diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 270e548b0f..1eda8a197e 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -717,12 +717,12 @@ }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", "redirect_document_id": true }, { @@ -732,7 +732,12 @@ }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", "redirect_document_id": true }, { @@ -822,7 +827,12 @@ }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", "redirect_document_id": true }, { @@ -847,7 +857,7 @@ }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", "redirect_document_id": true }, { @@ -1438,7 +1448,7 @@ }, { "source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { @@ -1814,7 +1824,7 @@ { "source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", @@ -2409,7 +2419,7 @@ { "source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/device-security/security-policy-settings/debug-programs.md", @@ -3143,832 +3153,832 @@ }, { "source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-account-lockout.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-application-generated.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-application-generated", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-application-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-audit-policy-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-audit-policy-change", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-authorization-policy-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-authorization-policy-change", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-certification-services.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-certification-services", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-computer-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-detailed-file-share.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-detailed-file-share", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-directory-service-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-directory-service-replication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-distribution-group-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-distribution-group-management", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-dpapi-activity.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-file-share.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-file-share", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-file-system.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-connection", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-group-membership.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-handle-manipulation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-handle-manipulation", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-ipsec-driver.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-extended-mode", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-quick-mode", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-kernel-object.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-logoff.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-logoff", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-network-policy-server.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-account-management-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-account-management-events", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-object-access-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-object-access-events", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-privilege-use-events", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-other-system-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-pnp-activity.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-pnp-activity", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-process-creation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-process-termination.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-process-termination", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-registry.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-removable-storage.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-removable-storage", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-rpc-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sam.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sam", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-security-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-state-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-state-change", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-security-system-extension.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sensitive-privilege-use", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-special-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-system-integrity.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-system-integrity", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/audit-user-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-device-claims.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-device-claims", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-account-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-account-management", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-logon-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-logon-events", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/basic-audit-object-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-policy-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-policy-change", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-process-tracking.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-process-tracking", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/basic-audit-system-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-security-audit-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-security-audit-policies", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-1100.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1102.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1102", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-1104.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1105.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1105", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-1108.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4608.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4608", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4610.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4611.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4611", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4612.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4614.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4614", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4615.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4616.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4616", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4618.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4621.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4621", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4622.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4624.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4624", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4625.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4626.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4626", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4627.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4634.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4634", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4647.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4648.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4648", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4649.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4656.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4656", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4657.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4658.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4658", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4660.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4661.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4661", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4662.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4663.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4663", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4664.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4671.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4672.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4672", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4673.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4674.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4674", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4675.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4688.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4688", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4689.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4690.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4690", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4691.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4692.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4692", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4693.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4694.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4694", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4695.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4696.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4696", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4697.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4698.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4698", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4699.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4700.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4700", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4701.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4702.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4702", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4703.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4704.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4704", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4705.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4706.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4706", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4707.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4713.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4713", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4714.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4715.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4715", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4716.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4717.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4717", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4718.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4719.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4719", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4720.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4722.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4722", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4723.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4724.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4724", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4725.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4726.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4726", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4731.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4732.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4732", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4733.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4734.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4734", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4735.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4738.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4738", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4739.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4740.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4740", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4741.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4742.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4742", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4743.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4749.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4749", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4750.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4751.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4751", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4752.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4753.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4753", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4764.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4765.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4765", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4766.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4767.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4767", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4768.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4769.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4769", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4770.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4771.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4771", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4772.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4773.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4773", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4774.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4775.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4775", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4776.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4777.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4777", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4778.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4779.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4779", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4780.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4781.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4781", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4782.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4793.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4793", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4794.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4798.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4798", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4799.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4800.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4800", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4801.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4802.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4802", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4803.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4816.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4816", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4817.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4818.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4818", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4819.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4826.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4826", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4864.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4865.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4865", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4866.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4867.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4867", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4902.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4904.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4904", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4905.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4906.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4906", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4907.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4908.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4908", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4909.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4910.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4910", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4911.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4912.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4912", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4913.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4928.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4928", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4929.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4930.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4930", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4931.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4932.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4932", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4933.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4934.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4934", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4935.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4936.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4936", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4937.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4944.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4944", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4945.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4946.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4946", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4947.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4948.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4948", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4949.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4950.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4950", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4951.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4952.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4952", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4953.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4954.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4954", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4956.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4957.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4957", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4958.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4964.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4964", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-4985.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5024.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5024", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5025.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5027.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5027", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5028.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5029.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5029", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5030.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5031.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5031", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5032.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5033.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5033", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5034.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5035.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5035", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5037.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5038.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5038", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5039.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5051.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5051", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5056.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5057.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5057", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5058.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5059.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5059", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5060.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5061.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5061", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5062.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5063.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5063", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5064.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5065.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5065", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5066.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5067.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5067", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5068.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5069.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5069", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5070.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5136.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5136", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5137.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5138.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5138", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5139.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5140.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5140", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5141.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5142.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5142", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5143.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5144.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5144", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5145.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5148.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5148", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5149.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5150.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5150", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5151.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5153.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5154.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5154", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5155.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5156.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5156", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5157.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5158.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5158", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5159.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5168.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5168", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5376.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5377.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5377", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5378.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5447.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5447", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5632.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5633.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5633", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5712.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5888.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5888", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-5889.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5890.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5890", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6144.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6145.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6145", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6281.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6400.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6400", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6401.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6402.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6402", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6403.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6404.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6404", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6405.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6406.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6406", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6407.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6408.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6408", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6409.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6410.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6410", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6416.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6419.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6419", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6420.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6421.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6421", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6422.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6423.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6423", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/event-6424.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/file-system-global-object-access-auditing", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-claim-types.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-claim-types", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/other-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/security-auditing-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/security-auditing-overview", "redirect_document_id": true }, { "source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/view-the-security-event-log.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/view-the-security-event-log", "redirect_document_id": true }, { @@ -5843,7 +5853,7 @@ }, { "source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", -"redirect_url": "/devices/surface/surface-device-compatibility-with-windows-10-ltsc", +"redirect_url": "https://docs.microsoft.com/surface/surface-device-compatibility-with-windows-10-ltsc", "redirect_document_id": true }, { @@ -5858,17 +5868,17 @@ }, { "source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", -"redirect_url": "/education/windows/switch-to-pro-education", +"redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", "redirect_document_id": false }, { "source_path": "education/windows/switch-to-pro-education.md", -"redirect_url": "/education/windows/change-to-pro-education", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", +"redirect_document_id": false }, { "source_path": "education/windows/swithc-to-pro-de.md", - "redirect_url": "/education/windows/switch-to-pro-education", + "redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", "redirect_document_id": false }, { @@ -5933,22 +5943,22 @@ }, { "source_path": "devices/surface/surface-diagnostic-toolkit.md", -"redirect_url": "/surface/index", +"redirect_url": "https://docs.microsoft.com/surface/index", "redirect_document_id": true }, { "source_path": "devices/surface/manage-surface-dock-firmware-updates.md", -"redirect_url": "devices/surface/update", +"redirect_url": "https://docs.microsoft.com/surface/indexdevices/surface/update", "redirect_document_id": true }, { "source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", -"redirect_url": "/surface-hub/finishing-your-surface-hub-meeting", +"redirect_url": "https://docs.microsoft.com/surface-hub/finishing-your-surface-hub-meeting", "redirect_document_id": true }, { "source_path": "devices/hololens/hololens-microsoft-layout-app.md", -"redirect_url": "/hololens/hololens-microsoft-dynamics-365-layout-app", +"redirect_url": "https://docs.microsoft.com/hololens/hololens-microsoft-dynamics-365-layout-app", "redirect_document_id": true }, { @@ -5968,12 +5978,12 @@ }, { "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", -"redirect_url": "/surface-hub/provisioning-packages-for-surface-hub", +"redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", "redirect_document_id": true }, { "source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", -"redirect_url": "/surface-hub/admin-group-management-for-surface-hub", +"redirect_url": "https://docs.microsoft.com/surface-hub/admin-group-management-for-surface-hub", "redirect_document_id": true }, { @@ -5983,7 +5993,7 @@ }, { "source_path": "devices/surface-hub/intro-to-surface-hub.md", -"redirect_url": "/surface-hub/index", +"redirect_url": "https://docs.microsoft.com/surface-hub/index", "redirect_document_id": false }, { @@ -6438,7 +6448,7 @@ }, { "source_path": "windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md", -"redirect_url": "https://technet.microsoft.com/library/jj635854.aspx", +"redirect_url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj635854(v=ws.11)", "redirect_document_id": true }, { @@ -6508,12 +6518,12 @@ }, { "source_path": "windows/manage/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business#manage-apps-in-your-inventory", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", "redirect_document_id": false }, { @@ -6573,12 +6583,12 @@ }, { "source_path": "windows/manage/manage-inventory-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", "redirect_document_id": true }, { @@ -6963,7 +6973,7 @@ }, { "source_path": "windows/plan/windows-10-guidance-for-education-environments.md", -"redirect_url": "/edu/windows/index", +"redirect_url": "https://docs.microsoft.com/education/windows", "redirect_document_id": true }, { @@ -7008,7 +7018,7 @@ }, { "source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", -"redirect_url": "/microsoft-edge/deploy/enterprise-guidance-using-microsoft-edge-and-ie11", +"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", "redirect_document_id": true }, { @@ -7053,12 +7063,12 @@ }, { "source_path": "windows/whats-new/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/windows-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", "redirect_document_id": true }, { "source_path": "store-for-business/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/microsoft-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/microsoft-store-for-business-overview", "redirect_document_id": true }, { @@ -7864,7 +7874,7 @@ { "source_path": "windows/deploy/troubleshoot-upgrade-readiness.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/deploy/understanding-migration-xml-files.md", @@ -8014,7 +8024,7 @@ { "source_path": "windows/deploy/use-upgrade-readiness-to-manage-windows-upgrades.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/deploy/use-vamt-in-windows-powershell.md", @@ -12948,17 +12958,17 @@ }, { "source_path": "windows/manage/acquire-apps-windows-store-for-business.md", -"redirect_url": "/microsoft-store/acquire-apps-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/acquire-apps-windows-store-for-business.md", -"redirect_url": "/microsoft-store/acquire-apps-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/add-unsigned-app-to-code-integrity-policy.md", -"redirect_url": "/microsoft-store/add-unsigned-app-to-code-integrity-policy", +"redirect_url": "https://docs.microsoft.com/microsoft-store/add-unsigned-app-to-code-integrity-policy", "redirect_document_id": true }, { @@ -12968,17 +12978,17 @@ }, { "source_path": "windows/manage/app-inventory-management-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/apps-in-windows-store-for-business.md", -"redirect_url": "/microsoft-store/apps-in-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/apps-in-windows-store-for-business.md", -"redirect_url": "/microsoft-store/apps-in-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-microsoft-store-for-business", "redirect_document_id": true }, { @@ -13483,17 +13493,17 @@ }, { "source_path": "windows/manage/assign-apps-to-employees.md", -"redirect_url": "/microsoft-store/assign-apps-to-employees", +"redirect_url": "https://docs.microsoft.com/microsoft-store/assign-apps-to-employees", "redirect_document_id": true }, { "source_path": "windows/manage/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "/microsoft-store/configure-mdm-provider-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "/microsoft-store/configure-mdm-provider-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business", "redirect_document_id": true }, { @@ -13503,37 +13513,37 @@ }, { "source_path": "windows/manage/device-guard-signing-portal.md", -"redirect_url": "/microsoft-store/device-guard-signing-portal", +"redirect_url": "https://docs.microsoft.com/microsoft-store/device-guard-signing-portal", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-apps-from-your-private-store.md", -"redirect_url": "/microsoft-store/distribute-apps-from-your-private-store", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-apps-with-management-tool.md", -"redirect_url": "/microsoft-store/distribute-apps-with-management-tool", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-with-management-tool", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-offline-apps.md", -"redirect_url": "/microsoft-store/distribute-offline-apps", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-offline-apps", "redirect_document_id": true }, { "source_path": "windows/manage/find-and-acquire-apps-overview.md", -"redirect_url": "/microsoft-store/find-and-acquire-apps-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/find-and-acquire-apps-overview", "redirect_document_id": true }, { @@ -13548,7 +13558,7 @@ }, { "source_path": "windows/manage/manage-access-to-private-store.md", -"redirect_url": "/microsoft-store/manage-access-to-private-store", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-access-to-private-store", "redirect_document_id": true }, { @@ -13558,7 +13568,7 @@ }, { "source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/manage-apps-microsoft-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-apps-microsoft-store-for-business-overview", "redirect_document_id": true }, { @@ -13568,37 +13578,37 @@ }, { "source_path": "windows/manage/manage-orders-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-orders-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/manage-orders-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-orders-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/manage-private-store-settings.md", -"redirect_url": "/microsoft-store/manage-private-store-settings", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-private-store-settings", "redirect_document_id": true }, { "source_path": "windows/manage/manage-settings-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-settings-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/manage-settings-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-settings-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-users-and-groups-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-users-and-groups-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-microsoft-store-for-business", "redirect_document_id": true }, { @@ -13618,12 +13628,12 @@ }, { "source_path": "windows/manage/prerequisites-windows-store-for-business.md", -"redirect_url": "/microsoft-store/prerequisites-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/prerequisites-windows-store-for-business.md", -"redirect_url": "/microsoft-store/prerequisites-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business", "redirect_document_id": true }, { @@ -13633,58 +13643,58 @@ }, { "source_path": "windows/manage/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "/microsoft-store/roles-and-permissions-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "/microsoft-store/roles-and-permissions-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/settings-reference-windows-store-for-business.md", -"redirect_url": "/microsoft-store/settings-reference-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/settings-reference-windows-store-for-business.md", -"redirect_url": "/microsoft-store/settings-reference-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/sign-code-integrity-policy-with-device-guard-signing.md", -"redirect_url": "/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", "redirect_document_id": true }, { "source_path": "windows/manage/sign-up-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/sign-up-windows-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business-overview", "redirect_document_id": true }, { "source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business-overview", "redirect_document_id": true }, { "source_path": "windows/manage/sign-up-windows-store-for-business.md", -"redirect_url": "/microsoft-store/sign-up-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/sign-up-windows-store-for-business.md", -"redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business", +"redirect_document_id": false }, { "source_path": "windows/manage/troubleshoot-windows-store-for-business.md", -"redirect_url": "/microsoft-store/troubleshoot-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/troubleshoot-windows-store-for-business.md", -"redirect_url": "/microsoft-store/troubleshoot-microsoft-store-for-business", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-microsoft-store-for-business", +"redirect_document_id": false }, { "source_path": "windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md", @@ -13823,13 +13833,13 @@ }, { "source_path": "windows/manage/update-windows-store-for-business-account-settings.md", -"redirect_url": "/microsoft-store/update-windows-store-for-business-account-settings", +"redirect_url": "https://docs.microsoft.com/microsoft-store/update-windows-store-for-business-account-settings", "redirect_document_id": true }, { "source_path": "store-for-business/update-windows-store-for-business-account-settings.md", -"redirect_url": "/microsoft-store/update-microsoft-store-for-business-account-settings", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings", +"redirect_document_id": false }, { "source_path": "windows/manage/windows-10-mobile-and-mdm.md", @@ -13843,12 +13853,12 @@ }, { "source_path": "windows/manage/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/windows-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", "redirect_document_id": true }, { "source_path": "windows/manage/working-with-line-of-business-apps.md", -"redirect_url": "/microsoft-store/working-with-line-of-business-apps", +"redirect_url": "https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps", "redirect_document_id": true }, { @@ -14094,7 +14104,7 @@ { "source_path": "windows/update/waas-manage-updates-wufb.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/update/waas-mobile-updates.md", @@ -14308,7 +14318,7 @@ }, { "source_path": "windows/manage/windows-store-for-business.md", -"redirect_url": "/microsoft-store/index", +"redirect_url": "https://docs.microsoft.com/microsoft-store/index", "redirect_document_id": true }, { @@ -14433,7 +14443,7 @@ }, { "source_path": "education/windows/windows-automatic-redeployment.md", -"redirect_url": "/education/windows/autopilot-reset", +"redirect_url": "https://docs.microsoft.com/education/windows/autopilot-reset", "redirect_document_id": true }, { @@ -14793,7 +14803,7 @@ }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/index.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/index", "redirect_document_id": true }, { @@ -14969,7 +14979,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-analytics", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md", @@ -15054,7 +15064,7 @@ { "source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path":"windows/security/threat-protection/windows-defender-atp/use-apis.md", @@ -15064,6 +15074,9 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user", +"redirect_document_id": true +}, +{ "source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1709-removed-features", "redirect_document_id": true @@ -15081,7 +15094,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md", @@ -15091,7 +15104,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-indicators", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", @@ -15185,7 +15198,7 @@ }, { "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", -"redirect_url": "/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", +"redirect_url": "https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", "redirect_document_id": true }, { @@ -15238,10 +15251,20 @@ "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education", "redirect_document_id": false }, +{ + "source_path": "devices/surface/surface-dock-updater.md", + "redirect_url": "/surface/surface-dock-firmware-update", + "redirect_document_id": true + }, { "source_path": "education/get-started/use-school-data-sync.md", "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync", "redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", +"redirect_document_id": true } ] } diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md index b58f9167db..5cd357aea7 100644 --- a/browsers/edge/about-microsoft-edge.md +++ b/browsers/edge/about-microsoft-edge.md @@ -19,6 +19,9 @@ ms.date: 10/02/2018 # Microsoft Edge system and language requirements >Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index e02b6ba010..2529a88fea 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -16,6 +16,8 @@ ms.author: dansimp # Change history for Microsoft Edge Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). #### [2018](#tab/2018/) ## October 2018 diff --git a/browsers/edge/microsoft-edge-faq.md b/browsers/edge/microsoft-edge-faq.md index 4e520db1e3..632905e3cb 100644 --- a/browsers/edge/microsoft-edge-faq.md +++ b/browsers/edge/microsoft-edge-faq.md @@ -17,6 +17,9 @@ ms.localizationpriority: medium >Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + ## How can I get the next major version of Microsoft Edge, based on Chromium? In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index b8899ba2b6..130038d3a2 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -17,7 +17,10 @@ ms.date: 10/29/2018 # Deploy Microsoft Edge kiosk mode >Applies to: Microsoft Edge on Windows 10, version 1809 ->Professional, Enterprise, and Education +>Professional, Enterprise, and Education + +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge in kiosk mode. diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml index 5007545950..4c11b5c85e 100644 --- a/browsers/internet-explorer/internet-explorer.yml +++ b/browsers/internet-explorer/internet-explorer.yml @@ -41,7 +41,7 @@ sections: - type: markdown text: " Find the resources you need to successfully deploy Internet Explorer 11 in your organization.
- +

**Customize Internet Explorer 11**
The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after deployment.
Download IEAK 11
IEAK 11 user's guide
Frequently asked questions about IEAK 11
Customization and distribution guidelines
**Install Internet Explorer 11**
Explore the different options for installation.
Through Automatic Updates (recommended)
As part of an operating system deployment
Over the network
With System Center 2012 R2 Configuration Manager
With Windows Server Update Services (WSUS)
With Microsoft Intune
With third-party tools

**Customize Internet Explorer 11**
The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after deployment.
Download IEAK 11
IEAK 11 user's guide
Frequently asked questions about IEAK 11
Customization and distribution guidelines
**Install Internet Explorer 11**
Explore the different options for installation.
Through Automatic Updates (recommended)
As part of an operating system deployment
Over the network
With System Center 2012 R2 Configuration Manager
With Windows Server Update Services (WSUS)
With Microsoft Intune
With third-party tools
" - title: Manage @@ -49,7 +49,7 @@ sections: - type: markdown text: " Find everything you need to manage Internet Explorer 11 effectively in your organization. Get information on Group Policy, blocked out-of-date ActiveX controls, scripts, and more.
- +

**Enforce settings with Group Policy**
Learn how to use Group Policy to enforce settings on the computers in your organization.
Group Policy for beginners
New Group Policy settings for IE11
Administrative templates for IE11
**Standardize with Group Policy preferences**
Group Policy preferences simplify deployment and standardize configurations, but unlike Group Policy, they can later be changed by users.
Group Policy preferences for IE11
Configure Group Policy preferences

**Blocked out-of-date ActiveX controls**
Find out more about the out-of-date ActiveX control blocking security feature available in Internet Explorer.
Blocked out-of-date ActiveX controls
Out-of-date ActiveX control blocking
Update to block out-of-date ActiveX controls in Internet Explorer
**Scripts for IT professionals**
Find scripts to help you save time and automate common tasks.
Batch loop: Check is a process running, if yes, wait in loop
Script to join user to AD with automatic Local user Profile Migration
Find-IE Citrix receiver Version
See all scripts

**Enforce settings with Group Policy**
Learn how to use Group Policy to enforce settings on the computers in your organization.
Group Policy for beginners
New Group Policy settings for IE11
Administrative templates for IE11
**Standardize with Group Policy preferences**
Group Policy preferences simplify deployment and standardize configurations, but unlike Group Policy, they can later be changed by users.
Group Policy preferences for IE11
Configure Group Policy preferences

**Blocked out-of-date ActiveX controls**
Find out more about the out-of-date ActiveX control blocking security feature available in Internet Explorer.
Blocked out-of-date ActiveX controls
Out-of-date ActiveX control blocking
Update to block out-of-date ActiveX controls in Internet Explorer
**Scripts for IT professionals**
Find scripts to help you save time and automate common tasks.
Batch loop: Check is a process running, if yes, wait in loop
Script to join user to AD with automatic Local user Profile Migration
Find-IE Citrix receiver Version
See all scripts
" - title: Support diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index 00620b9f7c..8196982606 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -611,7 +611,7 @@ function ExitIfError($strMsg) ## Check dependencies ## try { - Import-Module LyncOnlineConnector + Import-Module SkypeOnlineConnector Import-Module MSOnline } catch @@ -1100,7 +1100,7 @@ if ($fSfbIsOnline -or $fExIsOnline) if ($fSfbIsOnline) { try { - Import-Module LyncOnlineConnector + Import-Module SkypeOnlineConnector } catch { @@ -1513,7 +1513,7 @@ else if ($online) { try { - Import-Module LyncOnlineConnector + Import-Module SkypeOnlineConnector } catch { diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index a834e039ee..ff76987746 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -30,7 +30,7 @@ If you prefer to use a graphical user interface, you can create a device account ### Create the account in the admin center -1. Sign in to Office 365 by visiting http://portal.office.com +1. Sign in to Office 365 by visiting https://portal.office.com 2. Provide the admin credentials for your Office 365 tenant. This will take you to your Microsoft 365 Admin Center. ![Microsoft 365 admin center.](images/setupdeviceaccto365-02.png) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 96577828d5..5b45fdcb93 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -46,7 +46,9 @@ You can enroll your Surface Hubs using bulk, manual, or automatic enrollment. Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. -For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment). +First step is to set up Automatic MDM enrollment. See [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment). + +Then, when devices are setup during First-run, pick the option to join to Azure Active Directory, see [Set up admins for this device page](https://docs.microsoft.com/surface-hub/first-run-program-surface-hub#set-up-admins-for-this-device-page) ## Manage Surface Hub settings with MDM diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md index 1b73cf6980..03b3f8d7ef 100644 --- a/devices/surface-hub/surface-hub-2s-account.md +++ b/devices/surface-hub/surface-hub-2s-account.md @@ -35,7 +35,7 @@ Create the account using the Microsoft 365 admin center or by using PowerShell. ![Leave remaining settings unchanged in the default state](images/sh2-account3.png) -3. Set the password for the device account. Ensure that you **do not** select the option **Make this user change their password when they first sign in.** +3. Set the password for the device account. To set the password, choose **Users** and then select **Active Users**. Now search for the newly created user to set the password. Ensure that you **do not** select the option **Make this user change their password when they first sign in.** ![Set the password for the device account](images/sh2-account4.png) diff --git a/devices/surface-hub/surface-hub-2s-connect.md b/devices/surface-hub/surface-hub-2s-connect.md index 3726eae176..7cc48d747d 100644 --- a/devices/surface-hub/surface-hub-2s-connect.md +++ b/devices/surface-hub/surface-hub-2s-connect.md @@ -131,4 +131,4 @@ You can connect the following accessories to Surface Hub-2S using Bluetooth: - Speakers > [!NOTE] -> After you connect a Bluetooth headset or speaker, you might need to change the default microphone and speaker settings. For more information, see [**Local management for Surface Hub settings**](https://docs.microsoft.com/en-us/surface-hub/local-management-surface-hub-settings). +> After you connect a Bluetooth headset or speaker, you might need to change the default microphone and speaker settings. For more information, see [**Local management for Surface Hub settings**](https://docs.microsoft.com/surface-hub/local-management-surface-hub-settings). diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index 1ec2e35f1b..3a335c36cb 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -10,7 +10,6 @@ ### [Surface Laptop 2 Tech specs](https://www.microsoft.com/surface/devices/surface-laptop/tech-specs) ## Plan -### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) ### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md) ### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md) ### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) @@ -21,6 +20,7 @@ ## Deploy ### [Deploy Surface devices](deploy.md) +### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) ### [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) ### [Windows 10 ARM-based PC app compatibility](surface-pro-arm-app-performance.md) ### [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) diff --git a/devices/surface/get-started.md b/devices/surface/get-started.md index 7e007abc4e..407e12ba82 100644 --- a/devices/surface/get-started.md +++ b/devices/surface/get-started.md @@ -28,8 +28,7 @@ Harness the power of Surface, Windows, and Office connected together through the

Plan

-

Autopilot and Surface devices

-

Surface and SCCM considerations

+

Surface and SCCM considerations

Deploy Surface app with Microsoft Store for Business

@@ -47,9 +46,9 @@ Harness the power of Surface, Windows, and Office connected together through the

Deploy

+

Autopilot and Surface devices

+

Deploying, managing, and servicing Surface Pro X

Deploy the latest firmware and drivers

-

Customize start-up experience

-

Surface SKU reference

diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index a2d74d331c..29b42615a0 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -36,6 +36,7 @@ Compatible Surface devices include: * Surface Pro (Model 1796) * Surface Laptop * Surface Studio +* Surface Studio 2 * Surface Book * Surface Pro 4 * Surface 3 LTE diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md index 98d0555db4..0457612090 100644 --- a/devices/surface/surface-pro-arm-app-management.md +++ b/devices/surface/surface-pro-arm-app-management.md @@ -3,7 +3,7 @@ title: Deploying, managing, and servicing Surface Pro X description: This article provides an overview of key considerations for deploying, managing, and servicing Surface Pro X. ms.prod: w10 ms.mktglfcycl: manage -ms.localizationpriority: medium +ms.localizationpriority: high ms.sitesec: library author: dansimp ms.author: dansimp diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md index 42d9e3a2c5..fbbaec21e8 100644 --- a/devices/surface/surface-wireless-connect.md +++ b/devices/surface/surface-wireless-connect.md @@ -27,7 +27,7 @@ This document assumes you have successfully deployed a wireless network that sup ## Configuring access points for optimal roaming capabilities -If you’re managing a wireless network that’s typically accessed by many different types of client devices, it’s recommended to enable specific protocols on access points (APs) in your WLAN, as described in [Fast Roaming with 802.11k, 802.11v, and 802.11r](https://docs.microsoft.com/en-us/windows-hardware/drivers/network/fast-roaming-with-802-11k--802-11v--and-802-11r). Surface devices can take advantage of the following wireless protocols: +If you’re managing a wireless network that’s typically accessed by many different types of client devices, it’s recommended to enable specific protocols on access points (APs) in your WLAN, as described in [Fast Roaming with 802.11k, 802.11v, and 802.11r](https://docs.microsoft.com/windows-hardware/drivers/network/fast-roaming-with-802-11k--802-11v--and-802-11r). Surface devices can take advantage of the following wireless protocols: - **802.11r.** “**Fast BSS Transition”** accelerates connecting to new wireless access points by reducing the number of frames required before your device can access another AP as you move around with your device. - **802.11k.** **“Neighbor Reports”** provides devices with information on current conditions at neighboring access points. It can help your Surface device choose the best AP using criteria other than signal strength such as AP utilization. diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md index aee66dbdb7..9c6fafb2d6 100644 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ b/devices/surface/windows-autopilot-and-surface-devices.md @@ -19,7 +19,7 @@ Windows Autopilot is a cloud-based deployment technology available in Windows 10 With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution. -In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library. For information about licensing and other prerequisites, see [Windows Autopilot requirements](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements). +In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library. For information about licensing and other prerequisites, see [Windows Autopilot requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements). ### Windows version considerations Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update) or later. These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. All new Surface devices ship with Windows 10 Version 1709 or above. diff --git a/mdop/appv-v5/TOC.md b/mdop/appv-v5/TOC.md index db147e8a98..6f2058280a 100644 --- a/mdop/appv-v5/TOC.md +++ b/mdop/appv-v5/TOC.md @@ -62,7 +62,7 @@ ##### [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md) ##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console 5.1](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md) ##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console 5.1](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md) -##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console 5.1](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md) +##### [Configure Applications and Default Virtual Application Extensions in Management Console](configure-applications-and-default-virtual-application-extensions-in-management-console.md) #### [Managing Connection Groups 5.1](managing-connection-groups51.md) ##### [About the Connection Group Virtual Environment 5.1](about-the-connection-group-virtual-environment51.md) ##### [About the Connection Group File 5.1](about-the-connection-group-file51.md) diff --git a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md index d0bcc87058..50214f1054 100644 --- a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md +++ b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md @@ -10,7 +10,7 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/16/2016 +ms.date: 10/03/2016 --- @@ -54,7 +54,7 @@ The most common tasks that you can perform with the App-V 5.0 Management console - [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md) -- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md) +- [Configure Applications and Default Virtual Application Extensions in Management Console](configure-applications-and-default-virtual-application-extensions-in-management-console.md) The main elements of the App-V 5.0 Management Console are: diff --git a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md index 9431f2a486..26ff07008e 100644 --- a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md +++ b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md @@ -54,7 +54,7 @@ The most common tasks that you can perform with the App-V 5.1 Management console - [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md) -- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md) +- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md) The main elements of the App-V 5.1 Management Console are: diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md b/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md similarity index 89% rename from mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md rename to mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md index 808352b5e4..c96dff8cbe 100644 --- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md +++ b/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md @@ -1,5 +1,5 @@ --- -title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console +title: Configure Applications and Default Virtual Application Extensions in Management Console description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console author: dansimp ms.assetid: 1e1941d3-fb22-4077-8ec6-7a0cb80335d8 @@ -10,14 +10,12 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 03/16/2017 +ms.date: 09/26/2019 --- +# Configure Applications and Default Virtual Application Extensions in Management Console -# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - - -Use the following procedure to view and configure default package extensions. +Use the following procedure to *view* and *configure* default package extensions. **To view and configure default virtual application extensions** diff --git a/mdop/dart-v8/TOC.md b/mdop/dart-v8/TOC.md index e6b9c3194c..b2c907364b 100644 --- a/mdop/dart-v8/TOC.md +++ b/mdop/dart-v8/TOC.md @@ -39,5 +39,5 @@ #### [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md) ## [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) ## [Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md) -### [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md) +### [Use Windows Defender Offline (WDO) for malware protection, not DaRT ](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md) diff --git a/mdop/dart-v8/index.md b/mdop/dart-v8/index.md index bcee6aaf64..d51694005d 100644 --- a/mdop/dart-v8/index.md +++ b/mdop/dart-v8/index.md @@ -7,7 +7,7 @@ ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 10/03/2017 --- @@ -38,7 +38,7 @@ DaRT 8.0 is an important part of the Microsoft Desktop Optimization Pack (MDOP), [Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md) -[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md) +[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md) [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) @@ -54,7 +54,7 @@ View updated product information and known issues for DaRT 8.0. Learn about the latest MDOP information and resources. [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). +Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com), or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).   diff --git a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md index 0733bc4bef..ec7b892511 100644 --- a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md +++ b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md @@ -10,7 +10,7 @@ ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library ms.prod: w10 -ms.date: 06/16/2016 +ms.date: 10/03/2016 --- @@ -48,7 +48,7 @@ For more information about **Crash Analyzer**, see [Diagnosing System Failures w ### Defender **Important**   -Environments with the DaRT Defender deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. For more information, see [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md). +Environments with the DaRT Defender deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. For more information, see [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md). diff --git a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md b/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md index da7f794b85..6fefab5848 100644 --- a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md +++ b/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md @@ -10,7 +10,7 @@ ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library ms.prod: w10 -ms.date: 06/16/2016 +ms.date: 10/03/2016 --- @@ -22,7 +22,7 @@ This section includes technical reference information about Microsoft Diagnostic ## Technical reference -- [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md) +[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md) Environments with the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. diff --git a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md b/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md similarity index 87% rename from mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md rename to mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md index fe85973fc6..6265073d6b 100644 --- a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md +++ b/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md @@ -1,5 +1,5 @@ --- -title: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection +title: Use Windows Defender Offline (WDO) for malware protection not DaRT description: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection author: dansimp ms.assetid: 59678283-4b44-4d02-ba8f-0e7315efd5d1 @@ -10,12 +10,12 @@ ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library ms.prod: w10 -ms.date: 08/30/2016 +ms.date: 09/25/2019 --- - -# Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection - + +# Use Windows Defender Offline (WDO) for malware protection, not DaRT. Environments that have the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. This applies to all currently supported versions of DaRT. These versions include DaRT 7, DaRT 8, and DaRT 8.1, together with their service packs. diff --git a/mdop/mbam-v25/deploy-mbam.md b/mdop/mbam-v25/deploy-mbam.md index 8d746d6841..cc24ad5c89 100644 --- a/mdop/mbam-v25/deploy-mbam.md +++ b/mdop/mbam-v25/deploy-mbam.md @@ -553,7 +553,7 @@ Now that you have finished the deployment activity, you should review the follow * If a certificate is used, the certificate must have both FQDN and NetBIOS names entered into the **Subject Alternative Name** field for all IIS servers in the load balance group and also as the Friendly Name (for example: bitlocker.corp.net). Otherwise, the certificate will be reported as not trusted by the browser when you browse load-balanced addresses. -For more information, see [IIS Network Load Balancing](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-high-availability#a-href-idbkmk-load-balanceaiis-network-load-balancing) and [Registering SPNs for the application pool account](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites#registering-spns-for-the-application-pool-account). +For more information, see [IIS Network Load Balancing](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-high-availability#a-href-idbkmk-load-balanceaiis-network-load-balancing) and [Registering SPNs for the application pool account](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites#registering-spns-for-the-application-pool-account). ### How to configure a certificate @@ -589,6 +589,6 @@ For more information, see [MBAM Setup fails with “Register SPN Deferred” err You'll see multiple OS options in the MBAM root node for GPO after you update the ADMX templates to their latest versions. For example, Windows 7, Windows 8.1, and Windows 10, version 1511 and later versions. For more information about how to update the ADMX templates, see the following articles: -* [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates) -* [Planning for MBAM 2.5 Group Policy Requirements](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-group-policy-requirements) +* [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates) +* [Planning for MBAM 2.5 Group Policy Requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-group-policy-requirements) * [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531) diff --git a/store-for-business/sign-up-microsoft-store-for-business-overview.md b/store-for-business/sign-up-microsoft-store-for-business-overview.md index 0159084242..68548aeb8b 100644 --- a/store-for-business/sign-up-microsoft-store-for-business-overview.md +++ b/store-for-business/sign-up-microsoft-store-for-business-overview.md @@ -12,7 +12,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 10/13/2017 +ms.date: 10/03/2019 --- # Sign up and get started @@ -29,10 +29,10 @@ IT admins can sign up for Microsoft Store for Business and Education, and get st | Topic | Description | | ----- | ----------- | | [Microsoft Store for Business and Education overview](windows-store-for-business-overview.md) | Learn about Microsoft Store for Business. | -| [Prerequisites for Microsoft Store for Business and Education](prerequisites-windows-store-for-business.md) | There are a few prerequisites for using Microsoft Store for Business and Education. | -| [Sign up for Microsoft Store for Business or Microsoft Store for Education](sign-up-windows-store-for-business.md) | Before you sign up for Store for Business and Education, at a minimum, you'll need an Azure Active Directory (AD) or Office 365 account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD or Office 365 account and directory as part of the sign up process. | -| [Roles and permissions in Microsoft Store for Business and Education](roles-and-permissions-windows-store-for-business.md) | The first person to sign in to Microsoft Store for Business and Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees. | -| [Settings reference: Microsoft Store for Business and Education](settings-reference-windows-store-for-business.md) | Microsoft Store for Business and Education has a group of settings that admins use to manage the store. | +| [Prerequisites for Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) | There are a few prerequisites for using Microsoft Store for Business and Education.](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) | +| [Sign up for Microsoft Store for Business or Microsoft Store for Education](https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business) | Before you sign up for Store for Business and Education, at a minimum, you'll need an Azure Active Directory (AD) or Office 365 account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD or Office 365 account and directory as part of the sign up process. | +| [Roles and permissions in Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business)| The first person to sign in to Microsoft Store for Business and Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees. | +| [Settings reference: Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business) | Microsoft Store for Business and Education has a group of settings that admins use to manage the store. | diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md index 894ed853fc..6601e238eb 100644 --- a/windows/client-management/generate-kernel-or-complete-crash-dump.md +++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md @@ -103,9 +103,9 @@ To do this, follow these steps: ### Use the keyboard -[Forcing a System Crash from the Keyboard](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard) +[Forcing a System Crash from the Keyboard](https://docs.microsoft.com/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard) ### Use Debugger -[Forcing a System Crash from the Debugger](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-debugger) +[Forcing a System Crash from the Debugger](https://docs.microsoft.com/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-debugger) diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 7dc2e66ea2..052d05d6a0 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -11,7 +11,7 @@ ms.date: 05/21/2019 # ApplicationControl CSP -Windows Defender Application Control (WDAC) policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike [AppLocker CSP](applocker-csp.md), ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. +Windows Defender Application Control (WDAC) policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike [AppLocker CSP](applocker-csp.md), ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. Existing WDAC policies deployed using AppLocker CSP’s CodeIntegrity node can now be deployed using ApplicationControl CSP URI. Although WDAC policy deployment via AppLocker CSP will continue to be supported, all new feature work will be done in ApplicationControl CSP only. ApplicationControl CSP was added in Windows 10, version 1903. @@ -117,7 +117,7 @@ Value type is char. To use ApplicationControl CSP, you must: - Know a generated policy’s GUID, which can be found in the policy xml as ``. - Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned. -- Create a policy node (a Base64-encoded blob of the binary policy representation) using the [certutil -encode](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_encode) command line tool. +- Create a policy node (a Base64-encoded blob of the binary policy representation) using the [certutil -encode](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_encode) command line tool. Here is a sample certutil invocation: ``` diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 6b3a628eb7..d0a24d5007 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -979,7 +979,7 @@ The data type is string. Default string is as follows: -https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype. +https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype. Add **SDDL** ``` xml diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index ec63a3f303..c4591652a5 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -2030,7 +2030,7 @@ The content below are the latest versions of the DDF files: - SDDL String controlling access to the channel. Default: https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype + SDDL String controlling access to the channel. Default: https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index 548a34e79e..cafddacdb6 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -32,7 +32,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( ## Enable a policy > [!NOTE] -> See [Understanding ADMX-backed policies](https://docs.microsoft.com/en-us/windows/client-management/mdm/understanding-admx-backed-policies). +> See [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies). 1. Find the policy from the list [ADMX-backed policies](policy-configuration-service-provider.md#admx-backed-policies). You need the following information listed in the policy description. - GP English name diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 7459beee1f..30f5348c1a 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -22,13 +22,13 @@ Requirements: - The enterprise has configured a mobile device management (MDM) service - The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) -- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. +- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. > [!TIP] > For additional information, see the following topics: > - [How to configure automatic registration of Windows domain-joined devices with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) -> - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan) -> - [Azure Active Directory integration with MDM](https://docs.microsoft.com/en-us/windows/client-management/mdm/azure-active-directory-integration-with-mdm) +> - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) +> - [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm) The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered. @@ -48,7 +48,7 @@ The following steps demonstrate required settings using the Intune service: ![Intune license verification](images/auto-enrollment-intune-license-verification.png) -2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/en-us/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). +2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). Also verify that the **MAM user scope** is set to **None**. Otherwise, it will have precedence over the MDM scope that will lead to issues. ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) @@ -76,7 +76,7 @@ Also verify that the **MAM user scope** is set to **None**. Otherwise, it will h ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) -7. Verify that the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is properly deployed to all devices which should be enrolled into Intune. +7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. 8. Verify that the device is not enrolled with the old Intune client used on the Intune Silverlight Portal (this is the Intune portal used before the Azure portal). @@ -106,19 +106,27 @@ Requirements: ![MDM policies](images/autoenrollment-mdm-policies.png) -4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in version 1709 of Windows 10). For ADMX files from version 1903 and later, select **User Credential** (support for Device Credential is coming) as the Selected Credential Type to use. User Credential enrolls Windows 10 1709 and later, once an Intune licensed user logs into the device. Device Credential will enroll the device and then assign a user later, once support for this is available. +4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** (support for Device Credential is coming) as the Selected Credential Type to use. User Credential enrolls Windows 10, version 1709 and later once an Intune licensed user logs into the device. Device Credential will enroll the device and then assign a user later, once support for this is available. ![MDM autoenrollment policy](images/autoenrollment-policy.png) 5. Click **Enable**, then click **OK**. - A task is created and scheduled to run every 5 minutes for the duration of 1 day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." +> [!NOTE] +> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have the Windows 10, version 1903 feature update installed. +The default behavior for older releases is to revert to **User Credential**. - To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). +When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." - If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. +To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). - ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) +If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. + +![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + +> [!Tip] +> You can avoid this behavior by using Conditional Access Policies in Azure AD. +Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview). 6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. @@ -154,6 +162,7 @@ Requirements: - Ensure that PCs belong to same computer group. > [!IMPORTANT] + > If you do not see the policy, it may be because you don’t have the ADMX installed for Windows 10, version 1903 or version 1809. To fix the issue, follow these steps: > 1. Download: > 1903 -->[Administrative Templates for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495) or @@ -163,6 +172,7 @@ Requirements: > 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3**, or > 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2** > 4. Copy the policy definitions folder to **C:\Windows\SYSVOL\domain\Policies** or **%windir%\sysvol\domain_name\policies\PolicyDefinitions** if a Group Policy Central Store exists. + > This procedure will work for any future version as well. 1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. diff --git a/windows/client-management/mdm/images/autoenrollment-mdm-policies.png b/windows/client-management/mdm/images/autoenrollment-mdm-policies.png index 29cb6d14da..6833b4ac8b 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-mdm-policies.png and b/windows/client-management/mdm/images/autoenrollment-mdm-policies.png differ diff --git a/windows/client-management/mdm/images/autoenrollment-policy.png b/windows/client-management/mdm/images/autoenrollment-policy.png index f9bb009514..61421babee 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-policy.png and b/windows/client-management/mdm/images/autoenrollment-policy.png differ diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md index 5378bd3600..e852fe64e8 100644 --- a/windows/client-management/mdm/oma-dm-protocol-support.md +++ b/windows/client-management/mdm/oma-dm-protocol-support.md @@ -349,7 +349,7 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo ## SyncML response status codes -When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification. +When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification. | Status code | Description | |-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index b7b64e75fe..32d3ae4dc0 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -271,7 +271,7 @@ Scope is permanent. Supported operation is Get. **SecurityKey/UseSecurityKeyForSignin** (only for ./Device/Vendor/MSFT) -Added in Windows 10, version 1903. Enables users to sign-in to their device with a [FIDO2 security key](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys) that is compatible with Microsoft’s implementation. +Added in Windows 10, version 1903. Enables users to sign-in to their device with a [FIDO2 security key](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys) that is compatible with Microsoft’s implementation. Scope is dynamic. Supported operations are Add, Get, Replace, and Delete. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index bc9f5c1927..330b5e5bf5 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -132,9 +132,9 @@ Here is an example: ``` - - - + + + diff --git a/windows/client-management/system-failure-recovery-options.md b/windows/client-management/system-failure-recovery-options.md index 04dcbbafc9..28f7edaab0 100644 --- a/windows/client-management/system-failure-recovery-options.md +++ b/windows/client-management/system-failure-recovery-options.md @@ -202,4 +202,4 @@ To view system failure and recovery settings for your local computer, type **wmi ## References -[Varieties of Kernel-Mode Dump Files](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files) +[Varieties of Kernel-Mode Dump Files](https://docs.microsoft.com/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files) diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index 70bda5a8f5..308677bcef 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -46,8 +46,8 @@ To understand the underlying cause of Windows startup problems, it's important t These articles will walk you through the resources you need to troubleshoot Windows startup issues: -- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/en-us/windows/client-management/advanced-troubleshooting-boot-problems) +- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems) -- [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-stop-errors) +- [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) -- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-windows-freeze) +- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index cca3071cad..e1100ede91 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -12,6 +12,7 @@ ms.localizationpriority: medium author: dansimp ms.author: dansimp ms.topic: article +ms.date: 10/03/2019 --- # Change history for Configure Windows 10 @@ -118,14 +119,14 @@ The following topics were moved into the [Privacy](/windows/privacy/index) libra New or changed topic | Description --- | --- -[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | Updated endpoints. +[Configure Windows diagnostic data in your organizationspro](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | Updated endpoints. [Configure cellular settings for tablets and PCs](provisioning-apn.md) | Added instructions for confirming that the settings were applied. ## March 2018 New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the March update. +[Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) | Added events and fields that were added in the March update. Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education** and reorganized the information to make the choices clearer. @@ -133,7 +134,7 @@ Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the February update. +[Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) | Added events and fields that were added in the February update. [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added steps for configuring a kiosk in Microsoft Intune. [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Updated the instructions for applying a customized Start layout using Microsoft Intune. @@ -144,9 +145,9 @@ New or changed topic | Description [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added videos demonstrating how to use Microsoft Intune and how to use provisioning packages to configure multi-app kiosks. [ConnectivityProfiles](wcd/wcd-connectivityprofiles.md) | Added settings for VPN **Native** and **Third Party** profile types. [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) | Clarified that the TopMFUApps elements in layoutmodification.xml are not supported in Windows 10, version 1709. -| [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) | New topic | +| [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overviewd) | New topic | [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Added section for removing default apps from the taskbar. -[Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them. +[Manage Windows 10 connection endpoints](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them. [Configure Windows Spotlight on the lock screen](windows-spotlight.md) | Added section for resolution of custom lock screen images. [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Added section for automatic sign-in after restart on unmanaged devices. @@ -155,7 +156,7 @@ New or changed topic | Description New or changed topic | Description --- | --- -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)| Added events that were added in November. | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)| Added events that were added in November. | [Create a provisioning package with multivariant settings](provisioning-packages/provisioning-multivariant.md) | Add support for desktop to [Conditions](provisioning-packages/provisioning-multivariant.md#conditions) table. ## October 2017 @@ -170,16 +171,16 @@ The topics in this library have been updated for Windows 10, version 1709 (also - [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) - [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) -- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) -- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) - +- [Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) +- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) + ## September 2017 |New or changed topic | Description| |--- | ---| -|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)|New conceptual info about Windows 10 and the upcoming GDPR-compliance requirements.| -|[Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added that Windows Spotlight can be managed by the Experience/AllowWindowsSpotlight MDM policy. | +|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper)|New conceptual info about Windows 10 and the upcoming GDPR-compliance requirements.| +|[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Added that Windows Spotlight can be managed by the Experience/AllowWindowsSpotlight MDM policy. | @@ -194,12 +195,12 @@ The topics in this library have been updated for Windows 10, version 1709 (also | New or changed topic | Description | | --- | --- | -|[Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md)|Updated categories and included diagnostic data.| +|[Windows 10, version 1703 Diagnostic Data](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)|Updated categories and included diagnostic data.| |[Add image for secondary tiles](start-secondary-tiles.md) | Added XML example for Edge secondary tiles and **ImportEdgeAssets** | |[Customize and export Start layout](customize-and-export-start-layout.md) | Added explanation for tile behavior when the app is not installed | |[Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access | -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)|Updated several Appraiser events and added Census.Speech. | -|[Manage connections from Windows operating system components to Microsoft-services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Updated Date & Time and Windows spotlight sections. | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)|Updated several Appraiser events and added Census.Speech. | +|[Manage connections from Windows operating system components to Microsoft-services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Updated Date & Time and Windows spotlight sections. | ## June 2017 @@ -214,7 +215,7 @@ The topics in this library have been updated for Windows 10, version 1709 (also | New or changed topic | Description | | --- | --- | | [Configure cellular settings for tablets and PCs](provisioning-apn.md) | New | -| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added MDM policies for privacy settings | +| [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Added MDM policies for privacy settings | ## April 2017 @@ -232,5 +233,4 @@ The topics in this library have been updated for Windows 10, version 1703 (also - [Use the Lockdown Designer app to create a Lockdown XML file](mobile-devices/mobile-lockdown-designer.md) - [Add image for secondary tiles](start-secondary-tiles.md) - [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md) -- [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -- [Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md) +- [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) \ No newline at end of file diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index af5a26163b..a02ff6ba03 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -77,7 +77,7 @@ In addition to the settings in the table, you may want to set up **automatic log 2. Go to - **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\WindowsNT\CurrentVersion\Winlogon** + **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon** 3. Set the values for the following keys. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index b88f801492..f42631e973 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -411,7 +411,7 @@ Group accounts are specified using ``. Nested groups are not supporte #### [Preview] Global Profile -Global profile is added in curernt Windows 10 Prerelease. There are times when IT Admin wants to everyone who logging into a specific devices are assigned access users, even there is no dedicated profile for that user, or there are times that Assigned Access could not identify a profile for the user and a fallback profile is wished to use. Global Profile is designed for these scenarios. +Global profile is added in current Windows 10 Prerelease. There are times when IT Admin wants to everyone who logging into a specific devices are assigned access users, even there is no dedicated profile for that user, or there are times that Assigned Access could not identify a profile for the user and a fallback profile is wished to use. Global Profile is designed for these scenarios. Usage is demonstrated below, by using the new xml namespace and specify GlobalProfile from that namespace. When GlobalProfile is configured, a non-admin account logs in, if this user does not have designated profile in Assigned Access, or Assigned Access fails to determine a profile for current user, global profile will be applied for the user. @@ -466,7 +466,9 @@ Note: - + + + ``` diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index cbcb56ed0d..b69a8c78e1 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -41,6 +41,9 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ### MSI installer +> [!NOTE] +> You can find more information about command-line options for Msiexec.exe [here](https://docs.microsoft.com/windows/win32/msi/command-line-options). + - **Command line arguments**: Optionally, append additional command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE - **Continue installations after failure**: Optionally, specify if you want to continue installing additional apps if this app fails to install diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md index 944c8ac8aa..f0259285ae 100644 --- a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md +++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md @@ -33,8 +33,8 @@ Figure 1. The machines used in this topic. Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content. -**Note**   -Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target. +> [!NOTE] +> Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target. ### Linked deployment shares in MDT @@ -49,6 +49,7 @@ DFS-R is not only very fast and reliable, but it also offers central monitoring, Setting up DFS-R for replication is a quick and straightforward process. You prepare the deployment servers and then create a replication group. To complete the setup, you configure some replication settings. ### Prepare MDT01 for replication + 1. On MDT01, using Server Manager, click **Add roles and features**. 2. On the **Select installation type** page, select **Role-based or feature-based installation**. 3. On the **Select destination server** page, select **MDT01.contoso.com** and click **Next**. @@ -88,23 +89,30 @@ Setting up DFS-R for replication is a quick and straightforward process. You pre When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT, that can be done by using the DefaultGateway property. 1. On MDT01, using Notepad, navigate to the **E:\\MDTProduction\\Control** folder and modify the Boostrap.ini file to look like this: - ``` + ```ini [Settings] Priority=DefaultGateway, Default + [DefaultGateway] 192.168.1.1=NewYork 192.168.2.1=Stockholm + [NewYork] DeployRoot=\\MDT01\MDTProduction$ + [Stockholm] DeployRoot=\\MDT02\MDTProduction$ + [Default] UserDomain=CONTOSO UserID=MDT_BA SkipBDDWelcome=YES ``` - **Note** - The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). + + > [!NOTE] + > The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. + > + > To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). 2. Save the Bootstrap.ini file. 3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. @@ -121,9 +129,12 @@ When you have multiple deployment servers sharing the same content, you need to Figure 5. Replacing the updated boot image in WDS. 6. Browse and select the **E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings. + ## Replicate the content Once the MDT01 and MDT02 servers are prepared, you are ready to configure the actual replication. + ### Create the replication group + 7. On MDT01, using DFS Management, right-click **Replication**, and select **New Replication Group**. 8. On the **Replication Group Type** page, select **Multipurpose replication group**, and click **Next**. 9. On the **Name and Domain** page, assign the **MDTProduction** name, and click **Next**. @@ -146,7 +157,9 @@ When you have multiple deployment servers sharing the same content, you need to 17. On the **Review Settings and Create Replication Group** page, click **Create**. 18. On the **Confirmation** page, click **Close**. + ### Configure replicated folders + 19. On MDT01, using DFS Management, expand **Replication** and then select **MDTProduction**. 20. In the middle pane, right-click the **MDT01** member and select **Properties**. 21. On the **MDT01 (MDTProduction) Properties** page, configure the following and then click **OK**: @@ -167,8 +180,8 @@ When you have multiple deployment servers sharing the same content, you need to 1. In the **Staging** tab, set the quota to **20480 MB**. 2. In the **Advanced** tab, set the quota to **8192 MB**. -**Note**   -It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly. + > [!NOTE] + > It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly. ### Verify replication 1. On MDT02, wait until you start to see content appear in the **E:\\MDTProduction** folder. diff --git a/windows/deployment/planning/windows-10-1803-removed-features.md b/windows/deployment/planning/windows-10-1803-removed-features.md index 651e7aa5a8..562f287c68 100644 --- a/windows/deployment/planning/windows-10-1803-removed-features.md +++ b/windows/deployment/planning/windows-10-1803-removed-features.md @@ -1,56 +1,58 @@ ---- -title: Windows 10, version 1803 - Features that have been removed -description: Learn about features that will be removed or deprecated in Windows 10, version 1803, or a future release -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.author: greglin -ms.date: 08/16/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Features removed or planned for replacement starting with Windows 10, version 1803 - -> Applies to: Windows 10, version 1803 - -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1803 (also called Windows 10 April 2018 Update). - -> [!TIP] -> - You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes. -> - Have questions about other releases? Check out the information for [Windows 10, version 1703](windows-10-creators-update-deprecation.md), and [Windows 10, version 1709](windows-10-fall-creators-deprecation.md). - -**The list is subject to change and might not include every affected feature or functionality.** - -## Features we removed in this release - -We've removed the following features and functionalities from the installed product image in Windows 10, version 1803. Applications or code that depend on these features won't function in this release unless you use an alternate method. - -|Feature |Instead you can use...| -|-----------|-------------------- -|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC or to stream music from OneDrive. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.| -|People - Suggestions will no longer include unsaved contacts for non-Microsoft accounts|Manually save the contact details for people you send mail to or get mail from.| -|Language control in the Control Panel| Use the Settings app to change your language settings.| -|HomeGroup|We are removing [HomeGroup](https://support.microsoft.com/help/17145) but not your ability to share printers, files, and folders.

When you update to Windows 10, version 1803, you won't see HomeGroup in File Explorer, the Control Panel, or Troubleshoot (**Settings > Update & Security > Troubleshoot**). Any printers, files, and folders that you shared using HomeGroup **will continue to be shared**.

Instead of using HomeGroup, you can now share printers, files and folders by using features that are built into Windows 10:
- [Share your network printer](https://www.bing.com/search?q=share+printer+windows+10)
- [Share files in File Explorer](https://support.microsoft.com/help/4027674/windows-10-share-files-in-file-explorer) | -|**Connect to suggested open hotspots** option in Wi-Fi settings |We previously [disabled the **Connect to suggested open hotspots** option](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) and are now removing it from the Wi-Fi settings page. You can manually connect to free wireless hotspots with **Network & Internet** settings, from the taskbar or Control Panel, or by using Wi-Fi Settings (for mobile devices).| -|XPS Viewer|We're changing the way you get XPS Viewer. In Windows 10, version 1709 and earlier versions, the app is included in the installation image. If you have XPS Viewer and you update to Windows 10, version 1803, there's no action required. You'll still have XPS Viewer.

However, if you install Windows 10, version 1803, on a new device (or as a clean installation), you may need to [install XPS Viewer from **Apps and Features** in the Settings app](https://docs.microsoft.com/windows/application-management/add-apps-and-features) or through [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you had XPS Viewer in Windows 10, version 1709, but manually removed it before updating, you'll need to manually reinstall it.| - - -## Features we’re no longer developing - -We are no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. - -If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -|Feature |Instead you can use...| -|-----------|---------------------| -|[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| -|[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| -|Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| -|Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| -|Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| -|IPv4/6 Transition Technologies (6to4, ISATAP, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| -|[Layered Service Providers](https://msdn.microsoft.com/library/windows/desktop/bb513664)|Layered Service Providers have been deprecated since Windows 8 and Windows Server 2012. Use the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510) instead. When you upgrade from an older version of Windows, any layered service providers you're using aren't migrated; you'll need to re-install them after upgrading.| -|Business Scanning, also called Distributed Scan Management (DSM) **(Added 05/03/2018)**|The [Scan Management functionality](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759124(v=ws.11)) was introduced in Windows 7 and enabled secure scanning and the management of scanners in an enterprise. We're no longer investing in this feature, and there are no devices available that support it.| +--- +title: Windows 10, version 1803 - Features that have been removed +description: Learn about features that will be removed or deprecated in Windows 10, version 1803, or a future release +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.date: 08/16/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# Features removed or planned for replacement starting with Windows 10, version 1803 + +> Applies to: Windows 10, version 1803 + +Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1803 (also called Windows 10 April 2018 Update). + +> [!TIP] +> - You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes. +- Have questions about other releases? Check out the information for [Features that are removed or deprecated in Windows 10, version 1703](https://docs.microsoft.com/windows/deployment/planning/windows-10-1703-removed-features), [Features that are removed or deprecated in Windows 10, version 1709](https://docs.microsoft.com/windows/deployment/planning/windows-10-1709-removed-features), and [Features that are removed or deprecated in Windows 10 Creators Update](https://support.microsoft.com/en-us/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update). + + +**The list is subject to change and might not include every affected feature or functionality.** + +## Features we removed in this release + +We've removed the following features and functionalities from the installed product image in Windows 10, version 1803. Applications or code that depend on these features won't function in this release unless you use an alternate method. + +|Feature |Instead you can use...| +|-----------|-------------------- +|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC or to stream music from OneDrive. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.| +|People - Suggestions will no longer include unsaved contacts for non-Microsoft accounts|Manually save the contact details for people you send mail to or get mail from.| +|Language control in the Control Panel| Use the Settings app to change your language settings.| +|HomeGroup|We are removing [HomeGroup](https://support.microsoft.com/help/17145) but not your ability to share printers, files, and folders.

When you update to Windows 10, version 1803, you won't see HomeGroup in File Explorer, the Control Panel, or Troubleshoot (**Settings > Update & Security > Troubleshoot**). Any printers, files, and folders that you shared using HomeGroup **will continue to be shared**.

Instead of using HomeGroup, you can now share printers, files and folders by using features that are built into Windows 10:
- [Share your network printer](https://www.bing.com/search?q=share+printer+windows+10)
- [Share files in File Explorer](https://support.microsoft.com/help/4027674/windows-10-share-files-in-file-explorer) | +|**Connect to suggested open hotspots** option in Wi-Fi settings |We previously [disabled the **Connect to suggested open hotspots** option](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) and are now removing it from the Wi-Fi settings page. You can manually connect to free wireless hotspots with **Network & Internet** settings, from the taskbar or Control Panel, or by using Wi-Fi Settings (for mobile devices).| +|XPS Viewer|We're changing the way you get XPS Viewer. In Windows 10, version 1709 and earlier versions, the app is included in the installation image. If you have XPS Viewer and you update to Windows 10, version 1803, there's no action required. You'll still have XPS Viewer.

However, if you install Windows 10, version 1803, on a new device (or as a clean installation), you may need to [install XPS Viewer from **Apps and Features** in the Settings app](https://docs.microsoft.com/windows/application-management/add-apps-and-features) or through [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you had XPS Viewer in Windows 10, version 1709, but manually removed it before updating, you'll need to manually reinstall it.| + + +## Features we’re no longer developing + +We are no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. + +If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). + +|Feature |Instead you can use...| +|-----------|---------------------| +|[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| +|[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| +|Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| +|Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| +|Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| +|IPv4/6 Transition Technologies (6to4, ISATAP, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| +|[Layered Service Providers](https://msdn.microsoft.com/library/windows/desktop/bb513664)|Layered Service Providers have been deprecated since Windows 8 and Windows Server 2012. Use the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510) instead. When you upgrade from an older version of Windows, any layered service providers you're using aren't migrated; you'll need to re-install them after upgrading.| +|Business Scanning, also called Distributed Scan Management (DSM) **(Added 05/03/2018)**|The [Scan Management functionality](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759124(v=ws.11)) was introduced in Windows 7 and enabled secure scanning and the management of scanners in an enterprise. We're no longer investing in this feature, and there are no devices available that support it.| diff --git a/windows/deployment/planning/windows-10-1809-removed-features.md b/windows/deployment/planning/windows-10-1809-removed-features.md index a538532b77..9a2cb63049 100644 --- a/windows/deployment/planning/windows-10-1809-removed-features.md +++ b/windows/deployment/planning/windows-10-1809-removed-features.md @@ -1,52 +1,54 @@ ---- -title: Windows 10, version 1809 - Features that have been removed -description: Learn about features that will be removed or deprecated in Windows 10, version 1809, or a future release -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.author: greglin -ms.date: 11/16/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Features removed or planned for replacement starting with Windows 10, version 1809 - -> Applies to: Windows 10, version 1809 - -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1809. - -> [!TIP] -> - You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes. -> - Have questions about other releases? Check out the information for [Windows 10, version 1803](windows-10-1803-removed-features.md), [Windows 10, version 1709](windows-10-fall-creators-deprecation.md), and [Windows 10, version 1703](windows-10-creators-update-deprecation.md). - -**The list is subject to change and might not include every affected feature or functionality.** - -## Features we removed in this release - -We're removing the following features and functionalities from the installed product image in Windows 10, version 1809. Applications or code that depend on these features won't function in this release unless you use an alternate method. - -|Feature |Instead you can use...| -|-----------|-------------------- -|Business Scanning, also called Distributed Scan Management (DSM)|We're removing this secure scanning and scanner management capability - there are no devices that support this feature.| -|[FontSmoothing setting](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-visualeffects-fontsmoothing) in unattend.xml|The FontSmoothing setting let you specify the font antialiasing strategy to use across the system. We've changed Windows 10 to use [ClearType](https://docs.microsoft.com/typography/cleartype/) by default, so we're removing this setting as it is no longer necessary. If you include this setting in the unattend.xml file, it'll be ignored.| -|Hologram app|We've replaced the Hologram app with the [Mixed Reality Viewer](https://support.microsoft.com/help/4041156/windows-10-mixed-reality-help). If you would like to create 3D word art, you can still do that in Paint 3D and view your art in VR or Hololens with the Mixed Reality Viewer.| -|limpet.exe|We're releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.| -|Phone Companion|When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the **Phone** page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.| -|Future updates through [Windows Embedded Developer Update](https://docs.microsoft.com/previous-versions/windows/embedded/ff770079\(v=winembedded.60\)) for Windows Embedded Standard 7-SP1 (WES7-SP1) and Windows Embedded Standard 8 (WES8)|We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/Home.aspx). [Learn how](https://techcommunity.microsoft.com/t5/Windows-Embedded/Change-to-the-Windows-Embedded-Developer-Update/ba-p/285704) to get updates from the catalog.| - -## Features we’re no longer developing - -We're no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. - -If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -|Feature |Instead you can use...| -|-----------|---------------------| -|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because third party partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| -|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| -|Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| - - +--- +title: Windows 10, version 1809 - Features that have been removed +description: Learn about features that will be removed or deprecated in Windows 10, version 1809, or a future release +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.date: 11/16/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# Features removed or planned for replacement starting with Windows 10, version 1809 + +> Applies to: Windows 10, version 1809 + +Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Here are the details about the features and functionalities that we removed in Windows 10, version 1809. + +> [!TIP] +> You can get early access to Windows 10 builds by joining the [Windows Insider program](https://insider.windows.com) - this is a great way to test feature changes. +> Have questions about other releases? Check out the information for [Features removed or planned for replacement starting with Windows 10, version 1809](https://docs.microsoft.com/windows/deployment/planning/windows-10-1809-removed-features), [Features removed or planned for replacement starting with Windows Server, version 1709](https://docs.microsoft.com/windows-server/get-started/removed-features-1709), and [Features that are removed or deprecated in Windows 10, version 1703](https://docs.microsoft.com/windows/deployment/planning/windows-10-1703-removed-features). + + +**The list is subject to change and might not include every affected feature or functionality.** + +## Features we removed in this release + +We're removing the following features and functionalities from the installed product image in Windows 10, version 1809. Applications or code that depend on these features won't function in this release unless you use an alternate method. + +|Feature |Instead you can use...| +|-----------|-------------------- +|Business Scanning, also called Distributed Scan Management (DSM)|We're removing this secure scanning and scanner management capability - there are no devices that support this feature.| +|[FontSmoothing setting](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-visualeffects-fontsmoothing) in unattend.xml|The FontSmoothing setting let you specify the font antialiasing strategy to use across the system. We've changed Windows 10 to use [ClearType](https://docs.microsoft.com/typography/cleartype/) by default, so we're removing this setting as it is no longer necessary. If you include this setting in the unattend.xml file, it'll be ignored.| +|Hologram app|We've replaced the Hologram app with the [Mixed Reality Viewer](https://support.microsoft.com/help/4041156/windows-10-mixed-reality-help). If you would like to create 3D word art, you can still do that in Paint 3D and view your art in VR or Hololens with the Mixed Reality Viewer.| +|limpet.exe|We're releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.| +|Phone Companion|When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the **Phone** page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.| +|Future updates through [Windows Embedded Developer Update](https://docs.microsoft.com/previous-versions/windows/embedded/ff770079\(v=winembedded.60\)) for Windows Embedded Standard 7-SP1 (WES7-SP1) and Windows Embedded Standard 8 (WES8)|We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/Home.aspx). [Learn how](https://techcommunity.microsoft.com/t5/Windows-Embedded/Change-to-the-Windows-Embedded-Developer-Update/ba-p/285704) to get updates from the catalog.| + +## Features we’re no longer developing + +We're no longer actively developing these features and may remove them from a future update. Some features have been replaced with other features or functionality, while others are now available from different sources. + +If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). + +|Feature |Instead you can use...| +|-----------|---------------------| +|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because third party partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| +|OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| +|Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| + + diff --git a/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png b/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png index 9e37eda7a6..9308673481 100644 Binary files a/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png and b/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png differ diff --git a/windows/deployment/update/images/azure-portal-UR-settings.png b/windows/deployment/update/images/azure-portal-UR-settings.png index d8a5a3594d..67ace993e8 100644 Binary files a/windows/deployment/update/images/azure-portal-UR-settings.png and b/windows/deployment/update/images/azure-portal-UR-settings.png differ diff --git a/windows/deployment/update/images/azure-portal-create-resource-boxes.png b/windows/deployment/update/images/azure-portal-create-resource-boxes.png index a90344e02d..b15bec2265 100644 Binary files a/windows/deployment/update/images/azure-portal-create-resource-boxes.png and b/windows/deployment/update/images/azure-portal-create-resource-boxes.png differ diff --git a/windows/deployment/update/images/temp-azure-portal-soltn-setting.png b/windows/deployment/update/images/temp-azure-portal-soltn-setting.png index 70815abf46..33175c7590 100644 Binary files a/windows/deployment/update/images/temp-azure-portal-soltn-setting.png and b/windows/deployment/update/images/temp-azure-portal-soltn-setting.png differ diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index 210ebcaf84..9c45228695 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -36,7 +36,7 @@ Windows as a service provides a new way to think about building, deploying, and | [Overview of Windows as a service](waas-overview.md) | Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools. | | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. | -| [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. | +| [Assign devices to servicing branches for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. | | [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization. | | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | | [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. | diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md index 74c05a0abe..b7e23d8a0a 100644 --- a/windows/deployment/update/waas-quick-start.md +++ b/windows/deployment/update/waas-quick-start.md @@ -19,15 +19,14 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 IoT Mobile Windows as a service is a new concept, introduced with the release of Windows 10. While [an extensive set of documentation](index.md) is available explaining all the specifics and nuances, here is a quick guide to the most important concepts. ## Definitions Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean. -- **Feature updates** will be released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. -- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month ("Patch Tuesday"), though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). +- **Feature updates** are released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. +- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). - **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. - **Servicing channels** allow organizations to choose when to deploy new features. - The **Semi-Annual Channel** receives feature updates twice per year. @@ -40,9 +39,9 @@ For some interesting in-depth information about how cumulative updates work, see ## Key Concepts -Windows 10 gains new functionality with twice-per-year feature update releases. Initially, organizations will use these feature update releases for pilot deployments to ensure compatibility with existing apps and infrastructure. After a period of time, typically about four months after the feature update release, broad deployment throughout the organization can begin. The exact timeframe is determined by feedback from customers, ISVs, OEMs, and others, with an explicit "ready for broad deployment" declaration signaling this to customers. +Windows 10 gains new functionality with twice-per-year feature update releases. Initially, organizations will use these feature update releases for pilot deployments to ensure compatibility with existing apps and infrastructure. With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. -Each Windows 10 feature update will be serviced with quality updates for 18 months from the date of the feature update release. +All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607 and later. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18-month lifecycle. Windows 10 Enterprise LTSB is a separate **Long Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years. @@ -50,7 +49,7 @@ See [Assign devices to servicing channels for Windows 10 updates](waas-servicing ## Staying up to date -The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of tools management and patching tools such as Windows Update, Windows Update for Business, Windows Server Update Services, System Center Configuration Manager, and third-party products) can be used to help with this process. [Windows Analytics Upgrade Readiness](https://www.microsoft.com/WindowsForBusiness/windows-analytics), a free tool to streamline Windows upgrade projects, is another important tool to help. +The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, System Center Configuration Manager, and third-party products) can be used to help with this process. [Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help. Because app compatibility, both for desktop apps and web apps, is outstanding with Windows 10, extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. diff --git a/windows/deployment/update/windows-analytics-privacy.md b/windows/deployment/update/windows-analytics-privacy.md index 8e7a8558db..d6749b666d 100644 --- a/windows/deployment/update/windows-analytics-privacy.md +++ b/windows/deployment/update/windows-analytics-privacy.md @@ -8,8 +8,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay +ms.audience: itpro +author: greg-lindsay ms.localizationpriority: high ms.collection: M365-analytics ms.topic: article @@ -43,6 +45,7 @@ See these topics for additional background information about related privacy iss - [Windows 10 and the GDPR for IT Decision Makers](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance) - [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) - [Windows 7, Windows 8, and Windows 8.1 Appraiser Telemetry Events, and Fields](https://go.microsoft.com/fwlink/?LinkID=822965) +- [Windows 10, version 1903 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903) - [Windows 10, version 1809 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809) - [Windows 10, version 1803 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803) - [Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) diff --git a/windows/deployment/volume-activation/volume-activation-windows-10.md b/windows/deployment/volume-activation/volume-activation-windows-10.md index 0d0a77909e..f308f019a8 100644 --- a/windows/deployment/volume-activation/volume-activation-windows-10.md +++ b/windows/deployment/volume-activation/volume-activation-windows-10.md @@ -1,5 +1,5 @@ --- -title: Volume Activation for Windows 10 (Windows 10) +title: Volume Activation for Windows 10 description: This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 ms.reviewer: @@ -10,7 +10,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article @@ -18,52 +19,54 @@ ms.topic: article # Volume Activation for Windows 10 -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 +> Applies to +> +>- Windows 10 +>- Windows Server 2012 R2 +>- Windows Server 2012 +>- Windows Server 2016 +>- Windows Server 2019 **Looking for volume licensing information?** -- [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104) + +- [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104) **Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +- [Get Help Activating Microsoft Windows](https://support.microsoft.com/help/12440/windows-10-activate) This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. -*Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as Open and Select) and to participants in programs such as the Microsoft Partner Program and MSDN Subscriptions. + +*Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as [Open](https://www.microsoft.com/Licensing/licensing-programs/open-license) and [Select](https://www.microsoft.com/Licensing/licensing-programs/select)) and to participants in programs such as the [Microsoft Partner Program](https://partner.microsoft.com/) and [MSDN Subscriptions](https://visualstudio.microsoft.com/msdn-platforms/). Volume activation is a configurable solution that helps automate and manage the product activation process on computers running Windows operating systems that have been licensed under a volume licensing program. Volume activation is also used with other software from Microsoft (most notably the Office suites) that are sold under volume licensing agreements and that support volume activation. -This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features that are available in Windows 10 and Windows Server 2012 R2 and the tools that are provided in these versions of Windows and Windows Server to manage volume activation. +This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features and the tools to manage volume activation. -Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8, Windows 7, Windows Server 2012, and Windows Server 2008 R2Windows Server 2008 R2 operating systems. This guide -discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. +Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8.1, Windows 7, Windows Server 2012, and Windows Server 2008 R2 operating systems. This guide discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. -Volume activation—and the need for activation itself—is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](https://go.microsoft.com/fwlink/p/?LinkId=618209) in the TechNet Library. +Volume activation -and the need for activation itself- is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831612(v=ws.11)). If you would like additional information about planning a volume activation deployment specifically for Windows 7 and Windows Server 2008 R2, please see the [Volume Activation Planning Guide for Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=618210). To successfully plan and implement a volume activation strategy, you must: -- Learn about and understand product activation. -- Review and evaluate the available activation types or models. -- Consider the connectivity of the clients to be activated. -- Choose the method or methods to be used with each type of client. -- Determine the types and number of product keys you will need. -- Determine the monitoring and reporting needs in your organization. -- Install and configure the tools required to support the methods selected. + +- Learn about and understand product activation. +- Review and evaluate the available activation types or models. +- Consider the connectivity of the clients to be activated. +- Choose the method or methods to be used with each type of client. +- Determine the types and number of product keys you will need. +- Determine the monitoring and reporting needs in your organization. +- Install and configure the tools required to support the methods selected. Keep in mind that the method of activation does not change an organization’s responsibility to the licensing requirements. You must ensure that all software used in your organization is properly licensed and activated in accordance with the terms of the licensing agreements in place. -**In this guide:** -- [Plan for volume activation](plan-for-volume-activation-client.md) -- [Activate using Key Management Service](activate-using-key-management-service-vamt.md) -- [Activate using Active Directory-based activation](activate-using-active-directory-based-activation-client.md) -- [Activate clients running Windows 10](activate-windows-10-clients-vamt.md) -- [Monitor activation](monitor-activation-client.md) -- [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) -- [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) -  +## Additional information + +- [Plan for volume activation](plan-for-volume-activation-client.md) +- [Activate using Key Management Service](activate-using-key-management-service-vamt.md) +- [Activate using Active Directory-based activation](activate-using-active-directory-based-activation-client.md) +- [Activate clients running Windows 10](activate-windows-10-clients-vamt.md) +- [Monitor activation](monitor-activation-client.md) +- [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) +- [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md index b5cc63019b..7aacf56861 100644 --- a/windows/deployment/windows-autopilot/white-glove.md +++ b/windows/deployment/windows-autopilot/white-glove.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy -audience: itpro +audience: itproF author: greg-lindsay manager: laurawi ms.audience: itpro @@ -30,7 +30,7 @@ With **Windows Autopilot for white glove deployment**, the provisioning process ![OEM](images/wg02.png) -Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven [Azure AD join](user-driven-aad.md) and [Hybrid Azure AD](user-driven-hybrid.md) join scenarios. +Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven mode for Azure Active Directory Join, and user-driven mode for Hybrid Azure Active directory join scenarios. ## Prerequisites diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index 1baaf03dea..80be0dc299 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -78,6 +78,10 @@ If the Microsoft Store is not accessible, the AutoPilot process will still conti Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode +Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips(including ones from any other manufacturer) come with these certificates preinstalled. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: +
Intel- https://ekop.intel.com/ekcertservice +
Qualcomm- https://ekcert.spserv.microsoft.com/EKCertificate/GetEKCertificate/v1 +
AMD- https://ftpm.amd.com/pki/aia ## Licensing requirements @@ -120,4 +124,4 @@ There are no additional hardware requirements to use Windows 10 Autopilot, beyon ## Related topics -[Configure Autopilot deployment](configure-autopilot.md) +[Configure Autopilot deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/) diff --git a/windows/deployment/windows-autopilot/windows-autopilot.md b/windows/deployment/windows-autopilot/windows-autopilot.md index f307fbf265..04f3d13f0c 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot.md +++ b/windows/deployment/windows-autopilot/windows-autopilot.md @@ -1,65 +1,66 @@ ---- -title: Overview of Windows Autopilot -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Overview of Windows Autopilot - -**Applies to** - -- Windows 10 - -Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple. - -Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following diagram: - - ![Process overview](images/image1.png) - -When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features. - -Once deployed, Windows 10 devices can be managed by tools such as Microsoft Intune, Windows Update for Business, System Center Configuration Manager, and other similar tools. Windows Autopilot can also be used to re-purpose a device by leveraging Windows Autopilot Reset to quickly prepare a device for a new user, or in break/fix scenarios to enable a device to quickly be brought back to a business-ready state. - -Windows Autopilot enables you to: -* Automatically join devices to Azure Active Directory (Azure AD) or Active Directory (via Hybrid Azure AD Join). See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. -* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription*](windows-autopilot-requirements-configuration.md)). -* Restrict the Administrator account creation. -* Create and auto-assign devices to configuration groups based on a device's profile. -* Customize OOBE content specific to the organization. - -## Windows Autopilot walkthrough - -The following video shows the process of setting up Windows Autopilot: - -
- - - -## Benefits of Windows Autopilot - -Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach. - -From the user's perspective, it only takes a few simple operations to make their device ready to use. - -From the IT pro's perspective, the only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated. - -## Requirements - -Windows 10 version 1703 or higher is required to use Windows Autopilot. See [Windows Autopilot requirements](windows-autopilot-requirements.md) for detailed information on software, configuration, network, and licensing requirements. - -## Related topics - -[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot)
-[Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) +--- +title: Overview of Windows Autopilot +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.reviewer: mniehaus +manager: laurawi +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Overview of Windows Autopilot + +**Applies to** + +- Windows 10 + +Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple. + +Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following diagram: + + ![Process overview](images/image1.png) + +When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features. + +Once deployed, Windows 10 devices can be managed by tools such as Microsoft Intune, Windows Update for Business, System Center Configuration Manager, and other similar tools. Windows Autopilot can also be used to re-purpose a device by leveraging Windows Autopilot Reset to quickly prepare a device for a new user, or in break/fix scenarios to enable a device to quickly be brought back to a business-ready state. + +Windows Autopilot enables you to: +* Automatically join devices to Azure Active Directory (Azure AD) or Active Directory (via Hybrid Azure AD Join). See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. +* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription for configuration*](https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Windows-10-Azure-AD-and-Microsoft-Intune-Automatic-MDM/ba-p/244067)). +* Restrict the Administrator account creation. +* Create and auto-assign devices to configuration groups based on a device's profile. +* Customize OOBE content specific to the organization. + +## Windows Autopilot walkthrough + +The following video shows the process of setting up Windows Autopilot: + +
+ + + +## Benefits of Windows Autopilot + +Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach. + +From the user's perspective, it only takes a few simple operations to make their device ready to use. + +From the IT pro's perspective, the only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated. + +## Requirements + +Windows 10 version 1703 or higher is required to use Windows Autopilot. See [Windows Autopilot requirements](windows-autopilot-requirements.md) for detailed information on software, configuration, network, and licensing requirements. + +## Related topics + +[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot)
+[Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) diff --git a/windows/hub/windows-10.yml b/windows/hub/windows-10.yml index e858c87806..1504e2cae3 100644 --- a/windows/hub/windows-10.yml +++ b/windows/hub/windows-10.yml @@ -33,7 +33,7 @@ sections: - type: markdown text: " Learn about the latest releases and servicing options.
- +
What's new in Windows 10, version 1809
What's new in Windows 10, version 1803
What's new in Windows 10, version 1709
Windows 10 release information
Windows 10 update history
Windows 10 roadmap
What's new in Windows 10, version 1809
What's new in Windows 10, version 1803
What's new in Windows 10, version 1709
Windows 10 release information
Windows 10 update history
Windows 10 roadmap
" - title: Frequently asked questions @@ -41,7 +41,7 @@ sections: - type: markdown text: " Get answers to common questions, or get help with a specific problem.
- +
Windows 10 FAQ for IT Pros
Windows 10 forums
Windows 10 TechCommunity
Which edition is right for your organization?
Infrastructure requirements
What's Windows as a service?
Windows 10 Mobile deployment and management guide
Windows 10 FAQ for IT Pros
Windows 10 forums
Windows 10 TechCommunity
Which edition is right for your organization?
Infrastructure requirements
What's Windows as a service?
Windows 10 Mobile deployment and management guide
" - title: Plan @@ -57,7 +57,7 @@ sections: - type: markdown text: " Download recommended tools and get step-by-step guidance for in-place upgrades, dynamic provisioning, or traditional deployments.
- +

**In-place upgrade**
The simplest way to upgrade PCs that are currently running WIndows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
Upgrade to Windows 10 with Configuration Manager
Upgrade to Windows 10 with MDT
**Traditional deployment**
Some organizations may still need to opt for an image-based deployment of Windows 10.
Deploy Windows 10 with Configuration Manager
Deploy Windows 10 with MDT

**Dynamic provisioning**
With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
Provisioning packages for Windows 10
Build and apply a provisioning package
Customize Windows 10 start and the taskbar		Windows deployment for education environments
Set up a shared or guest PC with Windows 10
Sideload apps in Windows 10

**In-place upgrade**
The simplest way to upgrade PCs that are currently running WIndows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
Upgrade to Windows 10 with Configuration Manager
Upgrade to Windows 10 with MDT
**Traditional deployment**
Some organizations may still need to opt for an image-based deployment of Windows 10.
Deploy Windows 10 with Configuration Manager
Deploy Windows 10 with MDT

**Dynamic provisioning**
With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
Provisioning packages for Windows 10
Build and apply a provisioning package
Customize Windows 10 start and the taskbar		Windows deployment for education environments
Set up a shared or guest PC with Windows 10
Sideload apps in Windows 10
" - title: Management and security @@ -65,7 +65,7 @@ sections: - type: markdown text: " Learn how to manage Windows 10 clients and apps, secure company data, and manage risk.
- +

**Manage Windows 10 updates**
Get best practices and tools to help you manage clients and apps.
Manage clients in Windows 10
Manage apps and features in Windows 10
**Security**
Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
Windows 10 enterprise security
Threat protection
Identity protection
Information protection

**Manage Windows 10 updates**
Get best practices and tools to help you manage clients and apps.
Manage clients in Windows 10
Manage apps and features in Windows 10
**Security**
Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
Windows 10 enterprise security
Threat protection
Identity protection
Information protection
" - title: Stay informed diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md index 50d0770521..ba1428445d 100644 --- a/windows/privacy/gdpr-it-guidance.md +++ b/windows/privacy/gdpr-it-guidance.md @@ -224,7 +224,7 @@ IT Professionals that are interested in this configuration, see [Windows 10 pers ### Windows 10 connections to Microsoft -To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) and [Manage Windows 10 connection endpoints](manage-windows-endpoints.md). These articles describe how these settings can be managed by an IT Professional. +To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). This article describe how these settings can be managed by an IT Professional, and fronts an array of Windows version-specific articles. ### At-a-glance: the relationship between an IT organization and the GDPR diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index 8211fc3089..3f002495cd 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -140,8 +140,8 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. [Defender/SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent). Stop sending file samples back to Microsoft. **Set to 2 (two)** 1. Windows Defender Smartscreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender Smartscreen. **Set to 0 (zero)** 1. Windows Defender Smartscreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** - 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** - 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **String**, Value: **FileShares** + 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** + 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **String**, Value: **FileShares** 1. **Windows Spotlight** - [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight). Disable Windows Spotlight. **Set to 0 (zero)** 1. **Microsoft Store** 1. [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps). Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. **Set to 1 (one)** @@ -151,8 +151,8 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 100 (one hundred)** 1. **Windows Update** 1. [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Control automatic updates. **Set to 5 (five)** - 1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** - 1. Windows Update Service URL - [Update/UpdateServiceUrl](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-updateserviceurl). Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with the Value: + 1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** + 1. Windows Update Service URL - [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl). Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with the Value: 1. **\\$CmdID$\\\chr\text/plain\\ \./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl\\http://abcd-srv:8530\\** ### Allowed traffic for Microsoft Intune / MDM configurations diff --git a/windows/privacy/windows-diagnostic-data-1703.md b/windows/privacy/windows-diagnostic-data-1703.md index d398441cbc..73ccd75c12 100644 --- a/windows/privacy/windows-diagnostic-data-1703.md +++ b/windows/privacy/windows-diagnostic-data-1703.md @@ -21,7 +21,7 @@ ms.reviewer: **Applies to:** - Windows 10, version 1703 -Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md). +Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703). The data covered in this article is grouped into the following categories: diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md index 2d1b7a1a36..13660e8f01 100644 --- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md @@ -23,7 +23,7 @@ ms.reviewer: - Windows 10 Professional, version 1709 - Windows 10 Education, version 1709 -In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-endpoints.md), the following endpoints are available on other editions of Windows 10, version 1709. +In addition to the endpoints listed for [Windows 10 Enterprise](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services), the following endpoints are available on other editions of Windows 10, version 1709. We used the following methodology to derive these network endpoints: diff --git a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md index 885bdb44c7..208f378b9e 100644 --- a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md @@ -23,7 +23,7 @@ ms.reviewer: - Windows 10 Professional, version 1803 - Windows 10 Education, version 1803 -In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-endpoints.md), the following endpoints are available on other editions of Windows 10, version 1803. +In addition to the endpoints listed for [Windows 10 Enterprise](https://docs.microsoft.com/en-gb/windows/privacy/manage-windows-1803-endpoints ), the following endpoints are available on other editions of Windows 10, version 1803. We used the following methodology to derive these network endpoints: diff --git a/windows/privacy/windows-personal-data-services-configuration.md b/windows/privacy/windows-personal-data-services-configuration.md index 0b5997a3eb..93c2b4da00 100644 --- a/windows/privacy/windows-personal-data-services-configuration.md +++ b/windows/privacy/windows-personal-data-services-configuration.md @@ -399,7 +399,7 @@ These settings whether employees send “Do Not Track” header from the Microso ### Windows Privacy on docs.microsoft.com * [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -* [Manage Windows 10 connection endpoints](manage-windows-endpoints.md) +* [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) * [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data) * [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml index 1b60cb6d84..4b08bb66bc 100644 --- a/windows/release-information/resolved-issues-windows-10-1507.yml +++ b/windows/release-information/resolved-issues-windows-10-1507.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -55,7 +55,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4524153		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4520011		October 08, 2019
10:00 AM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 10240.18305

August 13, 2019
KB4512497		Resolved
KB4517276		August 17, 2019
02:00 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 10240.18244

June 11, 2019
KB4503291		Resolved External
August 09, 2019
07:03 PM PT
Event Viewer may close or you may receive an error when using Custom Views
When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

See details >		OS Build 10240.18244

June 11, 2019
KB4503291		Resolved
KB4507458		July 09, 2019
10:00 AM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524153.

Back to top		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4524153		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520011.

Back to top		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4520011		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml index f6d0389a8b..443edfba45 100644 --- a/windows/release-information/resolved-issues-windows-10-1607.yml +++ b/windows/release-information/resolved-issues-windows-10-1607.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -71,7 +71,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4524152		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4519998		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 14393.3204

September 10, 2019
KB4516044		Resolved
September 17, 2019
04:47 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

See details >		OS Build 14393.3053

June 18, 2019
KB4503294		Resolved
KB4516044		September 10, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		August 13, 2019
10:00 AM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524152.

Back to top		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4524152		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519998.

Back to top		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4519998		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows.

Back to top		OS Build 14393.3204

September 10, 2019
KB4516044		Resolved
Resolved:
September 17, 2019
04:47 PM PT

Opened:
September 13, 2019
05:25 PM PT
" @@ -81,7 +81,7 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516044.

Back to top		OS Build 14393.3053

June 18, 2019
KB4503294		Resolved
KB4516044		Resolved:
September 10, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516044.

Back to top		OS Build 14393.3053

June 18, 2019
KB4503294		Resolved
KB4516044		Resolved:
September 10, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
After installing KB4512517, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4512495. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512495 and install. For instructions, see Update Windows 10.

Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

Back to top		OS Build 14393.3144

August 13, 2019
KB4512517		Resolved
KB4512495		Resolved:
August 17, 2019
02:00 PM PT

Opened:
August 14, 2019
03:34 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503267) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

Back to top		OS Build 14393.3025

June 11, 2019
KB4503267		Resolved External
Last updated:
August 09, 2019
07:03 PM PT

Opened:
August 09, 2019
04:25 PM PT
diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml index 4478c0a447..3417779bd7 100644 --- a/windows/release-information/resolved-issues-windows-10-1703.yml +++ b/windows/release-information/resolved-issues-windows-10-1703.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -62,7 +62,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4524151		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4520010		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 15063.2045

September 10, 2019
KB4516068		Resolved
September 17, 2019
04:47 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		August 13, 2019
10:00 AM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 15063.1988

August 13, 2019
KB4512507		Resolved
KB4512474		August 17, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524151.

Back to top		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4524151		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520010.

Back to top		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4520010		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows.

Back to top		OS Build 15063.2045

September 10, 2019
KB4516068		Resolved
Resolved:
September 17, 2019
04:47 PM PT

Opened:
September 13, 2019
05:25 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml index f74e209cd0..edf606e491 100644 --- a/windows/release-information/resolved-issues-windows-10-1709.yml +++ b/windows/release-information/resolved-issues-windows-10-1709.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -64,7 +64,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4524150		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4520004		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 16299.1387

September 10, 2019
KB4516066		Resolved
September 19, 2019
04:08 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 16299.1217

June 11, 2019
KB4503284		Resolved
KB4512494		August 16, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524150.

Back to top		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4524150		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520004.

Back to top		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4520004		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4516066, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 16299.1387

September 10, 2019
KB4516066		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml index a1829db162..88242a7ce0 100644 --- a/windows/release-information/resolved-issues-windows-10-1803.yml +++ b/windows/release-information/resolved-issues-windows-10-1803.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -65,7 +65,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4524149		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4520008		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 17134.1006

September 10, 2019
KB4516058		Resolved
September 19, 2019
04:08 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

See details >		N/A

Resolved
September 03, 2019
12:32 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524149.

Back to top		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4524149		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520008.

Back to top		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4520008		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4516058, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 17134.1006

September 10, 2019
KB4516058		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

Affected platforms:
  • Client: Windows 10, version 1803
  • Server: Windows Server, version 1803
Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

Back to top		N/A

Resolved
Resolved:
September 03, 2019
12:32 PM PT

Opened:
September 03, 2019
12:32 PM PT
diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index 141d598e3f..a3da9d620b 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -72,7 +72,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4524148		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4519338		October 08, 2019
10:00 AM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

See details >		OS Build 17763.55

October 09, 2018
KB4464330		Resolved
KB4516077		September 24, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 17763.737

September 10, 2019
KB4512578		Resolved
September 19, 2019
04:08 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524148.

Back to top		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4524148		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519338.

Back to top		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4519338		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4512578, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 17763.737

September 10, 2019
KB4512578		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
" @@ -82,7 +82,7 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516077.

Back to top		OS Build 17763.55

October 09, 2018
KB4464330		Resolved
KB4516077		Resolved:
September 24, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516077.

Back to top		OS Build 17763.55

October 09, 2018
KB4464330		Resolved
KB4516077		Resolved:
September 24, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
After installing KB4511553, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4512534. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512534 and install. For instructions, see Update Windows 10.

Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

Back to top		OS Build 17763.678

August 13, 2019
KB4511553		Resolved
KB4512534		Resolved:
August 17, 2019
02:00 PM PT

Opened:
August 14, 2019
03:34 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503327) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

Back to top		OS Build 17763.557

June 11, 2019
KB4503327		Resolved External
Last updated:
August 09, 2019
07:03 PM PT

Opened:
August 09, 2019
04:25 PM PT
diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 110be2f42f..b8113225b2 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -70,7 +70,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4524147		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4517389		October 08, 2019
10:00 AM PT
Audio in games is quiet or different than expected
Microsoft has received reports that audio in certain games is quieter or different than expected.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
KB4517211		September 26, 2019
02:00 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
September 19, 2019
04:08 PM PT
Some users report issues related to the Start menu and Windows Desktop Search
Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
September 19, 2019
04:58 PM PT
- + diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml index bd24de9f18..06de4933bb 100644 --- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: "
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524147.

Back to top		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4524147		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4517389.

Back to top		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4517389		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Audio in games is quiet or different than expected
Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4517211.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
KB4517211		Resolved:
September 26, 2019
02:00 PM PT

Opened:
September 13, 2019
05:25 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
Some users report issues related to the Start menu and Windows Desktop Search
Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
Resolved:
September 19, 2019
04:58 PM PT

Opened:
September 11, 2019
05:18 PM PT
- + @@ -66,7 +66,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516048		Resolved
KB4524157		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516048		Resolved
KB4519976		October 08, 2019
10:00 AM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center
Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

See details >		August 13, 2019
KB4512506		Resolved
KB4516048		September 24, 2019
10:00 AM PT
Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

See details >		August 13, 2019
KB4512506		Resolved External
August 27, 2019
02:29 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		June 11, 2019
KB4503292		Resolved
KB4512514		August 17, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524157. If you are using Security Only updates, see KB4524135 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516048		Resolved
KB4524157		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519976. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516048		Resolved
KB4519976		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center
After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

Affected platforms:
  • Client: Windows 7 SP1
Resolution: This issue was resolved in KB4516048.

Back to top		August 13, 2019
KB4512506		Resolved
KB4516048		Resolved:
September 24, 2019
10:00 AM PT

Opened:
September 10, 2019
09:48 AM PT
" diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml index eb55d204f7..b397d4c0c7 100644 --- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -66,7 +66,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516041		Resolved
KB4524156		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516041		Resolved
KB4520005		October 08, 2019
10:00 AM PT
Windows RT 8.1 devices may have issues opening Internet Explorer 11
On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

See details >		September 10, 2019
KB4516067		Resolved
KB4516041		September 24, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		June 11, 2019
KB4503276		Resolved
KB4512478		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		August 13, 2019
KB4512488		Resolved
KB4517298		August 16, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524156. If you are using Security Only updates, see KB4524135 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516041		Resolved
KB4524156		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520005. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516041		Resolved
KB4520005		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Windows RT 8.1 devices may have issues opening Internet Explorer 11
On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


Affected platforms:
  • Client: Windows RT 8.1
Resolution: This issue was resolved in KB4516041.

Back to top		September 10, 2019
KB4516067		Resolved
KB4516041		Resolved:
September 24, 2019
10:00 AM PT

Opened:
September 13, 2019
05:25 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml index 4e48865271..1549fb60e3 100644 --- a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml +++ b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -57,7 +57,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516030		Resolved
KB4524135		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516030		Resolved
KB4520002		October 08, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		June 11, 2019
KB4503273		Resolved
KB4512499		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		August 13, 2019
KB4512476		Resolved
KB4517301		August 16, 2019
02:00 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		June 11, 2019
KB4503273		Resolved External
August 09, 2019
07:03 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524135.

Back to top		September 24, 2019
KB4516030		Resolved
KB4524135		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520002. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516030		Resolved
KB4520002		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
" diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml index aa3359846f..71e4d56153 100644 --- a/windows/release-information/resolved-issues-windows-server-2012.yml +++ b/windows/release-information/resolved-issues-windows-server-2012.yml @@ -32,7 +32,7 @@ sections: - type: markdown text: " - + @@ -62,7 +62,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516069		Resolved
KB4524154		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516069		Resolved
KB4520007		October 08, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		June 11, 2019
KB4503285		Resolved
KB4512512		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		August 13, 2019
KB4512518		Resolved
KB4517302		August 16, 2019
02:00 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		June 11, 2019
KB4503285		Resolved External
August 09, 2019
07:03 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524154. If you are using Security Only updates, see KB4524135 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516069		Resolved
KB4524154		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520007. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516069		Resolved
KB4520007		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
" diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml index ea9de65f95..ca4bc3e9f8 100644 --- a/windows/release-information/status-windows-10-1507.yml +++ b/windows/release-information/status-windows-10-1507.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- +
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4524153		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4520011		October 08, 2019
10:00 AM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 10240.18094

January 08, 2019
KB4480962		Mitigated
April 25, 2019
02:00 PM PT
" @@ -77,7 +77,7 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524153.

Back to top		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4524153		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520011.

Back to top		OS Build 10240.18334

September 23, 2019
KB4522009		Resolved
KB4520011		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
" diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index 58db7bec3f..b85ec92096 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -60,10 +60,9 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + - @@ -82,7 +81,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4524152		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4519998		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 14393.3204

September 10, 2019
KB4516044		Resolved
September 17, 2019
04:47 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

See details >		OS Build 14393.3053

June 18, 2019
KB4503294		Resolved
KB4516044		September 10, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		August 13, 2019
10:00 AM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 14393.2724

January 08, 2019
KB4480961		Mitigated
April 25, 2019
02:00 PM PT
Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

See details >		OS Build 14393.2608

November 13, 2018
KB4467691		Mitigated
February 19, 2019
10:00 AM PT
Cluster service may fail if the minimum password length is set to greater than 14
The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters.

See details >		OS Build 14393.2639

November 27, 2018
KB4467684		Mitigated
April 25, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524152.

Back to top		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4524152		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519998.

Back to top		OS Build 14393.3206

September 23, 2019
KB4522010		Resolved
KB4519998		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows.

Back to top		OS Build 14393.3204

September 10, 2019
KB4516044		Resolved
Resolved:
September 17, 2019
04:47 PM PT

Opened:
September 13, 2019
05:25 PM PT
" @@ -92,17 +91,7 @@ sections: - type: markdown text: " - -
DetailsOriginating updateStatusHistory
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516044.

Back to top		OS Build 14393.3053

June 18, 2019
KB4503294		Resolved
KB4516044		Resolved:
September 10, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
- " - -- title: July 2019 -- items: - - type: markdown - text: " - - +
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512517 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 14393.3115

July 16, 2019
KB4507459		Resolved
KB4512517		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516044.

Back to top		OS Build 14393.3053

June 18, 2019
KB4503294		Resolved
KB4516044		Resolved:
September 10, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
" diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml index a402fad971..9f123d8aeb 100644 --- a/windows/release-information/status-windows-10-1703.yml +++ b/windows/release-information/status-windows-10-1703.yml @@ -64,9 +64,8 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + -
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4524151		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4520010		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 15063.2045

September 10, 2019
KB4516068		Resolved
September 17, 2019
04:47 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		August 13, 2019
10:00 AM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 15063.1563

January 08, 2019
KB4480973		Mitigated
April 25, 2019
02:00 PM PT
" @@ -83,21 +82,11 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524151.

Back to top		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4524151		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520010.

Back to top		OS Build 15063.2046

September 23, 2019
KB4522011		Resolved
KB4520010		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows.

Back to top		OS Build 15063.2045

September 10, 2019
KB4516068		Resolved
Resolved:
September 17, 2019
04:47 PM PT

Opened:
September 13, 2019
05:25 PM PT
" -- title: July 2019 -- items: - - type: markdown - text: " - - -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512507 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 15063.1955

July 16, 2019
KB4507467		Resolved
KB4512507		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
- " - - title: January 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml index 2dd29ea31f..5c261a20d3 100644 --- a/windows/release-information/status-windows-10-1709.yml +++ b/windows/release-information/status-windows-10-1709.yml @@ -60,9 +60,8 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + -
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4524150		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4520004		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 16299.1387

September 10, 2019
KB4516066		Resolved
September 19, 2019
04:08 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		August 13, 2019
10:00 AM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 16299.904

January 08, 2019
KB4480978		Mitigated
April 25, 2019
02:00 PM PT
" @@ -79,21 +78,11 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524150.

Back to top		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4524150		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520004.

Back to top		OS Build 16299.1392

September 23, 2019
KB4522012		Resolved
KB4520004		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4516066, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 16299.1387

September 10, 2019
KB4516066		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
" -- title: July 2019 -- items: - - type: markdown - text: " - - -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512516 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 16299.1296

July 16, 2019
KB4507465		Resolved
KB4512516		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
- " - - title: January 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index a69dcf3047..20747f2e00 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -64,10 +64,9 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + -
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4524149		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4520008		October 08, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 17134.1006

September 10, 2019
KB4516058		Resolved
September 19, 2019
04:08 PM PT
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

See details >		OS Build 17134.950

August 13, 2019
KB4512501		Mitigated
September 11, 2019
05:32 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
Startup to a black screen after installing updates
Your device may startup to a black screen during the first logon after installing updates.

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Mitigated
June 14, 2019
04:41 PM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 17134.523

January 08, 2019
KB4480966		Mitigated
April 25, 2019
02:00 PM PT
@@ -85,22 +84,12 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524149.

Back to top		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4524149		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520008.

Back to top		OS Build 17134.1009

September 23, 2019
KB4522014		Resolved
KB4520008		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4516058, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 17134.1006

September 10, 2019
KB4516058		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
After installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps:
  1. Close the Windows Mixed Reality Portal, if it is running.
  2. Open Task Manager by selecting the Start button and typing Task Manager.
  3. In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
  4. You can now open the Windows Mixed Reality Portal.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 17134.950

August 13, 2019
KB4512501		Mitigated
Last updated:
September 11, 2019
05:32 PM PT

Opened:
September 11, 2019
05:32 PM PT
" -- title: July 2019 -- items: - - type: markdown - text: " - - -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512501 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
- " - - title: June 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index 1cb92449c8..e2249fd197 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,11 +64,10 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + - @@ -87,7 +86,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4524148		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4519338		October 08, 2019
10:00 AM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

See details >		OS Build 17763.55

October 09, 2018
KB4464330		Resolved
KB4516077		September 24, 2019
10:00 AM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 17763.737

September 10, 2019
KB4512578		Resolved
September 19, 2019
04:08 PM PT
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

See details >		OS Build 17763.678

August 13, 2019
KB4511553		Mitigated
September 11, 2019
05:32 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
Startup to a black screen after installing updates
Your device may startup to a black screen during the first logon after installing updates.

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Mitigated
June 14, 2019
04:41 PM PT
Devices with some Asian language packs installed may receive an error
After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F

See details >		OS Build 17763.437

April 09, 2019
KB4493509		Mitigated
May 03, 2019
10:59 AM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

See details >		OS Build 17763.253

January 08, 2019
KB4480116		Mitigated
April 09, 2019
10:00 AM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524148.

Back to top		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4524148		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519338.

Back to top		OS Build 17763.740

September 23, 2019
KB4522015		Resolved
KB4519338		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4512578, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 17763.737

September 10, 2019
KB4512578		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
After installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps:
  1. Close the Windows Mixed Reality Portal, if it is running.
  2. Open Task Manager by selecting the Start button and typing Task Manager.
  3. In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
  4. You can now open the Windows Mixed Reality Portal.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 17763.678

August 13, 2019
KB4511553		Mitigated
Last updated:
September 11, 2019
05:32 PM PT

Opened:
September 11, 2019
05:32 PM PT
@@ -98,17 +97,7 @@ sections: - type: markdown text: " - -
DetailsOriginating updateStatusHistory
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516077.

Back to top		OS Build 17763.55

October 09, 2018
KB4464330		Resolved
KB4516077		Resolved:
September 24, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
- " - -- title: July 2019 -- items: - - type: markdown - text: " - - +
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4511553 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		Resolved:
August 13, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Apps and scripts using the NetQueryDisplayInformation API may fail with error
 Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

Affected platforms:
  • Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4516077.

Back to top		OS Build 17763.55

October 09, 2018
KB4464330		Resolved
KB4516077		Resolved:
September 24, 2019
10:00 AM PT

Opened:
August 01, 2019
05:00 PM PT
" diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index 661f11987d..fab48103a1 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -64,15 +64,13 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + - - @@ -95,7 +93,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4524147		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4517389		October 08, 2019
10:00 AM PT
Audio in games is quiet or different than expected
Microsoft has received reports that audio in certain games is quieter or different than expected.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
KB4517211		September 26, 2019
02:00 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
September 19, 2019
04:08 PM PT
Some users report issues related to the Start menu and Windows Desktop Search
Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
September 19, 2019
04:58 PM PT
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.

See details >		N/A

Mitigated
September 13, 2019
05:25 PM PT
Screenshots and Snips have an unnatural orange tint
Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

See details >		OS Build 18362.356

September 10, 2019
KB4516115		Resolved External
September 11, 2019
08:54 PM PT
Windows Desktop Search may not return any results and may have high CPU usage
Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

See details >		OS Build 18362.329

August 30, 2019
KB4512941		Resolved
KB4515384		September 10, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Updates may fail to install and you may receive Error 0x80073701
Installation of updates may fail and you may receive an error, \"Updates Failed, There were problems installing some updates, but we'll try again later\" and \"Error 0x80073701.\"

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
August 16, 2019
04:28 PM PT
Intermittent loss of Wi-Fi connectivity
Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated External
August 01, 2019
08:44 PM PT
Gamma ramps, color profiles, and night light settings do not apply in some cases
Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
August 01, 2019
06:27 PM PT
- + @@ -119,9 +117,6 @@ sections: - type: markdown text: "
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524147.

Back to top		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4524147		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4517389.

Back to top		OS Build 18362.357

September 23, 2019
KB4522016		Resolved
KB4517389		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Audio in games is quiet or different than expected
Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4517211.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
KB4517211		Resolved:
September 26, 2019
02:00 PM PT

Opened:
September 13, 2019
05:25 PM PT
IME may become unresponsive or have High CPU usage
Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
  1. Select the Start button and type Services.
  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
  3. Locate Startup type: and change it to Manual
  4. Select Ok
  5. The TabletInputService service is now in the default configuration and IME should work as expected.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
Resolved:
September 19, 2019
04:08 PM PT

Opened:
September 13, 2019
05:25 PM PT
Some users report issues related to the Start menu and Windows Desktop Search
Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Resolved
Resolved:
September 19, 2019
04:58 PM PT

Opened:
September 11, 2019
05:18 PM PT
- -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.

To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
Last updated:
July 16, 2019
09:04 AM PT

Opened:
July 12, 2019
04:20 PM PT
" diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index 1f1610c028..3d71ca817a 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- +
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516048		Resolved
KB4524157		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516048		Resolved
KB4519976		October 08, 2019
10:00 AM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center
Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

See details >		August 13, 2019
KB4512506		Resolved
KB4516048		September 24, 2019
10:00 AM PT
IA64 and x64 devices may fail to start after installing updates
After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

See details >		August 13, 2019
KB4512506		Mitigated
August 17, 2019
12:59 PM PT
@@ -78,7 +78,7 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524157. If you are using Security Only updates, see KB4524135 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516048		Resolved
KB4524157		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519976. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516048		Resolved
KB4519976		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center
After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

Affected platforms:
  • Client: Windows 7 SP1
Resolution: This issue was resolved in KB4516048.

Back to top		August 13, 2019
KB4512506		Resolved
KB4516048		Resolved:
September 24, 2019
10:00 AM PT

Opened:
September 10, 2019
09:48 AM PT
" diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml index d974923d48..a95d9775c6 100644 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + @@ -79,7 +79,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516041		Resolved
KB4524156		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516041		Resolved
KB4520005		October 08, 2019
10:00 AM PT
Windows RT 8.1 devices may have issues opening Internet Explorer 11
On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

See details >		September 10, 2019
KB4516067		Resolved
KB4516041		September 24, 2019
10:00 AM PT
Japanese IME doesn't show the new Japanese Era name as a text input option
If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

See details >		April 25, 2019
KB4493443		Mitigated
May 15, 2019
05:53 PM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

See details >		January 08, 2019
KB4480963		Mitigated
April 25, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524156. If you are using Security Only updates, see KB4524135 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516041		Resolved
KB4524156		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520005. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516041		Resolved
KB4520005		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Windows RT 8.1 devices may have issues opening Internet Explorer 11
On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


Affected platforms:
  • Client: Windows RT 8.1
Resolution: This issue was resolved in KB4516041.

Back to top		September 10, 2019
KB4516067		Resolved
KB4516041		Resolved:
September 24, 2019
10:00 AM PT

Opened:
September 13, 2019
05:25 PM PT
" diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml index 0eee091e73..fda671a495 100644 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ b/windows/release-information/status-windows-server-2008-sp2.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- +
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516030		Resolved
KB4524135		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516030		Resolved
KB4520002		October 08, 2019
10:00 AM PT
Issues manually installing updates by double-clicking the .msu file
You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

See details >		September 10, 2019
KB4474419		Mitigated
KB4474419		September 24, 2019
08:17 AM PT
" @@ -77,7 +77,7 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524135.

Back to top		September 24, 2019
KB4516030		Resolved
KB4524135		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520002. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516030		Resolved
KB4520002		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Issues manually installing updates by double-clicking the .msu file
After installing the SHA-2 update (KB4474419) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"

Affected platforms:
  • Server: Windows Server 2008 SP2
Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet

Resolution: This issue is resolved in KB4474419 released September 23, 2019. Currently, this version is only available from the Microsoft Update Catalog. To resolve this issue, you will need to manually download the package and use the workaround above to install it.

Next steps: We estimate a solution will be available in mid-October on Windows Update and Windows Server Update Services (WSUS).

Back to top		September 10, 2019
KB4474419		Mitigated
KB4474419		Last updated:
September 24, 2019
08:17 AM PT

Opened:
September 20, 2019
04:57 PM PT
" diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml index f22c434757..f472c2357e 100644 --- a/windows/release-information/status-windows-server-2012.yml +++ b/windows/release-information/status-windows-server-2012.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- +
SummaryOriginating updateStatusLast updated
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516069		Resolved
KB4524154		October 03, 2019
10:00 AM PT
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.

See details >		September 24, 2019
KB4516069		Resolved
KB4520007		October 08, 2019
10:00 AM PT
Japanese IME doesn't show the new Japanese Era name as a text input option
If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

See details >		April 25, 2019
KB4493462		Mitigated
May 15, 2019
05:53 PM PT
Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

See details >		January 08, 2019
KB4480975		Mitigated
April 25, 2019
02:00 PM PT
@@ -78,7 +78,7 @@ sections: - type: markdown text: " - +
DetailsOriginating updateStatusHistory
Intermittent issues when printing
The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing. Some apps may close or error when the print spooler fails and you may receive a remote procedure call error (RPC error) from some printing utility or printing apps.

Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4524154. If you are using Security Only updates, see KB4524135 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516069		Resolved
KB4524154		Resolved:
October 03, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
Intermittent issues when printing
Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520007. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

Back to top		September 24, 2019
KB4516069		Resolved
KB4520007		Resolved:
October 08, 2019
10:00 AM PT

Opened:
September 30, 2019
06:26 PM PT
" diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index 2d377d5542..92b6cf0393 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,8 @@ sections: text: " - + + @@ -66,7 +67,7 @@ sections: - + diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 5738d0e7ff..daf03b598f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -204,8 +204,9 @@ If the error occurs again, check the error code against the following table to s
MessageDate
Take action: Security update available for all supported versions of Windows
On October 3, 2019, Microsoft expanded delivery of the out-of-band Internet Explorer scripting engine security vulnerability (CVE-2019-1367) update released on September 23, 2019 to Windows Update and Windows Server Update Services (WSUS). This is now a required security update for all supported versions of Windows as it includes the Internet Explorer scripting engine vulnerability mitigation and corrects a recent printing issue some users have experienced. All customers using Windows Update or WSUS will be offered this update automatically. We recommend that you install this update as soon as a possible, then restart your PC to fully apply the mitigations and help secure your devices. As with all cumulative updates, this update supersedes any preceding update.
 
Note: This update does not replace the standard October 2019 monthly security update release, which is scheduled for October 8, 2019.
October 03, 2019
08:00 AM PT
Take Action: October 2019 security update available for all supported versions of Windows
The October 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
 
October 08, 2019
08:00 AM PT
Take action: Security update available for all supported versions of Windows
On October 3, 2019, Microsoft expanded delivery of the out-of-band Internet Explorer scripting engine security vulnerability (CVE-2019-1367) update released on September 23, 2019 to Windows Update and Windows Server Update Services (WSUS). This is now a required security update for all supported versions of Windows as it includes the Internet Explorer scripting engine vulnerability mitigation and corrects a recent printing issue some users have experienced. All customers using Windows Update or WSUS will be offered this update automatically. We recommend that you install this update as soon as a possible, then restart your PC to fully apply the mitigations and help secure your devices. As with all cumulative updates, this update supersedes any preceding update.
 
Note: This update does not replace the standard October 2019 monthly security update release, which is scheduled for October 8, 2019.
October 03, 2019
08:00 AM PT
September 2019 Windows 10, version 1903 \"D\" optional release is available
The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
September 26, 2019
02:00 PM PT
Status update: September 2019 Windows \"C\" optional release available
The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
September 24, 2019
08:10 AM PT
Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
September 24, 2019
08:00 AM PT
August 2019 security update now available for Windows 10, version 1903 and all supported versions of Windows
The August 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. A “B” release is the primary, regular update event for each month and is the only regular release that contains security fixes. As a result, we recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
August 13, 2019
10:00 AM PT
Advisory: Bluetooth encryption key size vulnerability disclosed (CVE-2019-9506)
On August 13, 2019, Microsoft released security updates to address a Bluetooth key length encryption vulnerability. To exploit this vulnerability, an attacker would need specialized hardware and would be limited by the signal range of the Bluetooth devices in use. For more information about this industry-wide issue, see CVE-2019-9506 | Bluetooth Encryption Key Size Vulnerability in the Microsoft Security Update Guide and important guidance for IT pros in KB4514157. (Note: we are documenting this vulnerability together with guidance for IT admins as part of a coordinated industry disclosure effort.)
August 13, 2019
10:00 AM PT
Advisory: Windows Advanced Local Procedure Call Elevation of Privilege vulnerability disclosed (CVE-2019-1162)
On August 13, 2019, Google Project Zero (GPZ) disclosed an Elevation of Privilege (EoP) vulnerability in how Windows handles calls to Advanced Local Procedure Call (ALPC) that affects Windows operating systems, versions 8.1 and higher. An attacker must already have code execution on the target system to leverage these vulnerabilities. Microsoft released security updates on August 13, 2019 that partially address this issue. Other items disclosed by GPZ require more time to address and we are working to release a resolution in mid-September. For more information, see CVE-2019-1162 | Windows ALPC Elevation of Privilege Vulnerability
August 13, 2019
10:00 AM PT
Take action: Windows 10, version 1803 (the April 2018 Update) reaches end of service on November 12, 2019
Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019 for Home and Pro editions. We will begin updating devices running Windows 10, version 1803 to Windows 10, version 1903 (the May 2019 Update) starting July 16, 2019 to help ensure that these devices remain in a serviced and secure state. For more information, see the Windows 10, version 1903 section of the Windows release health dashboard.
August 13, 2019
10:00 AM PT
Take action: Windows 10, version 1803 (the April 2018 Update) reaches end of service on November 12, 2019
Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019 for Home and Pro editions. We will begin updating devices running Windows 10, version 1803 to Windows 10, version 1903 (the May 2019 Update) starting July 16, 2019 to help ensure that these devices remain in a serviced and secure state. For more information, see the Windows 10, version 1903 section of the Windows release health dashboard.
August 13, 2019
10:00 AM PT
Advisory: Windows Kernel Information Disclosure Vulnerability (CVE-2019-1125)
On July 9, 2019, Microsoft released a security update for a Windows kernel information disclosure vulnerability (CVE-2019-1125). Customers who have Windows Update enabled and have applied the security updates released on July 9, 2019 are protected automatically; no further configuration is necessary. For more information, see CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability in the Microsoft Security Update Guide. (Note: we are documenting this mitigation publicly today, instead of back in July, as part of a coordinated industry disclosure effort.)
August 06, 2019
10:00 AM PT
Resolved August 1, 2019 16:00 PT: Microsoft Store users may encounter blank screens when clicking on certain buttons
Some customers running the version of the Microsoft Store app released on July 29, 2019 encountered a blank screen when selecting “Switch out of S mode,” “Get Genuine,” or some “Upgrade to [version]” OS upgrade options. This issue has now been resolved and a new version of the Microsoft Store app has been released. Users who encountered this issue will need to update the Microsoft Store app on their device. If you are still encountering an issue, please see Fix problems with apps from Microsoft Store.
August 01, 2019
02:00 PM PT
Status update: Windows 10, version 1903 “D” release now available
The optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
July 26, 2019
02:00 PM PT
- + ## Errors with unknown mitigation + For errors listed in this table, contact Microsoft Support for assistance. | Hex | Cause | diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md index 83a4dc444e..950be3148c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ b/windows/security/identity-protection/hello-for-business/hello-features.md @@ -25,12 +25,238 @@ ms.date: 05/05/2018 Consider these additional features you can use after your organization deploys Windows Hello for Business. -- [Conditional Access](hello-feature-conditional-access.md) -- [Dual Enrollment](hello-feature-dual-enrollment.md) -- [Dynamic lock](hello-feature-dynamic-lock.md) -- [Multifactor Unlock](feature-multifactor-unlock.md) -- [PIN Reset](hello-feature-pin-reset.md) -- [Remote Desktop](hello-feature-remote-desktop.md) +## Conditional access + +**Requirements:** +* Azure Active Directory +* Hybrid Windows Hello for Business deployment + + +In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals:+ +* Empower the end users to be productive wherever and whenever +* Protect the corporate assets at any time + +To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. + +Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. + +## Dynamic lock + +**Requirements:** +* Windows 10, version 1703 + +Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. + +The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: + +> [!IMPORTANT] +>Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. + +``` + + + +``` + +For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** attribute defaults Phones and uses the values from the following table + +|Description|Value| +|:-------------|:-------:| +|Miscellaneous|0| +|Computer|256| +|Phone|512| +|LAN/Network Access Point|768| +|Audio/Video|1024| +|Peripheral|1280| +|Imaging|1536| +|Wearable|1792| +|Toy|2048| +|Health|2304| +|Uncategorized|7936| + +The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. + +RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. + +## PIN reset + +**Applies to:** +- Windows 10, version 1709 or later + + +### Hybrid Deployments + +**Requirements:** +- Azure Active Directory +- Hybrid Windows Hello for Business deployment +- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined +- Windows 10, version 1709 or later, **Enterprise Edition** + +The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. + +>[!IMPORTANT] +> The Microsoft PIN Reset service only works with Windows 10, version 1709 or later **Enterprise Edition**. The feature does not work with the **Pro** edition. + +#### Onboarding the Microsoft PIN reset service to your Intune tenant + +Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. + +#### Connect Azure Active Directory with the PIN reset service + +1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. +2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
+![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png)
+3. In the Azure portal, you can verify that the Microsoft PIN reset service is integrated from the **Enterprise applications**, **All applications** blade.
+![PIN reset service permissions page](images/pinreset/pin-reset-service-application.png) + +#### Configure Windows devices to use PIN reset using Group Policy +You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. +2. Edit the Group Policy object from step 1. +3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. + +#### Configure Windows devices to use PIN reset using Microsoft Intune +To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): + +##### Create a PIN Reset Device configuration profile using Microsoft Intune + +1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
+ ``` + dsregcmd /status | findstr -snip "tenantid" + ``` +3. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. +4. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. +5. In the **Custom OMA-URI Settings** blade, Click **Add**. +6. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. +7. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. +8. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. + +##### Assign the PIN Reset Device configuration profile using Microsoft Intune +1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. +3. In the device configuration profile, click **Assignments**. +4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. + +### On-premises Deployments + +**Requirements** +* Active Directory +* On-premises Windows Hello for Business deployment +* Reset from settings - Windows 10, version 1703, Professional +* Reset above Lock - Windows 10, version 1709, Professional + +On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. + +>[!IMPORTANT] +>Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. + +#### Reset PIN from Settings +1. Sign-in to Windows 10, version 1703 or later using an alternate credential. +2. Open **Settings**, click **Accounts**, click **Sign-in options**. +3. Under **PIN**, click **I forgot my PIN** and follow the instructions. + +#### Reset PIN above the Lock Screen + 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in + 2. Enter your password and press enter. + 3. Follow the instructions provided by the provisioning process + 4. When finished, unlock your desktop using your newly created PIN. + +>[!NOTE] +> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. + +## Dual Enrollment + +**Requirements** +* Hybrid and On-premises Windows Hello for Business deployments +* Enterprise Joined or Hybrid Azure joined devices +* Windows 10, version 1709 + +> [!NOTE] +> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. + +> [!IMPORTANT] +> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. + +Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. + +By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. + +With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. + +> [!IMPORTANT] +> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. + +### Configure Windows Hello for Business Dual Enroll +In this task you will +- Configure Active Directory to support Domain Administrator enrollment +- Configure Dual Enrollment using Group Policy + +#### Configure Active Directory to support Domain Administrator enrollment +The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. + +Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but will they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. + +Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. + +1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
+```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
+where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
+```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` +2. To trigger security descriptor propagation, open **ldp.exe**. +3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. +4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. +5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. +6. Click **Run** to start the task. +7. Close LDP. + +#### Configuring Dual Enrollment using Group Policy +You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. +2. Edit the Group Policy object from step 1. +3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. +5. Restart computers targeted by this Group Policy object. + +The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. + +## Remote Desktop with Biometrics + +> [!Warning] +> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + +**Requirements** +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments +- Biometric enrollments +- Windows 10, version 1809 + +Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. + +> [!IMPORTANT] +> The remote desktop with biometrics feature only works with certificate trust deployments. The feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Microsoft continues to investigate supporting this feature for key trust deployments. + +### How does it work +It start with creating cryptographic keys. Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. + +A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). + +This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). + +Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. + +### Compatibility +Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. + +![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) + +> [!IMPORTANT] +> The remote desktop with biometric feature does not work with [Dual Enrollment](#dual-enrollment) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. + ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index d1c11a2a8c..060bf7e60a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -44,7 +44,7 @@ If you upgraded your Active Directory schema to the Windows Server 2016 schema a A fundamental prerequisite of all cloud and hybrid Windows Hello for Business deployments is device registration. A user cannot provision Windows Hello for Business unless the device from which they are trying to provision has registered with Azure Active Directory. For more information about device registration, read [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/devices/overview). You can use the **dsregcmd.exe** command to determine if your device is registered to Azure Active Directory. -![dsregcmd outpout](images/aadj/dsregcmd.png) +![dsregcmd output](images/aadj/dsregcmd.png) ### CRL Distribution Point (CDP) @@ -122,7 +122,7 @@ You need to host your new certificate revocation list of a web server so Azure A 5. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Configuration Editor**. 6. In the **Section** list, navigate to **system.webServer/security/requestFiltering**. ![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) - In the list of named value-pairs in the content pane, configure **allowDoubleEscapting** to **True**. Click **Apply** in the actions pane. + In the list of named value-pairs in the content pane, configure **allowDoubleEscaping** to **True**. Click **Apply** in the actions pane. ![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) 7. Close **Internet Information Services (IIS) Manager**. @@ -264,7 +264,7 @@ Steps you will perform include: 1. Sign-in a domain controller using administrative credentials. 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. -4. Click the **Certification Path** tab. In the **Certifcation path** view, select the top most node and click **View Certificate**. +4. Click the **Certification Path** tab. In the **Certification path** view, select the top most node and click **View Certificate**. ![Certificate Path](images/aadj/certlm-cert-path-tab.png) 5. In the new **Certificate** dialog box, click the **Details** tab. Click **Copy to File**. ![Details tab and copy to file](images/aadj/certlm-root-cert-details-tab.png) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 433457239a..cf2079e8e5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -205,7 +205,7 @@ When you're using AD FS, you need to enable the following WS-Trust endpoints: `/adfs/services/trust/13/certificatemixed` > [!WARNING] -> Both **adfs/services/trust/2005/windowstransport** or **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust WIndows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**. +> Both **adfs/services/trust/2005/windowstransport** and **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust Windows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**. > [!NOTE] >If you don’t have AD FS as your on-premises federation service, follow the instructions from your vendor to make sure they support WS-Trust 1.3 or 2005 endpoints and that these are published through the Metadata Exchange file (MEX). diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 081ef80a5d..73d306bba1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -79,7 +79,7 @@ The key trust type does not require issuing authentication certificates to end u The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. > [!NOTE] -> RDP does not support authentication with Windows Hello for business key trust deployments. RDP is only supported with certificate trust deployments at this tim +> RDP does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. #### Device registration @@ -91,6 +91,9 @@ The built-in Windows Hello for Business provisioning experience creates a hardwa #### Multifactor authentication +> [!IMPORTANT] +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. + The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user’s weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential. Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 281385a751..f6259064c6 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -108,21 +108,22 @@ ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/overview-hunting.md) -#### [Query data using Advanced hunting](microsoft-defender-atp/advanced-hunting.md) -#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) +#### [Learn the query language](microsoft-defender-atp/advanced-hunting.md) +#### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) #### [Advanced hunting schema reference]() -##### [All tables in the Advanced hunting schema](microsoft-defender-atp/advanced-hunting-reference.md) -##### [AlertEvents table](microsoft-defender-atp/advanced-hunting-alertevents-table.md) -##### [FileCreationEvents table](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) -##### [ImageLoadEvents table](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) -##### [LogonEvents table](microsoft-defender-atp/advanced-hunting-logonevents-table.md) -##### [MachineInfo table](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) -##### [MachineNetworkInfo table](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) -##### [MiscEvents table](microsoft-defender-atp/advanced-hunting-miscevents-table.md) -##### [NetworkCommunicationEvents table](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) -##### [ProcessCreationEvents table](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) -##### [RegistryEvents table](microsoft-defender-atp/advanced-hunting-registryevents-table.md) -#### [Advanced hunting query language best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +##### [Understand the schema](microsoft-defender-atp/advanced-hunting-reference.md) +##### [AlertEvents](microsoft-defender-atp/advanced-hunting-alertevents-table.md) +##### [FileCreationEvents](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) +##### [ImageLoadEvents](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) +##### [LogonEvents](microsoft-defender-atp/advanced-hunting-logonevents-table.md) +##### [MachineInfo](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) +##### [MachineNetworkInfo](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) +##### [MiscEvents](microsoft-defender-atp/advanced-hunting-miscevents-table.md) +##### [NetworkCommunicationEvents](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) +##### [ProcessCreationEvents](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) +##### [RegistryEvents](microsoft-defender-atp/advanced-hunting-registryevents-table.md) +#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) #### [Custom detections]() diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md index 2c39b15201..2fa857956a 100644 --- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md +++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium ms.author: dansimp author: dansimp -ms.date: 09/12/2019 +ms.date: 10/04/2019 ms.reviewer: dansimp manager: dansimp audience: ITPro @@ -20,21 +20,181 @@ audience: ITPro Microsoft recommends [a layered approach to securing removable media](https://aka.ms/devicecontrolblog), and Microsoft Defender ATP provides multiple monitoring and control features to help prevent threats in unauthorized peripherals from compromising your devices: -1. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling: - - [Windows Defender Antivirus real-time protection (RTP)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) to scan removable storage for malware. - - The [Attack Surface Reduction (ASR) USB rule](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) to block untrusted and unsigned processes that run from USB. - - [Direct Memory Access (DMA) protection settings](#protect-against-direct-memory-access-dma-attacks) to mitigate DMA attacks, including [Kernel DMA Protection for Thunderbolt](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and blocking DMA until a user signs in. +1. [Discover plug and play connected events for peripherals in Microsoft Defender ATP advanced hunting](#discover-plug-and-play-connected-events). Identify or investigate suspicious usage activity. -2. [Detect plug and play connected events for peripherals in Microsoft Defender ATP advanced hunting](#detect-plug-and-play-connected-events) - - Identify or investigate suspicious usage activity. Create customized alerts based on these PnP events or any other Microsoft Defender ATP events with [custom detection rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-detection-rules). +2. Configure to allow or block only certain removable devices and prevent threats. + 1. [Allow or block removable devices](#allow-or-block-removable-devices) based on granular configuration to deny write access to removable disks and approve or deny devices by USB vendor IDs, product IDs, device IDs, or a combination. Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. -3. [Respond to threats](#respond-to-threats) from peripherals in real-time based on properties reported by each peripheral: - - Granular configuration to deny write access to removable disks and approve or deny devices by USB vendor code, product code, device IDs, or a combination. - - Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. + 2. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling: + - Windows Defender Antivirus real-time protection (RTP) to scan removable storage for malware. + - The Attack Surface Reduction (ASR) USB rule to block untrusted and unsigned processes that run from USB. + - Direct Memory Access (DMA) protection settings to mitigate DMA attacks, including Kernel DMA Protection for Thunderbolt and blocking DMA until a user signs in. +3. [Create customized alerts and response actions](#create-customized-alerts-and-response-actions) to monitor usage of removable devices based on these plug and play events or any other Microsoft Defender ATP events with [custom detection rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). + +4. [Respond to threats](#respond-to-threats) from peripherals in real-time based on properties reported by each peripheral. >[!Note] >These threat reduction measures help prevent malware from coming into your environment. To protect enterprise data from leaving your environment, you can also configure data loss prevention measures. For example, on Windows 10 devices you can configure [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) and [Windows Information Protection](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure), which will encrypt company data even if it is stored on a personal device, or use the [Storage/RemovableDiskDenyWriteAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-storage#storage-removablediskdenywriteaccess) to deny write access to removable disks. Additionally, you can [classify and protect files on Windows devices](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview) (including their mounted USB devices) by using Microsoft Defender ATP and Azure Information Protection. +## Discover plug and play connected events + +You can view plug and play connected events in Microsoft Defender ATP advanced hunting to identify suspicious usage activity or perform internal investigations. +For examples of Microsoft Defender ATP advanced hunting queries, see the [Microsoft Defender ATP hunting queries GitHub repo](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). + +Sample Power BI report templates are available for Microsoft Defender ATP that you can use for Advanced hunting queries. With these sample templates, including one for device control, you can integrate the power of Advanced hunting into Power BI. See the [GitHub repository for PowerBI templates](https://github.com/microsoft/MDATP-PowerBI-Templates) for more information. See [Create custom reports using Power BI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi) to learn more about Power BI integration. + +## Allow or block removable devices +The following table describes the ways Microsoft Defender ATP can allow or block removable devices based on granular configuration. + +| Control | Description | +|----------|-------------| +| [Restrict USB drives and other peripherals](#restrict-usb-drives-and-other-peripherals) | You can allow/prevent users to install only the USB drives and other peripherals included on a list of authorized/unauthorized devices or device types. | +| [Block installation and usage of removable storage](#block-installation-and-usage-of-removable-storage) | You can't install or use removable storage. | +| [Only allow installation and usage of specifically approved peripherals](#only-allow-installation-and-usage-of-specifically-approved-peripherals) | You can only install and use approved peripherals that report specific properties in their firmware. | +| [Prevent installation of specifically prohibited peripherals](#prevent-installation-of-specifically-prohibited-peripherals) | You can't install or use prohibited peripherals that report specific properties in their firmware. | +| [Limit services that use Bluetooth](#limit-services-that-use-bluetooth) | You can limit the services that can use Bluetooth. | +| [Use Microsoft Defender ATP baseline settings](#use-microsoft-defender-atp-baseline-settings) | You can set the recommended configuration for ATP by using the Microsoft Defender ATP security baseline. | + +### Restrict USB drives and other peripherals + +To prevent malware infections or data loss, an organization may restrict USB drives and other peripherals. The following table describes the ways Microsoft Defender ATP can help prevent installation and usage of USB drives and other peripherals. + +| Control | Description +|----------|-------------| +| [Allow installation and usage of USB drives and other peripherals](#allow-installation-and-usage-of-usb-drives-and-other-peripherals) | Allow users to install only the USB drives and other peripherals included on a list of authorized devices or device types | +| [Prevent installation and usage of USB drives and other peripherals](#prevent-installation-and-usage-of-usb-drives-and-other-peripherals) | Prevent users from installing USB drives and other peripherals included on a list of unauthorized devices and device types | + +All of the above controls can be set through the Intune [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows). The relevant policies are located here in the Intune Administrator Templates: + +![AdminTemplates](images/admintemplates.png) + +>[!Note] +>Using Intune, you can apply device configuration policies to Azure AD user and/or device groups. +The above policies can also be set through the [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) and the [Device Installation GPOs](https://docs.microsoft.com/previous-versions/dotnet/articles/bb530324(v=msdn.10)). + +> [!Note] +> Always test and refine these settings with a pilot group of users and devices first before applying them in production. +For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://www.microsoft.com/security/blog/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/). + +#### Allow installation and usage of USB drives and other peripherals + +One way to approach allowing installation and usage of USB drives and other peripherals is to start by allowing everything. Afterwards, you can start reducing the allowable USB drivers and other peripherals. + +>[!Note] +>Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. + +1. Enable **Prevent installation of devices not described by other policy settings** to all users. +2. Enable **Allow installation of devices using drivers that match these device setup classes** for all [device setup classes](https://docs.microsoft.com/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors). + +To enforce the policy for already installed devices, apply the prevent policies that have this setting. + +When configuring the allow device installation policy, you must allow all parent attributes as well. You can view the parents of a device by opening Device Manager and view by connection. + +![Devices by connection](images/devicesbyconnection.png) + +In this example, the following classes needed to be added: HID, Keyboard, and {36fc9e60-c465-11cf-8056-444553540000}. See [Microsoft-provided USB drivers](https://docs.microsoft.com/windows-hardware/drivers/usbcon/supported-usb-classes) for more information. + +![Device host controller](images/devicehostcontroller.jpg) + +If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device ID that you want to add. To find the vendor or product IDs, see [Look up device vendor ID or product ID](#look-up-device-vendor-id-or-product-id). + +For example: + +1. Remove class USBDevice from the **Allow installation of devices using drivers that match these device setup**. +2. Add the vendor ID or product ID to allow in the **Allow installation of device that match any of these device IDs**. + + +#### Prevent installation and usage of USB drives and other peripherals + +If you want to prevent the installation of a device class or certain devices, you can use the prevent device installation policies: + +1. Enable **Prevent installation of devices that match any of these device IDs**. +2. Enable **Prevent installation of devices that match these device setup classes**. + +> [!Note] +> The prevent device installation policies take precedence over the allow device installation policies. + +The **Prevent installation of devices that match any of these device IDs** policy allows you to specify a list of vendor or product IDs for devices that Windows is prevented from installing. + +To prevent installation of devices that match any of these device IDs: + +1. [Look up device vendor ID or product ID](#look-up-device-vendor-id-or-product-id) for devices that you want Windows to prevent from installing. +![Look up vendor or product ID](images/lookup-vendor-product-id.png) +2. Enable **Prevent installation of devices that match any of these device IDs** and add the vendor or product IDs to the list. +![Add vendor ID to prevent list](images/add-vendor-id-to-prevent-list.png) + +#### Look up device vendor ID or product ID +You can use Device Manager to look up a device vendor or product ID. + +1. Open Device Manager. +2. Click **View** and select **Devices by connection**. +3. From the tree, right-click the device and select **Properties**. +4. In the dialog box for the selected device, click the **Details** tab. +5. Click the **Property** drop-down list and select **Hardware Ids**. +6. Right-click the top ID value and select **Copy**. + +For information on vendor and product ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers). + +For information on vendor IDs, see [USB members](https://www.usb.org/members). + +The following is an example for looking up a device vendor ID or product ID using PowerShell: +``` PowerShell +Get-WMIObject -Class Win32_DiskDrive | +Select-Object -Property * +``` + +### Block installation and usage of removable storage + +1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). +2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. + + ![Create device configuration profile](images/create-device-configuration-profile.png) + +3. Use the following settings: + + - Name: Type a name for the profile + - Description: Type a description + - Platform: Windows 10 and later + - Profile type: Device restrictions + + ![Create profile](images/create-profile.png) + +4. Click **Configure** > **General**. + +5. For **Removable storage** and **USB connection (mobile only)**, choose **Block**. **Removable storage** includes USB drives, whereas **USB connection (mobile only)** excludes USB charging but includes other USB connections on mobile devices only. + + ![General settings](images/general-settings.png) + +6. Click **OK** to close **General** settings and **Device restrictions**. + +7. Click **Create** to save the profile. + +### Only allow installation and usage of specifically approved peripherals + +Peripherals that are allowed to be installed can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks and allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + +For a SyncML example that allows installation of specific device IDs, see [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-allowinstallationofmatchingdeviceids). To allow specific device classes, see [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-allowinstallationofmatchingdevicesetupclasses). +Allowing installation of specific devices requires also enabling [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings). + +### Prevent installation of specifically prohibited peripherals + +Microsoft Defender ATP blocks installation and usage of prohibited peripherals by using either of these options: + +- [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows) can block any device with a matching hardware ID or setup class. +- [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) with a custom profile in Intune. You can [prevent installation of specific device IDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceids) or [prevent specific device classes](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdevicesetupclasses). + +### Limit services that use Bluetooth + +Using Intune, you can limit the services that can use Bluetooth through the ["Bluetooth allowed services"](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist-usage-guide). The default state of "Bluetooth allowed services" settings means everything is allowed. As soon as a service is added, that becomes the allowed list. If the customer adds the Keyboards and Mice values, and doesn’t add the file transfer GUIDs, file transfer should be blocked. + +![Bluetooth](images/bluetooth.png) + +### Use Microsoft Defender ATP baseline settings + +The Microsoft Defender ATP baseline settings represent the recommended configuration for ATP. Configuration settings for baseline are located in the edit profile page of the configuration settings. + +![Baselines](images/baselines.png) + ## Prevent threats from removable storage Removable storage devices can introduce additional security risk to your organization. Microsoft Defender ATP can help identify and block malicious files on removable storage devices. @@ -46,15 +206,15 @@ Note that if you block USB devices or any other device classes using the device >[!NOTE] >Always test and refine these settings with a pilot group of users and devices first before widely distributing to your organization. -The following table describes the ways Microsoft Defender ATP can help prevent installation and usage of USB peripherals. +The following table describes the ways Microsoft Defender ATP can help prevent threats from removable storage. For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://aka.ms/devicecontrolblog). | Control | Description | |----------|-------------| -| [Block installation and usage of removable storage](#block-installation-and-usage-of-removable-storage) | Users can't install or use removable storage | -| [Only allow installation and usage of specifically approved peripherals](#only-allow-installation-and-usage-of-specifically-approved-peripherals) | Users can only install and use approved peripherals that report specific properties in their firmware | -| [Prevent installation of specifically prohibited peripherals](#prevent-installation-of-specifically-prohibited-peripherals) | Users can't install or use prohibited peripherals that report specific properties in their firmware | +| [Enable Windows Defender Antivirus Scanning](#enable-windows-defender-antivirus-scanning) | Enable Windows Defender Antivirus scanning for real-time protection or scheduled scans.| +| [Block untrusted and unsigned processes on USB peripherals](#block-untrusted-and-unsigned-processes-on-usb-peripherals) | Block USB files that are unsigned or untrusted. | +| [Protect against Direct Memory Access (DMA) attacks](#protect-against-direct-memory-access-dma-attacks) | Configure settings to protect against DMA attacks. | >[!NOTE] >Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. @@ -76,7 +236,7 @@ Protecting authorized removable storage with Windows Defender Antivirus requires End-users might plug in removable devices that are infected with malware. To prevent infections, a company can block USB files that are unsigned or untrusted. -Alternatively, companies can leverage the audit feature of attack surface reduction rules to monitor the activity of untrusted and unsigned processes that execute on a USB peripheral. +Alternatively, companies can leverage the audit feature of [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) to monitor the activity of untrusted and unsigned processes that execute on a USB peripheral. This can be done by setting **Untrusted and unsigned processes that run from USB** to either **Block** or **Audit only**, respectively. With this rule, admins can prevent or audit unsigned or untrusted executable files from running from USB removable drives, including SD cards. Affected file types include executable files (such as .exe, .dll, or .scr) and script files such as a PowerShell (.ps), VisualBasic (.vbs), or JavaScript (.js) files. @@ -122,142 +282,15 @@ DMA attacks can lead to disclosure of sensitive information residing on a PC, or - [Block DMA until a user signs in](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dataprotection#dataprotection-allowdirectmemoryaccess) - [Block all connections via the Thunderbolt ports (including USB devices)](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d) -### Restrict USB Drives and Other Peripherals +## Create customized alerts and response actions -To prevent malware infections or data loss, an organization may restrict USB drives and other peripherals. The following table describes the ways Microsoft Defender Advanced Threat Protection can help prevent installation and usage of USB drives and other peripherals. - - Control | Description --|- - Allow installation and usage of USB drives and other peripherals | Allow users to install only the USB drives and other peripherals included on a list of authorized devices or device types - Prevent installation and usage of USB drives and other peripherals | Prevent users from installing USB drives and other peripherals included on a list of unauthorized devices and device types - -All of the above controls can be set through the Intune [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows). The relevant policies are located here in the Intune Administrator Templates: - -![AdminTemplates](images/admintemplates.png) - ->[!Note] ->Using Intune, you can apply device configuration policies to AAD user and/or device groups. -The above policies can also be set through the [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) and the [Device Installation GPOs](https://docs.microsoft.com/previous-versions/dotnet/articles/bb530324(v=msdn.10)). - -> [!Note] -> Always test and refine these settings with a pilot group of users and devices first before applying them in production. -For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://www.microsoft.com/security/blog/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/). - -### Allow installation and usage of USB drives and other peripherals - -One way to approach allowing installation and usage of USB drives and other peripherals is to start by allowing everything. Afterwards, you can start reducing the allowable USB drivers and other peripherals. - ->[!Note] ->Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. -> ->1. Enable **prevent installation of devices not described by other policy settings** to all users. ->2. Enable **allow installation of devices using drivers that match these device setup classes** for all [device setup classes](https://docs.microsoft.com/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors). -To enforce the policy for already installed devices, apply the prevent policies that have this setting. - -When configuring the allow device installation policy, you will need to allow all parent attributes as well. You can view the parents of a device by opening device manager and view by connection. - -![Device by Connection](images/devicesbyconnection.png) - -In this example, the following classes needed to be added: HID, Keyboard, and {36fc9e60-c465-11cf-8056-444553540000}. More information on [Microsoft-provided USB drivers](https://docs.microsoft.com/windows-hardware/drivers/usbcon/supported-usb-classes). - -![Device host controller](images/devicehostcontroller.jpg) - -If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device id that you want to add. For example, - -1. Remove class USBDevice from the **allow installation of devices using drivers that match these device setup** -2. Add the VID/PID to allow in the **allow installation of device that match any of these device IDs** - -> [!Note] -> How to locate the VID/PID: Using Device Manager; right click on the device and select properties. Click details tab, click property drop down list, and choose hardware Ids. Right click the top ID value and select copy. - ->Using PowerShell: Get-WMIObject -Class Win32_DiskDrive | -Select-Object -Property * ->For the typical format for the USB ID please reference the following link; (https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers) - -### Prevent installation and usage of USB drives and other peripherals - -If you want to prevent a device class or certain devices, you can use the prevent device installation policies. - -1. Enable **Prevent installation of devices that match any of these device IDs**. -2. Enable the **Prevent installation of devices that match these device setup classes policy**. - -> [!Note] -> The prevent device installation policies take precedence over the allow device installation policies. - -### Block installation and usage of removable storage - -1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). -2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. - - ![Create device configuration profile](images/create-device-configuration-profile.png) - -3. Use the following settings: - - - Name: Type a name for the profile - - Description: Type a description - - Platform: Windows 10 and later - - Profile type: Device restrictions - - ![Create profile](images/create-profile.png) - -4. Click **Configure** > **General**. - -5. For **Removable storage** and **USB connection (mobile only)**, choose **Block**. **Removable storage** includes USB drives, where **USB connection (mobile only)** excludes USB charging but includes other USB connections on mobile devices only. - - ![General settings](images/general-settings.png) - -6. Click **OK** to close **General** settings and **Device restrictions**. - -7. Click **Create** to save the profile. - -### Only allow installation and usage of specifically approved peripherals - -Peripherals that are allowed to be installed can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks and allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. - -For a SyncML example that allows installation of specific device IDs, see [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-allowinstallationofmatchingdeviceids). To allow specific device classes, see [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-allowinstallationofmatchingdevicesetupclasses). -Allowing installation of specific devices requires also enabling [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings). - -### Prevent installation of specifically prohibited peripherals - -Microsoft Defender ATP blocks installation and usage of prohibited peripherals by using either of these options: - -- [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows) can block any device with a matching hardware ID or setup class. -- [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) with a custom profile in Intune. You can [prevent installation of specific device IDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceids) or [prevent specific device classes](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdevicesetupclasses). - -### Security Baseline - -The Microsoft Defender Advanced Threat Protection (ATP) baseline settings, represent the recommended configuration for ATP. Configuration settings for baseline are located here in the edit profile page of the configuration settings. - -![Baselines](images/baselines.png) - -### Bluetooth - -Using Intune, you can limited the services that can use Bluetooth through the “Bluetooth allowed services”. The default state of “Bluetooth allowed services” settings means everything is allowed. As soon as a service is added, that becomes the allowed list. If the customer adds the Keyboards and Mice values, and don’t add the file transfer GUIDs, file transfer should be blocked. - -![Bluetooth](images/bluetooth.png) - -## Respond to threats - -You can create custom alerts and automatic response actions with the [Microsoft Defender ATP Custom Detection Rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). Response actions within the custom detection cover both machine and file level actions. You can also create alerts and automatic response actions using [PowerApps](https://powerapps.microsoft.com/) and [Flow](https://flow.microsoft.com/) with the [Microsoft Defender ATP connector](https://docs.microsoft.com/connectors/wdatp/). The connector supports actions for investigation, threat scanning, and restricting running applications. It is one of over 200 pre-defined connectors including Outlook, Teams, Slack, and more. Custom connectors can also be built. See [Connectors](https://docs.microsoft.com/connectors/) to learn more about connectors. - -For example, using either approach, you can automatically have the Microsoft Defender Antivirus run when a USB device is mounted onto a machine. - -## Detect plug and play connected events - -You can view plug and play connected events in Microsoft Defender ATP advanced hunting to identify suspicious usage activity or perform internal investigations. -For examples of Microsoft Defender ATP advanced hunting queries, see the [Microsoft Defender ATP hunting queries GitHub repo](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). - -Sample Power BI report templates are available for Microsoft Defender ATP that you can use for Advanced hunting queries. With these sample templates, including one for device control, you can integrate the power of Advanced hunting into Power BI. See the [GitHub repository for PowerBI templates](https://github.com/microsoft/MDATP-PowerBI-Templates) for more information. See [Create custom reports using Power BI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi) to learn more about Power BI integration. - -### Custom Alerts and Response Actions - -You can create custom alerts and response actions with the WDATP Connector and the Custom Detection Rules: +You can create custom alerts and response actions with the WDATP Connector and the custom detection rules: **Wdatp Connector response Actions:** **Investigate:** Initiate investigations, collect investigation package, and isolate a machine. -**Threat Scanning** on USB devices +**Threat Scanning** on USB devices. **Restrict execution of all applications** on the machine except a predefined set MDATP connector is one of over 200 pre-defined connectors including Outlook, Teams, Slack, etc. Custom connectors can be built. @@ -267,6 +300,14 @@ MDATP connector is one of over 200 pre-defined connectors including Outlook, Tea Both machine and file level actions can be applied. - [More information on Custom Detection Rules Response Actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules) +For information on device control related advance hunting events and examples on how to create custom alerts, see [Advanced hunting updates: USB events, machine-level actions, and schema changes](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Advanced-hunting-updates-USB-events-machine-level-actions-and/ba-p/824152). + +## Respond to threats + +You can create custom alerts and automatic response actions with the [Microsoft Defender ATP Custom Detection Rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). Response actions within the custom detection cover both machine and file level actions. You can also create alerts and automatic response actions using [PowerApps](https://powerapps.microsoft.com/) and [Flow](https://flow.microsoft.com/) with the [Microsoft Defender ATP connector](https://docs.microsoft.com/connectors/wdatp/). The connector supports actions for investigation, threat scanning, and restricting running applications. It is one of over 200 pre-defined connectors including Outlook, Teams, Slack, and more. Custom connectors can also be built. See [Connectors](https://docs.microsoft.com/connectors/) to learn more about connectors. + +For example, using either approach, you can automatically have the Microsoft Defender Antivirus run when a USB device is mounted onto a machine. + ## Related topics - [Configure real-time protection for Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) diff --git a/windows/security/threat-protection/device-control/images/add-vendor-id-to-prevent-list.png b/windows/security/threat-protection/device-control/images/add-vendor-id-to-prevent-list.png new file mode 100644 index 0000000000..c2cec3aca1 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/add-vendor-id-to-prevent-list.png differ diff --git a/windows/security/threat-protection/device-control/images/admintemplates.png b/windows/security/threat-protection/device-control/images/admintemplates.png index e95c44f251..4bf90b2b8a 100644 Binary files a/windows/security/threat-protection/device-control/images/admintemplates.png and b/windows/security/threat-protection/device-control/images/admintemplates.png differ diff --git a/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg b/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg index fd0666ef4c..cd814377be 100644 Binary files a/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg and b/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg differ diff --git a/windows/security/threat-protection/device-control/images/devicesbyconnection.png b/windows/security/threat-protection/device-control/images/devicesbyconnection.png index 089a1b70fe..4743358c57 100644 Binary files a/windows/security/threat-protection/device-control/images/devicesbyconnection.png and b/windows/security/threat-protection/device-control/images/devicesbyconnection.png differ diff --git a/windows/security/threat-protection/device-control/images/lookup-vendor-product-id.png b/windows/security/threat-protection/device-control/images/lookup-vendor-product-id.png new file mode 100644 index 0000000000..55be4d714a Binary files /dev/null and b/windows/security/threat-protection/device-control/images/lookup-vendor-product-id.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index e8fd745ba1..2904a8e60e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The AlertEvents table in the Advanced hunting schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. +The AlertEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -47,8 +47,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Table | string | Table that contains the details of the event | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index 75465b34a5..5acedaa5f1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -1,55 +1,50 @@ --- title: Advanced hunting best practices in Microsoft Defender ATP description: Learn about Advanced hunting best practices such as what filters and keywords to use to effectively query data. -keywords: advanced hunting, best practices, keyword, filters, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics +keywords: advanced hunting, best practices, keyword, filters, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macapara -author: mjcaparas +ms.author: lomayor +author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/24/2018 +ms.topic: article +ms.date: 09/25/2019 --- -# Advanced hunting query best practices in Microsoft Defender ATP +# Advanced hunting query best practices **Applies to:** - - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink) -## Performance best practices -The following best practices serve as a guideline of query performance best practices and for you to get faster results and be able to run complex queries. -- When trying new queries, always use `limit` to avoid extremely large result sets or use `count` to assess the size of the result set. -- Use time filters first. Ideally, limit your queries to 7 days. +## Optimize query performance +Apply the recommendations to get results faster and avoid timeouts while running complex queries: +- When trying new queries, always use `limit` to avoid extremely large result sets. You can also initially assess the size of the result set using `count`. +- Use time filters first. Ideally, limit your queries to seven days. - Put filters that are expected to remove most of the data in the beginning of the query, right after the time filter. - Use the `has` operator over `contains` when looking for full tokens. -- Use looking in specific column rather than using full text search across all columns. -- When joining between two tables, specify the table with fewer rows first. -- When joining between two tables, project only needed columns from both sides of the join. +- Look in a specific column rather than running full text searches across all columns. +- When joining tables, specify the table with fewer rows first. +- `project` only the necessary columns from tables you've joined. ->[!Tip] +>[!TIP] >For more guidance on improving query performance, read [Kusto query best practices](https://docs.microsoft.com/azure/kusto/query/best-practices). ## Query tips and pitfalls -### Using process IDs -Process IDs (PIDs) are recycled in Windows and reused for new processes and therefore can't serve as a unique identifier for a specific process. -To address this issue, Microsoft Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. +### Queries with process IDs +Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `MachineId` or `ComputerName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). -So, when you join data based on a specific process or summarize data for each process, you'll need to use a machine identifier (either `MachineId` or `ComputerName`), a process ID (`ProcessId` or `InitiatingProcessId`) and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`) +The following example query finds processes that access more than 10 IP addresses over port 445 (SMB), possibly scanning for file shares. -The following example query is created to find processes that access more than 10 IP addresses over port 445 (SMB), possibly scanning for file shares. - -Example query: ``` NetworkCommunicationEvents | where RemotePort == 445 and EventTime > ago(12h) and InitiatingProcessId !in (0, 4) @@ -59,22 +54,19 @@ NetworkCommunicationEvents The query summarizes by both `InitiatingProcessId` and `InitiatingProcessCreationTime` so that it looks at a single process, without mixing multiple processes with the same process ID. -### Using command lines - +### Queries with command lines Command lines can vary. When applicable, filter on file names and do fuzzy matching. -There are numerous ways to construct a command line to accomplish a task. +There are numerous ways to construct a command line to accomplish a task. For example, an attacker could reference an image file with or without a path, without a file extension, using environment variables, or with quotes. In addition, the attacker could also change the order of parameters or add multiple quotes and spaces. -For example, a malicious attacker could specify the process image file name without a path, with full path, without the file extension, using environment variables, add quotes, and others. In addition, the attacker can also change the order of some parameters, add multiple quotes or spaces, and much more. +To create more durable queries using command lines, apply the following practices: -To create more durable queries using command lines, we recommended the following guidelines: - -- Identify the known processes (such as net.exe, psexec.exe, and others) by matching on the filename fields, instead of filtering on the command line field. -- When querying for command line arguments, don't look for an exact match on multiple unrelated arguments in a certain order. Instead, use regular expressions or use multiple separate contains operators. +- Identify the known processes (such as *net.exe* or *psexec.exe*) by matching on the filename fields, instead of filtering on the command-line field. +- When querying for command-line arguments, don't look for an exact match on multiple unrelated arguments in a certain order. Instead, use regular expressions or use multiple separate contains operators. - Use case insensitive matches. For example, use `=~`, `in~`, `contains` instead of `==`, `in` or `contains_cs` -- To mitigate DOS command line obfuscation techniques, consider removing quotes, replacing commas with spaces, and replacing multiple consecutive spaces with a single space. This is just the start of handling DOS obfuscation techniques, but it does mitigate the most common ones. +- To mitigate DOS command-line obfuscation techniques, consider removing quotes, replacing commas with spaces, and replacing multiple consecutive spaces with a single space. Note that there are more complex DOS obfuscation techniques that require other approaches, but these can help address the most common ones. -The following example query shows various ways to construct a query that looks for the file *net.exe* to stop the Windows Defender Firewall service: +The following examples show various ways to construct a query that looks for the file *net.exe* to stop the Windows Defender Firewall service: ``` // Non-durable query - do not use @@ -93,4 +85,9 @@ ProcessCreationEvents | where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc" ``` ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-belowfoldlink) \ No newline at end of file +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-belowfoldlink) + +## Related topics +- [Advanced hunting overview](overview-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md index 2b414ee047..04b9c39707 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The FileCreationEvents table in the Advanced hunting schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. +The FileCreationEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -73,8 +73,6 @@ For information on other tables in the Advanced hunting schema, see [the Advanc | IsAzureInfoProtectionApplied | boolean | Indicates whether the file is encrypted by Azure Information Protection | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md index 160e833850..6f682f0578 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The ImageLoadEvents table in the Advanced hunting schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. +The ImageLoadEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -59,8 +59,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md index c5279cdd3d..0ef85d6027 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The LogonEvents table in the Advanced hunting schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +The LogonEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -67,8 +67,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md index abe7b49af5..5dd8272cc3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MachineInfo table in the Advanced hunting schema contains information about machines in the organization, including OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The MachineInfo table in the [Advanced hunting](overview-hunting.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -48,8 +48,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md index 717019c475..6ed1b6e9b3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MachineNetworkInfo table in the Advanced hunting schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The MachineNetworkInfo table in the [Advanced hunting](overview-hunting.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -49,8 +49,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | IPAddresses | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md index deeef6fd8a..6a3f93d80f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MiscEvents table in the Advanced hunting schema contains information about multiple event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The MiscEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -80,8 +80,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md index 9427ce74c8..b1f12de327 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The NetworkCommunicationEvents table in the Advanced hunting schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. +The NetworkCommunicationEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -63,8 +63,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md index 43a0651a0f..84aeeafcd5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The ProcessCreationEvents table in the Advanced hunting schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. +The ProcessCreationEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -71,8 +71,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md index 140286d974..88124e8c37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md @@ -8,27 +8,26 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macapara -author: mjcaparas +ms.author: lomayor +author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 07/24/2019 +ms.date: 09/25/2019 --- -# Advanced hunting reference in Microsoft Defender ATP +# Understand the Advanced hunting schema **Applies to:** - - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -## Advanced hunting table reference +## Schema tables -The Advanced hunting schema is made up of multiple tables that provide either event information or information about certain entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. +The [Advanced hunting](overview-hunting.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. The following reference lists all the tables in the Advanced hunting schema. Each table name links to a page describing the column names for that table. @@ -48,6 +47,5 @@ Table and column names are also listed within the Microsoft Defender Security Ce | **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | ## Related topics - -- [Query data using Advanced hunting](advanced-hunting.md) -- [Best practices for Advanced hunting query-writing](advanced-hunting-best-practices.md) +- [Advanced hunting overview](overview-hunting.md) +- [Learn the query language](advanced-hunting.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md index 3099373d13..b5150e366e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md @@ -26,9 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The RegistryEvents table in the Advanced hunting schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. +The RegistryEvents table in the [Advanced hunting](overview-hunting.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| @@ -61,8 +61,6 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) -- [Advanced hunting query best practices](advanced-hunting-best-practices.md) -- [Query data using Advanced hunting](advanced-hunting.md) +- [Learn the query language](advanced-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md new file mode 100644 index 0000000000..a7f66ba422 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -0,0 +1,64 @@ +--- +title: Use shared queries in advanced hunting +description: Take advantage of shared advanced hunting queries. Share your queries to the public or to your organization. +keywords: advanced hunting, atp query, query atp data, atp telemetry, events, events telemetry, kusto, github repo +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 09/25/2019 +--- + +# Use shared queries in Advanced hunting + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) + +[Advanced hunting](overview-hunting.md) queries can be shared among users in the same organization. You can also find queries shared publicly on GitHub. These queries let you quickly pursue specific threat hunting scenarios without having to write queries from scratch. + +![Image of shared queries](images/atp-advanced-hunting-shared-queries.png) + +## Save, modify, and share a query +You can save a new or existing query so that it is only accessible to you or shared with other users in your organization. + +1. Type a new query or load an existing one from under **Shared queries** or **My queries**. + +2. Select **Save** or **Save as** from the save options. To avoid overwriting an existing query, choose **Save as**. + +3. Enter a name for the query. + + ![Image of saving a query](images/advanced-hunting-save-query.png) + +4. Select the folder where you'd like to save the query. + - **Shared queries** — shared to all users in the your organization + - **My queries** — accessible only to you + +5. Select **Save**. + +## Delete or rename a query +1. Right-click on a query you want to rename or delete. + + ![Image of delete query](images/atp_advanced_hunting_delete_rename.png) + +2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query. + +## Access queries in the GitHub repository +Microsoft security researchers regularly share Advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). + +>[!TIP] +>Microsoft security researchers also provide Advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center. + +## Related topics +- [Advanced hunting overview](overview-hunting.md) +- [Learn the query language](advanced-hunting.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md index 9ce09a700b..6ef8ce1994 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md @@ -1,153 +1,143 @@ --- -title: Query data using Advanced hunting in Microsoft Defender ATP -description: Learn about Advanced hunting in Microsoft Defender ATP and how to query ATP data. -keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics +title: Learn the Advanced hunting query language +description: Get an overview of the common operators and other aspects of the Advanced hunting query language you can use to formulate queries +keywords: advanced hunting, atp query, query atp data, atp telemetry, events, events telemetry, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macapara -author: mjcaparas +ms.author: lomayor +author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 08/15/2018 +ms.date: 09/25/2019 --- -# Query data using Advanced hunting in Microsoft Defender ATP +# Learn the Advanced hunting query language + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) +Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-reference.md) specifically structured for Advanced hunting. To understand these concepts better, run your first query. -To get you started in querying your data, you can use the Basic or Advanced query examples, which have some preloaded queries to help you understand the basic query syntax. +## Try your first query -![Image of Advanced hunting window](images/atp-advanced-hunting.png) +In Microsoft Defender Security Center, go to **Advanced hunting** to run your first query. Use the following example: -## Use advanced hunting to query data +``` +// Finds PowerShell execution events that could involve a download. +ProcessCreationEvents +| where EventTime > ago(7d) +| where FileName in ("powershell.exe", "POWERSHELL.EXE", "powershell_ise.exe", "POWERSHELL_ISE.EXE") +| where ProcessCommandLine has "Net.WebClient" + or ProcessCommandLine has "DownloadFile" + or ProcessCommandLine has "Invoke-WebRequest" + or ProcessCommandLine has "Invoke-Shellcode" + or ProcessCommandLine contains "http:" +| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine +| top 100 by EventTime' +``` -A typical query starts with a table name followed by a series of operators separated by **|**. - -In the following example, we start with the table name **ProcessCreationEvents** and add piped elements as needed. +This is how it will look like in Advanced hunting. ![Image of Microsoft Defender ATP Advanced hunting query](images/advanced-hunting-query-example.png) -First, we define a time filter to review only records from the previous seven days. +### Describe the query and specify the table to search +The query starts with a short comment describing what it is for. This helps if you later decide to save your query and share it with others in your organization. -We then add a filter on the _FileName_ to contain only instances of _powershell.exe_. +``` +// Finds PowerShell execution events that could involve a download. +ProcessCreationEvents +``` -Afterwards, we add a filter on the _ProcessCommandLine_. +The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `ProcessCreationEvents` and add piped elements as needed. -Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**. +### Set the time range +The first piped element is a time filter scoped within the previous seven days. Keeping the time range as narrow as possible ensures that queries perform well, return manageable results, and don't time out. -You have the option of expanding the screen view so you can focus on your hunting query and related results. +``` +| where EventTime > ago(7d) +``` +### Search for specific executable files +The time range is immediately followed by a search for files representing the PowerShell application. -### Use operators -The query language is very powerful and has a lot of available operators, some of them are - +``` +| where FileName in ("powershell.exe", "POWERSHELL.EXE", "powershell_ise.exe", "POWERSHELL_ISE.EXE") +``` +### Search for specific command lines +Afterwards, the query looks for command lines that are typically used with PowerShell to download files. -- **where** - Filter a table to the subset of rows that satisfy a predicate. -- **summarize** - Produce a table that aggregates the content of the input table. -- **join** - Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table. -- **count** - Return the number of records in the input record set. -- **top** - Return the first N records sorted by the specified columns. -- **limit** - Return up to the specified number of rows. -- **project** - Select the columns to include, rename or drop, and insert new computed columns. -- **extend** - Create calculated columns and append them to the result set. -- **makeset** - Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group -- **find** - Find rows that match a predicate across a set of tables. +``` +| where ProcessCommandLine has "Net.WebClient" + or ProcessCommandLine has "DownloadFile" + or ProcessCommandLine has "Invoke-WebRequest" + or ProcessCommandLine has "Invoke-Shellcode" + or ProcessCommandLine contains "http:" +``` +### Select result columns and length +Now that your query clearly identifies the data you want to locate, you can add elements that define what the results look like. `project` returns specific columns and `top` limits the number of results, making the results well-formatted and reasonably large and easy to process. -To see a live example of these operators, run them as part of the **Get started** section. +``` +| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine +| top 100 by EventTime' +``` + +Click **Run query** to see the results. You can expand the screen view so you can focus on your hunting query and the results. + +## Learn common query operators for Advanced hunting + +Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by Advanced hunting supports a range of operators, including the following common ones. + +| Operator | Description and usage | +|--|--| +| **where** | Filter a table to the subset of rows that satisfy a predicate. | +| **summarize** | Produce a table that aggregates the content of the input table. | +| **join** | Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table. | +| **count** | Return the number of records in the input record set. | +| **top** | Return the first N records sorted by the specified columns. | +| **limit** | Return up to the specified number of rows. | +| **project** | Select the columns to include, rename or drop, and insert new computed columns. | +| **extend** | Create calculated columns and append them to the result set. | +| **makeset** | Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group. | +| **find** | Find rows that match a predicate across a set of tables. | + +To see a live example of these operators, run them from the **Get started** section of the Advanced hunting page. + +## Understand data types + +Data in Advanced hunting tables are generally classified into the following data types. + +| Data type | Description and query implications | +|--|--| +| **datetime** | Data and time information typically representing event timestamps | +| **string** | Character string | +| **bool** | True or false | +| **int** | 32-bit numeric value | +| **long** | 64-bit numeric value | + +## Use sample queries + +The **Get started** section provides a few simple queries using commonly used operators. Try running these queries and making small modifications to them. + +![Image of Advanced hunting window](images/atp-advanced-hunting.png) + +>[!NOTE] +>Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository. ## Access query language documentation -For more information on the query language and supported operators, see [Query Language](https://docs.microsoft.com/azure/log-analytics/query-language/query-language). - -## Use exposed tables in Advanced hunting - -The following tables are exposed as part of Advanced hunting: - -- **AlertEvents** - Alerts on Microsoft Defender Security Center -- **MachineInfo** - Machine information, including OS information -- **MachineNetworkInfo** - Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains -- **ProcessCreationEvents** - Process creation and related events -- **NetworkCommunicationEvents** - Network connection and related events -- **FileCreationEvents** - File creation, modification, and other file system events -- **RegistryEvents** - Creation and modification of registry entries -- **LogonEvents** - Login and other authentication events -- **ImageLoadEvents** - DLL loading events -- **MiscEvents** - Multiple event types, such as process injection, creation of scheduled tasks, and LSASS access attempts - -These tables include data from the last 30 days. - -## Use shared queries -Shared queries are prepopulated queries that give you a starting point on running queries on your organization's data. It includes a couple of examples that help demonstrate the query language capabilities. - -![Image of shared queries](images/atp-shared-queries.png) - -You can save, edit, update, or delete queries. - -### Save a query -You can create or modify a query and save it as your own query or share it with users who are in the same tenant. - -1. Create or modify a query. - -2. Click the **Save query** drop-down button and select **Save as**. - -3. Enter a name for the query. - - ![Image of saving a query](images/advanced-hunting-save-query.png) - -4. Select the folder where you'd like to save the query. - - Shared queries - Allows other users in the tenant to access the query - - My query - Accessible only to the user who saved the query - -5. Click **Save**. - -### Update a query -These steps guide you on modifying and overwriting an existing query. - -1. Edit an existing query. - -2. Click the **Save**. - -### Delete a query -1. Right-click on a query you want to delete. - - ![Image of delete query](images/atp-delete-query.png) - -2. Select **Delete** and confirm that you want to delete the query. - -## Result set capabilities in Advanced hunting - -The result set has several capabilities to provide you with effective investigation, including: - -- Columns that return entity-related objects, such as Machine name, Machine ID, File name, SHA1, User, IP, and URL, are linked to their entity pages in Microsoft Defender Security Center. -- You can right-click on a cell in the result set and add a filter to your written query. The current filtering options are **include**, **exclude** or **advanced filter**, which provides additional filtering options on the cell value. These cell values are part of the row set. - -![Image of Microsoft Defender ATP Advanced hunting result set](images/atp-advanced-hunting-results-filter.png) - -## Filter results in Advanced hunting -In Advanced hunting, you can use the advanced filter on the output result set of the query. -The filters provide an overview of the result set where -each column has it's own section and shows the distinct values that appear in the column and their prevalence. - -You can refine your query based on the filter by clicking the "+" or "-" buttons on the values that you want to include or exclude and click **Run query**. - -![Image of Advanced hunting filter](images/atp-filter-advanced-hunting.png) - -The filter selections will resolve as an additional query term and the results will be updated accordingly. - - - -## Public Advanced hunting query GitHub repository -Check out the [Advanced hunting repository](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). Contribute and use example queries shared by our customers. - +For more information on Kusto query language and supported operators, see [Query Language](https://docs.microsoft.com/azure/kusto/query/). >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink) -## Related topic -- [Advanced hunting reference](advanced-hunting-reference.md) -- [Advanced hunting query language best practices](advanced-hunting-best-practices.md) +## Related topics +- [Advanced hunting overview](overview-hunting.md) +- [Understand the schema](advanced-hunting-reference.md) +- [Apply query best practices](advanced-hunting-best-practices.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts.md b/windows/security/threat-protection/microsoft-defender-atp/alerts.md index bd14cbf032..2c44e8cfe9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts.md @@ -39,7 +39,7 @@ Method|Return Type |Description Property | Type | Description :---|:---|:--- id | String | Alert ID. -incidentId | String | The [Incident](view-incidents-queue.md) ID of the Alert. +incidentId | String | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert. assignedTo | String | Owner of the alert. severity | Enum | Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'. status | Enum | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 311f6803b0..a858f74cac 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -1,7 +1,7 @@ --- title: Use attack surface reduction rules to prevent malware infection description: Attack surface reduction rules can help prevent exploits from using apps and scripts to infect machines with malware -keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention +keywords: Attack surface reduction rules, asr, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -12,7 +12,6 @@ ms.localizationpriority: medium audience: ITPro author: levinec ms.author: ellevin -ms.date: 05/07/2019 ms.reviewer: manager: dansimp --- @@ -28,7 +27,7 @@ manager: dansimp Attack surface reduction rules help prevent behaviors malware often uses to infect computers with malicious code. You can set attack surface reduction rules for computers running Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, or Windows Server 2019. -To use attack surface reduction rules, you need a Windows 10 Enterprise license. If you have a Windows E5 license, it gives you the advanced management capabilities to power them. These include monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the Microsoft 365 Security Center. These advanced capabilities aren't available with an E3 license or with Windows 10 Enterprise without subscription, but you can use attack surface reduction rule events in Event Viewer to help facilitate deployment. +To use the entire feature set of attack surface reduction rules, you need a Windows 10 Enterprise license. With a Windows E5 license you get advanced management capabilities including monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the Microsoft 365 security center. These advanced capabilities aren't available with an E3 license, but you can use Event Viewer to review attack surface reduction rule events. Attack surface reduction rules target behaviors that malware and malicious apps typically use to infect computers, including: @@ -36,17 +35,17 @@ Attack surface reduction rules target behaviors that malware and malicious apps * Obfuscated or otherwise suspicious scripts * Behaviors that apps don't usually initiate during normal day-to-day work -You can use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks similar to malware. By monitoring audit data and [adding exclusions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. +You can use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. -Triggered rules display a notification on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays in the Microsoft Defender Security Center and in the Microsoft 365 securty center. +Triggered rules display a notification on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays in the Microsoft Defender Security Center and in the Microsoft 365 security center. For information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md). -## Review attack surface reduction events in the Microsoft Security Center +## Review attack surface reduction events in the Microsoft Defender Security Center Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how controlled folder access settings could affect your environment. +You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-hunting.md). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to understand how attack surface reduction rules could affect your environment. Here is an example query: @@ -208,7 +207,7 @@ This rule blocks the following file types from launching unless they either meet * Executable files (such as .exe, .dll, or .scr) > [!NOTE] -> You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. +> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule. > [!IMPORTANT] > The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. @@ -228,7 +227,7 @@ GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25 This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or exclusion list. > [!NOTE] -> You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. +> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule. This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 @@ -329,4 +328,4 @@ GUID: e6db77e5-3df2-4cf1-b95a-636979351e5b * [Enable attack surface reduction rules](enable-attack-surface-reduction.md) * [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) -* [Compatibility of Microsoft Defender with other antivirus/antimalware](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) +* [Compatibility of Microsoft Defender with other antivirus/antimalware](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index fac075a33c..4eafbbefa8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -53,7 +53,7 @@ The goal is to remediate the issues in the security recommendations list to impr See how you can [improve your security configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios#improve-your-security-configuration), for details. >[!IMPORTANT] ->To boost your vulnerability assessment detection rates, you can download the following set of optional security updates and deploy them in your network: +>To boost your vulnerability assessment detection rates, download the following mandatory security updates and deploy them in your network: >- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) >- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) >- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) @@ -62,8 +62,6 @@ See how you can [improve your security configuration](https://docs.microsoft.com >To download the security updates: >1. Go to [Microsoft Update Catalog](http://www.catalog.update.microsoft.com/home.aspx). >2. Key-in the security update KB number that you need to download, then click **Search**. -> ->Downloading the above-mentioned security updates will be mandatory starting Patch Tuesday, October 8, 2019. ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index 3974d3dc84..484a763167 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -57,7 +57,7 @@ From the device compliance page, create a configuration profile specifically for - Select **Create a device configuration profile to configure ATP sensor** to start with a predefined device configuration profile. - Create the device configuration profile from scratch. -For more information, [read about using Intune device configuration profiles to onboard machines to Microsoft Defender ATP](https://docs.microsoft.com/en-us/intune/advanced-threat-protection#onboard-devices-by-using-a-configuration-profile). +For more information, [read about using Intune device configuration profiles to onboard machines to Microsoft Defender ATP](https://docs.microsoft.com/intune/advanced-threat-protection#onboard-devices-by-using-a-configuration-profile). >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 2e925f762d..010274d097 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -33,8 +33,10 @@ Custom detection rules built from [Advanced hunting](overview-hunting.md) querie In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using an new query, run the query to identify errors and understand possible results. -> [!NOTE] -> To use a query for a custom detection rule, the query must return the `EventTime`, `MachineId`, and `ReportId` columns in the results. Queries that don’t use the `project` operator to customize results usually return these common columns. +#### Required columns in the query results +To use a query for a custom detection rule, the query must return the `EventTime`, `MachineId`, and `ReportId` columns in the results. Simple queries, such as those that don’t use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. + +There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `MachineId`, you can still return `EventTime` and `ReportId` by getting them from the most recent event involving each machine. The sample query below counts the number of unique machines (`MachineId`) with antivirus detections and uses this count to find only the machines with more than five detections. To return the latest `EventTime` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. @@ -112,3 +114,5 @@ You can also take the following actions on the rule from this page: ## Related topic - [Custom detections overview](overview-custom-detections.md) +- [Advanced hunting overview](overview-hunting.md) +- [Learn the Advanced hunting query language](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-shared-queries.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-shared-queries.png new file mode 100644 index 0000000000..c245c9e9fb Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting-shared-queries.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting.png index c8c053fd44..495ac3cb26 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting.png and b/windows/security/threat-protection/microsoft-defender-atp/images/atp-advanced-hunting.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/atp_advanced_hunting_delete_rename.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp_advanced_hunting_delete_rename.png new file mode 100644 index 0000000000..93931e9013 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/atp_advanced_hunting_delete_rename.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md index b78325e026..379a0c8d3e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents.md @@ -78,7 +78,6 @@ You can click the circles on the incident graph to view the details of the malic ![Image of incident details](images/atp-incident-graph-details.png) ## Related topics -- [View and organize the Incidents queue](view-incidents-queue.md) -- [Manage incidents](manage-incidents.md) - - +- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) +- [Investigate incidents in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents) +- [Manage Microsoft Defender ATP incidents](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-incidents) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md index 6f2cd9df63..56e0d4eeb2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md @@ -60,6 +60,6 @@ Added comments instantly appear on the pane. ## Related topics -- [Incidents queue](incidents-queue.md) +- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) - [View and organize the Incidents queue](view-incidents-queue.md) - [Investigate incidents](investigate-incidents.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index e4f3194e93..57782a8e2b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -37,6 +37,7 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr - Windows 10 Enterprise E5 - Windows 10 Education E5 - Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 +- Microsoft 365 E3 (M365 E3) with Identity and Threat Protection package For more information on the array of features in Windows 10 editions, see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare). diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index 8398ee9986..425427b295 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -28,11 +28,12 @@ With custom detections, you can proactively monitor for and respond to various e Custom detections work with [Advanced hunting](overview-hunting.md), which provides a powerful, flexible query language that covers a broad set of event and system information from your network. The queries run every 24 hours, generating alerts and taking response actions whenever there are matches. Custom detections provide: -- Alerts from rule-based detections built from Advanced hunting queries +- Alerts for rule-based detections built from Advanced hunting queries - Automatic response actions that apply to files and machines >[!NOTE] >To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. ## Related topic -- [Create and manage custom detection rules](custom-detection-rules.md) \ No newline at end of file +- [Create and manage custom detection rules](custom-detection-rules.md) +- [Advanced hunting overview](overview-hunting.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md index 8343dc2003..4c4cf5edcf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md @@ -37,7 +37,7 @@ The response capabilities give you the power to promptly remediate threats by ac Topic | Description :---|:--- [Security operations dashboard](security-operations-dashboard.md) | Explore a high level overview of detections, highlighting where response actions are needed. -[Incidents queue](incidents-queue.md) | View and organize the incidents queue, and manage and investigate alerts. +[Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) | View and organize the incidents queue, and manage and investigate alerts. [Alerts queue](alerts-queue.md) | View and organize the machine alerts queue, and manage and investigate alerts. [Machines list](machines-view-overview.md) | Investigate machines with generated alerts and search for specific events over time. [Take response actions](response-actions.md) | Learn about the available response actions and apply them to machines and files. diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md b/windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md index 3d1b55266e..ab47dc3981 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md @@ -1,40 +1,72 @@ --- -title: Overview of advanced hunting capabilities +title: Overview of Advanced hunting description: Hunt for possible threats across your organization using a powerful search and query tool -keywords: advanced hunting, hunting, search, query, tool, intellisense, telemetry +keywords: advanced hunting, hunting, search, query, tool, telemetry, custom detection, schema, kusto search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macapara -author: mjcaparas +ms.author: lomayor +author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro ms.collection: M365-security-compliance -ms.topic: conceptual +ms.topic: article --- -# Overview of advanced hunting +# Proactively hunt for threats with Advanced hunting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Microsoft Defender Security Center. +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -With advanced hunting, you can take advantage of the following capabilities: +Advanced hunting provides access to 30 days of raw data through a flexible query-based interface, allowing you to proactively explore events in your environment and locate interesting indicators and entities. This flexible access to data enables unconstrained hunting for both known and potential threats. -- **Powerful query language with IntelliSense** - Built on top of a query language that gives you the flexibility you need to take hunting to the next level. -- **Query the stored telemetry** - The telemetry data is accessible in tables for you to query. For example, you can query process creation, network communication, and many other event types. -- **Links to portal** - Certain query results, such as machine names and file names are actually direct links to the portal, consolidating the Advanced hunting query experience and the existing portal investigation experience. -- **Query examples** - A welcome page provides examples designed to get you started and get you familiar with the tables and the query language. +With custom detection rules, you can also use Advanced hunting queries to proactively monitor for and respond to various events and system states, including suspected breach activity and misconfigured machines. -## In this section -Topic | Description -:---|:--- -[Query data using Advanced hunting](advanced-hunting.md) | Learn how to use the basic or advanced query examples to search for possible emerging threats in your organization. -[Custom detections](overview-custom-detections.md)| With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. +## Get started with Advanced hunting +We recommend going through several steps to quickly get up and running with Advanced hunting. +| Learning goal | Description | Resource | +|--|--|--| +| **Get a feel for the language** | Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting.md) | +| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. This will help you determine where to look for data and how to construct your queries. | [Schema reference](advanced-hunting-reference.md) | +| **Use predefined queries** | Explore collections of predefined queries covering different threat hunting scenarios. | [Shared queries](advanced-hunting-shared-queries.md) | +| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | [Custom detections overview](overview-custom-detections.md) | +## Get help as you write queries +Take advantage of the following functionality to write queries faster: +- **Autosuggest** — as you write queries, Advanced hunting provides suggestions. +- **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor. + +## Drilldown from query results +To view more information about entities, such as machines, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity in Microsoft Defender Security Center. + +## Tweak your queries from the results +Right-click a value in the result set to quickly enhance your query. You can use the options to: + +- Explicitly look for the selected value (`==`) +- Exclude the selected value from the query (`!=`) +- Get more advanced operators for adding the value to your query, such as `contains`, `starts with` and `ends with` + +![Image of Microsoft Defender ATP Advanced hunting result set](images/atp-advanced-hunting-results-filter.png) + +## Filter the query results +The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances. + +Refine your query by selecting the "+" or "-" buttons next to the values that you want to include or exclude. + +![Image of Advanced hunting filter](images/atp-filter-advanced-hunting.png) + +Once you apply the filter to modify the query and then run the query, the results are updated accordingly. + +## Related topics +- [Learn the query language](advanced-hunting.md) +- [Use shared queries](advanced-hunting-shared-queries.md) +- [Understand the schema](advanced-hunting-reference.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Custom detections overview](overview-custom-detections.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md b/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md index 7a1c0650f9..9a9fa6e53c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md +++ b/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md @@ -141,7 +141,7 @@ You can create a custom dashboard in Power BI Desktop to create visualizations t ![Settings with download connector button](images/atp-download-connector.png) -4. Create a new directory `Microsoft Power BI Desktop\Custom Connectors` under the user's Documents folder. +4. Create a new directory `[Documents]\Power BI Desktop\Custom Connectors`. 5. Copy WDATPDataConnector.mez from the zip to the directory you just created. @@ -150,6 +150,9 @@ You can create a custom dashboard in Power BI Desktop to create visualizations t 7. Click **File** > **Options and settings** > **Custom data connectors**. 8. Select **New table and matrix visuals** and **Custom data connectors** and click **OK**. + + > [!NOTE] + > If you plan on using Custom Connectors or connectors that you or a third party has developed, you must select *(Not Recommended) Allow any extension to load without warning* under **Power BI Desktop** > **File** > **Options and settings** > **Options** > **Security** > **Data Extensions**". >[!NOTE] >If you are using Power BI Desktop July 2017 version (or later), you won't need to select **New table and matrix visuals**. You'll only need to select **Custom data connectors**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index d63d1f4ea5..f7512247e0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -29,21 +29,19 @@ Ensure that your machines: >[!NOTE] >Threat & Vulnerability Management can also scan machines that run on Windows 7 and Windows Server 2019 operating systems and detects vulnerabilities addressed in patch Tuesday. -- Have the following mandatory updates installed: -- (1) RS3 customers | [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441) -- (2) RS4 customers | [KB4493464](https://support.microsoft.com/help/4493464) +- Have the following mandatory updates installed and deployed in your network to boost your vulnerability assessment detection rates: + +> Release | Security update KB number and link +> :---|:--- +> RS3 customers | [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441) and [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) +> RS4 customers| [KB4493464](https://support.microsoft.com/help/4493464) and [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) +> RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) +> 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) + - Are onboarded to Microsoft Intune and System Center Configuration Manager (SCCM). If you are use SCCM, update your console to the latest May version 1905 - Have at least one security recommendation that can be viewed in the machine page - Are tagged or marked as co-managed ->[!IMPORTANT] ->To boost your vulnerability assessment detection rates, you can download the following set of optional security updates and deploy them in your network: ->- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) ->- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) ->- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) ->- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) ->

Downloading and deploying the above-mentioned security updates will be mandatory starting Patch Tuesday, October 8, 2019. - ## Reduce your threat and vulnerability exposure Threat & Vulnerability Management introduces a new exposure score metric, which visually represents how exposed your machines are to imminent threats. diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index bb9f499cd3..e2615c2319 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -26,12 +26,11 @@ Threat & Vulnerability Management leverages the same signals in Microsoft Defend The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights. >[!IMPORTANT] ->To boost your vulnerability assessment detection rates, you can download the following set of optional security updates and deploy them in your network: +>To boost your vulnerability assessment detection rates, download the following mandatory security updates and deploy them in your network: >- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) >- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) >- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) >- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) ->

Downloading the above-mentioned security updates will be mandatory starting Patch Tuesday, October 8, 2019. ## Navigate through your organization's weaknesses page You can see the list of vulnerabilities in four ways: diff --git a/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md b/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md index c3753c466c..4bda743be9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md @@ -64,7 +64,7 @@ You can choose to limit the list of incidents shown based on their status to see Use this filter to show incidents that contain sensitivity labels. ## Related topics -- [Incidents queue](incidents-queue.md) +- [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) - [Manage incidents](manage-incidents.md) - [Investigate incidents](investigate-incidents.md) diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index 8ce51363fd..f9421d02f6 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -31,9 +31,7 @@ The Security Compliance Toolkit consists of: - Windows 10 Version 1809 (October 2018 Update) - Windows 10 Version 1803 (April 2018 Update) - Windows 10 Version 1709 (Fall Creators Update) - - Windows 10 Version 1703 (Creators Update) - Windows 10 Version 1607 (Anniversary Update) - - Windows 10 Version 1511 (November Update) - Windows 10 Version 1507 - Windows Server security baselines @@ -42,7 +40,7 @@ The Security Compliance Toolkit consists of: - Windows Server 2012 R2 - Microsoft Office security baseline - - Office 2016 + - Office365 ProPlus (Sept 2019) - Tools - Policy Analyzer tool diff --git a/windows/security/threat-protection/security-policy-settings/account-policies.md b/windows/security/threat-protection/security-policy-settings/account-policies.md index 3c9a703853..f740ced849 100644 --- a/windows/security/threat-protection/security-policy-settings/account-policies.md +++ b/windows/security/threat-protection/security-policy-settings/account-policies.md @@ -25,7 +25,8 @@ ms.date: 04/19/2017 An overview of account policies in Windows and provides links to policy descriptions. All account policies settings applied by using Group Policy are applied at the domain level. Default values are present in the built-in default domain controller policy for Password Policy settings, Account Lockout Policy settings, and Kerberos Policy settings. The domain account policy becomes the default local account policy of any device that is a member of the domain. If these policies are set at any level below the domain level in Active Directory Domain Services (AD DS), they affect only local accounts on member servers. -> **Note:**  Each domain can have only one account policy. The account policy must be defined in the default domain policy or in a new policy that is linked to the root of the domain and given precedence over the default domain policy, which is enforced by the domain controllers in the domain. These domain-wide account policy settings (Password Policy, Account Lockout Policy, and Kerberos Policy) are enforced by the domain controllers in the domain; therefore, domain controllers always retrieve the values of these account policy settings from the default domain policy Group Policy Object (GPO). +> [!NOTE] +> Each domain can have only one account policy. The account policy must be defined in the default domain policy or in a new policy that is linked to the root of the domain and given precedence over the default domain policy, which is enforced by the domain controllers in the domain. These domain-wide account policy settings (Password Policy, Account Lockout Policy, and Kerberos Policy) are enforced by the domain controllers in the domain; therefore, domain controllers always retrieve the values of these account policy settings from the default domain policy Group Policy Object (GPO). The only exception is when another account policy is defined for an organizational unit (OU). The account policy settings for the OU affect the local policy on any computers that are contained in the OU. For example, if an OU policy defines a maximum password age that differs from the domain-level account policy, the OU policy will be applied and enforced only when users log on to the local computer. The default local computer policies apply only to computers that are in a workgroup or in a domain where neither an OU account policy nor a domain policy applies. diff --git a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md index 090bb9f3bf..82dc9c1898 100644 --- a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md +++ b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md @@ -84,6 +84,9 @@ Settings are applied in the following order through a Group Policy Object (GPO), When a local setting is greyed out, it indicates that a GPO currently controls that setting. +> [!NOTE] +> More information about configuring the policy can be found [here](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings). + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index ba47760e7f..5760e380c9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -11,7 +11,6 @@ ms.pagetype: security ms.localizationpriority: medium author: dansimp ms.author: dansimp -ms.date: 12/10/2018 ms.reviewer: manager: dansimp --- @@ -36,12 +35,16 @@ The utility has the following commands: ```DOS MpCmdRun.exe [command] [-options] ``` +For example, +``` +MpCmdRun.exe -scan -2 +``` | Command | Description | |:--------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------| | \-? **or** -h | Displays all available options for this tool | -| \-Scan [-ScanType #] [-File \ [-DisableRemediation] [-BootSectorScan]] [-Timeout \] [-Cancel] | Scans for malicious software | +| \-Scan [-ScanType [0\|1\|2\|3]] [-File \ [-DisableRemediation] [-BootSectorScan]] [-Timeout \] [-Cancel] | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. | | \-Trace [-Grouping #] [-Level #] | Starts diagnostic tracing | | \-GetFiles | Collects support information | | \-GetFilesDiagTrack | Same as Getfiles but outputs to temporary DiagTrack folder | @@ -54,7 +57,10 @@ MpCmdRun.exe [command] [-options] | \-ListAllDynamicSignatures | Lists the loaded dynamic Security intelligence | | \-RemoveDynamicSignature [-SignatureSetID] | Removes dynamic Security intelligence | | \-CheckExclusion -path \ | Checks whether a path is excluded | - +For example, +``` +mpcmdrun.exe -scan -2 +``` ## Related topics - [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index ee825e3d08..10cc42c9f3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -107,6 +107,9 @@ The procedures in this article first describe how to set the order, and then how 6. Click **OK**. This will set the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting. +> [!NOTE] +> For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Windows Defender Antivirus > Signature Updates** +> For Windows 10, version 1903, the policy path is **Windows Components > Windows Defender Antivirus > Security Intelligence Updates** **Use Configuration Manager to manage the update location:** diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 0a78bbd6af..8324650680 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -149,7 +149,7 @@ In this case, Tamper Protection status changes, and this feature is no longer ap ### Will there be an alert about Tamper Protection status changing in the Microsoft Defender Advanced Threat Protection portal? -Yes. The alert is shown in [https://microsoft.securitycenter.com](https://microsoft.securitycenter.com) under **Alerts**. +Yes. The alert is shown in [https://securitycenter.microsoft.com](https://microsoft.securitycenter.com) under **Alerts**. In addition, your security operations team can use hunting queries, such as the following: diff --git a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md index 11c42404cd..f8a9335f5f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md @@ -37,12 +37,9 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi 4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**. 5. On the **File Blocking Level** switch, select one of the following: - 1. **High** to provide a strong level of detection - 2. **High +** to apply additional protection measures - 3. **Zero tolerance** to block all unknown executables - - > [!WARNING] - > While unlikely, setting this switch to **High** might cause some legitimate files to be detected. The **High +** setting might impact client performance. We recommend you set this to the default level (**Not configured**). + 1. **High**: Applies a strong level of detection. + 2. **High +**: Uses the **High** level and applies additional protection measures (may impact client performance). + 3. **Zero tolerance**: Blocks all unknown executables. 8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile. @@ -64,15 +61,14 @@ For more information about Intune device profiles, including how to create and c 5. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**. 1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: - 1. Setting to **Default Windows Defender Antivirus blocking level** provides strong detection without increasing the risk of detecting legitimate files. - 2. Setting to **High blocking level** applies a strong level of detection. - 3. **High + blocking level** applies additional protection measures. + 1. **Default Windows Defender Antivirus blocking level** provides strong detection without increasing the risk of detecting legitimate files. + 2. **High blocking level** applies a strong level of detection while optimizing client performance (greater chance of false positives). + 3. **High + blocking level** applies additional protection measures (may impact client performance and increase risk of false positives). 4. **Zero tolerance blocking level** blocks all unknown executables. > [!WARNING] - > While unlikely, setting this switch to **High** might cause some legitimate files to be detected (although you will have the option to unblock or dispute that detection). The **High +** setting might impact client performance. We recommend you set this to the default level (**Not configured**). - -1. Click **OK**. + > While unlikely, setting this switch to **High** or **High +** may cause some legitimate files to be detected (although you will have the option to unblock or dispute that detection). +6. Click **OK**. diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 960e256e35..717e08d7d4 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -43,6 +43,10 @@ The following matrix illustrates the states that Windows Defender AV will enter | Windows Server 2016 | Windows Defender AV | No | Active mode | (1) On Windows Server 2016, Windows Defender AV will not enter passive or disabled mode if you have also installed a third-party antivirus product. If you install a third-party antivirus product, you should [uninstall Windows Defender AV on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md) to prevent problems caused by having multiple antivirus products installed on a machine. +If you are Using Windows Server, version 1803 and Windows 2019, you can enable passive mode by setting this registry key: +- Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection +- Name: ForceDefenderPassiveMode +- Value: 1 See the [Windows Defender Antivirus on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md#install-or-uninstall-windows-defender-av-on-windows-server-2016) topic for key differences and management options for Windows Server installations. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 7f4112593f..eef2cc16e8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -90,7 +90,8 @@ AppLocker rules can be created on domain controllers. AppLocker is included with enterprise-level editions of Windows. You can author AppLocker rules for a single computer or for a group of computers. For a single computer, you can author the rules by using the Local Security Policy editor (secpol.msc). For a group of computers, you can author the rules within a Group Policy Object by using the Group Policy Management Console (GPMC). -> **Note:**  The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. +> [!NOTE] +> The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. ### Using AppLocker on Server Core diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md index f68602c282..4bf66b9c31 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md @@ -27,7 +27,8 @@ This topic for IT professionals describes the steps to create a standard set of AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed to run. ->**Important:**  You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types. +> [!IMPORTANT] +> You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types. You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md index 20b1b50dae..2f56b9e1e8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/21/2017 --- # Maintain AppLocker policies @@ -41,7 +40,9 @@ There are three methods you can use to maintain AppLocker policies: - [Maintaining AppLocker policies on the local computer](#bkmk-applkr-use-locsnapin) ## Maintaining AppLocker policies by using Mobile Device Management (MDM) +Using the AppLocker configuration service provider, you can select which apps are allowed or blocked from running. Using the CSP, you can configure app restrictions based on grouping (such as EXE, MSI, DLL, Store apps and more) and then chose how to enforce different policies for different apps. +For more information, see the [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp). ## Maintaining AppLocker policies by using Group Policy diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md index 3a9dee486d..4b12248403 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md @@ -30,7 +30,8 @@ This topic for IT professionals describes concepts and lists procedures to help Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity. With packaged apps, it is possible to control the entire app by using a single AppLocker rule. ->**Note:**  AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps. +> [!NOTE] +> AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps. Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software’s publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. @@ -53,9 +54,10 @@ For more info about packaged apps, see [Packaged apps and packaged app installer You can use two methods to create an inventory of packaged apps on a computer: the AppLocker console or the **Get-AppxPackage** Windows PowerShell cmdlet. ->**Note:**  Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). +> [!NOTE] +> Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). -For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](https://technet.microsoft.com/library/hh847210.aspx). +For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](https://docs.microsoft.com/powershell/module/applocker/). For info about creating rules for Packaged apps, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md). @@ -74,7 +76,7 @@ Just as there are differences in managing each rule collection, you need to mana 1. Gather information about which Packaged apps are running in your environment. For information about how to do this, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). -2. Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Packaged Apps Default Rules in AppLocker](https://technet.microsoft.com/library/ee460941(WS.10).aspx). +2. Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Understanding AppLocker default rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules). 3. Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md index d2d2d98598..02228d1867 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md @@ -27,7 +27,8 @@ This topic for IT professional describes the set of rules that can be used to en AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. ->**Important:**  You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. +> [!IMPORTANT] +> You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. If you require additional app security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index bf87000f78..610fcc1a0c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -1,6 +1,7 @@ --- -title: Use a reference device to create and maintain AppLocker policies (Windows 10) +title: "Use a reference device to create and maintain AppLocker policies (Windows 10)" description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. +ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 ms.author: macapara ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index d192ac21a9..97eea2439c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -80,6 +80,9 @@ When merging, the policy type and ID of the leftmost/first policy specified is u ### Deploying policies +> [!NOTE] +> You cannot use the "Deploy Windows Defender Application Control" group policy setting to deploy multiple CI policies. You will have to copy the `*.cip` files, both the baseline and the supplemental ones, to C:\Windows\System32\CodeIntegrity\CiPolicies\Active\. + In order to deploy policies using the new multiple policy format you will need to: 1. Ensure policies are copied to the right location diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 8aae066fd4..387ba074e2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -18,6 +18,7 @@ ms.author: dansimp **Applies to** - Windows 10 - Windows Server 2016 +- Windows Server 2019 Members of the security community\* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control. @@ -69,8 +70,8 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
->[!Note] ->This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. +> [!Note] +> This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. Certain software applications may allow additional code to run by design. These types of applications should be blocked by your Windows Defender Application Control policy. @@ -88,7 +89,7 @@ Microsoft recommends that you block the following Microsoft-signed applications - msxml6.dll - jscript9.dll -Pick the correct version of each .dll for the Windows release you plan to support, and remove the other versions. +Pick the correct version of each .dll for the Windows release you plan to support, and remove the other versions. Ensure that you also uncomment them in the signing scenarios section. ```xml @@ -888,9 +889,11 @@ Pick the correct version of each .dll for the Windows release you plan to suppor + @@ -1511,3 +1514,10 @@ Pick the correct version of each .dll for the Windows release you plan to suppor ```
+ +> [!Note] +> To create a policy that works on both Windows 10, version 1803 and version 1809, you can create two different policies, or merge them into one broader policy. + +## More information + +- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) diff --git a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md index cde7dc4fc5..15c54f8ada 100644 --- a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -34,7 +34,7 @@ Select Windows Defender Firewall. ## Firewall rule components -The firewall rule configurations in Intune use the Windows 10 CSP for Firewall. For more information, see [Firewall CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp). +The firewall rule configurations in Intune use the Windows 10 CSP for Firewall. For more information, see [Firewall CSP](https://docs.microsoft.com/windows/client-management/mdm/firewall-csp). ## Application Control connections for an app or program. diff --git a/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md index a4d7f249b4..57292a294e 100644 --- a/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md +++ b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md @@ -89,6 +89,9 @@ First, create the WMI filter and configure it to look for a specified version (o 10. Click **Save** to save your completed filter. +> [!NOTE] +> If you're using multiple queries in the same WMI filter, these queries must all return **TRUE** for the filter requirements to be met and for the GPO to be applied. + ## To link a WMI filter to a GPO After you have created a filter with the correct query, link the filter to the GPO. Filters can be reused with many GPOs simultaneously; you do not have to create a new one for each GPO if an existing one meets your needs. diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index e59d8d582b..30b70df2a4 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -20,8 +20,8 @@ ms.reviewer: **Applies to** - Windows 10 -- Windows Server 2016 -- Office 2016 +- Windows Server +- Office 365 ProPlus ## Using security baselines in your organization