From b24b63f2ef09ac763c66b44e7d4cd1fb402095c2 Mon Sep 17 00:00:00 2001 From: Jared Parkinson Date: Mon, 21 Aug 2017 06:08:56 -0600 Subject: [PATCH 1/5] Update test-windows10s-for-edu.md --- education/windows/test-windows10s-for-edu.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md index f84864aaaf..fec38dd7d3 100644 --- a/education/windows/test-windows10s-for-edu.md +++ b/education/windows/test-windows10s-for-edu.md @@ -228,7 +228,7 @@ Common support questions for the Windows 10 S test program: * **What if I want to move from Windows 10 S to Windows 10 Pro?** - If you want to discontinue using Windows 10 S, follow the instructions to return to your previous installation of Windows 10. If you already had Windows 10 Pro or Windows 10 Pro Education on the device you are testing on, you should be able to move to Windows 10 Pro or Windows 10 Pro Education at no charge with the instructions in this document. Otherwise, ther emay be a cost to acquire a Windows 10 Pro license in the Store. + If you want to discontinue using Windows 10 S, follow the instructions to return to your previous installation of Windows 10. If you already had Windows 10 Pro or Windows 10 Pro Education on the device you are testing on, you should be able to move to Windows 10 Pro or Windows 10 Pro Education at no charge with the instructions in this document. Otherwise, there may be a cost to acquire a Windows 10 Pro license in the Store. For help with activation issues, click on the appropriate link below for support options. * For Volume Licensing Agreement or Shape the Future program customers, go to the [Microsoft Commercial Support](https://support.microsoft.com/gp/commercialsupport) website and select the country/region in which you are seeking commercial support to contact our commercial support team. From d10dacc238a7ccea69199e159156307a3f419e34 Mon Sep 17 00:00:00 2001 From: chintanpatel Date: Fri, 25 Aug 2017 09:55:06 -0700 Subject: [PATCH 2/5] Update configure-wd-app-guard.md --- .../configure-wd-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md index 73bb0a5fb0..5221675063 100644 --- a/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md +++ b/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md @@ -40,7 +40,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Win |-----------|------------------|-----------|-------| |Configure Windows Defender Application Guard clipboard settings|At least Windows 10 Enterprise|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.| |Configure Windows Defender Application Guard print settings|At least Windows 10 Enterprise|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| -|Block enterprise websites to load non-enterprise content in IE and Edge|At least Windows 10 Enterprise|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.

**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard.| +|Block enterprise websites to load non-enterprise content in IE and Edge|At least Windows 10 Enterprise|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.

**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | |Allow Persistence|At least Windows 10 Enterprise|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

**Disabled or not configured.** All user data within Application Guard is reset between sessions.

**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**
  1. Open a command-line program and navigate to Windows/System32.
  2. Type `wdagtool.exe cleanup`.
    The container environment is reset, retaining only the employee-generated data.
  3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`.
    The container environment is reset, including discarding all employee-generated data.
| |Turn On/Off Windows Defender Application Guard (WDAG)|At least Windows 10 Enterprise|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.

**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.| From 9e44197fc374495cd08454e9979d97c2dcd135c4 Mon Sep 17 00:00:00 2001 From: Chai Wei Jie Date: Sat, 26 Aug 2017 14:18:50 +0800 Subject: [PATCH 3/5] Fix incorrect directory --- windows/deployment/windows-10-poc-sc-config-mgr.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index eb042d424b..dc842b3f38 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -239,8 +239,8 @@ This section contains several procedures to support Zero Touch installation with 1. Type the following commands at a Windows PowerShell prompt on SRV1: ``` - New-Item -ItemType Directory -Path "C:Sources\OSD\Boot" - New-Item -ItemType Directory -Path "C:Sources\OSD\OS" + New-Item -ItemType Directory -Path "C:\Sources\OSD\Boot" + New-Item -ItemType Directory -Path "C:\Sources\OSD\OS" New-Item -ItemType Directory -Path "C:\Sources\OSD\Settings" New-Item -ItemType Directory -Path "C:\Sources\OSD\Branding" New-Item -ItemType Directory -Path "C:\Sources\OSD\MDT" @@ -560,7 +560,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 1. Type the following commands at an elevated Windows PowerShell prompt on SRV1: ``` - New-Item -ItemType Directory -Path "C:Sources\OSD\OS\Windows 10 Enterprise x64" + New-Item -ItemType Directory -Path "C:\Sources\OSD\OS\Windows 10 Enterprise x64" cmd /c copy /z "C:\MDTBuildLab\Captures\REFW10X64-001.wim" "C:\Sources\OSD\OS\Windows 10 Enterprise x64" ``` From 186a3b08983d8a18c61695cea3e32b7c67c4f945 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 30 Aug 2017 13:54:53 +0000 Subject: [PATCH 4/5] Merged PR 2943: Fix redirect for old kiosk topic --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 9ee61b0ad6..cf6462beb5 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -227,7 +227,7 @@ }, { "source_path": "windows/manage/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/set-up-a-device-for-anyone-to-use", +"redirect_url": "/windows/configuration/kiosk-shared-pc", "redirect_document_id": true }, { From 8a68fb42126c137884b3a7a3afb5a8a5b8198e56 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 30 Aug 2017 16:40:56 +0000 Subject: [PATCH 5/5] Merged PR 2952: Bitlocker CSP updated --- windows/client-management/mdm/bitlocker-csp.md | 10 +++++++++- .../mdm/new-in-windows-mdm-enrollment-management.md | 10 +++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 979c1f9105..6b49909e86 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/14/2017 +ms.date: 08/28/2017 --- # BitLocker CSP @@ -211,6 +211,9 @@ The following diagram shows the BitLocker configuration service provider in tree

On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.

+> [!Note] +> In Windows 10, version 1709, you can use a minimum PIN of 4 digits. SystemDrivesMinimumPINLength policy must be set to allow PINs shorter than 6 digits. +

If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.

If you disable or do not configure this setting, users can configure only basic options on computers with a TPM.

@@ -298,6 +301,11 @@ The following diagram shows the BitLocker configuration service provider in tree

This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.

+> [!Note] +> In Windows 10, version 1709, you can use a minimum PIN length of 4 digits. +> +>In TPM 2.0 if minimum PIN length is set below 6 digits, Windows will attempt to update the TPM lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. This does not apply to TPM 1.2. +

If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN.

If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits.

diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 1e82260c11..d3068c66de 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -981,6 +981,14 @@ For details about Microsoft mobile device management protocols for Windows 10 s +[Bitlocker CSP](bitlocker-csp.md) +

Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

+ + +[ADMX-backed policies in Policy CSP](policy-configuration-service-provider.md#admx-backed-policies) +

Added new policies.

+ + [Policy CSP](policy-configuration-service-provider.md)

Added the following new policies for Windows 10, version 1709:

    @@ -1385,7 +1393,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware [BitLocker CSP](bitlocker-csp.md) -Added information to the ADMX-backed policies. +Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. [Firewall CSP](firewall-csp.md)