by Using Windows PowerShell +title: How to apply the deployment configuration file by using Windows PowerShell (Windows 10) +description: How to apply the deployment configuration file by using Windows PowerShell for Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,35 +8,42 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to apply the deployment configuration file by using Windows PowerShell +>Applies to: Windows 10, version 1607 -# How to Apply the Deployment Configuration File by Using Windows PowerShell +The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings of the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: -**Applies to** -- Windows 10, version 1607 +* C:\\Packages\\Contoso\\MyApp.appv +* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: +## Apply the deployment configuration file with Windows PowerShell -**c:\\Packages\\Contoso\\MyApp.appv** +>[!NOTE] +>The following procedure is an example that uses the following two file paths for the package and configuration files: + > + >* C:\\Packages\\Contoso\\MyApp.appv + >* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml + > +>If your package and configuration file use different file paths than the example, feel free to replace them as needed. -**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** +To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, enter the following cmdlet: -**To Apply the Deployment Configuration File Using Windows PowerShell** +```PowerShell +Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml +``` -- To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, type the following: +>[!NOTE] +>This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: + > + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` - `Add-AppVClientPackage -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` - - **Note**
- This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - - `Set-AppVClientPackage -Name Myapp -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` - -   ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index a59c999681..2632d17e87 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -8,34 +8,42 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# How to apply the user configuration file by using Windows PowerShell - -# How to Apply the User Configuration File by Using Windows PowerShell - -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: -**c:\\Packages\\Contoso\\MyApp.appv** +* C:\\Packages\\Contoso\\MyApp.appv -**To apply a user Configuration file** +## Apply a user configuration file -1. To add the package to the computer using the Windows PowerShell console, type the following command: +Use the following procedure to specify a user-specific configuration file. - `Add-AppVClientPackage c:\Packages\Contoso\MyApp.appv` +>[!NOTE] +>The following procedure uses the following example file path for its package: + > + >* C:\\Packages\\Contoso\\MyApp.appv. + > +>f your package file uses a different file path than the example, feel free to replace it. -2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: +1. Enter the following cmdlet to add the package to the computer using the Windows PowerShell console: - `Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml` + ```PowerShell + Add-AppVClientPackage C:\Packages\Contoso\MyApp.appv + ``` +2. Enter the following cmdlet to publish the package to the user and specify the updated the dynamic user configuration file: + ```PowerShell + Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml + ``` ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 23a9fe37c6..5292d2ed73 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -8,70 +8,55 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- +# Automatically clean up unpublished packages on the App-V client +>Applies to: Windows 10, version 1703 -# Automatically cleanup unpublished packages on the App-V client +Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after a device restart. -**Applies to** -- Windows 10, version 1703 +## Clean up with PowerShell cmdlets -Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. +You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, which will automatically clean up your unpublished App-V packages from your App-V client devices. -## Cleanup by using PowerShell commands -Using PowerShell, you can turn on the **AutoCleanupEnabled** setting to automatically cleanup your unpublished App-V packages from your App-V client devices. +### Turn on the AutoCleanupEnabled option -**To turn on the AutoCleanupEnabled option** +1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package clean up functionality: -1. Open PowerShell as an admin and run the following command to turn on the automatic package cleanup functionality: - - ```ps1 + ```PowerShell Set-AppvClientConfiguration -AutoCleanupEnabled 1 ``` - The command runs and you should see the following info on the PowerShell screen: - - - - - - - - - - - - - - - - -
NameValueSetbyGroupPolicy
AutoCleanupEnabled1False
+ After running the cmdlet, you should see the following info on the PowerShell screen: -2. Run the following command to make sure the configuration is ready to automatically cleanup your packages. + |Name|Value|SetbyGroupPolicy| + |---|---|---| + |AutoCleanupEnabled|1|False| - ```ps1 +2. Run the following cmdlet to make sure the configuration is ready to automatically clean up your packages. + + ```PowerShell Get-AppvClientConfiguration ``` - You should see the **AutoCleanupEnabled** option turned on (shows a value of "1") in the configuration list. + If the **AutoCleanupEnabled** option shows a value of **1** in the configuration list, that means the setting is turned on. -## Cleanup by using Group Policy settings -Using Group Policy, you can turn on the **Enable automatic cleanup of unused appv packages** setting to automatically cleanup your unpublished App-V packages from your App-V client devices. +## Clean up with Group Policy settings -**To turn on the Enable automatic cleanup of unused appv packages setting** +Using Group Policy, you can turn on the **Enable automatic clean up of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. -1. Open your Group Policy editor and double-click the Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused appv packages setting. +### Turn on the Enable automatic clean up of unused App-V packages setting -2. Click **Enabled**, and then click **OK**. +1. Open your Group Policy editor and select the **Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused App-V packages** setting. - After your Group Policy updates, the setting is turned on and will cleanup any unpublished App-V packages on the App-V Client after restarting. +2. Select **Enabled**, then select **OK**. + + After your Group Policy updates and you reset the client, the setting will clean up any unpublished App-V packages on the App-V client. ### Related topics + - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) - - [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186) - - [Using the App-V Client Management Console](appv-using-the-client-management-console.md) +## Have a suggestion for App-V? -**Have a suggestion for App-V?**

-Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 7d050134a8..7544ce59d5 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -8,9 +8,28 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- - # Available Mobile Device Management (MDM) settings for App-V -With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps by using these Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. + +With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps by using these Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. + +|Policy name|Supported versions|URI full path|Data type|Values| +|---|---|---|---|---| +|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Name|String|Read-only data, provided by your App-V packages.| +|Version|Windows 10, version 1703|||| +|Publisher|Windows 10, version 1703|||| +|InstallLocation|Windows 10, version 1703|||| +|InstallDate|Windows 10, version 1703|||| +|Users|Windows 10, version 1703|||| +|AppVPackageID|Windows 10, version 1703|||| +|AppVVersionID|Windows 10, version 1703|||| +|AppVPackageUri|Windows 10, version 1703|||| +|LastError|Windows 10, version 1703|||| +|LastErrorDescription|Windows 10, version 1703|||| +|SyncStatusDescription|Windows 10, version 1703|||| +|SyncProgress|Windows 10, version 1703|||| +|PublishXML|Windows 10, version 1703|||| +|Policy|Windows 10, version 1703|||| + From a72487a8239474b30943e627227b6294e4c3cf50 Mon Sep 17 00:00:00 2001 From: Yuhang Zhu Date: Mon, 11 Jun 2018 12:51:50 +0000 Subject: [PATCH 013/102] Merged PR 8963: Remove a statement from MicrosoftNetworkClient policy. This a real edit change. Thanks. --- .../policy-configuration-service-provider.md | 16 + ...policy-csp-localpoliciessecurityoptions.md | 365 +++++++++++++++--- 2 files changed, 317 insertions(+), 64 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 403a5e2cb4..921e2c246d 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2048,12 +2048,18 @@ The following diagram shows the Policy configuration service provider in tree fo
LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways +
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession +
LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
@@ -2075,6 +2081,9 @@ The following diagram shows the Policy configuration service provider in tree fo
LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM +
LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
@@ -2084,6 +2093,9 @@ The following diagram shows the Policy configuration service provider in tree fo
LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients +
LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
@@ -4407,17 +4419,21 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) - [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) - [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) - [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) - [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-amountofidletimerequiredbeforesuspendingsession) - [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) - [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) - [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) - [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) - [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) - [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowlocalsystemtousecomputeridentityforntlm) - [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) - [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) - [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) - [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) - [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) - [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 49a48f512a..ce338ff2ae 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,11 +6,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/06/2018 +ms.date: 06/05/2018 --- # Policy CSP - LocalPoliciesSecurityOptions +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +
@@ -81,12 +84,18 @@ ms.date: 04/06/2018
LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways +
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
+
+ LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession +
LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
@@ -108,6 +117,9 @@ ms.date: 04/06/2018
LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM +
LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
@@ -117,6 +129,9 @@ ms.date: 04/06/2018
LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
+
+ LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients +
LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
@@ -838,15 +853,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -914,15 +920,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -985,15 +982,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -1495,6 +1483,83 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways** + + +
+ + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +

+ + + +Microsoft network client: Digitally sign communications (always) + +This security setting determines whether packet signing is required by the SMB client component. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. + +If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. + +Default: Disabled. + + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + +GP Info: +- GP English name: *Microsoft network client: Digitally sign communications (always)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees** @@ -1618,6 +1683,72 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Microsoft network server: Amount of idle time required before suspending a session + +This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. + +Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. + +For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. + +Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. + + + +GP Info: +- GP English name: *Microsoft network server: Amount of idle time required before suspending session* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways** @@ -2051,6 +2182,78 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Network security: Allow Local System to use computer identity for NTLM + +This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. + +If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. + +If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. + +By default, this policy is enabled on Windows 7 and above. + +By default, this policy is disabled on Windows Vista. + +This policy is supported on at least Windows Vista or Windows Server 2008. + +Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. + + + +GP Info: +- GP English name: *Network security: Allow Local System to use computer identity for NTLM* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests** @@ -2246,6 +2449,75 @@ GP Info:
+ +**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + +This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. +Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + + + +GP Info: +- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + + + + + + +
+ **LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers** @@ -2359,15 +2631,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -2429,15 +2692,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -2499,15 +2753,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -2569,15 +2814,6 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - -
@@ -3406,6 +3642,7 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. From df4de51f2c1c9ff924c6b3b2938d26838430f9e4 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 11 Jun 2018 13:08:15 +0000 Subject: [PATCH 014/102] Merged PR 8966: Remove outdated wifi requirement --- devices/hololens/hololens-setup.md | 1 - 1 file changed, 1 deletion(-) diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md index 8850ba0f96..0f62fc2e6e 100644 --- a/devices/hololens/hololens-setup.md +++ b/devices/hololens/hololens-setup.md @@ -19,7 +19,6 @@ Before you get started setting up your HoloLens, make sure you have a Wi-Fi netw The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. You need to connect HoloLens to a Wi-Fi network with Internet connectivity so that the user account can be authenticated. - It can be an open Wi-Fi or password-protected Wi-Fi network. -- The Wi-Fi network cannot require you to navigate to a webpage to connect. - The Wi-Fi network cannot require certificates to connect. - The Wi-Fi network does not need to provide access to enterprise resources or intranet sites. From 9c18365310bd10f21e6e73f71f94b1ccbde60149 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 10:03:07 -0700 Subject: [PATCH 015/102] Created updated table --- .../app-v/appv-available-mdm-settings.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 7544ce59d5..3e8fa55d1c 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -15,20 +15,20 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| |Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10, version 1703|||| -|Publisher|Windows 10, version 1703|||| -|InstallLocation|Windows 10, version 1703|||| -|InstallDate|Windows 10, version 1703|||| -|Users|Windows 10, version 1703|||| -|AppVPackageID|Windows 10, version 1703|||| -|AppVVersionID|Windows 10, version 1703|||| -|AppVPackageUri|Windows 10, version 1703|||| -|LastError|Windows 10, version 1703|||| -|LastErrorDescription|Windows 10, version 1703|||| -|SyncStatusDescription|Windows 10, version 1703|||| -|SyncProgress|Windows 10, version 1703|||| -|PublishXML|Windows 10, version 1703|||| -|Policy|Windows 10, version 1703|||| +|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Version|String|Read-only data, provided by your App-V packages.| +|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Publisher|String|Read-only data, provided by your App-V packages.| +|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallLocation|String|Read-only data, provided by your App-V packages.| +|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallDate|String|Read-only data, provided by your App-V packages.| +|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Users|String|Read-only data, provided by your App-V packages.| +|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageID|String|Read-only data, provided by your App-V packages.| +|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVVersionID|String|Read-only data, provided by your App-V packages.| +|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageUri|String|Read-only data, provided by your App-V packages.| +|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| From 840bcc7b6cca660898932c8db701fd3f25ebca24 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 11 Jun 2018 10:14:47 -0700 Subject: [PATCH 016/102] added other entities for allowed blocked list settings --- ...ows-defender-advanced-threat-protection.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md index 4b6a427b67..f1e3dbc4a5 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 04/24/2018 +ms.date: 06/11/2018 --- # Manage automation allowed/blocked lists @@ -38,30 +38,31 @@ You can define the conditions for when entities are identified as malicious or s ## Create an allowed or blocked list 1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. -2. Select the type of entity you'd like to create an exclusion for. You can choose any of the following entities: +2. Select the tab of the type of entity you'd like to create an exclusion for. You can choose any of the following entities: - File hash - Certificate + - IP address + - DNS + - Email + - Process memory 3. Click **Add system exclusion**. -4. For each attribute specify the exclusion type, details, and the following required values: - - - **Files** - Hash value - - **Certificate** - PEM certificate file +4. For each attribute specify the exclusion type, details, and their corresponding required values. -5. Click **Update rule**. +5. Click **Add rule**. ## Edit a list 1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. -2. Select the type of entity you'd like to edit the list from. +2. Select the tab of the entity type you'd like to edit the list from. 3. Update the details of the rule and click **Update rule**. ## Delete a list 1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. -2. Select the type of entity you'd like to delete the list from. +2. Select the tab of the entity type you'd like to delete the list from. 3. Select the list type by clicking the check-box beside the list type. From da1c082a0a63f06c655ee551e74576227f4a0d84 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 10:26:34 -0700 Subject: [PATCH 017/102] Attempt to shorten uri column --- .../app-v/appv-available-mdm-settings.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 3e8fa55d1c..9e95747a79 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -14,21 +14,21 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| -|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Version|String|Read-only data, provided by your App-V packages.| -|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Publisher|String|Read-only data, provided by your App-V packages.| -|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallLocation|String|Read-only data, provided by your App-V packages.| -|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////InstallDate|String|Read-only data, provided by your App-V packages.| -|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////Users|String|Read-only data, provided by your App-V packages.| -|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageID|String|Read-only data, provided by your App-V packages.| -|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVVersionID|String|Read-only data, provided by your App-V packages.| -|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement////AppVPackageUri|String|Read-only data, provided by your App-V packages.| -|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| +|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Name|String|Read-only data, provided by your App-V packages.| +|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Version|String|Read-only data, provided by your App-V packages.| +|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Publisher|String|Read-only data, provided by your App-V packages.| +|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallLocation|String|Read-only data, provided by your App-V packages.| +|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallDate|String|Read-only data, provided by your App-V packages.| +|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Users|String|Read-only data, provided by your App-V packages.| +|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageID|String|Read-only data, provided by your App-V packages.| +|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVVersionID|String|Read-only data, provided by your App-V packages.| +|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageUri|String|Read-only data, provided by your App-V packages.| +|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.|
From 148043f8e793881391661712b133c22022217788 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 10:27:56 -0700 Subject: [PATCH 018/102] Added bullets --- .../app-v/appv-available-mdm-settings.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 9e95747a79..8b09c32feb 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -24,9 +24,9 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVVersionID|String|Read-only data, provided by your App-V packages.| |AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageUri|String|Read-only data, provided by your App-V packages.| |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|**0**: No errors returned during publish.
**1**: Unpublish groups failed during publish.
**2**: Publish no-group packages failed during publish.
**3**: Publish group packages failed during publish.
**4**: Unpublish packages failed during publish.
**5**: New policy write failed during publish.
**6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|**0**: App-V publishing is idle.
**1**: App-V connection groups publish in progress.
**2**: App-V packages (non-connection group) publish in progress.
**3**: App-V packages (connection group) publish in progress.
**4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|**0**: App-V Sync is idle.
**1**: App-V Sync is initializing.
**2**: App-V Sync is in progress.
**3**: App-V Sync is complete.
**4**: App-V Sync requires device reboot.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ Sync/PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 37e2e1acf6109387995f304f8b7521386ea843ec Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 11 Jun 2018 18:42:11 +0000 Subject: [PATCH 019/102] Merged PR 8974: add link for how to update HoloLens directly; update Intune kiosk profile --- devices/hololens/hololens-microsoft-layout-app.md | 2 +- devices/hololens/hololens-updates.md | 2 +- .../configuration/lock-down-windows-10-to-specific-apps.md | 5 +++-- windows/configuration/setup-kiosk-digital-signage.md | 4 +++- 4 files changed, 8 insertions(+), 5 deletions(-) diff --git a/devices/hololens/hololens-microsoft-layout-app.md b/devices/hololens/hololens-microsoft-layout-app.md index d2357ed2ee..4f5540e858 100644 --- a/devices/hololens/hololens-microsoft-layout-app.md +++ b/devices/hololens/hololens-microsoft-layout-app.md @@ -25,7 +25,7 @@ Microsoft Layout works with a HoloLens, or with a Windows Mixed Reality headset | OS requirements | Details | |:----------------------------------|:-----------------------------------------------------------| -| Build 10.0.17134.77 or above | See [Manage updates to HoloLens](hololens-updates.md) for instructions on upgrading to this build. | +| Build 10.0.17134.77 or above | See [Update HoloLens](https://support.microsoft.com/help/12643/hololens-update-hololens) for instructions on upgrading to this build. | #### Windows Mixed Reality headset requirements diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md index 0b91b6f361..e10552862b 100644 --- a/devices/hololens/hololens-updates.md +++ b/devices/hololens/hololens-updates.md @@ -12,7 +12,7 @@ ms.date: 04/30/2018 # Manage updates to HoloLens - +>**Looking for how to get the latest update? See [Update HoloLens](https://support.microsoft.com/help/12643/hololens-update-hololens).** Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. As with desktop devices, administrators can manage updates to the HoloLens operating system using [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb). diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 7610e6fe75..34225059f4 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -52,7 +52,7 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi 12. Enter a friendly name for the configuration. 10. In **Kiosk Mode**, select **Multi app kiosk**. 13. Select an app type. - - For **Add Win32 app**, enter the **App Name** and **Identifier**. + - For **Add Win32 app**, enter a friendly name for the app in **App Name**, and enter the path to the app executable in **Identifier**. - For **Add managed apps**, select an app that you manage through Intune. - For **Add app by AUMID**, enter the Application User Model ID (AUMID) for an installed UWP app. 14. Select whether to enable the taskbar. @@ -61,7 +61,8 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi 17. Select **OK**. You can add additional configurations or finish. 18. Assign the profile to a device group to configure the devices in that group as kiosks. - +>[!NOTE] +>Managed apps are apps that are in the Microsoft Store for Business that is synced with your Intune subscription. diff --git a/windows/configuration/setup-kiosk-digital-signage.md b/windows/configuration/setup-kiosk-digital-signage.md index 36581a3438..a2442ee9fb 100644 --- a/windows/configuration/setup-kiosk-digital-signage.md +++ b/windows/configuration/setup-kiosk-digital-signage.md @@ -270,7 +270,9 @@ The following steps explain how to configure a kiosk in Microsoft Intune. For ot 7. Select **Windows 10 and later** for the platform. 8. Select **Kiosk (Preview)** for the profile type. 9. Enter a friendly name for the kiosk configuration. -10. In **Kiosk Mode**, select **Single full-screen app kiosk**. +10. Select **Kiosk - 1 setting available**. +10. Select **Add** to add a kiosk configuration. +10. Enter a friendly name for the kiosk configuration, and then in **Kiosk Mode**, select **Single full-screen app kiosk**. 10. Select either **Select a managed app** to choose a kiosk app that is managed by Intune, or **Enter UWP app AUMID** to specify the kiosk app by AUMID, and then select the app or enter the AUMID as appropriate. 1. For the user account, select either **Autologon** to create a user account for the kiosk that will sign in automatically, or **Local user account** to configure an existing user account to run the kiosk. **Local user account** can be a local standard user account on the device or an Azure Active Directory account. 14. Select **OK**, and then select **Create**. From 8acf5994725441506f024dc89773edb32bd39547 Mon Sep 17 00:00:00 2001 From: danhwang1 <40180973+danhwang1@users.noreply.github.com> Date: Mon, 11 Jun 2018 11:45:40 -0700 Subject: [PATCH 020/102] Update supl-ddf-file.md We have recently made a change in our Location Platform pertaining to SUPL to increase the max number of root certificates from 3 to 6 (as mandated). As a result, we will need to update the necessary public documentation here: https://docs.microsoft.com/en-us/windows/client-management/mdm/supl-ddf-file --- .../client-management/mdm/supl-ddf-file.md | 198 +++++++++++++++++- 1 file changed, 197 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index e6ed98d713..4ee4e4ad1d 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -171,7 +171,7 @@ The XML below is the current version for this CSP. - MCCMNPairs + MCCMNCPairs @@ -482,6 +482,201 @@ The XML below is the current version for this CSP. + + RootCertificate4 + + + + + Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + + + + + + + + + + + + + + + Name + + + + + + Specifies the name of the H-SLP root certificate as a string, in the format name.cer. + + + + + + + + + + + text/plain + + + + + Data + + + + + + The base 64 encoded blob of the H-SLP root certificate. + + + + + + + + + + + + + + + + + RootCertificate5 + + + + + Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + + + + + + + + + + + + + + + Name + + + + + + Specifies the name of the H-SLP root certificate as a string, in the format name.cer. + + + + + + + + + + + text/plain + + + + + Data + + + + + + The base 64 encoded blob of the H-SLP root certificate. + + + + + + + + + + + + + + + + + RootCertificate6 + + + + + Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + + + + + + + + + + + + + + + Name + + + + + + Specifies the name of the H-SLP root certificate as a string, in the format name.cer. + + + + + + + + + + + text/plain + + + + + Data + + + + + + The base 64 encoded blob of the H-SLP root certificate. + + + + + + + + + + + + + + + V2UPL1 @@ -662,6 +857,7 @@ The XML below is the current version for this CSP. + ```   From 92466c0e772bfd4e17fddcf0f2c80c95046c2826 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 12:37:34 -0700 Subject: [PATCH 021/102] Adjusted spacing --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 8b09c32feb..1c5d1625d3 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -26,8 +26,8 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ Sync/PublishXML|String|Custom value, entered by admin.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 769a8b5bab997efd83405d5d51096f6afc8f6619 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 13:06:27 -0700 Subject: [PATCH 022/102] Attempt to adjust spacing. --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 1c5d1625d3..7b4de19db8 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -26,8 +26,8 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/ PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 2e791f3bf1304fc2ad71c51c5a9f4b2aa7063454 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Mon, 11 Jun 2018 21:27:30 +0000 Subject: [PATCH 023/102] Updated inclusive-classroom-it-admin.md --- education/get-started/inclusive-classroom-it-admin.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 16b5c8a0e2..6d3bb808df 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -37,10 +37,10 @@ ms.date: 03/18/2018 | Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| -| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| | | | | | | | | -| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | | | -| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| | | | | | | | | -| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| | | | | | | | | +| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | | | | +| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | +| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | | | | +| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | | Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | | | | Ability to request accessible content |
  • Outlook Web Access
| | | | | | | | |
@@ -48,6 +48,5 @@ ms.date: 03/18/2018 | Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| -| Translate Language of Document |
  • Word 2016
  • PowerPoint 2016
| | | | | | | | | -| PowerPoint Translator |
  • PowerPoint 2016 Add-in
| | | | | | | | | +| Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in
|

X

|

X

|

X

|

X

|

X

| | | |
\ No newline at end of file From c124f6d063f0900374e1fa2604aa397b800ae3a7 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 15:41:07 -0700 Subject: [PATCH 024/102] Next attempt at spacing adjustment --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 7b4de19db8..b6a44c1356 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -26,8 +26,8 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/ PublishXML|String|Custom value, entered by admin.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| |Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| From 05281c5b94d42d29d56c80c5121dfd1632af5004 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 11 Jun 2018 16:57:32 -0700 Subject: [PATCH 025/102] Continued updating articles --- ...to-packages-with-the-management-console.md | 49 ++++++++----------- 1 file changed, 21 insertions(+), 28 deletions(-) diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index 58b23dd73f..86ded03016 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -8,60 +8,53 @@ ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 --- - - # How to Configure Access to Packages by Using the Management Console -**Applies to** -- Windows 10, version 1607 +>Applies to: Windows 10, version 1607 Before you deploy an App-V virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. Use the following procedure to configure access to virtualized packages. -**To grant access to an App-V package** +## Grant access to an App-V package -1. Find the package you want to configure: +1. Find the package you want to configure: - 1. Open the App-V Management console. + 1. Open the App-V Management console. - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. + 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD ACCESS** page. Alternatively, select the package and select **EDIT** in the **AD ACCESS** pane. -2. Provision a security group for the package: +2. Provision a security group for the package: - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. + 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. - 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. + 1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**. - **Note**   - Ensure that you provide an associated domain name for the group that you are searching for. + >[!NOTE]   + >Ensure that you provide an associated domain name for the group that you are searching for. -   +3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. -3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. +4. Select **Close** to accept the default configuration settings and close the AD ACCESS page. -4. + To customize configurations for a specific group, select the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To make changes to your custom configurations, select **EDIT**. After you grant access, select **Close**. - To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. +## Remove access to an App-V package - To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. +1. Find the package you want to configure: -**To remove access to an App-V package** + 1. Open the App-V Management console. -1. Find the package you want to configure: + 1. To display the **AD ACCESS** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **EDIT** in the **AD ACCESS** pane. - 1. Open the App-V Management console. +2. Select the group you want to remove, then select **DELETE**. - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Select the group you want to remove, and click **DELETE**. - -3. To close the **AD ACCESS** page, click **Close**. +3. Select **Close**. ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). ## Related topics -[Operations for App-V](appv-operations.md) +* [Operations for App-V](appv-operations.md) From c763226d7779d7c9452a8b6611e0a731e6a067e6 Mon Sep 17 00:00:00 2001 From: Peter Lewis Date: Tue, 12 Jun 2018 12:01:16 +0100 Subject: [PATCH 026/102] Fix spelling mistake Corrected 'ois' to 'is' --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index c769840d86..a01bbdbab3 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -44,7 +44,7 @@ Microsoft publishes two types of Surface Hub releases broadly on an ongoing basi In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes. -The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime ois finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. +The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). From f762fd133f9936e4f6aafadca5b82cc089fdf059 Mon Sep 17 00:00:00 2001 From: Patti Short Date: Tue, 12 Jun 2018 06:14:26 -0700 Subject: [PATCH 027/102] changed the GP path to the policy --- browsers/edge/emie-to-improve-compatibility.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index fc8a612b80..b6c34c4968 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -43,14 +43,14 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip ### Set up Microsoft Edge to use the Enterprise Mode site list -You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). +You must turn on the **Configure the Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). > **Note**
> If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. **To turn on Enterprise Mode using Group Policy** -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Allows you to configure the Enterprise Mode Site list** setting.

Turning this setting on also requires you to create and store a site list.

![Local Group Policy Editor for using a site list](images/edge-emie-grouppolicysitelist.png) +1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Configure the Enterprise Mode Site List** policy.

Turning this setting on also requires you to create and store a site list.

![Local Group Policy Editor for using a site list](images/edge-emie-grouppolicysitelist.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. From 96c9a3a425f765ffd432d28053dca331103a068d Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 12 Jun 2018 13:45:04 +0000 Subject: [PATCH 028/102] Merged PR 8996: fix broken link for Surface Hub download --- devices/surface-hub/surface-hub-downloads.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md index 257bc6b58b..8ddafa924a 100644 --- a/devices/surface-hub/surface-hub-downloads.md +++ b/devices/surface-hub/surface-hub-downloads.md @@ -18,7 +18,7 @@ This topic provides links to useful Surface Hub documents, such as product datas | --- | --- | | [Surface Hub Site Readiness Guide (PDF)](http://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) | Make sure your site is ready for Surface Hub, including structural and power requirements, and get technical specs for Surface Hub. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov) | | [Surface Hub Setup Guide (English, French, Spanish) (PDF)](http://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. | -| [Surface Hub Quick Reference Guide (PDF)](http://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface Hub Quick Reference Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. | +| [Surface Hub Quick Reference Guide (PDF)](http://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. | | [Surface Hub User Guide (PDF)](http://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. | | [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC. | | [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf) | Learn how to replace the solid state drive (SSD) for the 55- and 84-inch Surface Hub. | From 0b0dedb2b287abddf0ba8ddc7d423e3e39d94522 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 10:19:28 -0700 Subject: [PATCH 029/102] added links to how to set startup auth --- .../information-protection/bitlocker/bitlocker-security-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index db335bddd1..a1988d5ced 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv ## What are the implications of using the sleep or hibernate power management options? -BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. +BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). ## What are the advantages of a TPM? From 691fcc8adcef630ede24ab5336814e0586e0a4ba Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 12 Jun 2018 10:23:42 -0700 Subject: [PATCH 030/102] first pass fixing links to dead OMS marketing page --- .../update/device-health-get-started.md | 13 ++++++++----- .../update/update-compliance-get-started.md | 8 ++++++-- .../upgrade/upgrade-readiness-get-started.md | 15 +++++++++------ .../upgrade/upgrade-readiness-requirements.md | 14 +++++++------- 4 files changed, 30 insertions(+), 20 deletions(-) diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md index 81a57be6d4..5b3a7b3474 100644 --- a/windows/deployment/update/device-health-get-started.md +++ b/windows/deployment/update/device-health-get-started.md @@ -5,7 +5,7 @@ keywords: Device Health, oms, operations management suite, prerequisites, requir ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.date: 03/20/2018 +ms.date: 06/12/2018 ms.pagetype: deploy author: jaimeo ms.author: jaimeo @@ -24,13 +24,16 @@ Steps are provided in sections that follow the recommended setup process: -## Add Device Health to Microsoft Operations Management Suite +## Add Device Health to Microsoft Operations Management Suite or Azure Log Analytics -Device Health is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). +Device Health is offered as a solution in the Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). -**If you are already using Windows Analytics**, you should use the same Azure Log Analytics workspace you're already using. find Device Health in the Solutions Gallery. Select the **Device Health** tile in the gallery and then click **Add** on the solution's details page. Device Health is now visible in your workspace. While you're in the Solutions Gallery, you should consider installing the [Upgrade Readiness](../upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) and [Update Compliance](update-compliance-monitor.md) solutions as well, if you haven't already. +**If you are already using Windows Analytics**, you should use the same Azure Log Analytics workspace you're already using. Find Device Health in the Solutions Gallery. Select the **Device Health** tile in the gallery and then click **Add** on the solution's details page. Device Health is now visible in your workspace. While you're in the Solutions Gallery, you should consider installing the [Upgrade Readiness](../upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) and [Update Compliance](update-compliance-monitor.md) solutions as well, if you haven't already. -**If you are not yet using Windows Analytics or Azure Log Analytics**, use the following steps to subscribe: +>[!NOTE] +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=DeviceHealthProd) to go directly to the Device Health solution and add it to your workspace. + +**If you are not yet using Windows Analytics or Azure Log Analytics**, follow these steps to subscribe: 1. Go to [Operations Management Suite](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**. [![Operations Management Suite bar with sign-in button](images/uc-02a.png)](images/uc-02.png) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 6cfecd1c73..9887546277 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -23,12 +23,16 @@ Steps are provided in sections that follow the recommended setup process: -## Add Update Compliance to Microsoft Operations Management Suite +## Add Update Compliance to Microsoft Operations Management Suite or Azure Log Analytics -Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). +Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). If you are already using OMS, skip to step **6** to add Update Compliance to your workspace. +>[!NOTE] +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=WaaSUpdateInsights) to go directly to the Device Health solution and add it to your workspace. + + If you are not yet using OMS, use the following steps to subscribe to OMS Update Compliance: 1. Go to [Operations Management Suite](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**. diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md index e80d01d273..3ee8a1a528 100644 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: deploy author: jaimeo ms.author: jaimeo -ms.date: 03/20/2018 +ms.date: 06/12/2018 ms.localizationpriority: high --- @@ -35,7 +35,7 @@ When you are ready to begin using Upgrade Readiness, perform the following steps To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information. -## Add Upgrade Readiness to Operations Management Suite +## Add Upgrade Readiness to Operations Management Suite or Azure Log Analytics Upgrade Readiness is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/). @@ -44,11 +44,14 @@ Upgrade Readiness is offered as a solution in the Microsoft Operations Managemen If you are already using OMS, you’ll find Upgrade Readiness in the Solutions Gallery. Select the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution's details page. Upgrade Readiness is now visible in your workspace. While you have this dialog open, you should also consider adding the [Device Health](../update/device-health-monitor.md) and [Update Compliance](../update/update-compliance-monitor.md) solutions as well, if you haven't already. To do so, just select the check boxes for those solutions. -If you are not using OMS: +>[!NOTE] +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=CompatibilityAssessment) to go directly to the Upgrade Readiness solution and add it to your workspace. -1. Go to the [Upgrade Readiness page on Microsoft.com](https://go.microsoft.com/fwlink/?LinkID=799190&clcid=0x409) and select **New Customers >** to start the process. -2. Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. -3. Create a new OMS workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. +If you are not using OMS or Azure Log Analytics: + +1. Go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. +2. Sign in to Operations Management Suite (OMS or Azure Log Analytics You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. +3. Create a new workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. 4. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. > If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. Your workspace opens. diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index 21dfb741d1..538d13cb2a 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -5,7 +5,7 @@ keywords: windows analytics, oms, operations management suite, prerequisites, re ms.prod: w10 author: jaimeo ms.author: -ms.date: 03/15/2018 +ms.date: 06/12/2018 ms.localizationpriority: high --- @@ -32,19 +32,19 @@ See [Windows 10 Specifications](http://www.microsoft.com/en-US/windows/windows-1 ### Windows 10 Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates. -The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com). +The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com). While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC. -## Operations Management Suite +## Operations Management Suite or Azure Log Analytics -Upgrade Readiness is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing on premise and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). +Upgrade Readiness is offered as a solution in Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud based services for managing on premise and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). -If you’re already using OMS, you’ll find Upgrade Readiness in the Solutions Gallery. Click the Upgrade Readiness tile in the gallery and then click Add on the solution’s details page. Upgrade Readiness is now visible in your workspace. +If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace. You can also -If you are not using OMS, go to the [Upgrade Readiness page](https://www.microsoft.com/en-us/windowsforbusiness/simplified-updates) on Microsoft.com and select **Sign up** to kick off the OMS onboarding process. During the onboarding process, you’ll create an OMS workspace and add the Upgrade Readiness solution to it. +If you are not using OMS or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. -Important: You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. +>[!IMPORTANT] You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work >or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. ## System Center Configuration Manager integration From ff9f493205532351390043b00a4859451d2f2bbf Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 10:24:27 -0700 Subject: [PATCH 031/102] added links to how to set startup auth --- .../bitlocker/bitlocker-security-faq.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index a1988d5ced..13ee71372a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: high author: brianlic-msft -ms.date: 05/03/2018 +ms.date: 06/12/2018 --- # BitLocker Security FAQ @@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv ## What are the implications of using the sleep or hibernate power management options? -BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). +BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For increased security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). ## What are the advantages of a TPM? From 49a75ea072dd6c8affa016687153e01b9e1c598a Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 10:25:42 -0700 Subject: [PATCH 032/102] Cleaning up for pull request Going to try something funky with that big table. --- ...ment-configuration-file-with-powershell.md | 14 +- ...user-configuration-file-with-powershell.md | 18 +- .../appv-auto-clean-unpublished-packages.md | 16 +- .../app-v/appv-available-mdm-settings.md | 202 +----------------- 4 files changed, 23 insertions(+), 227 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 42754ef837..a3958c5d49 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # How to apply the deployment configuration file by using Windows PowerShell @@ -20,12 +20,12 @@ The dynamic deployment configuration file is applied when a package is added or ## Apply the deployment configuration file with Windows PowerShell >[!NOTE] ->The following procedure is an example that uses the following two file paths for the package and configuration files: +>The following example cmdlet uses the following two file paths for the package and configuration files: > >* C:\\Packages\\Contoso\\MyApp.appv >* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml > ->If your package and configuration file use different file paths than the example, feel free to replace them as needed. +>If your package and configuration files use different file paths than the example, feel free to replace them as needed. To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, enter the following cmdlet: @@ -35,10 +35,10 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - > - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` + + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index 2632d17e87..c115854e06 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -1,12 +1,12 @@ --- -title: How to Apply the User Configuration File by Using Windows PowerShell (Windows 10) -description: How to Apply the User Configuration File by Using Windows PowerShell +title: How to apply the user configuration file by using Windows PowerShell (Windows 10) +description: How to apply the user configuration file by using Windows PowerShell (Windows 10). author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # How to apply the user configuration file by using Windows PowerShell @@ -14,22 +14,18 @@ ms.date: 04/19/2017 The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. -Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: - -* C:\\Packages\\Contoso\\MyApp.appv - ## Apply a user configuration file -Use the following procedure to specify a user-specific configuration file. +You can follow these steps to specify a user-specific configuration file: >[!NOTE] >The following procedure uses the following example file path for its package: > >* C:\\Packages\\Contoso\\MyApp.appv. > ->f your package file uses a different file path than the example, feel free to replace it. +>f your package file uses a different file path than the example, feel free to replace it as needed. -1. Enter the following cmdlet to add the package to the computer using the Windows PowerShell console: +1. Enter the following cmdlet in Windows PowerShell to add the package to the computer: ```PowerShell Add-AppVClientPackage C:\Packages\Contoso\MyApp.appv @@ -37,7 +33,7 @@ Use the following procedure to specify a user-specific configuration file. 2. Enter the following cmdlet to publish the package to the user and specify the updated the dynamic user configuration file: ```PowerShell - Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml + Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath C:\Packages\Contoso\config.xml ``` ## Have a suggestion for App-V? diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 5292d2ed73..bb51d5cad8 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -1,18 +1,18 @@ --- -title: Automatically cleanup unpublished packages on the App-V client (Windows 10) -description: How to automatically clean-up any unpublished packages on your App-V client devices. +title: Automatically clean up unpublished packages on the App-V client (Windows 10) +description: How to automatically clean up any unpublished packages on your App-V client devices. author: eross-msft ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # Automatically clean up unpublished packages on the App-V client >Applies to: Windows 10, version 1703 -Previous versions of App-V have required you to manually remove your unpublished packages from your client devices, to free up additional storage space. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after a device restart. +If you wanted to free up additional storage space in previous versions of App-V, you would have had to manually remove your unpublished packages from your client devices. Windows 10, version 1703 introduces the ability to use PowerShell or Group Policy settings to automatically clean up your unpublished packages after restarting your device. ## Clean up with PowerShell cmdlets @@ -20,7 +20,7 @@ You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, ### Turn on the AutoCleanupEnabled option -1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package clean up functionality: +1. Open PowerShell as an admin and enter the following cmdlet to turn on the automatic package cleanup functionality: ```PowerShell Set-AppvClientConfiguration -AutoCleanupEnabled 1 @@ -32,7 +32,7 @@ You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, |---|---|---| |AutoCleanupEnabled|1|False| -2. Run the following cmdlet to make sure the configuration is ready to automatically clean up your packages. +1. Run the following cmdlet to check if the configuration has the cleanup setting turned on. ```PowerShell Get-AppvClientConfiguration @@ -41,9 +41,9 @@ You can enter PowerShell cmdlets to turn on the **AutoCleanupEnabled** setting, ## Clean up with Group Policy settings -Using Group Policy, you can turn on the **Enable automatic clean up of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. +Using Group Policy, you can turn on the **Enable automatic cleanup of unused App-V packages** setting to automatically clean up your unpublished App-V packages from your App-V client devices. -### Turn on the Enable automatic clean up of unused App-V packages setting +### Turn on the Enable automatic cleanup of unused App-V packages setting 1. Open your Group Policy editor and select the **Administrative Templates\System\App-V\PackageManagement\Enable automatic cleanup of unused App-V packages** setting. diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index b6a44c1356..6c749e9884 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -28,204 +28,4 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Policy nameSupported versionsDetails
NameWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Name
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
VersionWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Version
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
PublisherWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Publisher
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
InstallLocationWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/InstallLocation
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
InstallDateWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/InstallDate
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
UsersWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/Users
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
AppVPackageIDWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/AppVPackageID
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
AppVVersionIDWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/AppVVersionID
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
AppVPackageUriWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/<enterprise_id>/<package_family_name>/<package_full_name>/AppVPackageUri
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V packages.
    • -
-
LastErrorWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastError
    • -
  • Data type. String
    • -
  • Value. Read-only data, provided by your App-V client.
    • -
-
LastErrorDescriptionWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/LastErrorDescription
    • -
  • Data type. String
    • -
  • Values. -
      -
    • 0. No errors returned during publish.
      • -
    • 1. Unpublish groups failed during publish.
      • -
    • 2. Publish no-group packages failed during publish.
      • -
    • 3. Publish group packages failed during publish.
      • -
    • 4. Unpublish packages failed during publish.
      • -
    • 5. New policy write failed during publish.
      • -
    • 6. Multiple non-fatal errors occurred during publish.
      • -
    -
    • -
-
SyncStatusDescriptionWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncStatusDescription
    • -
  • Data type. String
    • -
  • Values. -
      -
    • 0. App-V publishing is idle.
      • -
    • 1. App-V connection groups publish in progress.
      • -
    • 2. App-V packages (non-connection group) publish in progress.
      • -
    • 3. App-V packages (connection group) publish in progress.
      • -
    • 4. App-V packages unpublish in progress.
      • -
    -
    • -
-
SyncProgressWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress
    • -
  • Data type. String
    • -
  • Values. -
      -
    • 0. App-V Sync is idle.
      • -
    • 1. App-V Sync is initializing.
      • -
    • 2. App-V Sync is in progress.
      • -
    • 3. App-V Sync is complete.
      • -
    • 4. App-V Sync requires device reboot.
      • -
    -
    • -
-
PublishXMLWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML
    • -
  • Data type. String
    • -
  • Value. Custom value, entered by admin.
    • -
-
PolicyWindows 10, version 1703 -
    -
  • URI full path. ./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/configurationid/Policy
    • -
  • Data type. String
    • -
  • Value. Custom value, entered by admin.
    • -
-
\ No newline at end of file +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From 274ecc83c3c8159d5ab5c48dcd920bdfe64b0ac0 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 10:26:33 -0700 Subject: [PATCH 033/102] added links to how to set startup auth --- .../information-protection/bitlocker/bitlocker-security-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index 13ee71372a..6aac433261 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv ## What are the implications of using the sleep or hibernate power management options? -BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For increased security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). +BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For improved security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). ## What are the advantages of a TPM? From 4d22e79913ec5ec7a2b975c554a71af6815f5a20 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 10:37:48 -0700 Subject: [PATCH 034/102] Attempted spacing fix for middle column --- .../app-v/appv-available-mdm-settings.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 6c749e9884..b53a68364c 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -14,18 +14,18 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| -|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Name|String|Read-only data, provided by your App-V packages.| -|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Version|String|Read-only data, provided by your App-V packages.| -|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Publisher|String|Read-only data, provided by your App-V packages.| -|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallLocation|String|Read-only data, provided by your App-V packages.| -|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///InstallDate|String|Read-only data, provided by your App-V packages.| -|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///Users|String|Read-only data, provided by your App-V packages.| -|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageID|String|Read-only data, provided by your App-V packages.| -|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVVersionID|String|Read-only data, provided by your App-V packages.| -|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement/ ///AppVPackageUri|String|Read-only data, provided by your App-V packages.| -|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/ LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file +|Name|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Name|String|Read-only data, provided by your App-V packages.| +|Version|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Version|String|Read-only data, provided by your App-V packages.| +|Publisher|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Publisher|String|Read-only data, provided by your App-V packages.| +|InstallLocation|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //InstallLocation|String|Read-only data, provided by your App-V packages.| +|InstallDate|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //InstallDate|String|Read-only data, provided by your App-V packages.| +|Users|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //Users|String|Read-only data, provided by your App-V packages.| +|AppVPackageID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVPackageID|String|Read-only data, provided by your App-V packages.| +|AppVVersionID|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVVersionID|String|Read-only data, provided by your App-V packages.| +|AppVPackageUri|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPackageManagement// //AppVPackageUri|String|Read-only data, provided by your App-V packages.| +|LastError|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| +|LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| +|SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| +|SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From cdebda815d631819f1d4ac932d5c0c99abd2a3e4 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 17:40:24 +0000 Subject: [PATCH 035/102] Updated inclusive-classroom-it-admin.md --- education/get-started/inclusive-classroom-it-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 6d3bb808df..bcff2649a4 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -16,7 +16,7 @@ ms.date: 03/18/2018 |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| |

X

| | | +| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| |

X

| | | | Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| |

X

| | | | Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| |

X

| | | | Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | |

X

| |

X

| From 73311e46a1db5125647ccfac28e05eb1b1b5b579 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 17:46:51 +0000 Subject: [PATCH 036/102] Updated inclusive-classroom-it-admin.md, testing headings --- education/get-started/inclusive-classroom-it-admin.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index bcff2649a4..4ce644acdc 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -14,6 +14,9 @@ ms.author: alhughes ms.date: 03/18/2018 --- +# Inclusive Classroom IT Admin Guide + +## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| | Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| |

X

| | | @@ -45,7 +48,6 @@ ms.date: 03/18/2018 | Ability to request accessible content |
  • Outlook Web Access
| | | | | | | | |
- | Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | |---|---|---|---|---|---|---|---|---|---| | Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in
|

X

|

X

|

X

|

X

|

X

| | | | From 13238fcf3e90753450b81f1c31ca00d5833af540 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 17:54:09 +0000 Subject: [PATCH 037/102] Updated inclusive-classroom-it-admin.md --- .../get-started/inclusive-classroom-it-admin.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 4ce644acdc..1367c70c95 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -17,14 +17,14 @@ ms.date: 03/18/2018 # Inclusive Classroom IT Admin Guide ## Inclusive Classroom features -|Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | +|Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| |

X

| | | -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| |

X

| | | -| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| |

X

| | | -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | |

X

| |

X

| -| Line focus mode |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | |

X

| | | -| Picture Dictionary |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | |

X

| |

X

| +| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| | +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| | +| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| | +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | | +| Line focus mode |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | | +| Picture Dictionary |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | |
| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | From 0ecac91aae729a9c46418e51c7942cb834f959fc Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 11:05:29 -0700 Subject: [PATCH 038/102] Cleanup --- ...ss-to-packages-with-the-management-console.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index 86ded03016..f9a3d2bb7e 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # How to Configure Access to Packages by Using the Management Console @@ -22,22 +22,22 @@ Use the following procedure to configure access to virtualized packages. 1. Open the App-V Management console. - 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD ACCESS** page. Alternatively, select the package and select **EDIT** in the **AD ACCESS** pane. + 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD Access** page. Alternatively, select the package and select **Edit** in the **AD Access** pane. 2. Provision a security group for the package: - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. + 1. Go to the **Find valid Active Directory names and grant access** page. 1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**. >[!NOTE]   >Ensure that you provide an associated domain name for the group that you are searching for. -3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. +3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD entities with access** pane. -4. Select **Close** to accept the default configuration settings and close the AD ACCESS page. +4. Select **Close** to accept the default configuration settings and close the AD Access page. - To customize configurations for a specific group, select the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To make changes to your custom configurations, select **EDIT**. After you grant access, select **Close**. + To customize configurations for a specific group, select the **Assigned configurations** drop-down menu, then select **Custom**. To make changes to your custom configurations, select **Edit**. After you grant access, select **Close**. ## Remove access to an App-V package @@ -45,9 +45,9 @@ Use the following procedure to configure access to virtualized packages. 1. Open the App-V Management console. - 1. To display the **AD ACCESS** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **EDIT** in the **AD ACCESS** pane. + 1. To display the **AD Access** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **Edit** in the **AD Access** pane. -2. Select the group you want to remove, then select **DELETE**. +2. Select the group you want to remove, then select **Delete**. 3. Select **Close**. From c1e22d64cb659727e61d1f667154e46e5774a200 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 11:06:22 -0700 Subject: [PATCH 039/102] Spacing edit --- .../app-v/appv-available-mdm-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index b53a68364c..4d0eaf7540 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -27,5 +27,5 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |LastErrorDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/ configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file +|PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/
configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From b83f8f41c34bc5136e6e2a2678d355293f3affe3 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Tue, 12 Jun 2018 11:26:02 -0700 Subject: [PATCH 040/102] Add new functionality for existing ASR rule. --- .../attack-surface-reduction-exploit-guard.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 5fcdb543ec..344fe9385a 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 05/30/2018 +ms.date: 06/12/2018 --- @@ -127,6 +127,8 @@ Office apps, such as Word or Excel, will not be allowed to create child processe This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. +In Windows 10, version 1803 and later, this rule also blocks suspicious apps from being launched through Outlook or Access. + ### Rule: Block Office applications from creating executable content This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique. From 9b80f217466ba7935adef9e180a6bf591f3f77ef Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Tue, 12 Jun 2018 11:47:21 -0700 Subject: [PATCH 041/102] Add reviewer changes. --- .../attack-surface-reduction-exploit-guard.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 344fe9385a..4085972ad5 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -123,12 +123,10 @@ This rule blocks the following file types from being run or launched from an ema ### Rule: Block Office applications from creating child processes -Office apps, such as Word or Excel, will not be allowed to create child processes. +Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, Outlook, and Access. This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. -In Windows 10, version 1803 and later, this rule also blocks suspicious apps from being launched through Outlook or Access. - ### Rule: Block Office applications from creating executable content This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique. From 3a2606394c93471343771cc38fcc355844beec6a Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 19:23:14 +0000 Subject: [PATCH 042/102] Updated inclusive-classroom-it-admin.md, fixed up the tables --- .../inclusive-classroom-it-admin.md | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 1367c70c95..0deaac12fc 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -18,37 +18,37 @@ ms.date: 03/18/2018 ## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | -|---|---|---|---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting | OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
Word 2016, Word Online, Word Mac, Word for iOS
Outlook 2016, Outlook Web Access
Office Lens on iOS | |

X

|

X

|

X

| | -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS
| |

X

|

X

|

X

| | -| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

|

X

|

X

| | -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| |

X

| | | | -| Line focus mode |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | | -| Picture Dictionary |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS
| | | | | | +|---|---|---|---|---|---|---| +| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(Not including Outlook PC)

|

X

(Not including any OneNote apps or Outlook PC)

| +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(Not including any OneNote apps)

| +| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access)

|

X

(Not including Word iOS)

|

X

(Not including Word iOS)

|

X

(Not including any OneNote apps or Word iOS)

| +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| +| Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| +| Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|
-| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | -|---|---|---|---|---|---|---|---|---|---| -| Dictation |
  • OneNote 2016, OneNote for Windows 10
  • Word 2016
  • Outlook 2016
  • PowerPoint 2016
| |

X

|

X

| | | | | | -| Spelling suggestions for phonetic misspellings |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

|

X

| | | | | -| Synonyms alongside spelling suggestions that can be read aloud |
  • Word 2016
  • Outlook 2016
| |

X

|

X

|

X

| | | | | -| Grammar checks |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | | | | -| Customizable writing critiques |
  • Word 2016, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | | | | -| Tell me what you want to do |
  • Office 2016
  • Office Online
  • Office on iOS, Android, Windows 10
| |

X

|

X

|

X

| |

X

| | | -| Editor |
  • Word 2016
| |

X

|

X

| | | | | | +| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | +|---|---|---|---|---|---|---| +| Dictation |
  • OneNote 2016, OneNote for Windows 10
  • Word 2016
  • Outlook 2016
  • PowerPoint 2016
| |

X

|

X

| | | +| Spelling suggestions for phonetic misspellings |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

|

X

| | +| Synonyms alongside spelling suggestions that can be read aloud |
  • Word 2016
  • Outlook 2016
| |

X

|

X

|

X

| | +| Grammar checks |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | +| Customizable writing critiques |
  • Word 2016, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | +| Tell me what you want to do |
  • Office 2016
  • Office Online
  • Office on iOS, Android, Windows 10
| |

X

|

X

|

X

| | +| Editor |
  • Word 2016
| |

X

|

X

| | |
-| Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | -|---|---|---|---|---|---|---|---|---|---| -| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | | | | -| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | -| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | | | | -| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | | | -| Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | | | -| Ability to request accessible content |
  • Outlook Web Access
| | | | | | | | | +| Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | +|---|---|---|---|---|---|---| +| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | +| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | +| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | +| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | +| Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | +| Ability to request accessible content |
  • Outlook Web Access
| | | | | |
-| Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | Office 365 Web | Office Mac | Office iPad | -|---|---|---|---|---|---|---|---|---|---| -| Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in
|

X

|

X

|

X

|

X

|

X

| | | | +| Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | +|---|---|---|---|---|---|---| +| Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in)
|

X

|

X

|

X

|

X

|

X

|
\ No newline at end of file From 596329a76b5009bc00112ffbe93ceaa3bc68d3e8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 12:24:16 -0700 Subject: [PATCH 043/102] Edit spacing --- .../application-management/app-v/appv-available-mdm-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 4d0eaf7540..3c0cae1e21 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -28,4 +28,4 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVDynamicPolicy/
configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file +|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| \ No newline at end of file From 267d6b1e42cb7642f7a1b5605075a2cac7d8cdb3 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 12 Jun 2018 19:44:52 +0000 Subject: [PATCH 044/102] Merged PR 9009: fix link --- devices/hololens/hololens-provisioning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index 86631b4976..c1a90edadb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -22,7 +22,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device -To create provisioning packages, you must install Windows Configuration Designer [from Microsoft Store]((https://www.microsoft.com/store/apps/9nblggh4tx22)) or [from the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configurations Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box. +To create provisioning packages, you must install Windows Configuration Designer [from Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) or [from the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configurations Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box. From 26a9473445983b5435f5f1ff17a105b4f4a6b8da Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Jun 2018 13:03:25 -0700 Subject: [PATCH 045/102] added new topic for isg --- .../TOC.md | 1 + ...control-with-intelligent-security-graph.md | 142 ++++++++++++++++++ 2 files changed, 143 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 4bf7c5ff89..1d9c033045 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -18,6 +18,7 @@ ### [Merge WDAC policies](merge-windows-defender-application-control-policies.md) ### [Enforce WDAC policies](enforce-windows-defender-application-control-policies.md) ### [Deploy WDAC with a managed installer](use-windows-defender-application-control-with-managed-installer.md) +### [Deploy WDAC with Intelligent Security Graph (ISG)](use-windows-defender-application-control-with-intelligent-security-graph.md) ### [Deploy WDAC policies using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md) ### [Deploy WDAC policies using Intune](deploy-windows-defender-application-control-policies-using-intune.md) ### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md new file mode 100644 index 0000000000..57f5838a42 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -0,0 +1,142 @@ +--- +title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10) +description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: high +author: mdsakibMSFT +ms.date: 03/01/2018 +--- + +# Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph + +**Applies to:** + +- Windows 10 +- Windows Server 2016 + + +```code + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Enable service enforcement in AppLocker policy + +Since many installation processes rely on services, it is typically necessary to enable tracking of services. +Correct tracking of services requires the presence of at least one rule in the rule collection – a simple audit only rule will suffice. +For example: + +```code + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +### Enable the managed installer option in WDAC policy + +In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your WDAC policy. +This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). +An example of the managed installer option being set in policy is shown below. + +```code + + + + + + + + + + + + + + + + + +``` + +## Security considerations with managed installer + +Since managed installer is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. +It is best suited for deployment to systems where each user is configured as a standard user and where all software is deployed and installed by a software distribution solution, such as System Center Configuration Manager. + +Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed. +If the authorized managed installer process performs installations in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. +Some application installers include an option to automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization may continue to apply to all files created during the first run of the application. This could result in over-authorization for executables that were not intended. +To avoid this, ensure that the application deployment solution being used as a managed installer limits running applications as part of installation. + +## Known limitations with managed installer + +- Application execution control based on managed installer does not support applications that self-update. +If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin information and will not be authorized to run. +Enterprises should deploy and install all application updates using the managed installer. +In some cases, it may be possible to also designate an application binary that performs the self-updates as a managed installer. +Proper review for functionality and security should be performed for the application before using this method. + +- Although WDAC policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments. +Using the managed installer option with WDAC policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode. + +- Modern apps deployed through a managed installer will not be tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy. + +- Executables that extract files and then attempt to execute may not be allowed by the managed installer heuristic. +In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer. +Proper review for functionality and security should be performed for the application before using this method. + +- The managed installer heuristic does not authorize drivers. +The WDAC policy must have rules that allow the necessary drivers to run. + +- In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. +Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. +Review for functionality and performance for the related applications using the native images maybe necessary in some cases. From 1b3717b4e850e9916028733b3cf8cd0f2e666b80 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 12 Jun 2018 13:27:24 -0700 Subject: [PATCH 046/102] fixing some typos --- windows/deployment/update/update-compliance-get-started.md | 2 +- windows/deployment/upgrade/upgrade-readiness-get-started.md | 2 +- windows/deployment/upgrade/upgrade-readiness-requirements.md | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 9887546277..9d1b01ce0f 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -30,7 +30,7 @@ Update Compliance is offered as a solution in the Microsoft Operations Managemen If you are already using OMS, skip to step **6** to add Update Compliance to your workspace. >[!NOTE] ->If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=WaaSUpdateInsights) to go directly to the Device Health solution and add it to your workspace. +>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=WaaSUpdateInsights) to go directly to the Update Compliance solution and add it to your workspace. If you are not yet using OMS, use the following steps to subscribe to OMS Update Compliance: diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md index 3ee8a1a528..2972c0ff9c 100644 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md @@ -50,7 +50,7 @@ If you are already using OMS, you’ll find Upgrade Readiness in the Solutions G If you are not using OMS or Azure Log Analytics: 1. Go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. -2. Sign in to Operations Management Suite (OMS or Azure Log Analytics You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. +2. Sign in to Operations Management Suite (OMS) or Azure Log Analytics. You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. 3. Create a new workspace. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. 4. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index 538d13cb2a..7695e28a28 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -21,7 +21,7 @@ To perform an in-place upgrade, user computers must be running the latest versio The compatibility update that sends diagnostic data from user computers to Microsoft data centers works with Windows 7 SP1 and Windows 8.1 only. Upgrade Readiness cannot evaluate Windows XP or Windows Vista for upgrade eligibility. - + If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Windows Update or download and deploy the applicable package from the Microsoft Download Center. @@ -44,7 +44,8 @@ If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Read If you are not using OMS or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. ->[!IMPORTANT] You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work >or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. +>[!IMPORTANT] +>You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. You also need an Azure subscription to link to your OMS workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. ## System Center Configuration Manager integration From 1e12726a502bb1f81f9de09cedeadf8a8c2cb2c8 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:04:09 -0700 Subject: [PATCH 047/102] Finished cleanup --- ...y-the-deployment-configuration-file-with-powershell.md | 7 ++----- ...v-apply-the-user-configuration-file-with-powershell.md | 8 ++++---- .../app-v/appv-available-mdm-settings.md | 4 ++-- 3 files changed, 8 insertions(+), 11 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index a3958c5d49..f55d0d1e05 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -12,10 +12,7 @@ ms.date: 06/12/2018 >Applies to: Windows 10, version 1607 -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings of the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: - -* C:\\Packages\\Contoso\\MyApp.appv -* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml +When you add or set a package to a computer running the App-V client before it's been published, a dynamic deployment configuration file is applied to it. The dynamic deployment configuration file configures the default settings for the package that all users share on the computer running the App-V client. This section will tell you how to use a deployment configuration file. ## Apply the deployment configuration file with Windows PowerShell @@ -34,7 +31,7 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon ``` >[!NOTE] ->This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: +>This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: ```PowerShell Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index c115854e06..b51f7ac212 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -12,18 +12,18 @@ ms.date: 06/12/2018 >Applies to: Windows 10, version 1607 -The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. +When you publish a package to a specific user, you'll also need to specify a dynamic user configuration file to tell that package how to run. ## Apply a user configuration file -You can follow these steps to specify a user-specific configuration file: +Here's how to specify a user-specific configuration file: >[!NOTE] ->The following procedure uses the following example file path for its package: +>The following example cmdlets use this example file path for its package: > >* C:\\Packages\\Contoso\\MyApp.appv. > ->f your package file uses a different file path than the example, feel free to replace it as needed. +>If your package file uses a different file path than the example, feel free to replace it as needed. 1. Enter the following cmdlet in Windows PowerShell to add the package to the computer: diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 3c0cae1e21..9ccb2510ea 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -6,11 +6,11 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 06/12/2018 --- # Available Mobile Device Management (MDM) settings for App-V -With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps by using these Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. +With Windows 10, version 1703, you can configure, deploy, and manage your App-V apps with the following Mobile Device Management (MDM) settings. For the full list of available settings, see the [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) page. |Policy name|Supported versions|URI full path|Data type|Values| |---|---|---|---|---| From 326a6637c42d37100cb6c98c2bee6e70a5ffb4c4 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:09:06 -0700 Subject: [PATCH 048/102] Attempt to fix cmdlet formatting --- ...ply-the-deployment-configuration-file-with-powershell.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index f55d0d1e05..1fe64baff9 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -33,9 +33,9 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` ## Have a suggestion for App-V? From bdbea031da2c54910b31f5f32ac28bbb108032ff Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:28:50 -0700 Subject: [PATCH 049/102] Attempt to fix formatting again for powershell cmdlet --- ...ply-the-deployment-configuration-file-with-powershell.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 1fe64baff9..220186db45 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -33,9 +33,9 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` + ```PowerShell + Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml + ``` ## Have a suggestion for App-V? From 2ca39b9ba2e77070b0894ef0fba582e6bdae0e4e Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:30:14 -0700 Subject: [PATCH 050/102] Attempt to fix formatting again with brackets --- ...y-the-deployment-configuration-file-with-powershell.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 220186db45..90a114d137 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -32,10 +32,10 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: - - ```PowerShell - Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml - ``` +> +> ```PowerShell +> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml +> ``` ## Have a suggestion for App-V? From c0fa70b9c025b0cfb0377a9708071550d405376c Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 21:44:36 +0000 Subject: [PATCH 051/102] Updated inclusive-classroom-it-admin.md, added final 3 sections --- .../inclusive-classroom-it-admin.md | 36 ++++++++++++++++--- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 0deaac12fc..4daed3a54b 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -1,7 +1,7 @@ --- title: Inclusive Classroom IT Admin Guide description: Learning which Inclusive Classroom features are available in which apps and in which versions of Microsoft Office. -keywords: Test +keywords: Inclusive Classroom, Admin, Administrator, Microsoft Intune, Intune, Ease of Access, Office 365, account ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -11,12 +11,19 @@ ms.pagetype: edu ROBOTS: noindex,nofollow author: alhughes ms.author: alhughes -ms.date: 03/18/2018 +ms.date: 06/12/2018 --- # Inclusive Classroom IT Admin Guide +The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Office. +You will also learn how to deploy apps using Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. -## Inclusive Classroom features +1. [Inclusive Classroom features](#features) +2. [Deploying apps with Microsoft Intune](#intune) +3. [How to disable the Ease of Accesss settings for text in Windows 10](#ease) +4. [How to change your Office 365 account from monthly, semi-annual, or yearly](#account) + +## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| | Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(Not including Outlook PC)

|

X

(Not including any OneNote apps or Outlook PC)

| @@ -51,4 +58,25 @@ ms.date: 03/18/2018 | Communication features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| | Microsoft Translator |
  • Word 2016
  • Excel 2016
  • "Translator for Outlook" Add-in
  • PowerPoint 2016 (and PowerPoint Garage Add-in)
|

X

|

X

|

X

|

X

|

X

| -
\ No newline at end of file +
+ +## Deploying apps with Microsoft Intune +Microsoft Intune can be used to deploy apps such as Immersive Reader and Mirosoft Translator to all the computers connected in the same groups. +1. Go to the Intune for Education portal and login with your account. +2. Select the **Apps** page. +3. Find the app your looking for either in the included list or if it's not there you can select **Add app** and download it from the Microsoft Store. +4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. + +## How to disable the Ease of Accesss settings for text in Windows 10 +The Ease of Access settings in Windows 10 are very useful accessibility tools, but not every one needs them activated for their computer. With the following instructions you can turn off users ability to get to the Ease of access settings. +1. Go to the Intune for Education portal and login with your account. +2. Select the **Groups** page and then select your desired group. +3. Select **Settings** and under the **User access and device settings** section you find the toggle to set Ease of access to **Blocked** or **Not blocked**. +4. Select **Save** after making your selection. + +## How to change your Office 365 account from monthly, semi-annual, or yearly +Depending on how you plan to do billing, you can have Office 365 accounts that are set to renew monthly, semi-annually, or yearly. +1. Sign in to your services and subscriptions with your Microsoft account. +2. Find the subscription in the list, then select **Change how you pay**. + >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires. +3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. \ No newline at end of file From 9a9257760d00e1b8a9e70a9431528ceeee2dcd32 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 14:58:38 -0700 Subject: [PATCH 052/102] Next attempt to fix formatting --- ...ply-the-deployment-configuration-file-with-powershell.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 90a114d137..9010d42763 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -33,9 +33,9 @@ Add-AppVClientPackage -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentCon >[!NOTE] >This command captures the resulting object into $pkg. If the package is already present on the computer, you can use the **Set-AppVclientPackage** cmdlet to apply the deployment configuration document: > -> ```PowerShell -> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml -> ``` +> ```PowerShell +> Set-AppVClientPackage -Name Myapp -Path C:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration C:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml +> ``` ## Have a suggestion for App-V? From 750fbbabb8e7b7e8425a0952e168d68458bf673c Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 12 Jun 2018 15:21:45 -0700 Subject: [PATCH 053/102] Fixed formatting and placement of related topics section for consistency --- .../app-v/appv-auto-clean-unpublished-packages.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index bb51d5cad8..25e56caeaf 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -51,12 +51,12 @@ Using Group Policy, you can turn on the **Enable automatic cleanup of unused App After your Group Policy updates and you reset the client, the setting will clean up any unpublished App-V packages on the App-V client. -### Related topics +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). + +## Related topics - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) - [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186) -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) - -## Have a suggestion for App-V? - -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file +- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) \ No newline at end of file From d2bb6ad6664ece3cdacfe3b75056256968e7961c Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Tue, 12 Jun 2018 23:40:56 +0000 Subject: [PATCH 054/102] Updated inclusive-classroom-it-admin.md --- .../get-started/inclusive-classroom-it-admin.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 4daed3a54b..e095d037d3 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -15,8 +15,8 @@ ms.date: 06/12/2018 --- # Inclusive Classroom IT Admin Guide -The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Office. -You will also learn how to deploy apps using Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. +The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Microsoft Office. +You will also learn how to deploy apps using Microsoft Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription. 1. [Inclusive Classroom features](#features) 2. [Deploying apps with Microsoft Intune](#intune) @@ -64,19 +64,19 @@ You will also learn how to deploy apps using Intune, turn on or off Ease of acce Microsoft Intune can be used to deploy apps such as Immersive Reader and Mirosoft Translator to all the computers connected in the same groups. 1. Go to the Intune for Education portal and login with your account. 2. Select the **Apps** page. -3. Find the app your looking for either in the included list or if it's not there you can select **Add app** and download it from the Microsoft Store. +3. Find the app you're looking for either in the included list or, if it's not there, you can select **Add app** and download it from the Microsoft Store. 4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. -## How to disable the Ease of Accesss settings for text in Windows 10 +## How to disable the Ease of Access settings for text in Windows 10 The Ease of Access settings in Windows 10 are very useful accessibility tools, but not every one needs them activated for their computer. With the following instructions you can turn off users ability to get to the Ease of access settings. 1. Go to the Intune for Education portal and login with your account. 2. Select the **Groups** page and then select your desired group. -3. Select **Settings** and under the **User access and device settings** section you find the toggle to set Ease of access to **Blocked** or **Not blocked**. +3. Select **Settings** and under the **User access and device settings** section you will find the toggle to set **Ease of access** to **Blocked** or **Not blocked**. 4. Select **Save** after making your selection. ## How to change your Office 365 account from monthly, semi-annual, or yearly Depending on how you plan to do billing, you can have Office 365 accounts that are set to renew monthly, semi-annually, or yearly. -1. Sign in to your services and subscriptions with your Microsoft account. +1. Sign-in to your services and subscriptions with your Microsoft account. 2. Find the subscription in the list, then select **Change how you pay**. >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires. 3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. \ No newline at end of file From e2cb4b031ab11b5695b30b435ef8e6ba34d75011 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 12 Jun 2018 17:24:28 -0700 Subject: [PATCH 055/102] update applies to, fix char, modify console use --- ...evel-windows-defender-advanced-threat-protection.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md index a542df63b1..677d282889 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Onboard previous versions of Windows on Windows Defender ATP description: Onboard supported previous versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor -keywords: onboard, windows, 7, 8, oms, sp1, enterprise, pro, down level +keywords: onboard, windows, 7, oms, sp1, enterprise, pro, down level search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 06/11/2018 +ms.date: 06/17/2018 --- # Onboard Windows previous versions of Windows @@ -19,15 +19,13 @@ ms.date: 06/11/2018 - Windows 7 SP1 Enterprise - Windows 7 SP1 Pro -- Windows 8.1 Enterprise -- Windows 8.1 Pro - Windows Defender Advanced Threat Protection (Windows Defender ATP) [!include[Prerelease information](prerelease.md)] -Windows Defender ATP extends support to also include down-level operating systems, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console. +Windows Defender ATP extends support to also include down-level operating systems, providing advanced attack detection and investigation capabilities on supported Windows versions. -To onboard down-level Windows client endpoints to Windows Defender ATP, youll need to: +To onboard down-level Windows client endpoints to Windows Defender ATP, you'll need to: - Configure and update System Center Endpoint Protection clients. - Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP as instructed below. From 99c0736647e9edddff7cbc6cfaec77009de4bbaa Mon Sep 17 00:00:00 2001 From: Martin Adler <1208749+EagleIJoe@users.noreply.github.com> Date: Wed, 13 Jun 2018 12:51:37 +0200 Subject: [PATCH 056/102] Corrected examples XML syntax Upper case boolean values caused parser error Ending XML closing tag invalidates file --- .../app-v/appv-auto-batch-updating.md | 92 +++++++++---------- 1 file changed, 45 insertions(+), 47 deletions(-) diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md index 1d96b18fb8..ff99b0273a 100644 --- a/windows/application-management/app-v/appv-auto-batch-updating.md +++ b/windows/application-management/app-v/appv-auto-batch-updating.md @@ -41,29 +41,28 @@ Updating multiple apps at the same time requires that you create a **ConfigFile* **Example:** ```XML - - - Skype for Windows Update - D:\Install\Update\SkypeforWindows - SkypeSetup.exe - /S - C:\App-V_Package\Microsoft_Apps\skypeupdate.appv - 20 - True - True - - - Microsoft Power BI Update - D:\Install\Update\PowerBI - PBIDesktop.msi - /S - C:\App-V_Package\MS_Apps\powerbiupdate.appv - 20 - True - True - - - + + + Skype for Windows Update + D:\Install\Update\SkypeforWindows + SkypeSetup.exe + /S + C:\App-V_Package\Microsoft_Apps\skypeupdate.appv + 20 + true + true + + + Microsoft Power BI Update + D:\Install\Update\PowerBI + PBIDesktop.msi + /S + C:\App-V_Package\MS_Apps\powerbiupdate.appv + 20 + true + true + + ``` 3. Save your completed file under the name **ConfigFile**. @@ -101,29 +100,28 @@ Updating multipe apps at the same time requires that you create a **ConfigFile** ```XML - - - Skype for Windows Update - D:\Install\Update\SkypeforWindows - SkypeSetup.exe - /S - C:\App-V_Package\Microsoft_Apps\skypeupdate.appv - 20 - False - True - - - Microsoft Power BI Update - D:\Install\Update\PowerBI - PBIDesktop.msi - /S - C:\App-V_Package\MS_Apps\powerbiupdate.appv - 20 - False - True - - - + + + Skype for Windows Update + D:\Install\Update\SkypeforWindows + SkypeSetup.exe + /S + C:\App-V_Package\Microsoft_Apps\skypeupdate.appv + 20 + false + true + + + Microsoft Power BI Update + D:\Install\Update\PowerBI + PBIDesktop.msi + /S + C:\App-V_Package\MS_Apps\powerbiupdate.appv + 20 + false + true + + ``` ### Start the App-V Sequencer interface and app installation process @@ -157,4 +155,4 @@ There are three types of log files that occur when you sequence multiple apps at ## Have a suggestion for App-V? -Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](https://appv.uservoice.com/forums/280448-microsoft-application-virtualization). From 9ab71bdb870712272a40959d82dff6fa8c1d547b Mon Sep 17 00:00:00 2001 From: Frank Gorgenyi Date: Wed, 13 Jun 2018 12:37:34 +0000 Subject: [PATCH 057/102] Merged PR 9015: Change Quick Pair to Swift Pair. Change Quick Pair to Swift Pair. --- windows/client-management/mdm/policy-csp-bluetooth.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 519bdfeb1f..1fb3b009d6 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -236,14 +236,14 @@ The following list shows the supported values: -Added in Windows 10, version 1803. This policy allows the IT admin to block users on these managed devices from using Quick Pair and other proximity based scenarios. +Added in Windows 10, version 1803. This policy allows the IT admin to block users on these managed devices from using Swift Pair and other proximity based scenarios. The following list shows the supported values: -- 0 - Disallow. Block users on these managed devices from using Quick Pair and other proximity based scenarios -- 1 - Allow. Allow users on these managed devices to use Quick Pair and other proximity based scenarios +- 0 - Disallow. Block users on these managed devices from using Swift Pair and other proximity based scenarios +- 1 - Allow. Allow users on these managed devices to use Swift Pair and other proximity based scenarios From 18f3d7f9b13a10de950050a888ccd3deb47c0780 Mon Sep 17 00:00:00 2001 From: Christopher McClister Date: Wed, 13 Jun 2018 08:26:54 -0700 Subject: [PATCH 058/102] Added ms.collection meta data to Education hub per Lauren Moynihan --- education/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/education/index.md b/education/index.md index 424b52680d..c78b456b9e 100644 --- a/education/index.md +++ b/education/index.md @@ -6,6 +6,7 @@ description: Learn about product documentation and resources available for schoo author: CelesteDG ms.topic: hub-page ms.author: celested +ms.collection: ITAdminEDU ms.date: 10/30/2017 ---
From 79dfc736790d239eb0172e2ea9365323a5fc00f2 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 13 Jun 2018 08:52:54 -0700 Subject: [PATCH 059/102] Updated metadata dates --- ...v-apply-the-deployment-configuration-file-with-powershell.md | 2 +- .../appv-apply-the-user-configuration-file-with-powershell.md | 2 +- .../app-v/appv-auto-clean-unpublished-packages.md | 2 +- .../application-management/app-v/appv-available-mdm-settings.md | 2 +- ...-configure-access-to-packages-with-the-management-console.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md index 9010d42763..8d3a64000e 100644 --- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # How to apply the deployment configuration file by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md index b51f7ac212..d8a04ef887 100644 --- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # How to apply the user configuration file by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 25e56caeaf..cd9c6096a7 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # Automatically clean up unpublished packages on the App-V client diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 9ccb2510ea..d254a8b4b7 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # Available Mobile Device Management (MDM) settings for App-V diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md index f9a3d2bb7e..f44af0a19a 100644 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- # How to Configure Access to Packages by Using the Management Console From 436fe714e3178bc5f9be0c3b65482a4cacdac780 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Jun 2018 09:56:48 -0700 Subject: [PATCH 060/102] added bold to code snippet --- ...control-with-intelligent-security-graph.md | 151 ++++++------------ 1 file changed, 53 insertions(+), 98 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index 57f5838a42..c5c738cc8e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -15,11 +15,39 @@ ms.date: 03/01/2018 - Windows 10 - Windows Server 2016 +Application execution control can be difficult to implement in enterprises that do not have processes to effectively control the deployment of applications centrally through an IT managed system. +In such environments, users are empowered to acquire the applications they need for work, making accounting for all the applications that would need to be authorized for execution control a daunting task. -```code +Windows 10, version 1709 (also known as the Windows 10 Fall Creators Update) provides a new option, known as Intelligent Security Graph (ISG) authorization, that allows IT administrators to automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. The ISG option helps IT organizations take a significant first step towards going from having no application control at all to a simple means of preventing the execution of unknown and known bad software. + +## How does the integration between WDAC and the Intelligent Security Graph work? + +The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed the reputation data is used to help make the right policy authorization decision. + +After that initial download and installation, the WDAC component will check for the presence of the positive reputation information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the known good reputation classification. + +The reputation data on the client is rechecked periodically and enterprises can also specify that any cached reputation results are flushed on reboot. + +>[!NOTE] +>Admins needs to ensure that there is a WDAC policy in place to allow the system to boot and run any other authorized applications that may not be classified as being known good by the Intelligent Security Graph, for example custom line-of-business (LOB) apps. Since the Intelligent Security Graph is powered by global prevalence data, internal LOB apps may not be recognized as being known good. Other mechanisms like managed installer and explicit rules will help cover internal applications. Both System Center Configuration Manager (SCCM) and Microsoft Intune can be used to create and push a WDAC policy to your client machines. + +Other examples of WDAC policies are available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies and can help authorize Windows OS components, WHQL signed drivers and all Store apps. Admins can reference and customize them as needed for their Windows Defender Application Control deployment or [create a custom WDAC policy](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy). + +## Configuring Intelligent Security Graph authorization for Windows Defender Application Control + +Setting up the ISG authorization is easy regardless of what management solution you use. Configuring the ISG option involves these basic steps: + +- [Ensure that the ISG option is enabled in the WDAC policy XML](#ensure-that-the-intelligent-security-graph-option-is-enabled-in-the-wdac-policy-xml) +- [Enable the necessary services to allow WDAC to use the ISG correctly on the client](#enable-the-necessary-services-to-allow-wdac-to-use-the-isg-correctly-on-the-client) + +### Ensure that the Intelligent Security Graph option is enabled in the WDAC policy XML + +In order to enable trust for executables based on classifications in the ISG, the Enabled: Intelligent Security Graph authorization option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition it is recommended from a security perspective to also enable the Enabled:Invalidate EAs on Reboot option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. An example of both options being set is shown below. + +
  
      
-       
+       
      
      
        
@@ -27,12 +55,12 @@ ms.date: 03/01/2018
      
        
      
-     
-       
-     
-     
-       
-     
+     
+       
+     
+     
+       
+     
      
        
      
@@ -40,103 +68,30 @@ ms.date: 03/01/2018
        
      
  
+
+ +### Enable the necessary services to allow WDAC to use the ISG correctly on the client + +In order for the heuristics used by the ISG to function properly, a number of component in Windows need to be enabled. The easiest way to do this is to run the appidtel executable in c:\windows\system32. + +``` +appidtel start ``` -## Enable service enforcement in AppLocker policy +For WDAC policies deployed over MDM using the AppLocker CSP this step is not required as the CSP will enable the necessary components. ISG enabled through the SCCM WDAC UX will not need this step but if custom policies are being deployed outside of the WDAC UX through SCCM then this step is required. -Since many installation processes rely on services, it is typically necessary to enable tracking of services. -Correct tracking of services requires the presence of at least one rule in the rule collection – a simple audit only rule will suffice. -For example: +## Security considerations with using the Intelligent Security Graph -```code - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` +Since the ISG is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. It is best suited for deployment to systems where each user is configured as a standard user and there are other monitoring systems in place like Windows Defender Advanced Threat Protection to help provide optics into what users are doing. -### Enable the managed installer option in WDAC policy +Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of WDAC when the ISG option is allowed by circumventing or corrupting the heuristics used to assign reputation to application executables. The ISG option uses the same heuristic tracking as managed installer and so for application installers that include an option to automatically run the application at the end of the installation process the heuristic may over-authorize. -In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your WDAC policy. -This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). -An example of the managed installer option being set in policy is shown below. +## Known limitations with using the Intelligent Security Graph -```code - - - - - - - - - - - - - - - - - -``` +Since the ISG relies on identifying executables as being known good there are cases where it may classify legitimate executables as unknown leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in WDAC policy or by deployment through a WDAC managed installer. Typically this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG. -## Security considerations with managed installer +Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business it is straightforward to authorize modern apps with signer rules in the WDAC policy. -Since managed installer is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. -It is best suited for deployment to systems where each user is configured as a standard user and where all software is deployed and installed by a software distribution solution, such as System Center Configuration Manager. +The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. -Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed. -If the authorized managed installer process performs installations in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. -Some application installers include an option to automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization may continue to apply to all files created during the first run of the application. This could result in over-authorization for executables that were not intended. -To avoid this, ensure that the application deployment solution being used as a managed installer limits running applications as part of installation. - -## Known limitations with managed installer - -- Application execution control based on managed installer does not support applications that self-update. -If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin information and will not be authorized to run. -Enterprises should deploy and install all application updates using the managed installer. -In some cases, it may be possible to also designate an application binary that performs the self-updates as a managed installer. -Proper review for functionality and security should be performed for the application before using this method. - -- Although WDAC policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments. -Using the managed installer option with WDAC policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode. - -- Modern apps deployed through a managed installer will not be tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy. - -- Executables that extract files and then attempt to execute may not be allowed by the managed installer heuristic. -In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer. -Proper review for functionality and security should be performed for the application before using this method. - -- The managed installer heuristic does not authorize drivers. -The WDAC policy must have rules that allow the necessary drivers to run. - -- In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. -Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. -Review for functionality and performance for the related applications using the native images maybe necessary in some cases. +In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases. \ No newline at end of file From a33af7a063e817c9dd78174e6b196fd2c63e774d Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 13 Jun 2018 13:32:24 -0700 Subject: [PATCH 061/102] Corrected ASR rule functions. --- .../attack-surface-reduction-exploit-guard.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 4085972ad5..ef39fda490 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- @@ -174,7 +174,6 @@ This rule attempts to block Office files that contain macro code that is capable This rule blocks the following file types from being run or launched unless they meet prevalence or age criteria set by admins, or they are in a trusted list or exclusion list: - Executable files (such as .exe, .dll, or .scr) -- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) ### Rule: Use advanced protection against ransomware From e7903a90bbcc957f988d2d36f2e6274084f47ae4 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Jun 2018 13:52:18 -0700 Subject: [PATCH 062/102] fixed formatting --- ...control-with-intelligent-security-graph.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index c5c738cc8e..f5dfca7d37 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -22,7 +22,7 @@ Windows 10, version 1709 (also known as the Windows 10 Fall Creators Update) pro ## How does the integration between WDAC and the Intelligent Security Graph work? -The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed the reputation data is used to help make the right policy authorization decision. +The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed, the reputation data is used to help make the right policy authorization decision. After that initial download and installation, the WDAC component will check for the presence of the positive reputation information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the known good reputation classification. @@ -42,9 +42,9 @@ Setting up the ISG authorization is easy regardless of what management solution ### Ensure that the Intelligent Security Graph option is enabled in the WDAC policy XML -In order to enable trust for executables based on classifications in the ISG, the Enabled: Intelligent Security Graph authorization option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition it is recommended from a security perspective to also enable the Enabled:Invalidate EAs on Reboot option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. An example of both options being set is shown below. +In order to enable trust for executables based on classifications in the ISG, the **Enabled: Intelligent Security Graph authorization** option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition, it is recommended from a security perspective to also enable the **Enabled:Invalidate EAs on Reboot** option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. The following example shows both options being set. -
+```code
  
      
        
@@ -55,12 +55,12 @@ In order to enable trust for executables based on classifications in the ISG, th
      
        
      
-     
-       
-     
-     
-       
-     
+    
+      
+    
+    
+       
+    
      
        
      
@@ -68,7 +68,7 @@ In order to enable trust for executables based on classifications in the ISG, th
        
      
  
-
+``` ### Enable the necessary services to allow WDAC to use the ISG correctly on the client @@ -88,9 +88,9 @@ Users with administrator privileges or malware running as an administrator user ## Known limitations with using the Intelligent Security Graph -Since the ISG relies on identifying executables as being known good there are cases where it may classify legitimate executables as unknown leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in WDAC policy or by deployment through a WDAC managed installer. Typically this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG. +Since the ISG relies on identifying executables as being known good, there are cases where it may classify legitimate executables as unknown, leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in the WDAC policy or by deployment through a WDAC managed installer. Typically, this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG. -Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business it is straightforward to authorize modern apps with signer rules in the WDAC policy. +Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business. it is straightforward to authorize modern apps with signer rules in the WDAC policy. The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. From a84f2885449ccb019c65048e9c19d06cf8b925ca Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Jun 2018 13:56:08 -0700 Subject: [PATCH 063/102] fixed formatting --- ...ndows-defender-application-control-with-managed-installer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index efb071bcb1..badaf77f39 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: mdsakibMSFT -ms.date: 03/01/2018 +ms.date: 06/13/2018 --- # Deploy Managed Installer for Windows Defender Application Control From 1650ac230c4b901630c9680ebb31c309a2e57356 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 13 Jun 2018 14:01:22 -0700 Subject: [PATCH 064/102] Incorp review --- .../attack-surface-reduction-exploit-guard.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 4085972ad5..c1ad13b4dd 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/12/2018 +ms.date: 06/13/2018 --- @@ -187,6 +187,9 @@ Local Security Authority Subsystem Service (LSASS) authenticates users who log i >[!IMPORTANT] >[Exclusions do not apply to this rule](customize-attack-surface-reduction.md#exclude-files-and-folders). + >[!NOTE] + >Some apps are coded to enumerate all running processes and to attempt opening them with exhaustive permissions. This results in the app accessing LSASS even when it's not necessary. ASR will deny the app's process open action and log the details to the security event log. Entry in the event log for access denial by itself is not an indication of the presence of a malicious threat. + ### Rule: Block process creations originating from PSExec and WMI commands This rule blocks processes through PsExec and WMI commands from running, to prevent remote code execution that can spread malware attacks. From facc92390c2c008d60e772efc1edc7fe874b90ec Mon Sep 17 00:00:00 2001 From: Zane <34351912+zburtondbrs@users.noreply.github.com> Date: Wed, 13 Jun 2018 16:02:17 -0500 Subject: [PATCH 065/102] Update set-the-default-browser-using-group-policy.md The KB does not specify that this is a computer policy. Since there is not an equivalent user policy, I think that this should be explicitly stated. --- .../set-the-default-browser-using-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 899c3da6e3..900f6cbb17 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -17,7 +17,7 @@ You can use the Group Policy setting, **Set a default associations configuration **To set the default browser as Internet Explorer 11** -1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

+1. Open your Group Policy editor and go to the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). ![set default associations group policy setting](images/setdefaultbrowsergp.png) From 3f87dc491dbdba52acb699e5b5c0926809cefd10 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 13 Jun 2018 14:02:51 -0700 Subject: [PATCH 066/102] minor updates --- ...privacy-windows-defender-advanced-threat-protection.md | 6 +++--- ...censing-windows-defender-advanced-threat-protection.md | 2 +- ...rements-windows-defender-advanced-threat-protection.md | 6 +++--- ...ot-siem-windows-defender-advanced-threat-protection.md | 8 ++++---- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index 7a7abff824..1f6735881b 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 03/06/2018 +ms.date: 06/13/2018 --- # Windows Defender ATP data storage and privacy @@ -27,7 +27,7 @@ This section covers some of the most frequently asked questions regarding privac ## What data does Windows Defender ATP collect? -Microsoft will collect and store information from your configured machines in a database specific to the service for administration, tracking, and reporting purposes. +Windows Defender ATP will collect and store information from your configured machines in a customer dedicate and segregated tenant specific to the service for administration, tracking, and reporting purposes. Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version). @@ -51,7 +51,7 @@ In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wik ## Do I have the flexibility to select where to store my data? -When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the United Kingdom, Europe, or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States. +When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States. ## Is my data isolated from other customer data? Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides. diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md index e64acc561c..30c94ffd40 100644 --- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md @@ -66,7 +66,7 @@ When accessing the [Windows Defender ATP portal](https://SecurityCenter.Windows. You will need to set up your preferences for the Windows Defender ATP portal. -3. When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the United Kingdom, Europe, or The United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. +3. When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. > [!WARNING] > This option cannot be changed without completely offboarding from Windows Defender ATP and completing a new enrollment process. diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index c4a8127477..bd53b3a21d 100644 --- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -36,14 +36,14 @@ For more information, see [Windows 10 Enterprise edition](https://www.microsoft. ### Licensing requirements Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers: -- Windows 10 Enterprise E5 -- Windows 10 Education E5 +- Windows 10 Enterprise E5 +- Windows 10 Education E5 - Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2). ### Network and data storage and configuration requirements -When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the United Kingdom, Europe, or United States datacenter. +When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the European Union, the United Kingdom, or the United States datacenter. > [!NOTE] > - You cannot change your data storage location after the first-time setup. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index ba867a62e4..eb4b206317 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -63,10 +63,10 @@ If you encounter an error when trying to get a refresh token when using the thre - For Threat intelligence API: `https://WindowsDefenderATPCustomerTiConnector` 5. Add the following URL: - - For US: `https://winatpmanagement-us.securitycenter.windows.com/UserAuthenticationCallback`. - - For Europe: `https://winatpmanagement-eu.securitycenter.windows.com/UserAuthenticationCallback` - - For United Kingdom: `https://winatpmanagement-uk.securitycenter.windows.com/UserAuthenticationCallback` - + - For the European Union: `https://winatpmanagement-eu.securitycenter.windows.com/UserAuthenticationCallback` + - For the United Kingdom: `https://winatpmanagement-uk.securitycenter.windows.com/UserAuthenticationCallback` + - For the United States: `https://winatpmanagement-us.securitycenter.windows.com/UserAuthenticationCallback`. + 6. Click **Save**. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootsiem-belowfoldlink) From 71d2e1e786e30009f3965a6be272a1a3b8300ad6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 13 Jun 2018 14:17:05 -0700 Subject: [PATCH 067/102] typo --- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index 1f6735881b..872a54ee9b 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -27,7 +27,7 @@ This section covers some of the most frequently asked questions regarding privac ## What data does Windows Defender ATP collect? -Windows Defender ATP will collect and store information from your configured machines in a customer dedicate and segregated tenant specific to the service for administration, tracking, and reporting purposes. +Windows Defender ATP will collect and store information from your configured machines in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes. Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version). From 3d417b579cb5b4eb36bb5138848946614ce23637 Mon Sep 17 00:00:00 2001 From: Patti Short <35278231+shortpatti@users.noreply.github.com> Date: Wed, 13 Jun 2018 14:24:29 -0700 Subject: [PATCH 068/102] Revert "Update supl-ddf-file.md" --- .../client-management/mdm/supl-ddf-file.md | 198 +----------------- 1 file changed, 1 insertion(+), 197 deletions(-) diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 4ee4e4ad1d..e6ed98d713 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -171,7 +171,7 @@ The XML below is the current version for this CSP. - MCCMNCPairs + MCCMNPairs @@ -482,201 +482,6 @@ The XML below is the current version for this CSP. - - RootCertificate4 - - - - - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. - - - - - - - - - - - - - - - Name - - - - - - Specifies the name of the H-SLP root certificate as a string, in the format name.cer. - - - - - - - - - - - text/plain - - - - - Data - - - - - - The base 64 encoded blob of the H-SLP root certificate. - - - - - - - - - - - - - - - - - RootCertificate5 - - - - - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. - - - - - - - - - - - - - - - Name - - - - - - Specifies the name of the H-SLP root certificate as a string, in the format name.cer. - - - - - - - - - - - text/plain - - - - - Data - - - - - - The base 64 encoded blob of the H-SLP root certificate. - - - - - - - - - - - - - - - - - RootCertificate6 - - - - - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. - - - - - - - - - - - - - - - Name - - - - - - Specifies the name of the H-SLP root certificate as a string, in the format name.cer. - - - - - - - - - - - text/plain - - - - - Data - - - - - - The base 64 encoded blob of the H-SLP root certificate. - - - - - - - - - - - - - - - V2UPL1 @@ -857,7 +662,6 @@ The XML below is the current version for this CSP. - ```   From 57d57e319c5160365e228cfcea219843476ecf32 Mon Sep 17 00:00:00 2001 From: Luis Masieri <32968351+lmasieri@users.noreply.github.com> Date: Wed, 13 Jun 2018 14:29:15 -0700 Subject: [PATCH 069/102] Update whats-new-microsoft-store-business-education.md --- .../whats-new-microsoft-store-business-education.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index fc29d300b3..e2988a84c9 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -68,7 +68,7 @@ We’ve been working on bug fixes and performance improvements to provide you a - Bug fixes and performance improvements [October 2017](release-history-microsoft-store-business-education.md#october-2017) -- Bug fixes and permformance improvements +- Bug fixes and performance improvements [September 2017](release-history-microsoft-store-business-education.md#september-2017) - Manage Windows device deployment with Windows Autopilot Deployment From 8d57c7fd279afa47296b097d02db39f7b2052b9d Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Wed, 13 Jun 2018 22:38:16 +0000 Subject: [PATCH 070/102] Updated inclusive-classroom-it-admin.md, final changes before pull request --- .../inclusive-classroom-it-admin.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index e095d037d3..63c0d3cb23 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -20,18 +20,18 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea 1. [Inclusive Classroom features](#features) 2. [Deploying apps with Microsoft Intune](#intune) -3. [How to disable the Ease of Accesss settings for text in Windows 10](#ease) +3. [How to show/hide the Ease of Accesss settings for text in Windows 10](#ease) 4. [How to change your Office 365 account from monthly, semi-annual, or yearly](#account) ## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting |

  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(Not including Outlook PC)

|

X

(Not including any OneNote apps or Outlook PC)

| -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(Not including any OneNote apps)

| -| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(Not including Word for iOS, Word Online, Outlook Web Access)

|

X

(Not including Word iOS)

|

X

(Not including Word iOS)

|

X

(Not including any OneNote apps or Word iOS)

| -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| -| Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| -| Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(Not including Word Online, Outlook Web Access)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

|

X

(Not including any OneNote apps)

| +| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(N/A for Outlook PC)

|

X

(N/A for any OneNote apps or Outlook PC)

| +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(N/A for any OneNote apps)

| +| Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access)

|

X

(N/A for Word iOS)

|

X

(N/A for Word iOS)

|

X

(N/A for any OneNote apps or Word iOS)

| +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(ot includingN any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| +| Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| +| Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|
| Writing and proofing features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | @@ -50,7 +50,7 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea | Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | | Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | | Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | -| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
| |

X

| | | | +| Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
  • Microsoft Stream (includes ability to have captions auto-generated for videos in English and Spanish)
| |

X

| | | | | Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | | Ability to request accessible content |
  • Outlook Web Access
| | | | | |
@@ -61,14 +61,14 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea
## Deploying apps with Microsoft Intune -Microsoft Intune can be used to deploy apps such as Immersive Reader and Mirosoft Translator to all the computers connected in the same groups. -1. Go to the Intune for Education portal and login with your account. +Microsoft Intune can be used to deploy apps such as Immersive Reader and Microsoft Translator to all the devices connected in the same groups. +1. Go to the Intune for Education portal and log in with your account. 2. Select the **Apps** page. -3. Find the app you're looking for either in the included list or, if it's not there, you can select **Add app** and download it from the Microsoft Store. +3. Find the app you're looking for in the included list (if it's not there, you can select **Add app** and download it from the Microsoft Store). 4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to. -## How to disable the Ease of Access settings for text in Windows 10 -The Ease of Access settings in Windows 10 are very useful accessibility tools, but not every one needs them activated for their computer. With the following instructions you can turn off users ability to get to the Ease of access settings. +## How to show/hide the Ease of access settings for text in Windows 10 +The Ease of access settings in Windows 10 are very useful accessibility tools, but having those options could be a bit much for everyone in a group to have in their device. With the following instructions you can chose to hide or show the Ease of access settings on users' devices. 1. Go to the Intune for Education portal and login with your account. 2. Select the **Groups** page and then select your desired group. 3. Select **Settings** and under the **User access and device settings** section you will find the toggle to set **Ease of access** to **Blocked** or **Not blocked**. From aee53922e55ffb6f767a3a81744308ceacfeafe4 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 14 Jun 2018 13:16:03 +0000 Subject: [PATCH 071/102] Merged PR 9058: fixing formatting --- windows/privacy/manage-windows-endpoints.md | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/windows/privacy/manage-windows-endpoints.md b/windows/privacy/manage-windows-endpoints.md index e43a9ddff4..ba3adcb3c4 100644 --- a/windows/privacy/manage-windows-endpoints.md +++ b/windows/privacy/manage-windows-endpoints.md @@ -34,7 +34,7 @@ We used the following methodology to derive these network endpoints: 2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. +5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -529,8 +529,7 @@ In addition to the endpoints listed for Windows 10 Enterprise, the following end | dual-a-0001.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. | | fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | -| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2/ -HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | +| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | | fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | | g.live.com/1rewlive5skydrive/ | HTTPS | Used by a redirection service to automatically update URLs. | @@ -552,11 +551,9 @@ HTTPS | Enables connections to Windows Update, Microsoft Update, and the online | pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | | pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. | | purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | -| ris.api.iris.microsoft.com.akadns.net | TLSv1.2/ -HTTPS | Used to retrieve Windows Spotlight metadata. | +| ris.api.iris.microsoft.com.akadns.net | TLSv1.2\/HTTPS | Used to retrieve Windows Spotlight metadata. | | settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. | -| sls.update.microsoft.com.nsatc.net | TLSv1.2/ -HTTPS | Enables connections to Windows Update. | +| sls.update.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update. | | star-mini.c10r.facebook.com | TLSv1.2 | Used for the Facebook Live Tile. | | storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. | | storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | @@ -578,8 +575,7 @@ HTTPS | Enables connections to Windows Update. | | **Destination** | **Protocol** | **Description** | | --- | --- | --- | | *.*.akamai.net | HTTP | Used to download content. | -| *.*.akamaiedge.net | HTTP/ -TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. | +| *.*.akamaiedge.net | TLSv1.2\/HTTP | Used to check for updates to maps that have been downloaded for offline use. | | *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. | | *.blob.core.windows.net | HTTPS | Used by Windows Update to update words used for language input methods. | | *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. | @@ -618,8 +614,7 @@ TLSv1.2 | Used to check for updates to maps that have been downloaded for offlin | evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office Online. | | fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | -| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2/ -HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | +| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe3.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | | fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | @@ -704,8 +699,7 @@ HTTPS | Enables connections to Windows Update, Microsoft Update, and the online | fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | | fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. | -| g.msn.com.nsatc.net | HTTP/ -TLSv1.2 | Used to retrieve Windows Spotlight metadata. | +| g.msn.com.nsatc.net | TLSv1.2\/HTTP | Used to retrieve Windows Spotlight metadata. | | geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. | | geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. | From c7b5756f6843a2fece5d8b4a69c5b33cbe369f75 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Thu, 14 Jun 2018 14:42:13 +0000 Subject: [PATCH 072/102] Merged PR 9060: Fixed heading --- devices/hololens/hololens-kiosk.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 0abcc7ac79..745543c41c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -42,7 +42,8 @@ If you use [MDM, Microsoft Intune](#intune-kiosk), or a [provisioning package](# >[!NOTE] >Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. -### Start layout file for Intune + +### Start layout file for MDM (Intune and others) Save the following sample as an XML file. You will select this file when you configure the kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). From 719eeb5302d3965fcfb66f4146c873480c4b48ad Mon Sep 17 00:00:00 2001 From: JohnRajunas Date: Thu, 14 Jun 2018 12:38:36 -0400 Subject: [PATCH 073/102] Update windows-10-start-layout-options-and-policies.md I think adding the reference to CopyProfile not being supported will help insure IT Pros do not consider using it as a alternative to the options detailed here --- .../windows-10-start-layout-options-and-policies.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index 58bb51fd67..82f903e308 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -30,6 +30,8 @@ Organizations might want to deploy a customized Start and taskbar configuration >Start and taskbar configuration can be applied to devices running Windows 10 Pro, version 1703. > >Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/library/jj649079.aspx). +> +>Using CopyProfile for Start menu customization in Windows 10 isn't supported. For more information [Customize the Default User Profile by Using CopyProfile](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile) From 74700422bc9d02a594ddcacb94f21e06ff34a6c1 Mon Sep 17 00:00:00 2001 From: Paul Fitzgerald Date: Thu, 14 Jun 2018 11:38:46 -0500 Subject: [PATCH 074/102] Update upgrade-readiness-deployment-script.md Updated URL to point to new location for referenced information. --- .../deployment/upgrade/upgrade-readiness-deployment-script.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md index c28763cabf..774f54ce73 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md @@ -229,7 +229,7 @@ The deployment script displays the following exit codes to let you know if it wa 32 - Appraiser version on the machine is outdated. - The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://technet.microsoft.com/en-us/itpro/windows/deploy/upgrade-readiness-get-started#deploy-the-compatibility-update-and-related-kbs) for Windows 7 SP1/Windows 8.1. + The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/en-us/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. 33 - **CompatTelRunner.exe** exited with an exit code From 4e484666e0081fa699d83a97ed82149fc7d2bd30 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Thu, 14 Jun 2018 20:21:21 +0000 Subject: [PATCH 075/102] Merged PR 9074: update Intune kiosk instructions for HoloLens --- devices/hololens/hololens-kiosk.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 745543c41c..9b54f8a335 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -93,7 +93,7 @@ You will [create an XML file](#ppkg-kiosk) to define the kiosk configuration to ## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) -For HoloLens devices that are managed by Microsoft Intune, you [create a device restriction profile](https://docs.microsoft.com/intune/device-profile-create) and configure the [Kiosk (Preview) settings](https://docs.microsoft.com/intune/device-restrictions-windows-holographic#kiosk-preview). +For HoloLens devices that are managed by Microsoft Intune, you [create a device profile](https://docs.microsoft.com/intune/device-profile-create) and configure the [Kiosk settings](https://docs.microsoft.com/intune/kiosk-settings). For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. @@ -213,8 +213,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ## More information -Watch how to configure a kiosk in Microsoft Intune. ->[!VIDEO https://www.microsoft.com/videoplayer/embed/ce9992ab-9fea-465d-b773-ee960b990c4a?autoplay=false] + Watch how to configure a kiosk in a provisioning package. >[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false] \ No newline at end of file From b16e9511dadc13693353b005cc91c44179f0c52d Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Thu, 14 Jun 2018 20:56:50 +0000 Subject: [PATCH 076/102] Updated inclusive-classroom-it-admin.md, fixing text issue --- education/get-started/inclusive-classroom-it-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index 63c0d3cb23..856e1c3a19 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -29,7 +29,7 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea | Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(N/A for Outlook PC)

|

X

(N/A for any OneNote apps or Outlook PC)

| | Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(N/A for any OneNote apps)

| | Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access)

|

X

(N/A for Word iOS)

|

X

(N/A for Word iOS)

|

X

(N/A for any OneNote apps or Word iOS)

| -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(ot includingN any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| | Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| | Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|
From eda252e46e8678735d766bd9d59dff4366b42805 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 14 Jun 2018 14:28:17 -0700 Subject: [PATCH 077/102] added new block list --- .../microsoft-recommended-block-rules.md | 549 +++++++++++++++++- ...control-with-intelligent-security-graph.md | 4 +- 2 files changed, 547 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index ae37d52989..0dbc282f16 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: jsuther1974 -ms.date: 06/08/2018 +ms.date: 06/14/2018 --- # Microsoft recommended block rules @@ -384,7 +384,278 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +