diff --git a/devices/surface-hub/images/wicd-screen02b.png b/devices/surface-hub/images/wicd-screen02b.png index 258ebfae82..6686186f8b 100644 Binary files a/devices/surface-hub/images/wicd-screen02b.png and b/devices/surface-hub/images/wicd-screen02b.png differ diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index 03268e3bb2..8c84d59605 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -36,14 +36,3 @@ Documents related to the Microsoft Surface Hub. - -  - -  - -  - - - - - diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md index 0872e5b054..ef5e99e41b 100644 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md @@ -54,7 +54,7 @@ A device account is an Exchange resource account that Surface Hub uses to displa After you've created your device account, there are a couple of ways to verify that it's setup correctly. - Run Surface Hub device account validation PowerShell scripts. For more information, see [Surface Hub device account scripts](https://gallery.technet.microsoft.com/scriptcenter/Surface-Hub-device-account-6db77696) in Script Center, or [PowerShell scripts for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) later in this guide. - Use the account with the [Lync Windows Store app](https://www.microsoft.com/en-us/store/p/lync/9wzdncrfhvhm). If Lync signs in successfully, then the device account will most likely work with Skype for Business on Surface Hub. - + ## Prepare for first-run program There are a few more item to consider before you start the [first-run program](first-run-program-surface-hub.md). diff --git a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md index 59e451d855..a4eb84f063 100644 --- a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md +++ b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md @@ -156,7 +156,7 @@ Depending on the app, you may or may not need to download a new app framework. ![icd tiles](images/wicd-screen-apps-02a.png) - Select the settings that are **Common to all Windows editions**, and click **Next**. + Select the settings that are **Common to all Windows desktop editions**, and click **Next**. ![icd tiles](images/wicd-screen02b.png) diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index b819adf9a0..3f1dad3d00 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -565,7 +565,7 @@ After you create the Windows Store for Business portal, configure it by using th Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. -**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. +**Note**  Your educational institution can now use a credit card to pay for apps in Windows Store for Business. You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users. diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 788c6dd819..c4ecb5351d 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -18,6 +18,8 @@ author: jdeckerMS Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. +[Download the Set up School PCs app from the Windows Store](https://www.microsoft.com/store/apps/9nblggh4ls40) + ![Run app, turn on PC, insert USB key](images/app1.jpg) ## What does this app do? diff --git a/mdop/agpm/choosing-which-version-of-agpm-to-install.md b/mdop/agpm/choosing-which-version-of-agpm-to-install.md index e047f05e63..e79ec15b6e 100644 --- a/mdop/agpm/choosing-which-version-of-agpm-to-install.md +++ b/mdop/agpm/choosing-which-version-of-agpm-to-install.md @@ -13,7 +13,7 @@ ms.prod: w10 # Choosing Which Version of AGPM to Install -Each release of Microsoft Advanced Group Policy Management (AGPM) supports specific versions of the Windows operating system. We strongly recommend that you run the AGPM Client and AGPM Server on the same line of operating systems, for example, Windows 8.1 with Windows Server 2012 R2, Windows 8 with Windows Server 2012, and so on. +Each release of Microsoft Advanced Group Policy Management (AGPM) supports specific versions of the Windows operating system. We strongly recommend that you run the AGPM Client and AGPM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. We recommend that you install the AGPM Server on the most recent version of the operating system in the domain. AGPM uses the Group Policy Management Console (GPMC) to back up and restore Group Policy Objects (GPOs). Because newer versions of the GPMC provide additional policy settings that are not available in earlier versions, you can manage more policy settings by using the most recent version of the operating system. @@ -45,8 +45,8 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and -

Windows 10

-

Windows 10

+

Windows Server 2016 or Windows 10

+

Windows Server 2016 or Windows 10

Supported

@@ -55,19 +55,19 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and

Supported

-

Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8

-

Windows Server 2012 or Windows 8

+

Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

+

Windows Server 2012 or Windows 8.1

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

Windows Server 2008 R2 or Windows 7

Windows Server 2008 R2 or Windows 7

-

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8

+

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

-

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

+

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

Windows Server 2008 or Windows Vista with SP1

@@ -77,7 +77,7 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and

Windows Server 2008 or Windows Vista with SP1

Windows Server 2008 or Windows Vista with SP1

-

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

+

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

@@ -113,29 +113,29 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP2, and

Supported

-

Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8

-

Windows Server 2012 or Windows 8

+

Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

+

Windows Server 2012 or Windows 8.1

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

Windows Server 2008 R2 or Windows 7

Windows Server 2008 R2 or Windows 7

-

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8

+

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

-

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

+

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

Windows Server 2008 or Windows Vista with SP1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Not supported

Windows Server 2008 or Windows Vista with SP1

Windows Server 2008 or Windows Vista with SP1

-

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

+

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

@@ -164,29 +164,29 @@ Table 2 lists the operating systems on which you can install AGPM 4.0 SP1, and t -

Windows Server 2012 or Windows 8

-

Windows Server 2012 or Windows 8

+

Windows Server 2012

+

Windows Server 2012

Supported

Windows Server 2008 R2 or Windows 7

Windows Server 2008 R2 or Windows 7

-

Supported, but cannot edit policy settings or preference items that exist only in Windows 8

+

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Windows Server 2008 or Windows Vista with SP1

-

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2, Windows 8, or Windows 7

+

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2, or Windows 7

Windows Server 2008 or Windows Vista with SP1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Supported

Windows Server 2008 or Windows Vista with SP1

Windows Server 2008 or Windows Vista with SP1

-

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2, Windows 8, or Windows 7

+

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2, or Windows 7

diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md index 7d17648258..cc29f75805 100644 --- a/mdop/agpm/index.md +++ b/mdop/agpm/index.md @@ -18,11 +18,11 @@ Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of th ## AGPM Version Information -[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. +[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. -[AGPM 4.0 SP2](agpm-40-sp2-navengl.md) supports Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. +[AGPM 4.0 SP2](agpm-40-sp2-navengl.md) supports Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. -[AGPM 4.0 SP1](agpm-40-sp1-navengl.md) supports Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. +[AGPM 4.0 SP1](agpm-40-sp1-navengl.md) supports Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. [AGPM 4](agpm-4-navengl.md) supports Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md index ee8e39c778..bdc3444ecd 100644 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md +++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md @@ -88,6 +88,10 @@ If a user who has the Editor role submits a request to deploy a GPO, and the use **Workaround:** None. +### Added mechanism to override AGPM default behavior of removing GPO permission changes + +As of HF02, AGPM has added a registry key to enable overriding the default AGPM GPO permission behavior. For more information, please see [Changes to Group Policy object permissions through AGPM are ignored](https://support.microsoft.com/kb/3174540) + ## Related topics diff --git a/mdop/agpm/whats-new-in-agpm-40-sp3.md b/mdop/agpm/whats-new-in-agpm-40-sp3.md index e598c1a4b8..a6dc4a4984 100644 --- a/mdop/agpm/whats-new-in-agpm-40-sp3.md +++ b/mdop/agpm/whats-new-in-agpm-40-sp3.md @@ -22,7 +22,7 @@ AGPM 4.0 SP3 supports the following features and functionality. ### Support for Windows 10 -AGPM 4.0 SP3 adds support for the Windows 10 operating systems. +AGPM 4.0 SP3 adds support for the Windows 10 and Windows Server 2016 operating systems. ### Support for PowerShell @@ -111,7 +111,7 @@ You can upgrade the AGPM Client or AGPM Server to AGPM 4.0 SP3 without being pr ## Supported configurations -AGPM 4.0 SP3 supports the configurations in the following table. Although AGPM supports mixed configurations, we strongly recommend that you run the AGPM Client and AGPM Server on the same operating system line—for example, Windows 10 only, Windows 8.1 with Windows Server 2012 R2, and so on. +AGPM 4.0 SP3 supports the configurations in the following table. Although AGPM supports mixed configurations, we strongly recommend that you run the AGPM Client and AGPM Server on the same operating system line—for example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. **AGPM 4.0 SP3 supported operating systems and policy settings** @@ -130,7 +130,7 @@ AGPM 4.0 SP3 supports the configurations in the following table. Although AGPM -

Windows 10

+

Windows Server 2016 or Windows 10

Windows 10

Supported

@@ -140,29 +140,29 @@ AGPM 4.0 SP3 supports the configurations in the following table. Although AGPM

Supported

-

Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8

-

Windows Server 2012 or Windows 8

+

Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

+

Windows Server 2012

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

Windows Server 2008 R2 or Windows 7

Windows Server 2008 R2 or Windows 7

-

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8

+

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

-

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

+

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

Windows Server 2008 or Windows Vista with SP1

-

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

+

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Not supported

Windows Server 2008 or Windows Vista with SP1

Windows Server 2008 or Windows Vista with SP1

-

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

+

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

@@ -190,7 +190,7 @@ The following table describes the behavior of AGPM 4.0 SP3 Client and Server in **Remote Server Administration Tools** -**Windows 10** +**Windows 10 or Windows Server 2016** If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md index 9c74ff17a6..bdb0ee8304 100644 --- a/mdop/appv-v5/app-v-51-supported-configurations.md +++ b/mdop/appv-v5/app-v-51-supported-configurations.md @@ -58,16 +58,21 @@ Microsoft provides support for the current service pack and, in some cases, the -

Microsoft Windows Server 2012 R2

+

Microsoft Windows Server 2016

64-bit

-

Microsoft Windows Server 2012

+

Microsoft Windows Server 2012 R2

64-bit

+

Microsoft Windows Server 2012

+

+

64-bit

+ +

Microsoft Windows Server 2008 R2

SP1

64-bit

@@ -147,16 +152,21 @@ The following table lists the operating systems that are supported for the App-V -

Microsoft Windows Server 2012 R2

+

Microsoft Windows Server 2016

64-bit

-

Microsoft Windows Server 2012

+

Microsoft Windows Server 2012 R2

64-bit

+

Microsoft Windows Server 2012

+

+

64-bit

+ +

Microsoft Windows Server 2008 R2

SP1

64-bit

@@ -195,16 +205,21 @@ The following table lists the operating systems that are supported for the App-V -

Microsoft Windows Server 2012 R2

+

Microsoft Windows Server 2016

64-bit

-

Microsoft Windows Server 2012

+

Microsoft Windows Server 2012 R2

64-bit

+

Microsoft Windows Server 2012

+

+

64-bit

+ +

Microsoft Windows Server 2008 R2

SP1

64-bit

@@ -267,6 +282,8 @@ The following table lists the SQL Server versions that are supported for the App The following table lists the operating systems that are supported for the App-V 5.1 client installation. +**Note:** With the Windows 10 Anniversary release (aka 1607 version), the App-V client is in-box and will block installation of any previous version of the App-V client + @@ -282,7 +299,7 @@ The following table lists the operating systems that are supported for the App-V - + @@ -292,11 +309,6 @@ The following table lists the operating systems that are supported for the App-V - - - - - @@ -344,16 +356,21 @@ The following table lists the operating systems that are supported for App-V 5.1 - + - + + + + + + @@ -393,32 +410,32 @@ The following table lists the operating systems that are supported for the App-V - + + + + + + - + - + - - - - - - + diff --git a/mdop/appv-v5/release-notes-for-app-v-51.md b/mdop/appv-v5/release-notes-for-app-v-51.md index 333b6f7931..f183670c1c 100644 --- a/mdop/appv-v5/release-notes-for-app-v-51.md +++ b/mdop/appv-v5/release-notes-for-app-v-51.md @@ -143,6 +143,44 @@ The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO **Workaround**: Use a different filename +## Intermittent "File Not Found" error when Mounting a Package + + +Occassionally when mounting a package, a "File Not Found" (0x80070002) error is generated. Typically, this occurs when a folder in an App-V package contains many files ( i.e. 20K or more). This can cause streaming to take longer than expected and to time out which generates the "File Not Found" error. + +**Workaround**: Starting with HF06, a new registry key has been introduced to enable extending this time-out period. + +

Microsoft Windows 10

Microsoft Windows 10 (pre-1607 version)

32-bit or 64-bit

32-bit or 64-bit

Microsoft Windows 8

32-bit or 64-bit

Windows 7

SP1

32-bit or 64-bit

Microsoft Windows Server 2012 R2

Microsoft Windows Server 2016

64-bit

Microsoft Windows Server 2012

Microsoft Windows Server 2012 R2

64-bit

Microsoft Windows Server 2012

64-bit

Microsoft Windows Server 2008 R2

SP1

64-bit

Microsoft Windows Server 2012 R2

Microsoft Windows Server 2016

64-bit

Microsoft Windows Server 2012 R2

64-bit

Microsoft Windows Server 2012

64-bit

Microsoft Windows Server 2008 R2

SP1

64-bit

Microsoft Windows 10

32-bit and 64-bit

Microsoft Windows 8.1

32-bit and 64-bit

Microsoft Windows 8

Microsoft Windows 8.1

32-bit and 64-bit
++++ + + + + + + + + + + + + + + + + + + + + + + +
PathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Streaming
SettingStreamResponseWaitTimeout
DataTypeDWORD
UnitsSeconds
Default5
+**Note**: this value is the default if the registry key is not defined or a value <=5 is specified. +
+ ## Got a suggestion for App-V? diff --git a/mdop/mbam-v25/about-mbam-25-sp1.md b/mdop/mbam-v25/about-mbam-25-sp1.md index 96df87e28a..c6886e1c65 100644 --- a/mdop/mbam-v25/about-mbam-25-sp1.md +++ b/mdop/mbam-v25/about-mbam-25-sp1.md @@ -88,7 +88,7 @@ For a list of all languages supported for client and server in MBAM 2.5 and MBAM ### Support for Windows 10 -MBAM 2.5 SP1 adds support for Windows 10, in addition to the same software that is supported in earlier versions of MBAM. +MBAM 2.5 SP1 adds support for Windows 10 and Windows Server 2016, in addition to the same software that is supported in earlier versions of MBAM. Windows 10 is supported in both MBAM 2.5 and MBAM 2.5 SP1. @@ -217,6 +217,7 @@ After installation, the service will now set the MBAM agent service to use delay The compliance calculation logic for "Locked Fixed Data" volumes has been changed to report the volumes as "Compliant," but with a Protector State and Encryption State of "Unknown" and with a Compliance Status Detail of "Volume is locked". Previously, locked volumes were reported as “Non-Compliant”, a Protector State of "Encrypted", an Encryption State of "Unknown", and a Compliance Status Detail of "An unknown error". + ## How to Get MDOP Technologies diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md index ae4aa4c63c..bae880c439 100644 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ b/mdop/mbam-v25/mbam-25-supported-configurations.md @@ -137,6 +137,8 @@ The following tables show the languages that are supported for the MBAM Client ( ### MBAM Server operating system requirements +We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. + The following table lists the operating systems that are supported for the MBAM Server installation. @@ -156,21 +158,27 @@ The following table lists the operating systems that are supported for the MBAM - - - + + + + + + + + + - - - + + + @@ -441,6 +449,8 @@ The following table lists the server processor, RAM, and disk space requirements ### Client operating system requirements +We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. + The following table lists the operating systems that are supported for MBAM Client installation. The same requirements apply to the Stand-alone and the Configuration Manager Integration topologies.

Windows Server 2008 R2

Standard, Enterprise, or Datacenter

SP1

Windows Server 2016

Standard or Datacenter

64-bit

Windows Server 2012 R2

Standard or Datacenter

64-bit

Windows Server 2012

Standard or Datacenter

64-bit

Windows Server 2012 R2

Standard or Datacenter

Windows Server 2008 R2

Standard, Enterprise, or Datacenter

SP1

64-bit
@@ -472,20 +482,14 @@ The following table lists the operating systems that are supported for MBAM Clie - - - - - - - + - + @@ -532,30 +536,24 @@ The following table lists the operating systems that are supported for MBAM Grou - - - - - - - + - + - + diff --git a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md index 7a1f4ce2ae..b52e59331b 100644 --- a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md +++ b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md @@ -118,6 +118,22 @@ If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an "Acc **Workaround:** If the "Access Denied" error message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. +### Support for Bitlocker XTS-AES encryption algorithm +Bitlocker added support for the XTS-AES encryption algorithm in Windows 10, version 1511. +As of HF02, MBAM now supports this Bitlocker option and is a client-only update. +However, there are two known limitations: + +* MBAM will correctly report compliance status but the **Cipher Strength** field in MBAM reports will be empty. +MBAM pre-built reports and compliance charts won’t break but the **Cipher Strength** column will be empty for XTS machines. +Also, if a customer has a custom report that uses this particular field, they may have to make adjustments to accommodate this update. + +* Customers must use the same encryption strength for OS and data volumes on the same machine. +If different encryption strengths are used, MBAM will report the machine as **non-compliant**. + +### Self-Service Portal automatically adds "-" on Key ID entry +As of HF02, the MBAM Self-Service Portal automatically adds the '-' on Key ID entry. +**Note:** The Server has to be reconfigured for the Javascript to take effect. + ## Got a suggestion for MBAM? diff --git a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md b/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md index da5caca883..75c4d4f4b9 100644 --- a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md +++ b/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md @@ -70,7 +70,7 @@ If upon installation the user or administrator choses to participate in the Cust ### Monitor Application Settings -The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It is runs at logon but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory. +The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It is run at logon but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory.

32-bit or 64-bit

Windows 8

Enterprise

32-bit or 64-bit

Windows 7

Enterprise or Ultimate

SP1

32-bit or 64-bit

Windows To Go

Windows 8, Windows 8.1, and Windows 10 Enterprise

Windows 8.1 and Windows 10 Enterprise

32-bit or 64-bit

32-bit or 64-bit

Windows 8

Enterprise, or Pro

32-bit or 64-bit

Windows 7

Enterprise, or Ultimate

SP1

32-bit or 64-bit

Windows Server 2012 R2

Standard or Datacenter

64-bit

Windows Server 2012

Standard or Datacenter

64-bit

Windows Server 2008 R2

Standard, Enterprise, or Datacenter

SP1

@@ -96,7 +96,7 @@ The **Monitor Application Settings** task is used to synchronize settings for Wi ### Sync Controller Application The **Sync Controller Application** task is used to start the Sync Controller to synchronize settings from the computer to the settings storage location. By default, the task runs every 30 minutes. At that time, local settings are synchronized to the settings storage location, and updated settings on the settings storage location are synchronized to the computer. The Sync Controller application runs the Microsoft.Uev.SyncController.exe, which is located in the UE-V Agent installation directory. - +**Note:** As per the **Monitor Application Settings** task, this task is run at logon but is delayed by 30 seconds to not affect the logon detrimentally.
@@ -305,7 +305,7 @@ The following additional information applies to UE-V scheduled tasks: - ll task sequence programs are located in the UE-V Agent installation folder, `%programFiles%\Microsoft User Experience Virtualization\Agent\[architecture]\`, by default. -- The Sync Controller Application Scheduled task is the crucial component when the UE-V SyncMethod is set to “SyncProvider” (UE-V 2 default configuration). This scheduled task keeps the SettingsSToragePath synchronized with the locally cached versions of the settings package files. If users complain that settings do not synchronize often enough, then you can reduce the scheduled task setting to as little as 1 minute.  You can also increase the 30 min default to a higher amount if necessary. +- The Sync Controller Application Scheduled task is the crucial component when the UE-V SyncMethod is set to “SyncProvider” (UE-V 2 default configuration). This scheduled task keeps the SettingsSToragePath synchronized with the locally cached versions of the settings package files. If users complain that settings do not synchronize often enough, then you can reduce the scheduled task setting to as little as 1 minute.  You can also increase the 30 min default to a higher amount if necessary. If users complain that settings do not synchronize fast enough on logon, then you can remove the delay setting for the scheduled task. (You can find the delay setting in the **Edit Trigger** dialogue box) - You do not need to disable the Template Auto Update scheduled task if you use another method to keep the clients’ templates in sync (i.e. Group Policy or Configuration Manager Baselines). Leaving the SettingsTemplateCatalog property value blank prevents UE-V from checking the settings catalog for custom templates. This scheduled task runs ApplySettingsCatalog.exe and will essentially return immediately. diff --git a/windows/deploy/TOC.md b/windows/deploy/TOC.md index 8d1cde1de9..893c06b098 100644 --- a/windows/deploy/TOC.md +++ b/windows/deploy/TOC.md @@ -9,6 +9,7 @@ #### [Prepare your environment](upgrade-analytics-prepare-your-environment.md) #### [Resolve application and driver issues](upgrade-analytics-resolve-issues.md) #### [Deploy Windows](upgrade-analytics-deploy-windows.md) +#### [Review site discovery](upgrade-analytics-review-site-discovery.md) ### [Troubleshoot Upgrade Analytics](troubleshoot-upgrade-analytics.md) ## [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md) ### [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) diff --git a/windows/deploy/change-history-for-deploy-windows-10.md b/windows/deploy/change-history-for-deploy-windows-10.md index fb3f4478ec..d09519574f 100644 --- a/windows/deploy/change-history-for-deploy-windows-10.md +++ b/windows/deploy/change-history-for-deploy-windows-10.md @@ -15,6 +15,9 @@ This topic lists new and updated topics in the [Deploy Windows 10](index.md) doc | New or changed topic | Description | |----------------------|-------------| | [Windows 10 Enterprise E3 in CSP Overview](windows-10-enterprise-e3-overview.md) | New | +| [Get started with Upgrade Analytics](upgrade-analytics-get-started.md) | Updated with prerequisites for site discovery | +| [Resolve application and driver issues](upgrade-analytics-resolve-issues.md) | Updated with app status info for Ready For Windows | +| [Review site discovery](upgrade-analytics-review-site-discovery.md) | New | ## RELEASE: Windows 10, version 1607 diff --git a/windows/deploy/images/upgrade-analytics-create-iedataoptin.png b/windows/deploy/images/upgrade-analytics-create-iedataoptin.png new file mode 100644 index 0000000000..60f5ccbc90 Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-create-iedataoptin.png differ diff --git a/windows/deploy/images/upgrade-analytics-most-active-sites.png b/windows/deploy/images/upgrade-analytics-most-active-sites.png new file mode 100644 index 0000000000..180c5ddced Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-most-active-sites.png differ diff --git a/windows/deploy/images/upgrade-analytics-namepub-rollup.PNG b/windows/deploy/images/upgrade-analytics-namepub-rollup.PNG new file mode 100644 index 0000000000..2041f14fd4 Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-namepub-rollup.PNG differ diff --git a/windows/deploy/images/upgrade-analytics-query-activex-name.png b/windows/deploy/images/upgrade-analytics-query-activex-name.png new file mode 100644 index 0000000000..5068e7d20e Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-query-activex-name.png differ diff --git a/windows/deploy/images/upgrade-analytics-ready-for-windows-status-guidance-precedence.PNG b/windows/deploy/images/upgrade-analytics-ready-for-windows-status-guidance-precedence.PNG new file mode 100644 index 0000000000..4d22cc9353 Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-ready-for-windows-status-guidance-precedence.PNG differ diff --git a/windows/deploy/images/upgrade-analytics-ready-for-windows-status.PNG b/windows/deploy/images/upgrade-analytics-ready-for-windows-status.PNG new file mode 100644 index 0000000000..c233db2340 Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-ready-for-windows-status.PNG differ diff --git a/windows/deploy/images/upgrade-analytics-site-activity-by-doc-mode.png b/windows/deploy/images/upgrade-analytics-site-activity-by-doc-mode.png new file mode 100644 index 0000000000..d1a46f1791 Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-site-activity-by-doc-mode.png differ diff --git a/windows/deploy/images/upgrade-analytics-site-domain-detail.png b/windows/deploy/images/upgrade-analytics-site-domain-detail.png new file mode 100644 index 0000000000..15a7ee20c4 Binary files /dev/null and b/windows/deploy/images/upgrade-analytics-site-domain-detail.png differ diff --git a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md index 637b6aaaca..546035f735 100644 --- a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md +++ b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md @@ -92,9 +92,10 @@ By default MDT stores the log files locally on the client. In order to capture a 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create and share the **E:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: + ``` syntax New-Item -Path E:\Logs -ItemType directory - New-SmbShare ?Name Logs$ ?Path E:\Logs -ChangeAccess EVERYONE + New-SmbShare -Name Logs$ -Path E:\Logs -ChangeAccess EVERYONE icacls E:\Logs /grant '"MDT_BA":(OI)(CI)(M)' ``` diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index d80f83c9d3..070a9e137c 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -95,10 +95,15 @@ The compatibility update KB scans your computers and enables application usage t | **Operating System** | **KBs** | |----------------------|-----------------------------------------------------------------------------| | Windows 8.1 | [KB 2976978](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978)
Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see
[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2976978 must be installed before you can download and install KB3150513. | -| Windows 7 SP1 | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664)
Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see
[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2976978 must be installed before you can download and install KB3150513. | +| Windows 7 SP1 | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664)
Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues may be encountered when the latest Windows operating system is installed.
For more information about this KB, see
[KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513)
Provides updated configuration and definitions for compatibility diagnostics performed on the system.
For more information about this KB, see
NOTE: KB2952664 must be installed before you can download and install KB3150513. | IMPORTANT: Restart user computers after you install the compatibility update KBs for the first time. +| **Site discovery** | **KB** | +|----------------------|-----------------------------------------------------------------------------| +| [Review site discovery](upgrade-analytics-review-site-discovery.md) | [KB 3170106](https://support.microsoft.com/en-us/kb/3170106)
Site discovery requires July 2016 security update for Internet Explorer. | + + ### Automate data collection To ensure that user computers are receiving the most up to date data from Microsoft, we recommend that you establish the following data sharing and analysis processes. @@ -151,9 +156,19 @@ To run the Upgrade Analytics deployment script: 3. For troubleshooting, set isVerboseLogging to $true to generate log information that can help with diagnosing issues. By default, isVerboseLogging is set to $false. Ensure the Diagnostics folder is installed in the same directory as the script to use this mode. -4. Notify users if they need to restart their computers. By default, this is set to off. +4. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: -5. After you finish editing the parameters in RunConfig.bat, run the script as an administrator. + > *IEOptInLevel = 0 Internet Explorer data collection is disabled* + > + > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* + > + > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* + > + > *IEOptInLevel = 3 Data collection is enabled for all sites* + +5. Notify users if they need to restart their computers. By default, this is set to off. + +6. After you finish editing the parameters in RunConfig.bat, run the script as an administrator. ## Seeing data from computers in Upgrade Analytics diff --git a/windows/deploy/upgrade-analytics-resolve-issues.md b/windows/deploy/upgrade-analytics-resolve-issues.md index 31bd19b03a..078290d9b3 100644 --- a/windows/deploy/upgrade-analytics-resolve-issues.md +++ b/windows/deploy/upgrade-analytics-resolve-issues.md @@ -22,6 +22,12 @@ Upgrade decisions include: The blades in the **Resolve issues** section are: +- Review applications with known issues +- Review applications with no known issues +- Review drivers with known issues + +As you review applications with known issues, you can also see ISV support of applications for [Ready for Windows](https://www.readyforwindows.com/). + ## Review applications with known issues Applications with issues known to Microsoft are listed, grouped by upgrade assessment into **Attention needed** or **Fix available**. @@ -67,14 +73,39 @@ For applications assessed as **Fix available**, review the table below for detai | Fix available | Yes | Blocking upgrade, but can be reinstalled after upgrading | The application is compatible with the new operating system, but won’t migrate. | Remove the application before upgrading and reinstall on the new operating system.
| | Fix available | Yes | Disk encryption blocking upgrade | The application’s encryption features are blocking the upgrade. | Disable the encryption feature before upgrading and enable it again after upgrading.
| +### ISV support for applications with Ready for Windows + +[Ready for Windows](https://www.readyforwindows.com/) lists software solutions that are supported and in use for Windows 10. This site leverages data about application adoption from commercial Windows 10 installations and helps IT managers upgrade to Windows 10 with confidence. For more information, see [Ready for Windows Frequently Asked Questions](https://developer.microsoft.com/windows/ready-for-windows/#/faq/). + +Click **Review Applications With Known Issues** to see the status of applications for Ready for Windows and corresponding guidance. For example: + +![Upgrade analytics Ready for Windows status](images/upgrade-analytics-ready-for-windows-status.png) + +If there are known issues with an application, the specific guidance for that known issue takes precedence over the Ready for Windows guidance. + +![Upgrade analytics Ready for Windows status guidance precedence](images/upgrade-analytics-ready-for-windows-status-guidance-precedence.png) + +If you query with RollupLevel="NamePublisher", each version of the application can have a different status for Ready for Windows. In this case, different values appear for Ready for Windows. + +![Name publisher rollup](images/upgrade-analytics-namepub-rollup.png) + +The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/en-us/windows/ready-for-windows#/faq/?scrollTo=faqStatuses) + +| Ready for Windows Status | Query rollup level | What this means | Guidance | +|-------------------|--------------------------|-----------------|----------| +|Supported version available | Granular | The software provider has declared support for one or more versions of this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10. | +| Highly adopted | Granular | This version of this application has been highly adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 100,000 commercial Windows 10 devices. | +| Adopted | Granular | This version of this application has been adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 10,000 commercial Windows 10 devices. | +| Insufficient Data | Granular | Too few commercial Windows 10 devices are sharing information about this version of this application for Microsoft to categorize its adoption. | N/A | +| Contact developer | Granular | There may be compatibility issues with this version of the application, so Microsoft recommends contacting the software provider to learn more. | Check [Ready for Windows](https://www.readyforwindows.com/) for additional information.| +|Supported version available | NamePublisher | The software provider has declared support for this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10.| +|Adoption status available | NamePublisher | A Ready for Windows adoption status is available for one or more versions of this application. Please check Ready for Windows to learn more. |Check [Ready for Windows](https://www.readyforwindows.com/) for adoption information for this application.| +| Unknown | Any | There is no Ready for Windows information available for this version of this application. Information may be available for other versions of the application at [Ready for Windows](https://www.readyforwindows.com/). | N/A | + ## Review applications with no known issues Applications with no issues known to Microsoft are listed, grouped by upgrade decision. - - ![Review applications with no known issues](images/upgrade-analytics-apps-no-known-issues.png) Applications with no known issues that are installed on 2% or less of your total computer inventory \[number of computers application is installed on/total number of computers in your inventory\] are automatically marked **Ready to upgrade** and included in the applications reviewed count. Applications with no known issues that are installed on more than 2% of your total computer inventory are automatically marked **Not reviewed**. @@ -95,10 +126,6 @@ To change an application's upgrade decision: Drivers that won’t migrate to the new operating system are listed, grouped by availability. - - ![Review drivers with known issues](images/upgrade-analytics-drivers-known.png) Availability categories are explained in the table below. diff --git a/windows/deploy/upgrade-analytics-review-site-discovery.md b/windows/deploy/upgrade-analytics-review-site-discovery.md new file mode 100644 index 0000000000..33b5bdac0e --- /dev/null +++ b/windows/deploy/upgrade-analytics-review-site-discovery.md @@ -0,0 +1,68 @@ +--- +title: Review site discovery +description: Explains how to review internet web site discovery with Upgrade Analytics. +ms.prod: w10 +author: Justinha +--- + +# Review site discovery + +This section of the Upgrade Analytics workflow provides an inventory of web sites that are being used by client computers that run Internet Explorer on Windows 8.1 and Windows 7 in your environment. This inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. Data from Microsoft Edge is not collected. + +> Note: Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. In addition, the data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. + +## Install prerequisite security update for Internet Explorer + +Ensure the following prerequisites are met before using site discovery: + +1. Install the latest Internet Explorer 11 Cumulative Update. This update provides the capability for site discovery and is available in the [July 2016 cumulative update (KB3170106)](https://support.microsoft.com/kb/3170106) and later. +2. Install the update for customer experience and diagnostic telemetery ([KB3080149](https://support.microsoft.com/kb/3080149)). +3. Enable Internet Explorer data collection, which is disabled by default. The best way to enable it is to modify the [Upgrade Analytics deployment script](upgrade-analytics-get-started.md#run-the-upgrade-analytics-deployment-script) to allow Internet Explorer data collection before you run it. + + If necessary, you can also enable it by creating the following registry entry. + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection + + Entry name: IEDataOptIn + + Data type: DWORD + + Values: + + > *IEOptInLevel = 0 Internet Explorer data collection is disabled* + > + > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* + > + > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* + > + > *IEOptInLevel = 3 Data collection is enabled for all sites* + + For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://msdn.microsoft.com/library/ms537183.aspx). + + ![Create the IEDataOptIn registry key](images/upgrade-analytics-create-iedataoptin.png) + +## Review most active sites + +This blade indicates the most visited sites by computers in your environment. Review this list to determine which web applications and sites are used most frequently. The number of visits is based on the total number of views, and not by the number of unique devices accessing a page. + +For each site, the fully qualified domain name will be listed. You can sort the data by domain name or by URL. + +![Most active sites](Images/upgrade-analytics-most-active-sites.png) + +Click the name of any site in the list to drill down into more details about the visits, including the time of each visit and the computer name. + +![Site domain detail](images/upgrade-analytics-site-domain-detail.png) + +## Review document modes in use + +This blade provides information about which document modes are used in the sites that are visited in your environment. Document modes are used to provide compatibility with older versions of Internet Explorer. Sites that use older technologies may require additional testing and are less likely to be compatible with Microsoft Edge. Counts are based on total page views and not the number of unique devices. For more information about document modes, see [Deprecated document modes](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/deprecated-document-modes). + +![Site activity by document mode](images/upgrade-analytics-site-activity-by-doc-mode.png) + +## Run browser-related queries + +You can run predefined queries to capture more info, such as sites that have Enterprise Mode enabled, or the number of unique computers that have visited a site. For example, this query returns the most used ActiveX controls. You can modify and save the predefined queries. + +![](images/upgrade-analytics-query-activex-name.png) + + diff --git a/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md b/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md index 0f14199f76..4045eb3913 100644 --- a/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md +++ b/windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md @@ -23,4 +23,6 @@ The Upgrade Analytics workflow gives you compatibility and usage information abo 3. [Identifying computers that are upgrade ready](upgrade-analytics-deploy-windows.md) +4. [Review site discovery](upgrade-analytics-review-site-discovery.md) + diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 6dc8ea8b8c..db02131f0c 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -20,7 +20,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the networking table to clarify details around Enterprise Cloud Resources and Enterprise Proxy Servers. | |[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |Updated the networking table to clarify details around Enterprise Cloud Resources and Enterprise Proxy Servers. | | [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) | Clarified how convenience PIN works in Windows 10, version 1607, on domain-joined PCs | -| [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) | Corrected certreq ezxample and added a new Windows PowerShell example for creating a self-signed certficate | +| [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) | Corrected certreq example and added a new Windows PowerShell example for creating a self-signed certificate | ## August 2016 |New or changed topic | Description | diff --git a/windows/keep-secure/remote-credential-guard.md b/windows/keep-secure/remote-credential-guard.md index 575cb5f7f2..2a813caee1 100644 --- a/windows/keep-secure/remote-credential-guard.md +++ b/windows/keep-secure/remote-credential-guard.md @@ -35,7 +35,6 @@ The Remote Desktop client and server must meet the following requirements in ord - They must be running at least Windows 10, version 1607 or Windows Server 2016. - The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Remote Credential Guard. - ## Enable Remote Credential Guard You must enable Remote Credential Guard on the target device by using the registry. @@ -60,12 +59,13 @@ You can use Remote Credential Guard on the client device by setting a Group Poli 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Credentials Delegation**. 2. Double-click **Restrict delegation of credentials to remote servers**. -3. In the **Use the following restricted mode** box: - - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Remote Credential Guard, choose **Require Remote Credential Guard**. In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used. +3. Under **Use the following restricted mode**: + - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Remote Credential Guard, choose **Prefer Remote Credential Guard**. In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used. > **Note:** Neither Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. - - If you want to allow Remote Credential Guard, choose **Prefer Remote Credential Guard**. + - If you want to require Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [Hardware and software requirements](#hardware-and-software-requirements) listed earlier in this topic. + 4. Click **OK**. ![Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 4d3345f8a1..7a77dece05 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -20,6 +20,7 @@ localizationpriority: high - Windows 10 Pro - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) + >For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service that enables enterprise customers to detect, investigate, and respond to advanced threats on their networks. diff --git a/windows/manage/lock-down-windows-10-to-specific-apps.md b/windows/manage/lock-down-windows-10-to-specific-apps.md index a585ae2a4f..8ab992a6f0 100644 --- a/windows/manage/lock-down-windows-10-to-specific-apps.md +++ b/windows/manage/lock-down-windows-10-to-specific-apps.md @@ -18,6 +18,8 @@ localizationpriority: high - Windows 10 +>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](../keep-secure/applocker-overview.md). AppLocker rules specify which apps are allowed to run on the device. diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 83ea150608..42d9d21bc2 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -270,11 +270,11 @@ Fonts that are included in Windows but that are not stored on the local device c If you're running Windows 10, version 1607 or Windows Server 2016, disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**. +If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. + > [!NOTE] > After you apply this policy, you must restart the device for it to take effect. -If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. - ### 6. Insider Preview builds diff --git a/windows/manage/mandatory-user-profile.md b/windows/manage/mandatory-user-profile.md index 5a19dddc3e..698093e9a1 100644 --- a/windows/manage/mandatory-user-profile.md +++ b/windows/manage/mandatory-user-profile.md @@ -18,7 +18,7 @@ author: jdeckerMS > [!NOTE] > When a mandatory profile is applied to a PC running Windows 10, version 1511, some features such as Universal Windows Platform (UWP) apps, the Start menu, Cortana, and Search, will not work correctly. This will be fixed in a future update. -A mandatory user profile is a roaming user profile that has been pre-configured by an administrators to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. +A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. diff --git a/windows/manage/stop-employees-from-using-the-windows-store.md b/windows/manage/stop-employees-from-using-the-windows-store.md index c95b8cddad..8f2d26753c 100644 --- a/windows/manage/stop-employees-from-using-the-windows-store.md +++ b/windows/manage/stop-employees-from-using-the-windows-store.md @@ -18,7 +18,9 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -IT Pros can configure access to Windows Store for client computers in their organization. For some organizations, business policies require blocking access to Windows Store. +>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + +IT pros can configure access to Windows Store for client computers in their organization. For some organizations, business policies require blocking access to Windows Store. ## Options to configure access to Windows Store diff --git a/windows/manage/waas-wufb-intune.md b/windows/manage/waas-wufb-intune.md index 91e628629f..b22418aedb 100644 --- a/windows/manage/waas-wufb-intune.md +++ b/windows/manage/waas-wufb-intune.md @@ -146,7 +146,7 @@ In this example, you use three security groups from Table 1 in [Build deployment 8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 14 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. 8. In **Setting name**, type **Defer feature updates for 14 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatePeriodInDays**. +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. 11. In the **Value** box, type **14**, and then click **OK**. ![Settings for this policy](images/waas-wufb-intune-step11a.png) @@ -186,7 +186,7 @@ You have now configured the **Ring 2 Pilot Business Users** deployment ring to e 8. In **Setting name**, type **Defer feature updates for 0 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatePeriodInDays**. +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. 11. In the **Value** box, type **0**, and then click **OK**. @@ -228,7 +228,7 @@ You have now configured the **Ring 3 Broad IT** deployment ring to receive CBB f 8. In **Setting name**, type **Defer quality updates for 7 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatePeriodInDays**. +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesPeriodInDays**. 11. In the **Value** box, type **7**, and then click **OK**. @@ -236,7 +236,7 @@ You have now configured the **Ring 3 Broad IT** deployment ring to receive CBB f 8. In **Setting name**, type **Defer feature updates for 30 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatePeriodInDays**. +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. 11. In the **Value** box, type **30**, and then click **OK**. diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 4dcad74254..b676817d41 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -197,7 +197,7 @@ Event ID 6416 has been added to track when an external device is detected throug The following sections describe the new and changed functionality in the TPM for Windows 10: - [Device health attestation](#bkmk-dha) - [Microsoft Passport](microsoft-passport.md) support -- [Device Guard](device-guard-overview.md) support +- [Device Guard](../keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) support - [Credential Guard](../keep-secure/credential-guard.md) support ### Device health attestation