From b6e7c0bb2899d2e807714331ef91cda3cf1cce58 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Thu, 21 May 2020 13:20:05 -0700 Subject: [PATCH 01/31] Update preferences page for new options for sample submission --- .../microsoft-defender-atp/linux-preferences.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index 537883114e..bafb5834dd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -247,13 +247,17 @@ Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, de #### Enable / disable automatic sample submissions -Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. You are prompted if the submitted file is likely to contain personal information. +Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. There are three levels for controlling sample submission: + +- **None**: no suspicious samples are submitted to Microsoft. +- **Safe**: only suspicious samples that do not contain personally identifiable information (PII) are submitted automatically. This is the default value for this setting. +- **All**: all suspicious samples are submitted to Microsoft. ||| |:---|:---| -| **Key** | automaticSampleSubmission | +| **Key** | automaticSampleSubmissionConsent | | **Data type** | Boolean | -| **Possible values** | true (default)
false | +| **Possible values** | none
safe (default)
all | ## Recommended configuration profile @@ -266,7 +270,7 @@ The following configuration profile will: - **Potentially unwanted applications (PUA)** are blocked. - **Archive bombs** (file with a high compression rate) are audited to the product logs. - Enable cloud-delivered protection. -- Enable automatic sample submission. +- Enable automatic sample submission at `safe` level. ### Sample profile @@ -286,7 +290,7 @@ The following configuration profile will: ] }, "cloudService":{ - "automaticSampleSubmission":true, + "automaticSampleSubmissionConsent":"safe", "enabled":true } } @@ -346,7 +350,7 @@ The following configuration profile contains entries for all settings described "cloudService":{ "enabled":true, "diagnosticLevel":"optional", - "automaticSampleSubmission":true + "automaticSampleSubmissionConsent":"safe" } } ``` From 0ade3ada666ad66c5d0201755b1b76e5b82fb3e8 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 22 May 2020 17:22:16 -0700 Subject: [PATCH 02/31] . --- .../microsoft-defender-atp/linux-preferences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index bafb5834dd..828c7b8f00 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -256,7 +256,7 @@ Determines whether suspicious samples (that are likely to contain threats) are s ||| |:---|:---| | **Key** | automaticSampleSubmissionConsent | -| **Data type** | Boolean | +| **Data type** | String | | **Possible values** | none
safe (default)
all | ## Recommended configuration profile From b6fed0c419100fb14b8a593902d80ad4ed5e8eb2 Mon Sep 17 00:00:00 2001 From: "Jeff Reeds (Aquent LLC)" Date: Tue, 26 May 2020 12:56:33 -0700 Subject: [PATCH 03/31] Updated photo to fit better --- windows/configuration/images/Shared_PC_1.jpg | Bin 0 -> 40769 bytes windows/configuration/images/Shared_PC_1.png | Bin 55388 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/configuration/images/Shared_PC_1.jpg delete mode 100644 windows/configuration/images/Shared_PC_1.png diff --git a/windows/configuration/images/Shared_PC_1.jpg b/windows/configuration/images/Shared_PC_1.jpg new file mode 100644 index 0000000000000000000000000000000000000000..7b993b00a8918f4ad6e00522e458bfeea2927649 GIT binary patch literal 40769 zcmeFa2|SeT-Z(zCB>TRb3Qko8kqm~hWX%#nQ6~Eqld^APCrj4I zZe}FA8CeFi{O_LUInR0OocEmbod55AKfm95Xzouw?p#|o+hjA~{K4##C5)Ke84ILdVJ>B`38>2zjYOTn+m$)cQSfWnX&}_>_i@!qjXTZ zz<>8!Ma<1&|F5t5_S#rU#qI@~p@QBH?Gz(!pf;U8DuYM$r!K|k1EX4z zF7@zzQ@bCRc##Sk(q=$dY#1C`?Xc;Wbr)5c5nf=<8N4RvJf`lND#-HY#Qtzl1EmqV z+)EBdj~5~r(Tlws&<%UK=l}G}+5zmYZOoGekA$AQ$pCVqf&e7he}`x&(Vhw_Evp~5 zthW&&7!x3$m7+PJAF}3Fyj>(*BxXyEgh)j>6%w-v-|Eqf>V{Kfx~4K!BS*0# zl{;e3_m?`DOpoP%)YIIG{CY89gGT)fZ2mVwl|=1W7U4I#*!^|5OlGVsY_4l9UV z=(w$yq$=GdDE{?gV6ceDgVTJey~bwCy_R$AJVtbjH>jYqfs_i=YHl^sF}5Dj$$#SvkCE@ zhY87sWupTx6i?8-+%|LGxd_u%XWrq0HJ-=c4se*uCc3AUg@00cr(JaJd8=#HJMW<` za1q)cVGri^?V1okgdliH?Ab(vr3r=Xu2iNh|1iy)7e+ndaW8j_7)K}~#PulzA6zsJ z>l>fX+`U)ZL2|mxxJADuhspicyy$%`n+jBlGMIRH(tpjo;NH4n$Rvjnn%Sx{!&kDV zS4c*@DwQErg0q`9a0<*mfv8uZf^I{>^C?FLl+d9EouNy7Nxn%ekFXB3sAoI=BdQT8 zCq(mO$+^ldBT_As?_5IR`Z#Mt%uq1t03xgP;fTgF?kR}TNrtna;Seg(SV>5cu%sdKbYgqdk9{JacW1X4M3tVrGEt3>_TrZ z#ybR;!R=jFGmtIJCfqA=)Ql%JMqbtK9U*+%1_cN>$|Ps zXptSXmQ_()EUs3j_w?8?PqFxABtz|Sm_CjQ@^`K_pBg{yD0H>c*17%i`CHH$k#J8_ zLGUX$%?>S571tVywzHOV2?q11^QX=p#NJLesP5Hn9yoq)>+u_&>6n1yqrB_DwD_fO$j;X(O``b#ACv@MIE*2c+DCXArqRalwY=NO7D9W&^jZk92jyN%{ z#e%%qh-89soAji7+c_eTow91_aoRRQEjB=h{(6K+$}^fxR3O|W1AZD`n26Qbv#N1c zci^>UvgPybQ^(pgCog>Qg}`n5(01KHNv%;O$;>tShW#p@rGskfgJT#SRgP0BUrRh) zNZeXUhM&!lpzCKV(~mZgH$yo?x?u@K^6yGAm&vGU&gY?xv5 zgyj3AKAEbyVxJQRY|ll{-c4~HrIS|oYvo-=uv0S05)sd~azSuX^MLJ&dS_ zybhx<`VR0XU339IE_9bYyCZ?bSzBJMh+3X|${%BUJtqUFc6w>v;HGZ_ zDjU&g=i4WPJuXC?nzvoNxj+jo3X>TBV)xRv{iB-mYxa9Y&Yg!aI$U%_2Hv4)u$mvo zd-+2uF==SAza8{p_`?Ufm+sAQ>m3(3Jg^B_%HB}!LJ=mun`x}y4rQ!Oq2>@5Q)&;Iqlmi6TS7EKn2AV%tMJX`>;Dx?AavAIT9`#QGY&>qR6}frGkp0 zsURmyz%o!lV2Fb}1Lb3qNn~r-*9xT3K!$?Dwq`O-$||AN9w)NC-)^FuJ#ezjE`V|v zwmn)egbX3+<2Rc<@@!fS2zOGP#R#5Mkg4AEOA$6Aw$_oHRRDL%MbuxcK5mCu;hGcU z8x%gR-Gi#ua@u&}-0J&9dw=BOs9&qs3T3}&X$rm=q6h~E)U%>hr%PcAMc!ag~)*}wj6W5;;+ zPrKLvc;gdhl3P>MkqTmk8z2b!m@n@P5eGvEQo$BlJf{Zs9lL!77B$Cspqp*a;6l=7 z?u!Fq(=iDrdhXfT`n`6S*f#q(G?YjMl>`^KWz4NwIZQGhol%&Wf66UVD-pvcwAZpE z=la?6kiqLYxI=!&9zyx_cARCjQ@h+V;oy>|y1CTl8nSMC@@e2Ix^8NMEWY4|`q z`{9Ek0ohNrK@VlXCA_wDgW;eML%Kzk$@LG2r}=8ySNlv7FBY?nj-BxM0>U2aBpj8PNQBlH1icmSbsyWk}cs0UOwWvue`fJh#G6GzL2+&l3i{p`v`BgR0b9gE!_)f4B zXV%9Q`_+NGe5IT%0SMGDTN+(HjOt7@GDgQD5c715b=# zqafGJ-1N(~uIi4NxGLXeHyiCtM7@HqusKZkDt?^`3RAa34O@*W7sSqwynXesL}Lke z_)EU6-vut2#Us*mop9kDO`>fBg7!MmK)QUeT2?G&`&Ixsu`7wMO)Z>3@M{ijH5Ihs zP7YB&u%kqb+PRFM422u#43C|`Yp2g|2Xx)OTc~9#a)Y0Kisj`?v)%zC#x~#Y?$jNU z%0RWb4+>`6WTQxYAWI6i>@Z}S2Ry~H7h&B;Ox`LQg8Ys*dw17E`~ioQaq1hUn}uAe zuO}zA?77aIRi5IBq%(&T^N`h3xde_1E5q&3pSwmB<`Ye~rs-w;CJJ=NOcNT>2 z>Hx)rJK zLKcf(H*lLcMMPj$!cqjQ@hjmE^L<>-RgZrCJWgvHN6+~ZY{ZT^4d#H01JA+Xn#6iM zJ7yVms052*(ap0@h;yv8@y`=DTEedoQT#Uk_Lz5kz4H3XV_$lrejS8qhUktdP@k<8 zj_tFA$c?{0Bypy2C;6mXtgBm>J4F~j_+pB@r%}824X%GJf3NAp;2`JYaAg4#u{zUC zkSBC;bVqF#@}9l%ggPgtgRFbG|3F2;7rReFD#;Hc6X?^VTf81v*|m0mcENNn(O~V> zjdKu=M7!pmoO1-m;AP5(N2lk?r-H?c#8047XJ50Y_|j7vC)qXWh-of7!?h?ZlD|F0 zoWK}{G8q4Cbv@|BzKp0TyNOEqa3m1)3el8>Ly6u5{wo6|`UZCO^5UOIE!1yL+??i; zWC@BMr|?;9T#%+~2AnU{uw5gf_)Q8Mf@9vR@Z|*mKybDl`8h#4R;%nwoR^B(7tv#0 z-}DI`84IUaCv{-i$ zImJHWX7IL*5Fb=m)Bm|7DnGkx+S-yk;888RAZRK;@wk;?gUe^B1~4U5ebAE^qyul!6jLzC4_?v(js^N`#UJO74s&v{pvAs zda>ZN_wR#SCe*xPwgGzw4r+4+X&d)|PSCzF2K26px3%U-YZu=j!7}WYL&oY;xlP*y z+o+5by%kgY*R%`qR1mK^_iZ1iov@`sb!|J5nDb~E@xyUP>H_wv2OLIVa%-8Xpk5n1n8Gs%B|R$c zpF%cv88LTs(-7}0FXJ}*tqjvgt7Fw%J3FsPhDpSF&Ag(5_VHtoWNtJQ6*Lt!L@g!LtJWj7WhUsTpoXLlDkusFsS7@_Qsj6k1Zdg$3utBpEdGnsH@qm95G zQmtLMAoM848I$jwW7}WiaM$lyEi?QL%?XWWkWY}(9R1zZQ)%)?JL_oHv&ETs6rZ;1 zXff^|s@n#KmE0lf?OY&g!1X+F@{Ghs1KJr*s{KsUTfL;Vi|HYwC7zp_C2M9OzT%Ez zbj0KM84dXcp`i%*6(w((+cmv&<85U*>BTIaiXP+t4lI zSSyB4Dd7(%saB3qL0aY4`sQ2CM3`PFU%DkA+iJw>IRwNP?N>s*S{IY^oHlD&hF08R zN~QMepOQdjYE2atTIC!?&X;v)zJ`N#*n~gd6C6Bj8}k$se~k-mJdzELhg31hTADa+^^iT4YixE1$6_=WdU8z>^h zX|{&hyqLiE*|`fC(y1OrDZ^K``8C8d@gZnA&oW zW|0q(9UNI*9sx=&{788pA~WlxB4%m}m3lPn=~{dh;EMg#szBm$sDZ+S$66k(wEEzj z<)G4>VkVxJ7GNHYb!t<02S+J+gC7gIPlVx|qG_`HVjKs3*@Lyb%F>kfy?-or^ELRA zTO9Nz&O@on$DR&{7|zD{qB9+l;KgkGUJ~FimW|NrlwfPyOo5ZgOpNt9fk$H<(`R3zRmg)`< zpU~0T-UQueT1qKdsj?qE4HkjR;u%AWsi4nxts@MRABcFVQvbKZYJN9 zsd(}rg3a5k4@|qZP$NFo9RQS6-g#G3*1L2wX##s(B&Iw}%k;A1UX92{I~sHC$3U+c z{-4hG#D;?`4om+I1YH8r0)ibTo~D8Z4gxhu=Q7=ub6*{iAF{c^) z>zcjOefrl>qU6LnD(ErT8mMx@B-4qR*>f++xp78b{rWts>I5WB(It?3l{xr zb9Bk=D18!KC8W1fsZJs-UYWW|6A zLjgQHh1mr{T=$}ac#PLWfOl&xO|GKKSJ{8Q13V0rB~n4N3R7Sb-voj%zrOt^U$MiH zr&mW8YjE&gTk5l5Q$d!Kd!pY!zCc~s?@>YVKCMrwpr4SQL+K{20OXDSoxEmmEGI3- z-)Hc1boRbH)q)8pKj_O&UtkA-3>-y&fj*f2n|VThBJHPzwLcAMdd`A{Z=CW={>0La zI2-+GOI@YBV25Lun&?SgewP^4g*4xO2cb>l7kXR&Q+gLYcp&JEZeQGZb# zKl9h$s*a)A|9%erld`x=ivK=ku}ccTpzcZq;CuXyo!?bZ|EfQ-tDt^RP{#qUi{A$D zx^naM3H{pr%cw5{>P()zZw!u)w%+y-KA)#}RpFW6dC~h$Bl%LzQ-}tsf(KNP+!e&^ zdlR8e2Uk>i&Y*J!wicV%xWb2uf^)wn1|3}GzWOeF@!X{gE~h_}ozgA7A&0wkNz&0E z;L&6HP%@uPZ_o|XBg&Gzz39%CG~-<9!pJAuJf=D~w0Vpe{#efDm=Y)TB5Oot(7N}) zNFzNwy};_1_#VAWrEffL5~#Q$g>J8qBPz=%@gHm&CLfYzTEF*6Z*i_q?g+ZOkY!>k z#YuJB4(z6OR!&@&6M&A$y zzaTXxD-gqs*fV|fpsJ)Z#N${E%Z<=}m$e;3)w=D*;mHLzCZoNDZz6*CUwzf;yEe0Xo&$8piTj$(4}@koDXp*|(cSGr~diL`#hUY2~}qdMi~k=g@_)p>32 zXs;^hGU%P?wgAdJkK$`&W5dM@S(Nb++yZ{yS34XPu4BWAn&!w1BM+Hp@O_&?oI?oEVvmF zVsl_XU0_16=b>j|S949*^l__vbxD)aj+?2jAR2v6A=)^pl>bshw4>&AGL8?@;uOl>G`V^+)Ya zF8jzlO`ggQJwW6~nZIj7(KCz?vkSh#3`u`>Tq$D|ZvCFosdd7|p;u z`$|VdL!(nwa{dBBgTI|WueVc`uhH|yQ@rPDi!@zc+(zVpTr~t^UOdTesh>~G+gP5w z5WKq6R(h<#l1uOK*?@VPeKbF3dAGz@%qv(BA)y~z@M{f`wbX}y|o?oQ`_FR&tlizrbm+gMyE4DBciPbQ>*#B@z zY}Ky+;qW;b59!c%f>x|w%)k#h*gOk8T1Gxml6Mq|Dy^3)W7`)jpXl{cJ~8vgN+3IQ zZ;Pip%LaZ}6ei|h=*R46la~|STwK_us;2E~!I4&?iDFRao|5%E5m4 zanB7_ulbMX-z=*x4j&MKPd28!SbEvRNWy^MQWnb=1C< zU#A5LO1(6DHbN2|T$e>)X411s644Ecvm@ix+wtUybk;_0A?Iz#bP%P=_ctC~p;bA;!F7tOsZ1*zw1E&sv_)g( zcNnb@vsoxPqFn(jS%;kBD+UQx($~1NY;fo^WOOAcgCi$Yv~%#q+CU``m?|dS<7r^dl@SEXR zM+#mh4sjaV^dp-5i6nj^HIA}>-gV1js(mWy-gB@qo>zf+7?c~iIDP?Xs zqZh!>*;&Q!uwR6?t*zN`3L24em>7iZ(rMJkM^?^`=)8ZB2}D4mC? zQ`W$ubGT+Rbj9U0!>8&t>qJ{p2JVEqm_1#;eOfq3`v0;^CYczBsnKnoVEwcfDQ;7R zZ^?FNvUIj-I-D?aTFaEipZ?bM2v;T%_d+1vNq__*gjY(~IX>VQut$&0Lb)Fj%eL(I zjVzerPE@_O-F)W%?e)pXckHw!wW{#D(2xhiK!ZLI2YQ^06)V1I0SUp}v)t+L)ZH!@ z2OmGVRyX~rJCX{bdx(m(5e=Sj%8%r4^16$3?1gJ*KTY(y-L~`YKEx@ zKV*x^hb~YKe3~X8nhdVXZEy0(AY0D&>jepoppA6Dnx> z${>27-G$8e={_;Wm>ARM`w_8v=6huF`gaGgWH!CVb7&C=q)Ld_K{n`1fGn?*O}N@8 zEaVBqY%9@{_-_4XuQqSkQy_ywV|nR&_QM6pezch+rKejpdt?k7(mzq+YKV$G(Ecu- zp2KHvv&}D#;hwT_Wi0spor>(aT3&+atMT=cf&op*PwH)VUKkIl$~EqPxw;n;=^f~* zV5J&b%SdEw9?3|GdXEv6x?CH#GG=8dqvm7iHSzLw8cqXg>*X47>G=G^4s0Zt5-a~Xn>>_yMY+5!#lhbc;k2E8=oR`_QizI*`@c^_yW=z=gqX3zEjzi|Tl%>+9T z&8eU>Vj)zJ-xKY(L|Hf>zO!-2wbEAToQ~;*Yasrc>3<>EJF6X}vqWUim0yy(baz706 z%S@o(k@P=16IZxFI(X~JwO^4bMUtpgg%DJV03tl2f`l-@z6F281Qo>6kAF{jtO4}3 z(*UW%9drfaxkbo#^r*#Podpn`7OhkeEjP(t^H6UzsTrWONvTB z^bz+*Z0i4r=|W+OU^d2%yw?j%p_K*yK=fbPB`C)O0jS91<$%D)=>VyMl0*u9HnI12 zWXpf2SRwe&jFbG!IMII@=MR+s*T<>&u7LhJP9LH{KMlxin0`mq6_OLcr$4Z)?jM;* zHsm|k-S|xq5ST-~h*_E61ObVUot<3c`*(|p#e`#%nZ_?L;kJI+CX zz5Z*V*u~E-eh`tn^7XT^*p-W2x!9G9zjdN^b=va0>rN=yLIfJ4qz2c{1-ki_NI|izoGHEZ!0*ai1%E+$J=_6f0 zEs*wq#AVu#z%`6gD&$vr@8tinV*QuW%)OTwJfThOBM3}c!z4E(q}l+>-@hJ;u?#7V zHmE9>5%w7z=ebxuwTZfVFP@McQF~yRq(&}->w0)%x?Gxy3^CsJ+NB}c&my*@IIUbVl56yU74uBcP=*Aw(OKt<{6fk5W0a!g_8|7hu#x_eFzJ@4Zkr&Wjc$F ziMcNMM5QK*tBVM2xiw94s%zoEbd&)LQ&f)6yT-=(jmo>4=NzVW20NQQjs%Qt-ZZ!c zOWp{sCSJiKr;tHPH74pB9w__!T@MOAWOd{S%fPUwFK7uBc}NiA_uD3ccFu%v1#a9R zek&l3Vx>ai;9OX+i-<$%po32~F~MM;!Qsi7Q3=I!y=h1nO`1Euj%kMIG&OvyWEMf`1ladS!R#^_kQFDP0v(S zP*^AQcFtSE^@ScEY?s|Tx2N&OH)cWR71n+c9PhmEO@t5PlzJ0ooAS_6q<0wxgy(!y z$;pJm(VaV!9!-ps_a^jj_HQ0ihd@-N)Nke!ksG!H>+JjBs)=U^C-6WmWi|Vq(o%~` z%dqP&E;_~nk=Luv>0@R+Vn2<1f0E@PBvc4GDoGd$Q>t+_r+vdQC*)ZYE@J1#)!Etn zPHoCIeC2S;PmgJa+dW54LO(_;Kx)yighG_Oqtjl@NNo;%OaBEUI;mY^xY;bvF!DNS z_8a%k!d7pNn{N5`?m)XZ`Xgii2l0{O^3TBjE8qN8urj_S?lgW&H=40-?KLnP^SYAD zBgBsl=$MCV2LzV;e;cv zCf^tL$uow;>%b0pY0-sL(4;sO6rKqLblJf`N%Q2+G=gBVexrRT#tBl~5@MTgGi*;0 zCfG&rwcIJIs=_Zn-Bjs0kM?8k%3+&%yv*}JaGBVUm;p|EH=%FcITu~M7p{5=mWPA5i zitD-bx$vdq6gR^i7cdnBfiO_cQW}5_nBoYC890#MU=f1=rLgEtU~^+^&QJ43Y%S;^ zza>G+6sVwY-|*0B@Mm+xs;@k$`xycg*b3Bxc~G{%B$FTKS6etvant|1PeJ~{Q~sYc z51h>+UF;!=I7@g(UNNjhTfUw;>cp&*d4AdO#kQFx((zBvqfRu!L?iWmGn-7>m1oXXSb1-^U+ z+o^L0+oY6$1K?-9u}GHB^NHKClOcu6JjF@Q1hIz_T*p4+N)bYkQh@wFk|P=Y4-i`j zAOZZf06h8}sO{P!$^(4_N6}jleu`Z?S#h>M#sP_cPHHu12&*a&f@P>(xYR?9(P{T8i?(C6V zskqOy9X^Zr`-A=f&`-jFqJlK+Nsu2VbB+CyUp*@G-g=-HjOt#n+da6u84oLqY<1>EmD6e^NcVq+_r@Dn3*`uw5Hu z-yaeEFTrL^{85tX5Wh<3*?%mdz+Q6E4be-T2oj0Jzs0!0NB1jR|A_LR_2qZA_T~8_ z54{C{Afmr%8vUUDuKvJK+h}|`{s%SU_p5SVRmt7q7?~Y$o=Ej19JdPS8{|)MxNtu- z&pdi!k*3fVgIMgxL`T?w6V37HW+;cv@L4rW{Ta*ROR*rfeec;ivo)z8i=BHj6EYp1 z&R@gs1YA8V;mVSKSYUtDRCp^M;lIWnvaRosBGM=O&}mOhmc8s1$HWsI;45{cpogvM zP2Pfs4Ze+Ao*x-^$=tbyTohql3r<0ix|0#V=!D2Ws%V|xOh_#X;0u}L-?gIl&y11b z^n*pXto)lLL;S=Tzgei&kY5=g<}Vg7{TITW|4p@;eF9EF00;d&4fHFi{xYxMNG1Lk z)AqNd`cZ=%7W#V{1WNpwpZ-;Q_m83b-M;?{-CqpHKZWkUGTi?Ry1%a<|I?uRzf>2H z?f)IMy4?%t@jtJ6$p4cT1F%i(ga3|J1MC{#ojUgLx}fr@DxS)T2X$P!Y1~?gh|s zhe#TIPmvaZ>NznFnOoO2VQZ)oB?zZO%At}Z+=T(z66pge`VNvMPtWHcQ5ia;OE^3g zzG^sn0@0#EEQ{JeY@4%sd>JlPDOHR-5?6g&Iy-H+WZH8$$}k``u)y@CvvhMw{?fb$ zgkk*&ngcG0_svBpl-E@EEzKmE&VTF;FvL2Qpft!x#B?x`ol-Z5-acxUYSw+TFX~{L zr5mJkTV2?-@v@5t@74jJ1oDg8k1Ix#zZYiy-VHI`{ke>CA*5w;XCJT(OD|klQ2FEH z5V;-x>(^uTR8TpV46OVz#lHf+`O0TQbHtp~;9Xs>E!+-!3vfu=wLw&|ur%BmzrJiY zFw^&`$s#j&_13ed*6CNS*McOD%`%}<+m}zGxChX7zyWDwl!4)s+QUy85-kU<52TgG z8p?hc7aCW(V`9a{sLm$SsOeWnd;$ZuS8VGYU_I6o%@p$tXQUx^C;b(5x5jiZ*h&0q9XSqijHUjmma5F@@O-HulQ_I}4 z%3vLxNK!K>;N*%C(Q@kIh-#C@@s>*T6L&C|(?%)x+-jEx%Y%$CadFmM0cHW~Y`>FZ zu7yZ5I)pDd+aOH(Rrw` zT&`By9M&^&UQV_+_hG8T+q<_tP0wsCJT(*8e9e9YkA6~;-2Hjfh(JG5GFCa@CArp- zqtx{^#8B1A<)a4+n-{?#cpi6+fU2{6QWbWmva-iT%rf|H+sDBkuBPqj_54K0yQ&SSb|GF|#3>+nJp{_5slh3*KM#ORM_a~P6!#a3WmU5 zD#1F-G;Jn$-7CiW=xRB^GJ+kNZYmsU(^;Eh@w0x{czeM!U8@Klb4anYIM>2iz#CE8uJ&_?l{Yc=u-i}qhePrxG`AjiI z5*B#5-&X}L-CrPID7z>>Y0Pih+kVdNvHt}ZE6iIxaSfRQVk&;H6`L58tXorA@iz7( zuBxQ={q^@2V>4{P9Dn53ux846j zD0W{S?899y*rLK|F+`dZ{|1ETB7_S_aZy3c3-6rRlGGKtzRarP`N^H|gjW`KB=IcwGt@ruzL<%5dAvw=bMFX9)YWOwo!xJ{ zEUY9)xCzbSZtdNeu=ycJEA_)|XReUQ%@(0sTH;5Zs!ii!9TA*x7PJe$qvk=pM`VdS zz4d&v@YS-Cl7RV%xdCT$l?xf-xPXo!It}1V3m1|#LHsISwIRoyxj?^BQ({2<%(nY< zqQX&b{d-(S@ANp@?;Xh-^|b!9rW-&yGQr-nzh4;GI;CIuxbXPRuiX{!SYNxkHo+-d z|7$|o4alWXl8B4@!ssZ9ZIT%{EoCfCP;S!pFnh5y-B-v%mg{C-r-03a=u+pBhFaPA zU@aS8TTTIoAt)6vn)*mx>R%JiEEP`ImOt9+pvcwLP}bq!pY+Xzow(TqVbUK zsqbQ3&9yx&_Hd9;%{;_U!j8FZg_MxT8MWJ;B9bA=Q7NUH$ za;R2fe&R@J&^~QDjrf9ht_qbpk#r~N#=O26&x7fTYtG_CvzzEVPZ_dSwrtzewI$qQ zD;fiDe3H1mZQEnSD49i!yMlLV?&fnSJN0TKH_P6a>3uDS)uleqxTA?`)6?V)&O*a0 z{>CH;JR}tE31oEHU^_N|g%1tR%{glEv|nkVB*Y-uD$Eq#SCAE&+>L??SB z=Xx~Xhx`2>a_5fCDGr~a6Kk7}*|e*L_wC&%)NKIj8%m(`&=HGSFvofUq<*76EFF)t z9PJFPDibh$boOBD=slPS-Dxr9H}LZWcHkgFSmB)#VyxtPdh9XA0&U+ zZjYU8tVwXsF@-K4LAz};B7DjfRw@;#Q*ceEN3Kq71>3!O{> zBV|EEUj0N8#C2V%H+Jmz$p(znlI(K9mt>lYIqwgwe)c;a#UyyJMoqgPtk+j?_e)Lr zz^&k8k?s$*60VFVgIJK)89>ngn>NpR)6D_%z69*M<(Z&-y zHL;RxZ4kW57HeR+p*D218iI97j=VBevWT5LPY`VsJcM7U*phVt=byG(in{WuDxj#2 z-Vp|9|4HEFk|&cPXqI)pB0M>LZ?z%L>GHn14BESk$pW6w?|)Pjr~g*vzmfz9;loK@ z`?5-%qT742GbfsQtSqc`#7-JT@Lu-{&zyqN0Oz=52Oq6g!}uH-J=c5mSq7hJehIgf z#CEKnL|m-fhu3?EjCB_Ljq*%$z~L(sNU;|g*9t$sj_`^#f4+W4BKF#<-l6J_jgLU! z-kIPr*i8lLA3!-f668luP(gqjUA15bxSvmla)GM-wnlae@a^3BRX3L{ek`P3{=+Ni z;ttR+qFRU8*z>(#dg%wDkxTX%5aCy0@y^R$R^0@bN6Nv5{r1z4h)c0aK%#)EZd?!54ehsD17`dJIQj+1s#}C=QQDk-*QNL~6W1K3}nGMJB zhx2e?WyN}!fG(@ALhgKfK;c0&>XBT4SmQ~c|HAhkq@lKWL_>N+LneQL=(5caJt_YU z0Qvm`=o-I#C1m=S$E65pO6Zqv@>coxs3azXq6$DR0uBS24;JWybAP%Q@WZFJyx|}D7qgIKi!^A z5i-Of$ebO&ppkbyt9MSPcTRT*Ke@&Xu7%Ekhs#mh%!y;@wk`P|ZvC$?F1<|=ruf@# zc90r(RC$3u7+0XN1}sSh{Y0Q>q5}lza9PupL#%YQ63qsabu)!^Gr`bCM9)#*EyQ!g z9V~iQ4(bZzx~9=T-VEeoSbw12cE9~vI`H|O*zAjAW@LtrW#}%cf9H%{QtwLj|0<~l z^#30fc&6r`Q{X?|4=C{LT?G!9%v}Y(YpZu{HIB6FmhHM_|G)!BZhd$4v4E=|PkcoX z#!0ov(@(;5HZcY>$xb=NT7_u=R#_h|Yi;_88nJnELtTDZPsA6f_XP>IWU4D&P3yn3 zIu7rgzpcEW)t4I{_r%n(1JyRI$p!OTX@Ii8Wz(QRmgA610VB7sJQX#fJ-%L8V_&zH ziQ1PjZr+|zcJFJ?<*eK*ktY`8Yp2q}WsVyGD{k7-WMC6BzVAoR#+&E;;UvRfil1qX zlUT2}*GhgvwmZwTk3DiRSG85QV=Mr<+=&>10JUO?(s@?fI+4(3aJ* zf6ol7?fvp%gYvDN@!m4A`$X>SUk=Zu12+gY`R>P;M&@bp^l16qW^LDY6O6iQcDml$ zaQr&k-bJl~@Z8KCYsF5Q=&@`{z>)D^d)uBB8_^o;Yl9?t{$qZT{cF$CkJ~qvzG{vv zBfCMr{CY4kjr5qbOQjQzJ#3OsQyhMtoa-JPI3Y|RCpPHIN?i)r5T3i6US9oa;?nuY z`m0MeQ?&MUi{yrc+Ee80L&Rjf$HsAj@B)Nm*&V@W0j-~gCF)1-sJPKt?cdjM@YrVw zk^9~pFUc7HYHiB+i{#|wsRK7jMGfcvw>M!^3&x{%klmwr0p zzCB&Y_S#XYx61ee^mtn^&Tc_w*N<-spFkC8 z3QrjN;5Qpp&5r9ma8pTimUw@m`Nij^j0CAzy)Mwh0kbez<3>C2%9P~_*RYf3{)CC0 z#vvJ}9E(<4^>^a$To_C^5{;@8to$c(ohHjv>kU~y&z24ODwoAJnnoT9Sniu}z($HZ z&AM~$;L)eL-BH1Q8uPK`K9)GM$4XF9n0^DlMV4|muVt5ehPH^jgoi>?-p7fX0eQ#T zbT!3*PpzvVvT+ctp#&Kf zzeW__+2bIlIIu3<%}MOrUR|AN@UfPY=R1>lQQ>I1+L_cXkGG5hyh}FH#Gxrf1cbF# zj2K7ZMsgEXMqIefhg;>6?c8rmepz8$e3!o8mN{-9vUZJTotI~P;!~?R+#27KN;qpw z^k!Hn3t!vWyDswta-iW2+o;Lo=OdTA?UZPSdu=>3NN~Jn(F0s)`e4Es?8ptaD%k-S zmPZjr=*jDJtm!8&JIQ09OIr9HoMw$?495Dx>guwzK|@K)3pZz;-T)d{Mhx#Qk*KRF z#WeH4K`}PIBS^+#Du|z*-4HvVk1QsKPCPMBYPS10DLqcV8VEF36rjV9CG3re!0j&| zW3ZDPaxva6nN-l-6R}K!tYt60EVJ+gjFykE8D@gKN)BNb%zgO@DoC6>>s-=Cyh3^3 zx{UquQr0bL8!4mq&-*!_>h7r)#@a2t!WZ_*^TRIpx10fUj(i?#kaNa9w;Ubcn|xC^ z6Dlh)9zk38m4{~Sp0+H!W=D$TSki;IiKc@sU?JgmTnE((*PU&?%p}<<9y2lzv$F*@ z-gm0Rqn3Q|=$0h;&~;IH%Sr@Mw?K#rGA=6bzjwVld|c;Z+Qd1oQ&VClh8I8^UIvYW z)eG0iudCTp;Rge;&J#uN>)+S&cA9n2M|_Os;N}dP(360dcbB+Qga@nDa((+P8ZC%J zO~;*FVUC0IhD=srW`<>Dc9L=?=8wXJQw7`V+g`KZORLtzZS)bf*`v7|IAJeV*4-W^ z$c^|!Hg^?YdC$OEO-PMo!!mX@6jP*qKOtE)*%xr<2#2a9yxz4OO6qH9_a2tTX-GUf z6Zr+jm{9kc-8$_ZTngJI-l{43cBokN46B)LZK#2>=Uq&CJo_0|r~fCqG#NAwNrvbb zNABUgp-p#kN;*H@(g4tm%r4u&NiuJKU2mz5D-$M{Zs4e(;lyT(^~uMz$Cmrmbu)5y z#L@<@G6F>ShT>I zmL=(<&cpAY=u)tcH*G}KOS)GS=2=+I`7P8XsjljT1`K!_8zO>|r+lWTk`RZK#K_Z! zq*-=%A+5_sM|=!`{?!FV8T?B0& z)Jlo7@7XhLzp7G&giy!lZDxj^vsG1~q(4w#p{GK<0T%YXS)%^;Sk~*lB0VvZ^TOo3 zGH{`YtseIEuMt*%f24zfQA5srItD~xKi|u|IF349tTsz(q-?9Sirj0rhM-o0i9s5V~I-$=irx*2~cu< zcoyY~-}oTt)E8>Dbonr(mDOWzusNf=jv&&!ru)f741sf|9H2i?h%fqDpTcjna!cPn zTj17xn&%XbnU>JJwTwEQ-rA6xpV2`ae>p{U2R0qLddn=B$*02l`*2SYJtAWPYVAsU zS9V;o1oZ8;Iv!;7GK>6+=^JT~y{HUy{PD@&pCAXW8GO(@gpc};uhYKz2r(>`w0_tM zbx$T&D6bzjciTEiaCr{#ermXFz`<)bLF}OZOo8d35}HHf&?9Qoe5=LGVxb?wiST8U zp$R@EaV_JbyzBOmx#_U!EAnxJO!W}HH@Ye%zie_>z8{e53w`n$sb0s~gwJzs?feA{ zE;Q<>(NSL0zNlTaPeY;oMiNZ^o@}+iU@r~_fGpGiEeW&=+-B=#^l<2v&5T%WI zM`fY9+Bcjh5AG(@WoPag7PCBp15&5h{L`;yPt<*d^!f;C8HBUd>d-`T(z!aKbST-X zk@3mW#zVNcD9_(LPZtDW<`h>8cl@;l1OB;-W8VS0hVQiKCOk@=N3ii;p=ARm$S!o^ zvQ@uG3lqllt$uK~2tLa+98UCcJ#YW;GaeCpBDE)j2Q#?|2fxj+yzSRc@ ziSwsyTsyVvO*GWCDorO*FqQfQV{Z)^c)TfyFwh7LXpzP^J!uh!OAh5^`uWZ&j_JIvYM<3SfX z0+;u_gBG%#vcq`w%l^Zwd@w$IVqpu@oDRG~y1au$P+o4_KDtV`7d*Epb{**cOz4c_ zzIdGMFonMKwI(uXn7t6Zv^ukxWYzh*FiUv@W4B$9gQdA^69LXMTUfv`rUIKUNoDGd zJ%Ro0#nESFKILAwxSKZ_#yN>24OD^U&IAd$(w7NVp3w&S@gHqJ3Gd#IZXK;}rcC7F zI>w+szsMCt+GW8?N%igxZ^bFj*$GkUDij_HAKq7^4(IWunu3IQspuc%Jw^3;un9}S z-s!b{M!MOHDOGR~qzq1A33Y8X9kq2SdF|JbmpI&`PjbUNAVb+`UsE!nvHDcXUOc4X Ze`5{*ccy(p&3|Z#pRC5VJ{4IR=YNXrZ%LxV_n zorm{RzxO-q{P#QS{BfRziwD=t9sAyU-+N#C+7a5Cs)Tqnc(-odB7C5xqxb$zHs}3MVW-p*HmuuazuHeTT^nY`aLIgd{A^^YM%Z3zdvyA z67nGSN~iZa=sE=11;R=nOI=>>c2TCN^Va8@_^f}j`FSv=RR%VG8}SHf_uud3*(1hl zLGmR`<1{F3?m1;}l+l;9$^l-k6!QRRJt~sxb4-Otj8aLv655u~zZQQVvTMk7#2u|n z@**^w>Sj*PuxGbN*7~{1xb;mvp46Xh6cxo(n3kl)4}y@Z|1;r1`BSQP7NQz6WpE@5 zMHfkQY5mH3x2>8fq7po{2kFthbuH+Y7=k1>`ZMjlUY)E)S=O zfzS8d$I|9ZT{io#T<>cb`%x^c{`#)OqBGS9swm*1nswQLO-2cvlab1%BhLjF)+UXeOGG?> z)vpo><&d<`)MEYXB=hX`kSs)9MhOKqAQi7WbhDmF$VB&$jtwhl_!kuB)53?#Jt!1-t`3Jo-PUQyN1WQ4Ufz z-NaKBvK^!{B9DJ__chq!7g9m^UqY)s?`HYM{gCz!sRcMv#ZX`By|}w=jSn_ys;;5n zdf04x{(Bu&n&ka7Z|RQym6n-Y|Mk1=&r`@ww8M%lvz4^NWU<@fg#MIWlNKU3>Q3uZ7fq>5bB~E99rL=i zGJhq9=%j$Ko?&eYDomO{hlL$@Cp~9WuhpbR<7GDGP`1soUcY91vOG*Dog(5A%pE$v zY*4G+er+R=8fn8UJ`p3Kr%%x~E{Q*1%}hTiJZw9hX)4JH(NNvvr5|g_8d6DXob*rW zdmGUu$xcpo$F*kNKAPDoZC+tTV*8}oC2%FxE_n-%EG@1ceYkvmetp#{C?fK7(!eUl zZLg1mc(pq&@M5vDgGe%oHBPD$PpL2QptJr26*Vwmezo`h=nHXxi($a&@<3sJrceIa z^S`_L7~?_VP*)asxw&k*?W1qnSm9(lYnuLcL=-&1 z19=X(oxRiHz<|16tI`gED0k_87;Ta9ci>RI=I|dsw!KFi^MQ4={3X-Wcvie-K5Io3 zZ$km^>-o!HUMZAKKd_bs;-HV9-+~z)Z^>To%MR>kU0+l#CmSa-UhRYno7Oh1+eWi4 zn8w(gfn8%{I+H_=WWVt&4$1O{Tr4Kecf8d%Gd!BM%i7brKG1q{62W}SLiYM}*x>?D z`x2SJHAP0F4z0kmF^_L)K8}IwgpU>$pzR~ah z=!kM>w91&GIgK^-UI^__W>08f-p;EWfpOc8JyRl?QwG&9#!BLCbq=5^;`|-As>5Y3 z7KA%1`MV8ntxk&|9o_Ty^3nuiw>*5~Y!n2T-ziaDsbSiE~QNWP2>4{ zH;22Kt}6G{`Ie&G*+f~ulhQg=BkT$@RSfzA|V$$3B+D(I-Ct^_}CY8MlGA zV_LG8nujBQEl-7ZQ?!$TAfIyb>9*ghWRE@F8bk5+%5avf$+oHQR!v8VeP>jBr_iLM zGcc)x8AxwQnW4$bU#+()*O{k5&M`Wa5ldGM&p~lc!{cM={jj0jkLw{I)+WiH3M>+%w4j+tiF$EPt^+PTo6x;Xn8~j z@u6Mpm&G>OCnh)s?lDd10=~JyDpZN_N=N>F!_Ufr{#Q5*2Abl_NfLG0o5gHHYG^jaCe0m1SX%uen3he!mUjL@W!g;5RYPm+Fd-{&G+%oJNpQ=MmEQs8+d8}5 zzF!^8^qM12zU~uKFz<&}4@Mj}tx7+!US=$<8j>h#SrkncBuO&6Kv7Oz@Wac&WhMXG zZbgNy;@C533Y=7LmWspZ8vUjuHz%D*=!k3i(s8$FOGWAN+!4H%a33>Wt*$5N&~)!Z z^klEB$nAK3GhM2PI;}9h=>nmc<@XX}oTa<5Co7_@h75-VsxkW_XH$WfQ+o+xiG6JKx`O^y%_Wv(_Fssl^Rk7P$Q5wU4Vb+f%U2w9lzaKKU3K-Sek zKEi8V6*y-r#u1onPhEEhY+kV`&U4=Xc)>Y{Cu@+nG!CIe){TT;#?h%|K1$G9E-~g>}*uEC#|lJ1F!X`ARzhpLz-RhVd3@4yhUmT)#9%t zA9^`lbt#NMn~iIj#hWlPR*k7-5Zc`+tBp*bESGlNpU;su5@CBO!|xSr`>O|y3~5#*-A4TC&SfWXE*Jl9Y^n z;jw54!$wx9ATzR3dkujlhypW!bD0B>;$AifIM788vxOOiOB%l*6N&Gs}CcUf7^XMNQp*6g%3t zpBb{Z{Qd&b0M7d=r6oOvJ*q3R9g%XuA-MO^bSs2IR;_U_)2}{1x{2|vokJm`$^|T} z%>yCl4<)`EWw#{n*IrEws@Dp%7*F)hU6eTFC>zIF%oKc(*o0e1oLefT#Xud^G~nN# z&uf4RJZ_vXv0~V6y75OH)e&hIAZ9DM%U+>N4QUeAUE4*`a93(5$|hY$t3L_mIeBAmb0+9Y6XnHZF;WNom!oQmWtD)Sg`#5B{*I% zg@x&kw2B`Sp$f7$-0MIcWt(1z;epk!)-d=WbA;hf@KufTx0)e}lHquJYzc&hgak(AH2c!TF(CGoQr^7AG zgsYqahQzWLI}6r#2vukh$ug$z#Jl5Ok;t!#ww`KCTSoDGo*Mtic)8|7MP*aka<*ZU z27wo@8Zo=%mL5D2Z7l_h`ge%wGAt^ZzY*Q|b%b;_U)+lo%6Vr#?6)H1Fwd-c!YIlSU3Dd+&Or@>V+17cZF4e((jJs%zknr`)fOi$A_#r&^7c^#4Be>cUpc zATxMkjS}9tEbZzw2VFIC?xoUXW7?I$J|N~7?Y+j4J&`}8FtJUwc_9&iU%i}|bzxoq z<2C+9`h!+3JPiPx%*6diFZQw-aVtO%5~;UV@Lh*}CaYe|+1rK0!imA|K)zJ# z_EmUlrsQHh1#~~?d9qZ6mLH0&X3qC#h3aWf;6=|_bU+@_x-)^r=E-7Q8B`wgzMS0I zw{V&J(NWAW=1QiZWooG4)sp;dyK4` zY0_7!TC2i8*%_RT)`9hz|9kgXgT`h+S<0qB4?Ba4n=6UJmpb-C1t!f(Vocro?sO1% zw<*N!{IYHki_z>uy^*NG!XM7$R>(T4&YuX*Mjm}@0p0hq>C1A!Wb35dv)LU=m2bUR z<|`5f4U-h<^5QSO6!bp>A{5Uxfl+cI5ZVobq~V}M%1qt|>J3h2GqntN zii#^Ao^G07OWcMaI%4&l6h`mN=UyYGTAmKX;D8jqq|INfESyiif%7ne?<%1CPivZ; zeL~KgcCbdBu@A#b?*?D>3vaJGbmH~XytSKxsWRHd`Ym&rQ?G=US57=NezJSVf41g8 zdLfdl)IhmKE-lpo=EQjZy(i3`#3kUQgOTXCoLzbfqy~;#^ODNB0t~9TJL1Qi`v#KR z1+1g=m>fDY!B8%J2&#Lbp zi=9`fWdK)@=EY>4&#blhw|rm{HfRq zGocl@Sh+K`shY~_tKiXBtyhO-;rQATyUT$2eq+T_r=|2ndzhZf%-AH?o2I-cl(`%2 znsbZ70t4-C4!&^^NqD8&s@%3Y5b7y1V{P9?m0xnN@77t+nn>~RmxAM;Ga47%X%y2P3&JzF*j@0+Ibo| z1zvy9llw@ru*Y|9KXcSv>ekjfkMl+cNB4dT@&3H|0!B!7 zAlPB^|BFX8E zYI!(U5)`5=_xeInS+;u4hYBf8EVa{SWVYeGl%P6!a5qlk>ZhG-5fq%yW%kF2@}x<) z&u(p6lp4mVUbl(AT8%#xcQqWd5q-MXC-JK^`k*AHqU{m8)Calt#>90Locmk7Q}Z4E znff)UIn{3u^1b${ZI%cRaByN5U)|1TigK1Q)U0>qSWHjn&J^bW@qHlJC^Em?*m%;x zB8G3#pB>;WylREcdS1v?!jgQn6m9^;l0H;j+lV1G}zP z1F!Nky>2Ij*2$?s9mD%ss1nc;VBSpwLF|NcjC7^+udpj3c3+K$y1k)rKq|_FfCxai zOJCT0Zc@-LK8k%giD!~Vm~0e>j(t{*#(PeiDvY+~cT_S9X}9{41(5oq1{&|JuOIn{j{9(WSI;os2+3t39_Wbi*2Q4|3A4j9kr_GD+s7Gl_Fx5CU% z30;C{+HDcoNvcgt8fwxkNAX%4awY+Kg&3~8ax6s4WR@VcEoWAA(q+q~j_sx0xIjOD zEm?kBx%#C9hrK&8nI@fGR`>!D?iq*x7R|lCfT{5)kHgso@jgt|HU0|}8;3}y8ml;^ z5_|By!{bcDF`noN#p)`iuc+Nj>*_iJ9Txi63xw@CLJYDm9c93pero5H+8XE3Ni(aL zV$8ccLC?;$xwI=hIHQb4KM|l<#VUe0WbmDvtVw9!FvjQA+&~!}XH^<8%0k0>wcbCp z`7${e=P+5A#bh%Ucqh~k$1@=mUT9QvMyRR01L-VLTC{+OiI93-U$f;xFi!n#|w5^9s9%OLL(QEKRUSMbjbMIjWZmMzTM~%U7MPlifC&Y3q zXuCmz1!M}EXBicCk52n(bFVrf%FNLs`Inu2!joIXooylv%qTm3xg3)@9o3Drqi0;j zkx%qMBo=t0s%}0o$?wI&v0QSkA%7vU|U@CwASR6P4>BiQ~uD{xJKJ z<#OvU&RK|8{Pu1e8W=rGh}p9OYnA&i&R?g^SA zHeP~N%?F&n1^j+PKsI4qsz@tHZJftn85T4S4_B5pE_?1PIbEK0vBc5gy>%*QfM{3J zsK+Hs;dz#Bhq*+FhW(NEE|*KjaXmW`^v7&x{x8|fb*(8zLgVZ`k7_D&D~CqQ|xsc#`ty}rRSR$tybPI~oY6i>k$v|z7j)`T;9htT{BO7D7B*%dPfhB52K{f;bL zF{v+6@EzUKIdCg{ZUSP0vMg~s`8nQBV;!bRJT-y6Y-vXeb)TjuYqE2pgAs~E;@0oX zjj^X@k1VQrcI(U_H4~q4C{MA@a5>{varJC7nIl~^N!ks#gIsaYVo%1wT7pfnZ$yC*sZiEGxEy0^Cim-7N=JttPRqem zroKv(95qx0=0#=ozH(>AK0Cb>hZLfDUU7ggk{Wc|%8_GFE=Ss1Wf?y#bul7JAY6Ao z+8(JNGLC@=WJ5~)O~f_qthO+Vw-6r0OOH&Oq7XHAUF)2uVB0=ZjW0|vIVQWBhR=v# zNW3RW8d8~Bwu)#G(cW_H)-xj3pN%Af;x#Q6zAC`U?Y>KN_)1VX)Hd%*G1F5d0BLr- zvKz%A_lwi_G)NbgkXxtui(rVDJ|{Z9`JPV~mzhr2trnslaRu*NuG)g9Ex$au{tRsk6EWMx%d?5AdLlja{-d-VZp}??hF=DNA47)`?qx>PCHB%r1wKf;)D^y+o5nP#|3rC z@*|@^7!;(z_?ZS(U3U=-!2SD+aSe%WOfzcOj-kU&^rJsYZX2}1p?37C84S4@gBx}i zuiAsc3;lehpTtO@6Ru`@E)~C3l|q4^G|5w0MCnLyWYDTjg^F$E&^91ny0tu#NIZeG z_>E?2^;f~{Dq_oDw{?BMLM0~ejbcB?5%xPQGN(@l!YbQ^;iuwz8t093TtFFY#^szW z*?U%5R)Gv%_v|ht+w`We*@LTg<9!@tmMGuE@}uL#Gd%Y~aj-e{KbS>l5QX7_O)^h9 zIg&L*rgMG9KP2Z7?Dc%iJCrjTN7wC+=HE3s$qh^k8$J&|z*&{sm6?;zwcqbEX*)q% zwCSc}CuE^vfNasRnw^Q9e&b7TO>#S_zP_8Et~*w}{@hA3GZ9w}68H=pPa0P)nL?sj z=)8i71K$^JYcjWr5$>;F&6F&bji=;4exTYCUlJ4_$b|HC_)}2e!4>HrdF}qzaMLY} zcQaQ^NN%#Qlh{O6t2ey-JK@+1g5rFGkG5a2au)*x8`aV5Khx5~Y7ToGR_Cv_=EI_% z5PT{nHw@CW3L0IXSvAcZ>06KUtKojFjY-L5N-+=-NBMx_E65NezT1Bb#rDY8ZQj(N zN>0lRgy9YOAw9`kjWNftWw+IcPO6eQ-JX1=OrqY*blElu2XNd#`sBFC)RyehkeOPK zY%L(8MnhT8=%z>!FP#EfU633;vYM_ue)ZuE5ebwu#dEu1v-D6LI`=j~%Xb!!eW^>o zhiO+q(p(0BttU_7e8xY%cn`qZcAPFFo*@}@IrQ?;Rp~}=D4CcbK;^W<=i3!fkScCb zZ-QU0o5LeZD*Nv}q03?tROHZCu>324d~d>Y z=jx_RbP7O4#`CLQV?zlMYS0HAHGeRE#G7Y^+qWEQYg-OWCJKXw_iH!1*04IaOFw#3 z7>F)+m^u0f7Z)-^d4Hb00IpBd=VJ6QN)^l`ZX>X?!K3^tBw7%B(fA49vULI-+Ozdf zDW%5WN6qEbTBtmxZBk6bjK3RQNOYvovD=FU->i9!)MlEMIpqmQcL>Q#7;#L z`^}+r%grZJK5GMHT2d7)>S-kLI}abW82F0l)LsrM4`uYvd=U$wajyD?XOR2J%yFMZ zW216CFYPIFqF)4U+9Nsi_V3o{y2a%2YgHgMd&-~9$8(4N8$It5l3N}HjWvjvV`s2ACD~|Tt z?T>ti@L%FYVU*p#U;gjHv=$fvaJJ^xtOQQ~eBkwEQIFmn^Q~oWroDFB2tMOGaopA5 z=cx5J@I}KA{v-iHN5b|`Jni`S=Ro~%brHp8zVQVvd?s+p!s!YV%Z*bwLmR%+6kK4} zxDzLra+dD|VW7j-5Ep1ES54>41H_b`crXu4-66m}0{}n{bSS>)JG{$YSY&&O7k&8` z#yhuj%waus-$b4L7HNxWX>+gl$VE`OnIJXDv|O5QcPOQq!7%PazfqRY%iM(`gy{f{ z!={T|pDvcz`0B)mq1rv#VMw^Y&gxi6?xEE4=IH`E%-r!9fkg)Ay7BFsdf@43O3VFH zrwGP(!#5R$4NuYjNA>Gd@XSBH#C~knfU#zka+iCPaZ=Gx2ps1X&%b$xNn_F|S3cg7 zC+r<&#DHXJU$BcHEkn*%4N?+K%HWsmxxpm-J48l6$Pk76Y+jq|}RpK06 zj~`OhA#8Hq3;suSa@0h$O{M1j`vJ;9RuEtsj@nHnAohNsf)m^>c-#X1L zLqM_XwdQrqnydw#l0w4?7lTxZA=l&iGEYKDl_XG|d(_uS0txc8mL<>Lv~*J?vc`(# zz!N1dfc&1T4Eog}Y+C?93yu}Bs1Akh+?1`lBbYk%zw53jdG36{nW|t5*l2$>M)%tP z>U4Fgz9U&!&kk{_RcCesGkE`aCCtm8aGEm(V82VQhg3GzLLQ2+kHt^l zsYwgY>vE`FGn2SxYVCE9NR5UUin0)8ibFEooWM{m+lWMxO`n+^)_*e6vT4n!BPcC# zHixAl{?-Ccq``xxaR5O8B-~9m=iGX^p?|3BB&lhTX*C|<{!Xl%cAN98<}2T2Ot@(p z&f?%n-Zrx%4hN_P6b_9KZWP1zE2Bvgln6p~qgdoYYni^d#f$vq`b#y)&g zQmDWKJD&GhGb=qZaBe<)alyS}wG`^zMy;-I;;MX!q8;v|9Ht-A&IzEl`|)0|vQ}_6 zk>fPm5AOfS8)2V6F?^DkM}Di0-Typ&%iZrwNod4yom_3%2Xahs@!IM*u0u~0Q-AMvDFK2+-OQdC$GVEV>`(+HzCGp)asv6~+NCo=tbe|fj5Zx5<&DN6Wx`w_ zKN_@?sY*_5`7~@S5aGK*WITwF`4uZ}_5HBYGMbZbk>pFbFABb_BFB<7s3rAd=bPow zHyNq$8|ezUt}`kr6OB4;W;&eR_g8AYK}}2TxY3}``h+h3GJiy7V?3xVCf(YE9r%iA zuYb{eK(ppa@gP6O@7N*8aAv)41!C zxQ(vYp!g#+d!a&ca~z%My~UUgk$dnjyIm!~IHEPfui#Z%#i3G&25rq>$W?Es>k!FS z8wO|r&6!flibS7@LD*ghS&Z1tiiSS|Zb#5G9(IyP8yZeD88}rnn#0T%#M;Lt+ZJ*m zc1p_Bt|kQ`>G>5|9p`tFUA2`UT?Fzj>=*-z+&)w^r7*BjyV5?$g5N4^g!g%m#FV4g zfOBYk1&r$UNpmMg#5`G!P18OiF#4Utc(7fHnU6jBED2iHP6)?%bu^y>pE=%-V!<=v z!?jpDV}0<=lW+%XQoRI*iQm}L%n^Uwz9g$Fhqrb3IQ*;@e}ezT?sWH8OSmbC7fzJe zdepC+x61yMd(P*jk~{qOWHT#%Xqh6qL@f5~TdlF1@&~I0Aovh^WI#~T{O7oDlYx(0 zw$5|arL+BsA@va{Vvv?Ck2H20rh+AL|F^4B4g+)(tN0jDrbo=SN^%IG>K4AO>nUlD zaC;?D(@toQ5YU)ySZ8Owd{Z&#k5rZF=&j9Qg`CD$&+Z{t3j@zYnLV7(gM3kmBEyNq zZ1k>rX2y2C{>EAG)(<7dX|1rEr}vG5SIJoECPH{t`jcr?g88JwH`DwWOHL-6-AP_l z9tMQ9KC}3WJCZCgr*11~x8p{7OcCr9?C#AB=S`i$gW;C+xuN zDd%_+C!|mBKv1M{xNv@aZxl&Zd5o4>AKx(Ytd@)l;iK@YahQ1vb}|wvhK~<@iNyvF zk>5zGLE_8}F(j@?hD=Es%FY_Alw@;OnYL8cNY-# zqKjn2D?=#f>|SZSI|=zH6@~7KM0;dt(Es3_lpfKNp~70EQXiKq3yaG&wD`b{a<- zkC3R@f*@xnsS)=>W?LX*nw?7ixRBOr=m^ei)7{n*^)!k-BJZg=jxsoJUl~Nt*tR>@ zxNHfz71eewqJh#AnMyni|IaDC%x`=;a8_W-F-vQpUt!kBajM~qhKs=RPpOVN-mj(#F;%d)=F#c3b1Ig(6|*fWy9YeAc`+2k;=1l$=7$GNm`Db})@ zf=$TSx0j~A){^^-4%^%PYP44{UMUb;$`G4noSA*qWQ-Oe6eXs0cPYqGZC=~SxK#%= zq2%wTpGz=Wv;XmHKK(}>S44RUNA+p-cEhd$vKErQqr- zB^dWz0_k{kg*WJLq_o$DJXQi*)+qRLO}%D4c0AGWN?87R_T((1hrfA^G%7Hty{t{A z_uKi>u^(4X?=|B(Lm?T;`i~)lp&tZ1PnT1sqK+KNDEgv&$})N%TaTa0t3FJ1!+bY{Z!FHp%=mGaUfp zDq{ZkK6^1<{lm~Rv(6^qjz?Bm0FxU5oY_dkDmVs&bof0T4tmG%Nh2r4fBpm~=n!D# zPM)j%Uat}xC)4loV7E>$wt24upzrX0xVrgFDF9Qdw# z{|_gy=td_~!ljm&J8+2o*A&B9NT)hrei0; z_)8_FrB`3S1F4i)-A`vLhhfD%p{qZ$=n{`$OUM1uFzefjXm{sS{;eASJ;B7B|ATkI z+wm-PcmJw@S`@=y^%K1N-}(N}-hsupC;V4`tJhxrRlonE#s7Qb|Nq&DCji1sL_zmg zCba*Yf3D3>R1{w+r8m=p|7|U{-+l-TrgE~t2fu0C`m3CRo&cOf#M=|>{Vx+gBw%Zb zT^URj^3L`CD|mdW#=U;7O=aIBFwP6EzX|~Qhv*(WAX9P-_|-qE9Zes2v1!T&OrA{qeAzH#oqLH-dp#!zu))7foU}M+GvJeH{ocb;%d?2t_OKrc zmmH+8_joNI{W8v8xnemSkYB0K5_Wh>_{y&2Lyte|&)_pDkIogV^|Usme2;$m%;PDV zs?<1)SDouU%JJh~W@hu)%<_~+-1}`WZh`z;vWtQGhv`545f9FB*MrZI7y8d6~B|bjUqZ&+H(F@~xhxxXq5IpI>eHZ%OrD%1dM5=2hvd zcd~Sn!-F8Lmq*LcVP7-yXUXOPrzh zr1AyqM%kp=B;PFqNGAhWlqT9)vy9qt?!(fxc=|UbJ>d#AD-%!i!Klrrw@*K#lQJm7RH=@^&q<=3faO>ioy@Gt=!d3x zOd95=1C11l7BK;RhXp0JU@wH$HpkV3zPV|v#705oZZ~bp4P{;?_&|8q30QGu7lrY- zkB%2&r*ZzW6ad9#?*d>$mO~S7(yWisC*F@6kKQ>vFKe7Lf~rdH$2RHB>&%&2JU;*J zVXb|H00$@YNEEHGgbyOu_T8y*>ocf&<-J4lP4bq0!;1ZG6<6|l#1|m8XBUJR>;v_N z!1x9}@1Hja=%u>(*{It>DCOkpY>8#bJ3+jS_~Y7HPvdET>f`|R7FL$qI1&v{ZC%%J z{%oelczx0{aMLr8RU5ypl=G-IcFVuE)Z1R37DuNbW{NxlQ8&(fsP&zE!geTKypHTo zI5SjD8DHSF@d)Np@l^!*7z}d{0SE~0aUf#xrFZ~2E_#f%UgGTUP=9r{xhXm7c14o; z@TT0}1I0&c$5nWURISexu}a(>J&pXT#tgi@c9g>+?)^*L3Ab|FbGXw|7VAx|AVNC2+)N zJdrY=iJ~wT5)_V#Bv|~0%r{wL2@(O?3CuU$qxTbbC@k@5?U$}ppJRS4U=b}=h#SCv$#G$w! zz+Naoks-f|jnj;Zg0%jj5^~6%_PrNHk-Z*90xWR1Z}K>AX`SjUs3^5jr$D5cT1TM*@T~_o%Nn+0j*sXahlh?!( z{U;V2mkFC4#Ik+{L-zR@Pmy~7R}5a^t726sc5+PKy(K;!l;z;f26$Kws{2vQyzu#gZ^mEBNYebAb@`8@dh>F`*#l{OwwTgybh`va zxXfHm2jm)u+K!!+bJsw5yV%}4U@=A%AcSq~-;{KkPP+I?S-z>to{hK-3iOO0tY&!4 zmH(pK(U2M6{^}gyE`5s*EmE<4mjE?;!bOriI0HEBQ zJWj0ce0Dp)3o?Lje$syL_U;o2spj($LbN4 zC-Eq0V@&(3-&*`A5MbjMhVBOe6RgR}DPTTKb81-6+XGOPYCK^OJ=JSswjr7GpL)$c z0PR!sF<;tJ9DkQ*Dc${ylaS61BL`=7YiCT(0%8#LM!3ZAw+kCr-ZW+1yU#qz6sz=YLGK#I4HF0WIrAU|Ihr5T=wJoH z%m+!YL;(s0)1iDZ^YGDtlPOw6<&KZS#h2hnKa6F+b#?R4?Sxz6N8hbB_p2p;D2Eg% zN}lEza|zOWez!OjKm0NH@uojX#(DEqn~Egos)nfQv?U#1;B0IM7*ITkyqk*l5Dtryfu+Ob4Zm)TIl3Ck z#AI_$o1?jjrNqb#s*wKKhC$4obvB;gf78IU0qK}l^k({pdTRXTP1ptaGfCL@J&z&r z)$!GMG5*w`q%HUAh!O{o;&{rLb}Rhye5-c8yd=FM$;&Z=RT_O1Xl*@ASd5YDtk-}& zc5HNL#l#uM5QsiLAf9^+@e%tGgz-5@N&IiO+jimsV7D!KqJW8VC9 zw};YpF!ykTQ0V9i1<{BT78_GwXQFf9Ir2%m{L&Ya2PC48RN~=BSw%qf9^zs_m5zomGhYY7H%G&dU{aE&g)yjL7mAJ z>EgGIDr_Db1MRuP??upchrsQNpf515&9c@2>ALrPrMnCkSQa?0*u=ShD>62aiY|&n zdIq)AO5>D1sdzCv&;oWgutaaXE=kyhu|Q-neE-RPq6KW!O&fzEF?WkZkGKZpye}A| zdAeQ2NJ*?8l3kKsq9k*$byJYcK&4w(PY--J56%u0-eiCcc zoiT-U-Ust|YG5@I2eCRD@R}9lxxwK*7MUFU?aD)Z3oJD3xNO)x7%#Z`#@$Z1hjO-( z!vOh3xLTyqAeVRUwGZHGedbM4Z5Ekv>F`k#QP7hr=v{=d#uls>;$+Gfnj{iNqvkz zVpo#u2O=#sI1S}CXBnnA72 zZqFSgg5z=1%2`7Y^1=IotM<`GQJGnD^i6tkCUdw%z_ypU=E%~`h=#`;?F}?a>yh{L z%ARTy`A2~cf#O`Xk6z6_w&cZ5$0mi?*&@Kevhx2M`=#AMk!*!jqh-Ssi&&XVUAxFT zyk0qU(mx+l9FjvtXMxl}Ty)7X{I6jhDc!t4T)6S7Be_Cql?ei`ylF2MHtlC4GUru% zH|@O`GjJ2iyrAo*XD5w+PRwNFDkg?bVma<$w*UU#B-7~56A^g2vJ}cxDgzyz6dhod zd?H3aj15vUoaJ#`Ql0I^aQ^HqR`cVP(q(UlQ2cLYOeV-{4jP}Nb*5GVcP33@+^ud0 zvqA8I0UmHMB^=-2P8-k;Ndkc|-Stbyx3Nz&3*^{K* zbZWSDQ`?OL=8dBp!URtOf_IjU_zO^d{@0t1%FTK$Q&*tV>d-lq9+BMOCMFv0K^E@j zHbhDiF2Ovs%RpQbK{S%bkhDx8^80ST6D%NuJMZ(^TJkX$-Xk1c^G@2K?LKkoYCebp zw|#9nbEFb~6s&Ss=KQfdK!(-fP$1ZzR)PO&*nIlRI!1W1V3j!ox{^BKjBT+BR z(xXCxy5y(5)kB}spi$}W-Y3UcVv6Hgp z(UcU7L^6TzBaTfQUK6+??UpFB*>W`1j}4W`MqOu1jE!55B-s3s$FqWZS@2SmF|%I} zkUVLtC2c~6R}ZGTUr9NizpaKy8jTdBnf-OaR%woveLvh@seL2N7X;ro62KziXK}+U zMT)q_Etrnsahs^#dXS#{%U>y}l(W-+?}2IgQxp5eYLAU0Eb2TV!bul%xnqI_-L-j`(gt%9JvNwC(=-AAOzYrb~0(fnES z(d-B(SG_}?w`K?3j#-QCB@M>$ zI+(LMY-m{v*OP0cY6L?1O{{Qnujbgia7xmQN2^0yha6$*--G6q&r*{+H_pFAHT@;A z0JOKXUKJS=gUu0HZydspJwHxgPhp_pM&XPynUdL82;O*;WTaCg#07~XVDFP|p_s2b z>`g=X!3rw8W*vKAkCppW?Y}*!_ca>1Hm_IBLOumzlh&FVx80_QcY}#6eOOv|yV7Y4 zkKgS7kX59hB(}B|&?Z;2$~H3h<-=cgBmjtNSmVELq<>nsPAxxGVIzfMVRbOj)&0Gj z*4Zy#D1I-rq>z^lh`7SzuW6-vo#4CZx}mfoc~{eFATiFgL*8FK=Zno;xV7unM>gdv-@z$SRJz>K*$5E*O zgXO1H@PL`u{Z$4Hk6jSz)nnr9oT-s0u_0VVq4(3@x1<+OOM>HlQ6wuF+5h`2C^5fp zmlhuVs5SG7?(H=#NIAxAoH9O4RJzXm!xT4f_oR8?r6iOwW>4jPTBiRBPGOS^Rse!Q}~(Sx{wl2?U?3q{q(-mme(53 zr@<4wyT)ag>y@V)S-i$&hoP0z8@@?Anb)V4ha0|c>7UNk`dN1Iy*2&3WhzrKx;mg) z^b=?dAUq&ymY=g&ZvKB-Y^B$<=R`yYB(v6T+Anl=z>_Pm!m;&iPI%_Ur{NTcKBCC+ z_`lwZTvkMf>%;6VFj_$ZX;P9`%roGV$83SE~ zO0aS*?A)$KVm>*ZTxj%9@*zr-9DI+xsV6!LVc%$D@TD0_6|KGg zbpGYC>GOkwy5=Me{R``9x3{w!hfUD^{wBeq!JfnCoJ`+kN)CzhB=t84d?O7)f~6T2GnxoY!qA9z9YY_~GZM;tmHK98E2$)WS0M z-rV-mkoO8=!PwHeU-BZy8ReeAR#m&s>_7IvgbmicismOjj{3)+50s)FjiODHqTgF` zr0DH+m}cKNz*tfP-+A#}-~RN~3}50t_Vex4~Xegq86S?f7Iu_)rX*ntT31B zZ>?9>CNFIg3Fc8eD%^1mLOf7`{dmiBC^IP^R~lMW9OWFjtHC zdhy|~5m3bmYgoAh(a_#_7rY;a*cg?PYBCrkn$!97Lf(>znE&ja~{2K?u#hU46lNdf{-9^Bkpo8&ic3I92We;uER7Cx(**O6adf>*BE z#I|U3u55Sym!vbHbUiwYq+d$vwKS|&9{R+4hr#IkjmY5goPZ3qS?N^>P%SuE9|?k@ zpy9tpBP8!p{uytXG~9>2kV?}RPuD4)JlousxFge(Ll9&J=)whckjH%3$9F z-ea5?o|CFoV03(es~-py=($eUGXxKh;{w(OTcKL9fYffDqyV;m)Fu7rJ;h%=z7}1g z%}{2Zv^_zF$AOJ#r6j}Pyv$rUc|Ts?iH=k$Kn%b46uIuxqC1&NbZ;UzN?X@|cz%cWJT@Kgt*=bx~ zGkQK|!;`V$xE+*aorL8a!tpBf1kjPRm)J$ z>lLlbz7OQJ3GttItYoJc;7BI%zokup|HUB0H*PsuvzKqn{hJ#CfN=zp5<+6Gw3?g% z#!g+LU_T1coZ7k3gW7|dl9rp6vA9uhH0z1`2pxBee0jH&7G{n&8Q~4YJ>vjrxq#G^ zn$W0OcL)#PIbKo7(T}M%248+{Xm=R2K!QU9s*!^;@f#Vrz}t)>Y|7?U=`y z#3G|H0?@wWK5M@G-r|k(cW!{M;u6u6lqoj-nV#6v`okV(Yi77HwM&ZdcijUB#-?uD zEA1R&bHd{q^CmYR@qy;b>rM*20tZh5s~-_{FOhM9{N#=5;?)egGl<=izG z=NN^1zKf`lK|$uu?05$*1fHjJ%!M*Pf$#!9kBS)B`{HCO9_N>XZn&a23jr;*y)*VME&WEkF zwT3Gm;fgetNwFV2u7CwbvI6Qq)Z@iQWOoDgt98-EIzUBk8MI}!sm?#g*s(tfVTnFp zy{1}-=-joRh8?6I-}O{FZ~7+b4A?2ROX6$t^z42T?dg~ER$=FAZ$yttkTtCgg_-Gt z!_5X301-p|jFDwTI&s+K!aV9N8;E`7E`guTUrrhmx1Uo-Xva&aTHry^3W`Xyt##de z|8tC_3KLq*YDwH)1u$$na1rcnKr5)0sBXOrQ3kIE_z=Ryv8Y)$9QCJztMus+4vE9A zJT5sw^}AMygAd&Z0-1R2Bu-tOE2G*4?7t4KfZqQMR}y%^cV*1lkVDc!w&g=~v)B5! z8XNChXy(gXRV$!K*iomMCQE82=cR?9(R>7F6D|Afqa07l@||Z179h)3K=n>TstQnyF*`PB65Wao zH;CGsc9y4%eQ_=f(yJqj?zjrc)+k`-y{vk?XO8J`?6X5#Yqhhg&{HOOyT(=7Pc8EP zUUB-#&S9vr*^Bdyi*`Sz-PEcA^I>zOF}B`uSjXsk6KV|4PE_0Uvqrlt({}W#qFo{G z2A)vDyVB>CN~t0|<6i<~)#GtT2}iu70QOB-vycoSj4Sx5OD+I8lxUQYwpGP>@!ADu;VnH%uwci+n_QeG-v!$vi+8U)TU1|LGNcTw&X-XgeFoWNw$&o#ne_FDa>@LE#iW^ zim$L_tDEgwwIyq{C+lUMHty_fX+#UNUcs%jqz{KVc#pQC8es10Iwv<(*@6{&yKg`T zmSx8}ch)7JSnIX3Q?^4;%0g&(B=H4pFRu$f&WYD349K!KS7j8v1=ewlx!ijBlxQtE zu2d!qUWZV3=(IWS_`0IsyKaV5=FtXV3p@W&l;|t4f3W+0$-EYA78R%8N$os zAlMjlT$VFAYpjCpU6}>D@?691wGL#Y-m)9IcYUD33k->G%o5;RNyib}9E(qIWi*~O zup@{_JJ{^?C*~zqzL`lNSwc|*-G&hf^Eh$+@;yAgq&>l^^1D==a;!k;)}J`}Lf$97 zb~n>et(&#thR-FwKqS}z1lLX~bur_lcAN$-aWm9Wa<@koL&<^7Vr0mAdUG|vPWB}< zA7twi=p%pZ1cP{OQt;(#n6B`8!GjI0zRacCx0CGh5$ig5T{n=)xNSJ_8d_&QhrNY@D4qr$tY*H8n@)_~;G6yG;aO^4( zHal_A=`P+s5(rXM7&in^ZG)oI;MS4*lffBH8+}8}6}CjT6sv%#rn;L7i3Rlb;Q@&( zBrc&+24e;gFM$_ImyA(NuaA9Xkrp(tXPrV;Ksl?B)u!Fd1{aVk(~~Qo?|Qhv=M5tK zuGErLYfJ%VWdcVz30x-mOSk2(SuU6wyKl)dByMbM?1=4QIw&dHlr$;z@|hQuwB)ZK$ib8o;Ep++g2;{C8Zx!1=S8ALUO0?Bh$CHK5|| zwCB?9FgxujSCfLPaud08YCk&%Hp}Wn-m#f20dk05-t)UUBwi4ozB%z3dWOA@>XxE}iVEul`lp>G#W1EfJ*9ku}M0j=YR0E#B|432;j01LuKt z3|XX#c{;1!81+rwR{G=<+igp1G-k(3nDI22hwJ$YJ<@m*$Q@ADH8nTQglV|gZ<_KF zQc!1Di5dHb#S_~1Mg5L>Wi*dxC%=ykAqHD$N0*1aq#huVBayZ;B-jS>-)`HVD%DP0<-^9jNJBRnm`DOf7fY0&9hN2`GX-SmPghf!j>q_9y{(>QS zJo=I*p%H1!`?(c|O_=PON>cx%Z+4C7B9@#;r=LQkN7G z&R-{j@Sjt_F6*8Cu6%Y==w^)k7zicYrJCe(;aRXWn@=gVKfFitx-my&)FvP?T#$QM zA1IQkCUDzm>pmLyuBT<$j<_a%H=A3?!j;;dZDWT*_0Hn;GzGHPC0e|-6PzD&Bo23V9>4Q@1yZ`K(@}gb zCFeFvl_CsnVcpQSG$C)Sig~!*$h2Q{EU7{~#HAw($0WM@OT9>pN0g+68r>R6F>i%h(~u6VphG)rhwoZBvhRQ(1*fGf$)KVC60K^0Hsk-3HaJJ zm-WIaq_4jgcRD3~9@`id>r6ro9vPWzsZ=9*6wS>4`Z5p=Cp~ppVW!|C*v?X(XXbmu zKeq264%{Nq?5JmnTScrqsM&~S$L;jO@63*>%%&dl0Dc}w$f%tvm zC*j`ZU08A5Q0>#%g`Z6g?)a)~v7P(j498LO5>y)irq|2U3-B}z$@6?rcgDZQj29wr z+vMA1B;C~@)Ie<}+V&L2gc4d~*1(Su6E$p?>=Q+cY*vG076<1)cLE-uO1?dR36$ zZEq>auZE=ikaLJcadN0YXmBgt^ZAfyxf+oe;-A5daTb&^gfdbG80!JL4c^-07HZD! zR%zO~we0;{X93?Bl?oKDD6SC5w7mBt7tGnSDR;d6RPUHk`ql@^%>r&-d)G%}IBJwe zhVg{CP|N5e2CK-T20ind1|NyE!WE@$CD@fOF$}`W1}>GEJS0LcJf;B5^9J8lS^=a3 zZOneX-RjpvYj>X$09b*#@6XnKEVDW5EOk+Y{>U9pVwx1te54Lm2Nx;EW32(iiR4)q z!)u;T>>s%6#G39l$$NQUu~*K#pjAi6d?G&D&a8BCG_|^~c=6Xk{1dVF!IG`lkocC| zaklqyw!K1Tk)Tmmv_RC@-t!^NE2S!xzYmPmz5q5Q5yO=xLPbo;3boi|5Sj6(`jN2p z1?BN(f-vo(Tl`?6iWcQN>XJ|ttRVa=!_vs8!(A?z`i0sZKC;zy86n4Ju@HHol>1Rj z6q5d2O)REa*7MB|nZ&^beU~Y89z8JXU`&%6t`0hx_mgV=P|N95SWpW2^B4xd7htvg2o`w58cr4wcdQoN=!4kKw0 z&QPHvmH|+^6UJ-i>a#$W=9wxq?(pqR{A&%bhuI>wGCYGr=i?>jnD9cPPpfx)U6MHE z>auH_*y;v&=O|VLX62>QR8GaBo%{v$r@dkUTL9OX&n69+55l@lB;C#NR$gk`c#?mL zEg|das;uEsy_=V}ew9P2HGvF|r__|=(oPQIuW{bZsy2B0vzp}F@)cDV8T}Oda59V; zY$o&iqlKSi->MC&#(y8nGl88Ek?FA?(Y+KgGox@Cl5qg`H~TQ=@XF|$03kxNcDqHC zg2eX6d(bV%A3Z!K;K?sL=VnV z`I3p1BFJ_}f_<(Wj?EM&xiXM=N)v~mtXKz}G!U0~zU*!#?y?tvzwUXIzf1GOziUXl@UV5`vs+(~?`dDR&G=uZO}ChbTo}CbeUuv~hHS`pOYU|4 zCSV{$k}6?ESunSU$SMthP>(YB&W&huEtI)tp0gysH45j=jogWQ%nWhq zLEt3CvXn7?pObyMoe!=)G|Cd$lwW8_oUBl3ZA9!$gt5vP>O$B4omRZi8cF{Fx3rdA1JIH?O$+DSg9aucCETX_&yj?9e2 z%U~P;=U{ibh> zZwAc&M!^c`J?UyD7VEw#%Rk3Fn)DTdU$J*pd4<%v#O7(tDSQjphoO6n&fTvrEwt*mxD-d z?6MfVfb+e6*1jC*iC#n4YdbN&UtMP}4y7}(7$lunVh0Jc1N%WP9^BArvjh=dg7^qc59+P$2dMSVx0QbYzUr#|> z>X}$dnbOepD*)49cSxH)iq-Y~a0t4r7yafj0MybCp?I9#$A`TrkzA+*)RqP*Lz8jp zFzxPRix7y^g*`3b_=gev=D1{!bIF)|{iYHSyJ~|J6w0rCSgz{^iD4|skA!389u>`$ z9+6xdxM9oTMe8!K8LoO5a~Ty*qGg>7vOT;tv8>=-(tIt7ZCxbn%Es+=Fs1MAieJyUt`uVq znPZyGcg_#1zmHbL-@@Oi?HJ=L4gM)8Aa*{og zE<#0$rqW*vgH4OSy5N2Eb77zjFDH7BGB;xBp6MYW9fe&7`&qvZz9Mopk$+4cdVn+z zyEb{lmBtq@>gx8R-CtUrLqK%X?UJy&^j7CGth_%|(Z$y;kb>;}*i$#coU?5 z;U#0B3M=(9u2?hp$>^@>@kf3Nz{7ek5CUU4Eg~vJ2Rdm*GXt7-Cw;elnl0!hNE)DZ zEdZWaFOB6kSMBcvvkJ8d#Pc`s0-E;oANs8MJmS`=MhpkcH^$~Um=XYhQIruja4kHyNBmj z)`J*Q#U4v4n&N5}2p(A%*Zc8W(iNfO-0Hi^$lcpyOTpYB<5@<&i4VX`_^xn^($pZE z%6fr5xT7+XgwH|?<{VJKGd~zdhA!zJQgi%(+!)Gtr;H8Q;#ql>hE(VUd}XZu`#R+m z*fagTBmIx(Sx9*KID&_RdCQvhQ*EN^`uM)%c*@B@fL$5_0QaT9GxYU88IDc$CHGsO z@$Wy5KWEmETpid4JBaMviW2OS!~Xq;sA_*g6q(K_(k2QPA&^mo8N0I7NfTzi9gfZ{ zW29HHuU*rcEuD*DeCBi-D!=gQNs67oFrwWYkMXL&CRCclL7PxUo>TD@qC8QEiOYH- zq(EJz96Bwr_hJ1c1fs0_XpE3bKgM~L51if<&6B}A7;mj3r8B^X>KB~l-^U)ZGtK0P zJQ~TT-x}WsW#`MnvTbNx;idrtK^5Pp^!KzlpI&1>m`7t%db&6l2v-$u!pfh%2#T%> z{eAYGu;sdfe=X=xrdp~q&2Fsz<&gwXj(isAWYpeJrhmVDL$RNfQD+`OW^!CzonzDS z!RF?)xB)eEqor8}%6Bb0qNAbO6IRTQij6N)9`5U=q18}@l{tQZqN>+ryk5A*4wABR zxTjT>!S~*Fyv0lzsAsorE1zxfSUBh&XqQJ_6B_o#02K)*9)yL<5W@Dw@xWXG#JXGp zT@?f;v+Rgkq6cN`4rg?nW_AjSZ;r3VDJ8-4yMj*DRmK&1x@7;VDN7gw^QZ7G-B^GI z^{f8ClV1MV_kqJjw%TxnbO2g~m8r7Pebl^kl;f2^GF$$d$<^t^d;lT7nz&?PT#iMb zs6`8U_VpoH0Ae~_##ws%H}bZa18YNjwCAJA%Iq~8W~t*4IN0v4@rwzBie8MMHLKSN zY^gYIAO&QJ84rNZk9M(He4=^ZVO!{X5cByjPhQC{U|!1bXpt-`TIK1>f*$z!5MuEW z)lzTp5}hkkuFjemG0phYs@9_KXM}TA`3j?5qRp_cMOJ(<`}(>P;nyg9mSSqi(ig8C zE$Ot=-^k8)*HxHiv{p?D@U1|5JX+}T6q>580w@&L^U4=+2fqWXxNG@A#$%@RV`RSM z2QB)b_xkpE*z(wZQY~w*^sz6eZPoeXITfywI*E{tPYTWy(zERAIknR|x|HiX;k(w1 zsri1t@1Wy*$9tLPmsr@|Psz1I;`AKiv`R{M2o#d;andc=5j;5>6!^25%DxiKes(Kzu|znAP=~makYV?{+ZP3 zdErGr-doY7NP`-1v>UY z>|7Int-U_||1skv%fPSAfBNyIGX=7CCK(C-B1F9PO<{v+vGc30c=R7rP7VbxGSR)Y z(_pd`#PcIk?vaB#P0kI6wpgnkv11)xr>rs`Im+&oL5y-!8oko!T7Ygmw?UCLht~eO z{gvG696M4Bxuz%+-glb5CzmsXZn$ZkA?R=Z?@Q(S{zLy>7PlwsOPz`Oj&T!g5G?#y z!ZiM2onCtv!wG+Ok-!g9#b5;&2-;W0x0>t%EB%}(L!MA0bBqAbqH)RgIl^rQk*POc ztnZd=}H^!3!bRsQk-7htV2|9N9~FZazeQwlsM7l*!<+5T#7_ zk9M(wfBT&7@V_StXLGniW^Zn>ZkD9g&XOWh1sHx13qdJ|rh_bRx>9t6H%M~7KDv-y z3`l-%@AN$_2){24ui0iFIT`$HLD$WAGy6Hh-~=!|4od1H3@~J-rGp1|b)gqKrkKHl zdt!N~ncE>Z4tT5c4l`l@_7=W$MU^z(Lr#tN{O`-oq~h$JJ76D77M@sib&u=P8mX}= z-=^u<&)v{(%-1~j7`-F(V@e(8YMSC8Vl8DJpN__tCWV+S)scL-JFz^9oV>IpioLF_q z`0^c6aou9)n*YB>&HNx!+cTtiJ7SqUcU{NHzI$Yax`dxYQ#i_$eI`1m+$kYL5y zASP05_3?B+(XqW#AzKim%AmvH!09AWN@MOlaEmN7j#{qqn4t0Vf4z5vEQT+t(`ja{ z9GqqSNowJOo9HjY9Z?s#q@B<1wwv-w2zp3V7E)@&MCxa@{srgzaF+M? z3oj=}+==^XVZHeeniQabTR#WP)vzGX?6`BhQ6Re8BRsON`7n~`W!H;TfNw{Q*au-r zo~WOJuo8Y0>pB;?R(}2M-<&`GTqad;{dn-tHvxX2(z%d4;F{+b%L%*+cuKf?1Oar! znPS-IVux;#Yyx zWpAX*196Jpe^4zapNf@uYu+b4dr%`W_m^t}_nQxmhxHt~rb{;LuWzKUIGz8=>IY8< z{l3K<$#hTl9!@j-gIf4l6~I01o3ZrIFTw|8;oyjuQNTz3^I`X$+HS`Wgatps3jUq* z0Z3MWm*19+=$|*TQ2P_G27i3~|MD{s#RNxQ{}XqT%aEu1=QF-s|G%I2|MYV#@a1RB zMM)LE?*QHK-UIn6Ev|9e-kjgon8YNcl&>`yn z@MfUMRBcf0?>8~w#|6MhdG)1l8;F99AojCu1lCMO1EuaVt5O$E7~o+ajs?!eWqAOp z9LKKY!gXTmz(HkjUDrx*i~wLxL#zRA$+bgAUlwJy{6jcUM=7q$WBLHX~Vg+Mgi>4wE`!v`?=*VC=mcnwXR%pu!=8=5(Lo;a>EE)2Zg$b4S(+s}r(jeqyx3%HYN0A#pEo=M4= z|DDwbR~CK&!uqS^dTc{hfMG==LE2vjz$g3=E(IJ$l=8O-Y1cRnkDlB}O1Ag&Rtmi@Z}_+bsCgP4S&={?v8%|cTcq9bAR24seggDqe1=gOqf!z6Ch<2J0bI$e z^O~YprDp4{OzhA8WuU{K#qZud4!?9{6d3H~bbxj-xxqU_<+Wvc0G+CF-?>p<+Wj(> zqbY{YKrUDc$Z`#DiokVO-k~EOBg$tq_5dG}>*k9;^GU7oU5I=}f(`z2T|+tMrmso9 z@NQ8|EHKva39l2ZAFU_oi^Qfc$b8=$wEz@suFzF-Tmk{5tZdih7sg_`d8Gf%Rtf}*y; zv7ms>M>5kh>gPDu)sJ6to|lS=W&K&non}MWhnzDWj{`jjQwHD+v?|HJ;w{@VJJCP` z%n2YF`>^2m(GNiEHQdJnl&`ZlV~QnEVr+0q3&D z{Ns}?DH*$;1XrYqiD}`?`*2%*+f}q&Jp#Nwo#jqwjc&C}yt5_mTY8Rj(R}3YV zTLDX2R?eg|~79V)EqrC8k!Gdz8*SNC^dF!*W9Z#0Om z88YH9ToNY4>pt4?gO+L&Ig@J@%;mBP+4caS6wF!dya=ym0SjPG%VT{mu}2v!4RofI zjgWPNdV!2T5f29oG9Ud?`0=XWjWj@ARlF?pMMjjA+%bthiG+(#Zy?Z>D_w%jV~80{ zvULTI1828ubVvq8;aY9}O!P_?zMGWqh-7Dy8PCDm{uc0o|MYX!Jh^;Gurr2M%}#@WFX_dUTNkTG}G1;SEdP>eP)AbVWGf5EgZ!dGCX9q z=k+pOSa5RSp2!i^EMCARIdKWV3y%Jd8g*(Fe1Oc^2YAR|1BC%Q45Q|bJW0b`uo)5+ zkN&lTv-m->x0qhS$v18zbKeQZ{<-w}#Z3U}Ur4tT3||ZmK7}(0O!U~k3w`g zb;f7}i#P5f80C(W{xhJfoKWOuy?xKeDVQf_Dpxa4N*;S*EDhLmr zE9Aaf3vP=GC9pU^J2S`c0|{^1P$L(9yag}7cg$;#;yYpPe7n73$V*B14AN#)n*1?aUv_kd04l zyIu$~;Zsa1xZrI)KI>`uCQ&}|PRSJzVfDp7Ab{=_RpgONO|rcdJl_!hwiss;MGohUnu7wvDA@^_TcO(i(YxVh(DXo8m1C!q#6RO?57R`h-N)L-9RNXKivxF$u6I`K8VW?*WJPYFfAlanf#0dRra-O{z z2DWyEyqTQ~Y&>ejCeTMt;%NJ2Dnt9i>76E~Zj-l|16;R&yZG`_4I^XJTfzC(-@537 z6V1N=MJ5CuQIqhkwnJ*U0IM&np_Ki2-CVO)Z2s5fQq}OE)80;nj6k{}(@8*2H^1z& z($AOdgYsXyT(Sm`8GHBNLM~{hxBPqjmQa9IQa1(fbq{W;#VCll(B4))KEb)Fm=s;^ zvfRgWl+S4(2w9p(13uqL9I^BstEr_v+4yd7;^EPcf5t+eFHrFs9vh4Y%)jmN!;kh; z73=Q2z_|yhq@j^zGu1CoKr7##$u$F~2;Z;XJIAXn0=lRq4xWZMFMkV)?4UW+yJ(fz zFTTfQA9rnuMOyAIG+Hr=h3B@oV?8Yu;Vop+7`Ih@92A*bWF>2iyt{+rkK91uT1$Nf zHsxk_ua#M+aTgASX&B!jmfuH18xju!|Go&km;HivJ7y>jZB6T#$KYCH$X3EUR*yi9UQA4*DVQW(jF*{qmVe9u5u)239^2hFGU!u zgw)W|FC&#psvM{#_Rqy(ncVI+6I|K4LYcvQI!z2PRl*5s2(afk>o-QFHfd%TFn`p* zj@|l9(m4B+Px86|&9TDQL)~Dz7T6%XC3!6C{tg`~ z`FI@W7;7dqVUxUL0Dk;u=;MlUnVY-(^>+)ue82iI<)ORH7iR@S+7+@}XP6MV#GX)Y zP%-=Pw=VW!Ye{flzhXGD8-t=Pe?iq`fY$$mA{`**K(G|f^Gb7lhZy(@P+s^o!`11+01SH)DrKzs;KuXM^0TU>7dq%jq;+1?EicI{_12nhM%Uq zyBA`&bcnRw3vX_FKojlexc=k)p3a4}=*>(Xgp?es%}!Rt7m? zVEUuR%O&QfcqOvxeB^5AX?P*QcK*3q;qG~oidUJenY5KH&HwjRk<;h}>dmo4(#u&c zXEK_F#jkKf2AS3e-ThtsnVlV(Dfz zc1*(~d9dE2t1`SVBMSdLqA2T0J&GO+7@DuJGeszS!uRq=vmN4YZihF!4LX^fvZc$J zbFP#op+oo7m8HHG1ev3%jhzbBm*VJ3ZMc&xo7x`jETUG)`#KGbL18!XLVQ=q4KAj! z($o(bu4ep8I~nt*W-*%uu~6j2HZBH6CzY(lh+Rj)$)#DBYeFA-ai>!SL zF3hZb->X_z0i1UF7@c=Tt6w?%@M-FK_1>vYSzPvenE8Of*94dT?`3~4yCuRQ(GE*? zInpnVXC^93JJv=^-JRDGRxLp!kHH_?lXTtHh*_WS@vpYhmG9-BvmfzDWL5eMU?yB^ zx_JcL&P3{VtE%-JPfp({@gl#O2_1xE#&6D@XTi2=>0AG!k8Q#N&94e|Z|E$EI5kex zo+#Z2>@fg+T%4Swi6&vc7JU!MNq;g(-bm1RGvVb>nLk{5wR2EBU4H3cZ4H(z)XGM=)_Z9&)wymQQM3Q+2Fy}^y-Z9so-QO-0Dapp8QW^* z<>A^Om>tV*bJFT|5gZZ4eNooT+a8MXu4Hi5FqC_pOW(TLnfv_dhNMF!{W8C}x>OZq zg5*Ku*oxNvnxCP>H>hJwdPloqRo>|md-vU_$h!hmrpt8xm!(aFmapGxsEx(Gkw>AMfTX%4Y$WSi=0An*;d%AxAxUFh~7wC=tHiR;XgP0Hsk8;K0a##95#i&dYM7G07AhDSxR;D%)&>^Mak)~ z886pG#pp&yo%QbA_AYsy7Od>Nyj?)((8;ys@>G6HX||P%`O#Da1-B}C^VOf8fxtWg z4=CCg&VNfg*3d6>c>ci|<5|d6dPLbFAS9XrT}UU6H61#8>3X~o5%j~h< z=-q^O9vgJTru_|JZY_A4w8UmRNwNr$&L85hbpJKCEIGS?XpTc<8 zL2Wu>I*iLjD^G_nOLAo&z`m_*IU+nnDT_lIe{4Vf*C$%@8+VK<6Lgpz?W_g*E*u|A z|7xw}!H(AD9W-tySflPzPHqEJU~|XmJN?4dyB@0O-OcS^5nk%&_PJCY>O!J~p)f3Q|JES3R%y%W>n zS1ziLXJOB8yT110vL>EIx@^0#(2=#P9tu{w#WLu5Ro-r7hD2e!29Dh+E6P&q{tUhf8yKq zMXZig!DG$x%?5Z0vgKPCWVIE)oth6^3$_7QmC8yjQ;J@Lx24Rn-Xo_63u^S|KcLog zvK=}#W^3Xm)3j1miFoxDt<+b8|10JvH%gE|9oz*iUkPW~)zvR{f6-Xny@r-3j2(B2 z0!5#jHm1Y|*?4NY_Gp@MK)5B2{aPnw5V>0-HLcdi)!T<%k=z&6=hB0mD^)OiJ3-dx zw&s@cREu;6YkGMUPyYK?C4=%!es*UK5nP$m;Z15?e0V)*(%W6Fm;RaF`P5~}g7M)v zTELj!yL&DAl^439h5bl`fCIk|_q+gY9qf~tOzouVYJg>D^y)kBqQ$O6^~EkaMWr3u zoFnI|6v^_sJ?n%5p%DSINr}5T-iD16yg!W`SLnAq&OMHgyHVLMh2J8px5kd76AmZJ zv9|rH1H6IG6hUXBr#91f4xp5^Yc$K@hAst^Ww)nA> zy;*D`a_&h!@D;*V!ADGvS$%0BaXd0j-_a~Bt_`Ya!fk2@@A|K<8u1Zt)Fr268pCJ4bp89Vh` zC;Ii?zYeYA9(7!uY=&M+hedqYQye0~j@7La)K|a zC#zs>F{14|w@1nB2H?pR4$|hbn;ibC~?=Ez%^+Ddqk!iQx zgo3j5`QNh~oWs~LVla=YyW+qEK8e63a36XCfNb z&$L<`PV&p|7JBb-cHE{(5@RsqG7cLQk^TzLclO-b8;-RupU6Y*q7aTFjG!G2MQ0IQopSp3P+t7)-=lL4l z+>rHL!N&K!A=kMf2OXNCa}0@a?~T_QwmB-C+J-8#bh;zw)^jQ7J(jV->(T4R$7Ya- z11T9PQ5S$mn7MOBjU))2a)mF!&cUptIsd@w6+5G|)u?GUw!_kJZ@XlzPwBHpO1X!Q zdplD_8AF(@66d-ryE#s7Up|(FIZ(1k_NERJOY4F}+N&~NG>N$ORcgRA_9W0c5 z{K|gpRqg3+4)b8;`}vt5o&=@zS>Ctwu{!~1NqyMfZg%WJ-BR*G7RK!&!+Gw{mI!ee z;iy@yIqj8JMuQ1eL(w$+*pbpz5h~=bdrPKA9srx^6@jiub^tanMfDF`LFQ~sM(K48 zm(QHGxll{p)#;rufkFdg2BeBhSJ`kp7BN+vhirelAcE2_;3_{2U8wBfF^n@lO zIHC81;uxJKDv@uKhhxcjkS>Q%YvDz$I*ydFz5WGTvlR8k&SXiCsM}b~)MnPZqZ?X- zW~XdEwa{7}J#&cHRdxzWfgi%7xptd`=BY;L< z(8{b~)X$qC7$6G!rn0v0Da(G~(-&?Sw&8+9#-vwOU0_|ELGkRdKJE@5m zqD?mB`M3jU&=qU<2Pv21(iIY{7a9G^)dgZqy@TT)- zR^mf5C-O@6srjUXE00yhDphM#B#xpML^>qOfewDPdtO8J^kl)5ZH0-pFekbdjZv9hf-H|4jd0QHi77Rvgw+%F|IIq zZ+Ob3anrNGsYaFrE1G>)Es3F92daCBk_pm|_~K$>;6^;CsbSC1iRRJ#PIHDoc3ceP z%}BNsDKna{mdW3m4YNc|6!AjDZThF;aVH62B|D_M_(tBE{>h1W{mAMBNG8Wm&g&Nc zpVrPZs;RAA+tLICfyk!U(4`lphTc2a=pZ6Sx`;?ZM|uZAKoJl@0RaK&H8ew&-V6|= zcS0|reJk$Q{qA%Ap3gCKWH=NO)|zw8IiLHvF5DT}!JgmdauYbqJ$xZZcM`B9oAZv< zqYu75Z@VrvvaH0cATe>ip;*zsayiB8tSI6?tp9$k;>z5z{5S)`*PE5E-enm$&$m{c z1B^8QDIHNAxSTtCl3(?i8SAk4#zYu6ATxP;yHJEsY4Y>HQqs#8^OY{EDMSk`en?Jt z)Zz2#Lk1&*q3y4ynPO-FBGZFwoBoYphq`1kxl|bAngO~OQ*EsG);<$wdiFS+W}H^J zx-bRRQlpw2C$j+F1B=sXV#TIkcW3#Q-_suF8L_V}@_RBpRn{)%TG&Ic;VL=X^ey0{ z79whKP4U6JWNWBCA+1x@U0~UZ`5e6PR$58E#;v2_Q!x~!cH+VkxI5Y8SVCPbr&#aO z<;nCnItZDBNZqTJb=oc~E5l*-<1D10`U6(P3z-M{V|ZqU31JYR(ZBZHGC-keLeH$` za_ZYS&bc0&Kn&aF10SGr!d7D@C7+-3B*SB$uZDHV0J&(*|`FK9Q z#1l9fMo33YUn;*O3RObycM${S)7?0)hMdDepu5>z^5^3uly%H{VM&v>X*@2Dg0qp^ z14Q-WOM2h!U^YPjZQQ-xq0b!S{rb?e#K%eo19{T^>M#TW%w3E3OT6y`HEZ@6E5rAg-y<{oJm0(la8lsJKre01Z5ubd@ zh&jjE3C&sky56IJf3xPcfh$6rd9QxzNz`ODn}5x7IYF?<{9-`);7AFDO923tammFH zY6JQx^KGEaRe%Fr97rY4=$X(z>IG`@BFQ+TL#3tk!N}e93Gu5+^$v!UY-h-0p$6<| z$ybj+*#Y7h?NiJZqa$23-X55Zzxwq~Gy?ZY(YXOz*vq&o+poVP43F_PQ9O^Qn;BPZ zDSb?Vevr$crr4xPYTK_#bPEhlWMe63=NBJ{<)8k76BdzTHNNIDFZG4u4~>MQ(1585 zu)*UQQUgugLO8liEdZ1ucH;?yn5J>Yus?qfaQW{Cs+cM*C{H{DD2g69c0jcGP;S3S z&97IxIM9W`J=%4>dm;IB4Zn!)w;v-ePZ9hO`@}v%D7gFMU&>3kQtLDKA9I=NiuMVL z4hjHdW3<5r=fMCb$j#fB+he9V*XVFaf2*lw;$$|;RwU3?_PVYVa9mUtZmXP{QXx)$ zxC!H|%1&&vL2B=|&bs_g+j9GGxR65F_c<2jD0S(RA(MsJ(x9}k4`sO62aX3(d0z3R z=>rSN_31Ot1yTQjI03&vFHm$qx9W>7pNkgdnC6}poRj4|th5pUm5h0VwFdHHcn^O4 z#Ffx(&9U#wI4>7u`1Jq;xZ1SCvP9NNFTZ5ms|pgjm{DU*mixoJCAfE089*P7LxSIz zw)KtFP3NGvL$OLVj>e8vk122|*y+>&0S*&9${_0F@TB8?qB%wnva&EZgK{ifv!Mcn zI()>y1c}ZBZsBq7rls2@1?O4;;>3!FW%2jHk+PiLmFI0WV2(SQ7mD~xSLZvfvLfyc6ig&oT=L5O`|fOdP+%GX~_e$3&KU4$NC7>m6sghynt? zAM!4?))I7pIp71EgTQ%IX$OMzEakT^;Q9ROSO!^w!e6*>Ln2W{fE+M_ea3JkL~cHrCVD;EfFp*%I8q6QUURLw%bJzUE&BNv+?2H#xuCo zz*s8LbFu?=w|0Eml>}K3P>9bwn8wu!&0W`kmP;7+ZNhiC6Am8s$GD2FD&-AeKlc(< zAbhc^iKSA;Bcj)eU#2AU3yJxSrH4W~gZ*0zi45N+l!0SRK+%^kd*~fN+EiKJO7pJg zaxSp6GR@ujKq-o)p5>pM;p0tE@ZjE7a33-Ro@x&=pgRjXe%eecm`?z7dL^46MsdE+ zx3!*JTmv@4u2;E7Sw=V*d=m3;Xp9DrT8z}KR-#YZZX0Oit^#UQ5AZwgi z>bPYf9Rb;we8e0WKz%&DoxU+9kZyhvn-Eisr44+w zFm1DsO}t>$|sY3!QsyEp}Kqy_s zmjS^HPRL+*Qn5$!DK2<079GI8M`@StHpKJThs*jFOlXl|5oj4R2w_%JNAE$-yI~-4 z|KyBYUBu!T_Jd#Y_oYh@y=!V9NHYZAY>MC^({<8ZCkRb)^n;GKFJFtbyg`tlck<08^1JloS#%T_hZ0%;m@ee3lwrP8XaylybZ-K= zhE^<3d7M13R%9`vTRYFD^vgdS#4Q4`klZa`QQ<^$YulMLIhv$>BEbzCB+C^5c>wFD z7kjYkG4%YQ?A+b8>ob0CeLCW+yC~{ED z8BBhz;5;WQVA_5^L$Q}qUdwUyjw_NoQ_gutRq2rd(cB)T;{5kZ#susWir2)M&tYGH z1-kcbii1V@k2D_CWksP_(FbRl!<2zk-`&!SU)&`Aos{z3rpNErn^8ffQw33G#}|hs zG=Y0>XBx&xSx0Q{Njk5y|1OyM?RtrW15%gW_RfT^7ZKMicU~vV=7r3Xw#^ISuO3fk z`ci%5U`-5zn#GF*t~VLq_(Y+*pn~VHrs{$z4jeIv60FMhGeC$2Nk!$0ujJYf6@{jA>&MHSC$nDAEM53(HKD-kj!e%Ooxqyo&jA!E_4o{AT6du zKD#!#c9Qm6LteJ;K?E{%dGZ927wm@Ew2O`vJGC2qGq%EbJD}E;4ic^8^h5D5%i$+T zew&-Rh|=$r?%@~BswA`G7<_wn6^>WN{%fjl>Bk|OBfnUU`B}}+=6hhj@Vv0AdE?NN zaLL@Jn^Jb&5=(M$518c9rlp}48)w6S;!Y_(Hr?Nlg>;p`-zNlU68}8H;C`c%&W(Sr zY*E;+)1z;b;{w;m%_zlTT2%^kBf2}tW!mfuS&XZoQcGPZ5kzY#3ZDdrJhCnpVMgm+U7vSz@?1F#;OKfV@8En`=E)?CPqnP^2?Ytxp?WD%nvJA{vv zBWn`A3zR-wX0T{AeaHbRwWr8l#D#vQRf0uBy^PjW83_ga{~|FwnZ1JP0yfgs#jH92 z%SHc($sCE;TGWSEM&DCJo2et)KJN@Ek$_7iF=q)>#4E&A=OGoh{f5rn0smVx-5m;E zL&mwGrr#ned64sKlaMQrOe&`1Zkl;Kh^C;K|l5d7E8SaQXZX!V{sn^S?x7+s9)iQTbK3 zZLqqE9GT*ID3NRU2TL0_tLj138T~HaAB1u>2XfFS#ozhpT2isQ6qLEWGta!R4}M=% z+5|-ZBw{e=HX+B*JnKL>CKUt)qnIhg@tgZx9!3LiY(xL}NT(XiVt)G&x?z{jiqBMN_mTU{@@O740;32N^+M2cW z_%}BD5p-U}$OtSuHqoRz_r2v^$xRiQ436w3p|r0;_1HO0AaW*7pyIsQO=5>?W2M~p z3tNc@McdL@Syf|u2SH>_L^fQb(=z8`^MN#0mP%x?Wvd=zeQDKPC}^)VMrwcu&Tb^4W4%3?X z>7Wlo!f9YQ8({6dU#6~f4N&t^@d!W5a`A!z%I<>DmxGiM*2U~ekOHztgo-a|S0T#` zs}qi)BrSU*Z;u$DgoK1#kh`cIW#1?*6&omdz8nTH>Wt(YqEwrj={YQC-CMKAvgN|_ zZHA1pstg$dkR-F@vpo2BcRx&%Ftta98|=QS5CJ~|zv4t|$neSH-?)4R9Q}|DeC^E$ zQSw`1LUqtqjnv0VfRbD2rnfUyYobi47Ca}M(Ft&&%~>D zz9csVHrH+_lcL0aFKrU*H7~BZT|R*76BH@4?L=sfY&xIC#xH}MRzpvj-UAm)qc2%p zFzD~CN@F#Y-Tqrev^HTx1m5N&@$%`)F3%?2HN};iskR*O^srF+tIRuV5`zaQ9SI z`xGP#i+`#jFJni{m*f@Xy=`Zw+&3mLl!xvjgQZ}10t zn(g5B92DVA@+@*@Ok})^AjglyJK0b^@F)j07z*pvT@vEBv3vvXgh&2Fq7N1T zzQ+2z6MP^eia4ob|HuvyDl8^tp)np=zO_()cj3Pt@u@H#JQVDb+DYPFb`YCU1P*FO zeRjcaY8{p1*7b326mKbWKV1kVx4FGJ$&h#}-p_u(Z6zgCaX^Q=go&ZN0h7cR6qpOE zj7?{H&Bua}vkYJv3Ldw0_|G!5ktV_15QN1$1%mPxbPX`SUx}^l(Xdt-DVXjvC6VQ8 z_AQ2W?=iupH{8fNbGg~7_J1+7euTJhZzz3ep8R<52>d&@*cflB#z|W_*~FJ#VqwhM zs)sB&Pc*s;<(s8xQAWZ%A2$RYdVCOFE~_Y=(9E@+ost)P4{w93I*)Qv5MM7BH8`nt z?ZL||8;!$$Yu@s9Fm}VfZL0?f&IOJ92v=8#K6ke5`S@OTUcGf3xxJR%5FuC*c#Eb|t#Hg;T?^XooOl*Sk8g}+IF_HIL0Udx zhE)R&lF_{{(y2H7eqP80Z)-Q2Kh?#OX+-M&o<+rF%$6&i#4f7(?9zzD(`#(ijczlNEmHIn+R#!c5LSSv?;A~7 z>qEi-rCkwBFw0Gn>J}jLrai0x1#z!-W;KAqv{aefh5kZCXuKb7AD`QP+On6Y-*cPm zv2jMItjlN1-6+j_b31Lw2{hdf0nE^xcBQ#W8OdowM0RG^LN}OCZKuH`)?l%{t$a&4 zt(BS^s$nd$3x#mJ&V{VC9_)0m*-XAK%SM2nrz!3a<600xt6+MGJm-{C1n{bUf|F;G zv>tIg;9PRZYiW__+91A`v!{qVVa*z~y_!o`E%qipYk0TcAS_8{DO*{|iT~=SY7wEz zKoYZa#W7UwgW)Pu)kS5$Lr-gKty(YLk}+XZFZU81`VOpaClfvqbuUH+U%#nABS0&Nry0ZB-)>ct^HPr^^&y1ZvBGQ67{wPk4VGhYhthlL`}{Ak{-d046kiYqZ-n9 zr~qCX%G(#)Dc}v?-KpZY^=NeL$fq{BkMh9k$hTf4R*wAg@zVA@3|NGz|Ui`uP> z`HLPxJcUGNAqyHLUgz>59!8tU$v*JwN5z=A)2K|VWivr6M7sB_`}{EGBs`&No<+5h zo~;Tarny6}Lbci#njC6EuEOLFvgfD*(<5`@E^_1cucOU?-%11Cr`+;-f{VRziif^FKuxFg?ES5mq zu=_AszTFVLS|G`^!ique1FFu)PISJ4X6zOv^Vb=lP$G(;X}ZB6-G$ZeystC zl`$BDs<5oKS4!9H4jC!*n+dI}a6qjOj0yNDd|`fiTEgA0*_h|wB?5P!LFzM+Ov>iD z0>F${Q(jqK>q-GHPZe^fB!A?u8?VAOv0noRRerimn!knuY5TOoEm36xK2GTmHWUQ)@?}=F-&m8=B(i>C@U=S!%UB9EOp?F&ciddB zHy=@)eO{l1=$J%Q0zUxWaM*&JDOpTCQ~#?Cz?p+^*-ZjsReeAZZEb%S!^9>}m4Jl{ zQYCnwP!i_O<^&z|SWkGPy?~I~i(mWZ75j4ZHsogw z;df55Vgrn_K=CgQ0$%ZyGX?|&-rIZoNY8_kOV(@4NXdImBOEZR=m(f&Hq9QbRY^h; z)=Xc-*ml(XiLSp*d!V$2fha{k)VxbWZWqzC47U#8R%Sg=;=nBZ| zP>G`h1QooGefMMTaip|bx{D*T&)Guke9(USZtnrYf+)9Tr@JwN;qg`Xz8XC3=>M%4 z;=NXg7*sN$kAkdR--GUF+3f*WsIKjk{Aob?MMI2>pT=#9!6j;?Ty^1Ae$P`zIAz6K zB$khTS|I;s6bswpg>L_a&wNgIj-+BX#JhaH`>qtECNpS6QB97ZOz9?<5W!gZ(Z7oJ zzh8P$)T*hjtdsby<~3b?5k{irY?B^;M-1U=*jBcfC3SAkFuCL=FIRmw{~5ubnwSe+ zxKBBFwUwXa(^M5?Mc$@YPz-;_#^*3MHlF#K)@A)*wx`9UzWjQ1#Nl^phmgSBKd})Y z#wywRQSqT4wx55Lz=550wqb}2-jOJ~d{l%9dhr1GK4-g>>E|!`*juDYpYX98f5so; z2uA^jB$qT*7tpgZT*+9b@Mr^@Db{@cU{HgI>tC0P7Ck@(^d6=$SA;yhcHb#qF7w-Y z5!9=<5JQz9y!P|b`GwlaWfi2-n;mdv4@b*g#=X;2WQ*B11sW=fJLc@MY#*nYxUO!$ z%9QsB#sJyg=Xx{=^dA(DG6!YVxFCrWeHxZm6P-eMRbql`{`Zxu2V?P2__RVnRH}9n zprf(Oo%hpsn2UoIc2&kT#n3q;T@WnJaMVibisx@UY72Z^e8&-7GgJmW$eFO z5$efQZC0GFk-Z4D>&cOnZ-O``QFl{UK|VpA%+I_DnA(?GymWb~SJ~nGLhqzsUihZr z^!m5m5~j-<-|fJ=-Pb=Q|15{5$}Mq%X6c7lL{;$|Txk+Y6|QMThgdAXd9E*VwpjT| zuzWOeF-!8y9e!4)nHn&;>jey)OMUnpZDSC6ZNbrSV(u7y&gPir^soE1B65SYObCdM zSA55O**RmYk}iY1?77>WQ!QHw@!m`7wv$}_{&PVJHwN$1BxKh7bn9-DJk~#%VKL;> zb=z%xK0@R*vX``Ui&b-PsqZVtkWnlHU}tSF22%J+1?eW=Whn~lK0?E7jJh?OPE)__ zF3kuTo_1c0x@_EJV!n6b)5iAZa%wwbH}^W_O+)mrQ+c`EqqEaRhjq4lnN=-8|GvJQ z*R5u?nfwuq;|C{L;`=VP`BKilkKx!Snki71=caHhw(%C*C2`CNvFf9CR&N(T}DT}`;Qs%NDEN_Ql-&;plk1xB|0L6cj!cZUXQD)(*2=i zxJkxf`LIt4K`D>ihR(m@)k0zZfti8ox=KF3-nCWsGn@JhNTLXi+Lht9>!|DH%c%?= z82Ttx)t0Ayz1~(tIW5Ylwo?+V=(jjDP2c;Lpt~MV?i=QsHLha|F04g7CjJ^f@nuEc z&Km7mK0p~_{xwT|j{TN?H7q4?jOrYWab>2*>S;B{|jnJOvxs`GktZ;76k|Y>GLG@X_AYmAXl7cE7Ka(`cD&?nmK@0&KGk2=PUi=pym+2`G0x+d&Yh7R|4Qwlc`yg za6>n=y!q3qH-bl;`M~F`uxxL|khTT$`~a{Mv$y+1((s4Q z^<*0-Pb~i=0dXA~LI%N+%vR>mw1RGcNH7A}@qXTZA@HZKQ;&NtGUPj{2HvVa`y>nBbkNnRO{3DfA@UMRSd8;2Gdfzn}xYGyhyGJt9}2lbKON?VSN*?~VB&LYyq4Cl$~peY?CkO?3mhFYOWMhX8t^+vHzO zUBk5XfH2;MsXA1sz5oTi`{oa3W8`gl0ubyU zb^P@XS#cvFg^)6Lb!hcJ*KD`>qx>n~GexTxX#k_i81v%zMPdDaJ}pG_t*b2Z#$pg5 z!xhvptInr?jl8NFK?+f!>C=MV8@%lQd^kD|QGHLqSsy8@*|q-C_w;{sUAUX}sP*TG z>*f*|p1@g*tBV$O zokhjp~2lF8_aFGN01}Z{Y^#{hQ^`epX8% zs`d|l3V@JK92kGz`tK#JCl4iOxI?>;DgK?ORfeAlV(zb@t*bZfr&Q-+9NmzOu_8&T zik~Sb6~edVfgfLC*wGQhsiy~l_xDHm_Dm4Os+};K2gOSoRKGOfHV23K>&;a6*M7!K)_MlqX!)YM#{c)% z^!jlF%x)jVSVz`ILL>q0V}_Wq$0dBFp{gUB_MHvK#oO9p|psWGP64{~w)>L&Y7zlY%DV3vLd zqrq|jAGr3-j6tVd=5ig)?iOX*G9Wy+>Biv%VB+T&8GqAG%%%jzShaF!i-Wv&lzv$O zoejT|vd$heFfj?>ntO4io2!PY%ul^gdayxtx;M)}gst)iu5`VwlD>R&gnx;CU5f*r zq~Q9wAq!y2n>dHd7fn#boRNv%s|IMCFW_7$Sk2nc<-HHqrj6TjTLl7&1&BOi#p4!F z|BUC|HxEw!&ThstMyp@9!vdb$qOsYVhHxDjU{pA=e4b?feaZ>~-Yf|JPCYF4h?J}y zCy>DjChRLmA210&&N^=AO~FYBH!6k=<{R{=K)-WauzmoIgCn9Sz$6-1g@=YsLZF%O zC%kF^QqX7{dnOMUYjRIS7xqD~^*(`S>YJ zYhT7N+7MO&7p|)61W;80(8G6e9)a!+Crjx)mow;$(2WPFe#|q_w<(N$cMDA4v8cyA z{rJ|{tk0ofHc*q_KnAMLD|6$m?Yk6i$6)Fd)kVE1zP?wi(#iKYLT?aephdC*F1C(P zg+7WH;|2xFaXMNj`E^Cgqpcz!tPu@hn1KEHx{jBNm9g?Co4+0b&FYO%cE zZ_9)89PqQX@e!bJ&H#Egq!0cOaJx2aK%S*=*p>Ay^{Ok)x!CtY5{FyMP#^?B#PPJx+(6ZWXppOam^lzVLMa^AA|Y%;KD=N)$X zpEoD?PVSID_o%^@!V z+f~4i4k`7w`x49Ap$-@O_pMf)x;xY1Bx`;3=8}4+Z0@|6Vdz};Gj1@v1CVXy>t>Ds zn|=Htp!U=Q&su{GAx1LFgx0*QlCVY2n|rrhuu{F7ckExMl#Ml@N1H|)(k`s_mSpBF z)r#|~(iIGj+?Mv308LJs6XJU~tM}6e)nd;6O25rf$-E=f-HsQ6m5nGsmFh4R zP1x>`HMZ}yY4c~b{zJ!h6!0AG^v$nn(5D20?_GB}0~C@>vkv4YXpIQ5rx0YvuR@Lx z*#-nq+tsLz4>+5j_x+G-=g5`Q7r#3!nwebeVV;N>vzg5IT=erZQIA(gy6Tr4Fgh)5 z0O4Im^aG@CD=F_;2fc(y_GdD$9?Q=P0U~R<-J=ROmoW_zsqmD~F+RwRx6L$XR>R6l zC?F>s#{L8{d>EmDT&n|49f8|)rcRs!cIXO16?qt+N*CL`6Is1&DT?V;77`Ki5nMMK zZ}a$p$T!UXtlZd@d`9vS|B&5vvjL!G)06D8iCPX$nX?y{kWph!nO!Rw=ZL> z)2AQ{glLy-=2T)D3tH&yFzGXAOQJ7v{zXvhl3oUG>Lt-Z1E1t@{=+7~Hp=3>9EtD+ zrdf>%3Q#azjKA-38yhQhi^^%g1G;OkG~A-kQhJb%BJ zJn@IrFL{2;=HN{vf+%eUyBc8T=xCYkE&?DxobB;PZ^Rf2kDAOSZx=~?t>YcJd2a&< zbEo+TzeV8Y%J(^dwU6ls8pw^tLwy81PTQ#sV@khWmzsKplexzkNnk$oMaWZFNV*9_ z@92vK*j!@AJFsg<0P^QHN(;fkPTJMuyC9fpi6eh4EkCM-WrpJXY4aH(JB_>D0y$gz zF8rc;>O^~-h*~`sv!hk1S%9Ys8&wwz?is%{%1K{rT z>KLzGJEr0+iQ?(gegqM}g%glaxNFF_e}LU4?Xc~XNEl_vnNe;WvLcLHh#x2$ePHpU zQS`%xN58z36s%Hz1-#9Nu~P8+T7omzLepKUe!}`YUwVlhPxnjD$AD8tJ?E`n0s`Oo z7xP1@^c@sYO#rSFX$kK)TDpJ34x*>d?ErAO#;6zhwBPuaN|;!?eZE7NVU(v<(ST&H@!I`!6?f{IhPIwCg;u<}`0pY3u-(TFVQv)`6vYr?H zChgz)+KYj$r$?@R|Kc5V6K>*Ng6{xGxxSZE?j4EYB#+!qiqpvKBa8=TWSf4;<3eb? zl4#icD5`hr29iVyu1R0yGhBXdu&rZu`mU50A^+m=Cp7+c=u98LjZr{q(f9awrtPmv z0rBlL5jqeV3f%W){Jq>!;UU3ciTh;yDgrTm&~{P0_Y9bNdjSwyJsgoo7bJoB^v@RV zO)LMU6D6|m`7PLIuo!udu5j&R5=OBVUt|{ahTW|b@v#VkZuPWZ+->E732O8}O{6{y zw5H^`8q-a`sI2u@q8dxQ;>GcHm{_&g7DH}>>m#al;&^WG;}{FH%qa$OnQ!5bnKOF< zfR_4z#-d5%@c!OYi<&WDIV5)qNG4@>C5l2ZEor@Es&ZGw`lE0PIuc=QU%k4y8Zn&n z@rP@YqBbCk7_g1pZ~$GI5~5dPR_ombt~{>F<&hvma0w(r&o??bE;iPvZGvj(3f-SG+l*Jk5c{ zXLxm1?Tb|@!&{!(Uh%MZ^10X1@SzQE^izucWfuF3hH5F6mlS*6?I6vVBivdwEp>!Q z<;I|n>}=mp*SDOPtT4CUC18G-(e^m;+xsjYh8uaRY8SW$7L+el62}6o_e%Es(LV6- zvMZu2k;BCPgj@VGgasn+$6Q1Zkrz5Li`era(jW36`C^RWK>q`UTPA%txx-a~#8A!G z;tW#rR`Bo(o`%Tq>xrLLEREu^BB>0 zSviQGI2~@;Iz>$gF^zC2Nbme^8n5g|9wNHvg;V^kCRG|qE=E8GQtRm8JlfR;F+L96 z)SDdaAnJW>^X?m*cdE}5B|TC_Y)#tfoEY!W^=fBIY;Ax|APFJ%JBMQ9$V@+T`Gg3H zrK@A&)@}+ihH3dD@`bD(l>opo<_xl#e8jpd51{zkoHVhx`w7li)`qu-*5xhTeOdTQ z&(ENCiZu4893&@XQr%ZiW^O7Rz|tjl(1?vR{ESxVZQyMk@tCNv4S3u?Ief?j%*vP_ zM^ixPR2JQG2FeQQ2W@REhJ1AtX%)5Ynu4<3IO6#Aj^NQ_WZHSwNtnNR>b`(YX>Xmm z2;%mtf6{P(;y=fmDH4TS0K987M*W`Z$+Q8suJhQwAq&98waEn=)44Hgc=x>~MViZ7 z0R0p;KU81mg08*aqqYrM*0|1)Bm#G`VHeb4qep-s%}g9n1P+XeARli?1D_v*+X*DOJK}6%m;StdIL=0@h%{tE;0Hg>%0= zR~zzuKT&`{;>!`sOn1V4Q7;0kn|2=Quqaf2ma=(gv5F-|LH>Pn> z32PoZ%@30%JOUo7tVr?s_#j@j*l_LJS0agrSV%T}KPJ@CugdJ#vHDvs$C?BaM270_ zsQmiL9`H59a#a8v#Ct7U9cDlS`Jh02RY233op3=W+f}$)@~DFGB@XImjF3n;%aDD;t8@<(3eJ$}J_jBwnMYZHc$=a_qfQ1e z0`7oKRW()=>s1ulL;TcGs# zXhc3UquzT@g^qj@X4L{c{1D$dp1Ya{=Xvq~!$I{lB5l`Rq!ZJ$a)U=>Lc#?3CU_Pe z4r*JoH0?przP{>|JfLZ=)X{6dHwpUd%>CRdcU08j zNEzp**B-?io<4&UF+W+wye@>E(OM#nJIt4Z#?7(GG9`!}ONLls1^CB8>bS-sH2y)?u(Kw}kjV?Q9YHl%@dw zgR#?I_tv-tYVif;o0!V11MSPgE6wv<=f+;U69hw%*9av$p~c^t3OMKRFqsjNOWQ!Q zo5e{z*H}1L{@_~m9pas?2K$oLaFLxw<^s$1{vP3aXW@IG9vGcHTg_*mmKo5q4dT5V z|MjnKLw;~_ERT?%+PRz;Cc+YRAN@XTB=L4Ml)2^b;uOP%p~@aREx2;`duc-ne$HO~ z>v1!66j!Gou)<)*ymttZr8pmmn{n+^;_$wao?Mn1>6E|tN=zBybU8%nx$L*}-Qytc zpYvn0tzM#BdcSD$d@nhWf_RuHP3oDDvo4HkeiUeEwox}HpQL}6zqboCcJxy!J~>|2 z)m51s(H@~1S}ZhZ@PBS?+-m;CxIn>W`_7KS^0|_E%ovQlKrZ{?XlYiQg*hZ4nUnc( zjFt?^GI*PwvPIp@WT|+p(DH&ujfCc|B4us_uhH0yLza?ysZw!#Am=pqJpnbP-ORM$ z{hzYb7R)>u-$r|aNlK58tcL@%lP2%7ryvb>1I{BYk3 zy#p!s>F)$LGhcub_}4n$jh)}vP_?%jb4T$c7tZBvm+yb_W|x_2r~-k7aB2wroy*()fU~`S8sWlQEt8!LF+AH?q*>}O#9c$J{K*I1f9`ZonW&d z!skVMMm>Mf4#U894Dbf+PiEk~MdXFOH+tg-EdL_@A~!~hA%z3vol~>TV%DCzzud|V_54nrvbO7Ea zb3jklfMC{IHL?>nQqWYSJ#C^QRUCcDInHVI&Kj&mm_TW=T|cKV5FMn>p#+ z>SvntyUe|5CAnB>g?KEtRJebYC(5oY8L zE?gn{lS}@xm)(1!gEn(`hH?DjkI%Gh7#d6f#B_r`hoKOGt*Z)*zK#4T7!GRR&mK!h z3`e&$Dy?c)TtQKkEy#4~_A(|Px)nkhlGF%$| z9?fN|eF9M!adM4tA0mM_>4X)jcQR-}5-KwGr+(NW6HiD^>bOk* zPxMd#*cm%p-E*pYJ_Ktzd4Yg)N9;289#_7787z^yp*;^0PxUVpa9Vno^52<=w1|W< zcmHRGa#u5_C6!pnAQc(RNli3y>%$ywUq_#d?0fcCE0XH|gBtVD#7=>(@w{ZZ&wmA{ zYW>Qn%P4E_i74wDZZ(sIB;`sxisW7u!SH64nZyO&i}g|o_QfJ~RpF@vyu@^S&cNC8 zg?MWsOktFZ5S8e?kL8d((&P=iS?Mc(fcc+e;;#d)PZh4!jJ9+-3Kljim zGNHmusaCpifU`dM*^`TBw{DRCo<@+3y@ZL~&3eTyt-Chv6(D5c0g22HcJ=Wh<&I zZ|YSaOO9yW`vF<#{m`3K_L!30J^>1cO{+8S+KY3cc*Z_% zl)6OTuk^FODx|Oo3_1idmdu%!{^6dOKqIZ@duRrmv5{#@qD(Dt_KU;oZZ$=zevF3l z=i8y`@Pkq5{UBbZ#5-9B^W6d^?|tqU#1p5=7Sp(!)ZR6av5#;x8~^W4wD}ud!hSuY zy5L z@3OO~q^J@|^mZMY#O?_|bV(j|7xKDrk@MlJoLe?|M+gw|o`0D?@&yd>^#xi{QGblIx#bDlXu&z02el6|T0OeW%B`EUs) zuZGkLx5iyh>Gh<>4dH1BD_|hstE+G+Svb21e{Ljh+*Zfoaigqr`u=iWAJYy;tJ>Eh z8s*KyNw+MYD}Z4}p%C8`xgj1e{Lw~bR9q7OqZqH-VTOAxQ}m0Ecd@QBi{xD4)orG0 z^!(lSMGmPEob9Dsg)xcJ>t0VYDlk^^g*t38W_;$@f=uk`&PMl%DN6rxLmB)S<Iz6#CKly>RGPgiKJYjj_`!!}J4NKp?Gr zmdt*tNl<^L#I+1hu9z@m&09A5r9t~) z5&1dL*YlLVJtP`9Gt$hVjB%LX$^7-Y?E^#i{dV!DI*|xaIP>$)r!$c80V&aMq*_B6 z65pwL=#zXKvLE^C_FI0Y$mDIE57FwHZ}tG|AT9{o+%Z0_wAlh4q%I_v z&w1WFQ(cU;u~BKI50x`xv;U?!m4}GmsArECUsb|Z#JeIG3au$*lXml!# z_tM*XbE;lHL2S>Jk8gslO`5cpy|Zuz$Nm{Di+#Xo`OjcY@ouo#M^zTLn11?z=%Iw8+Pp1C%kggqGMi%; zBTWkoyCaCZlsVqU0gh<()wLdvrS2KH)TcwxMPEJrAJL!$YL3PSkg&`3nA->;sEpcHCJR9&4_qg-&+22 z6W$VttquGuxR}xPpTEJqD1W3f@y|XO_u`U5i2a|n5$?=dcL@Iv{_FPCl75ktE5I*pbpy4pDi2@%Ki;0(k^lez From d51092cf8c179ebae7879308320b01f7494e6871 Mon Sep 17 00:00:00 2001 From: "Jeff Reeds (Aquent LLC)" Date: Wed, 27 May 2020 09:18:52 -0700 Subject: [PATCH 04/31] Update set-up-shared-or-guest-pc.md --- windows/configuration/set-up-shared-or-guest-pc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 289a37a0b6..78ed562391 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -9,7 +9,7 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 10/02/2018 +ms.date: 05/27/20 ms.reviewer: manager: dansimp --- From 7402727bc2ca85dacb392f771f2c0e2d32b74db3 Mon Sep 17 00:00:00 2001 From: "Jeff Reeds (Aquent LLC)" Date: Wed, 27 May 2020 09:52:38 -0700 Subject: [PATCH 05/31] Update set-up-shared-or-guest-pc.md --- windows/configuration/set-up-shared-or-guest-pc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 78ed562391..d77ca25608 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -9,7 +9,7 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 05/27/20 +ms.date: 05/27/2020 ms.reviewer: manager: dansimp --- From fde8590b82b31835ca5a5f9fbb4334e7479a86e5 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 29 May 2020 10:46:07 -0700 Subject: [PATCH 06/31] Updated strings to new syntax --- .../linux-exclusions.md | 18 +++---- .../linux-install-manually.md | 10 ++-- .../linux-install-with-ansible.md | 4 +- .../linux-install-with-puppet.md | 6 +-- .../microsoft-defender-atp/linux-pua.md | 2 +- .../microsoft-defender-atp/linux-resources.md | 50 +++++++++---------- .../linux-support-connectivity.md | 4 +- .../linux-support-install.md | 3 +- .../linux-support-perf.md | 10 ++-- 9 files changed, 53 insertions(+), 54 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md index ef0797f456..a8aa943686 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-exclusions.md @@ -64,7 +64,7 @@ For more information on how to configure exclusions from Puppet, Ansible, or ano Run the following command to see the available switches for managing exclusions: ```bash -$ mdatp --exclusion +$ mdatp exclusion ``` Examples: @@ -72,29 +72,29 @@ Examples: - Add an exclusion for a file extension: ```bash - $ mdatp --exclusion --add-extension .txt - Configuration updated successfully + $ mdatp exclusion extension add --name .txt + Extension exclusion configured successfully ``` - Add an exclusion for a file: ```bash - $ mdatp --exclusion --add-folder /var/log/dummy.log - Configuration updated successfully + $ mdatp exclusion file add --path /var/log/dummy.log + File exclusion configured successfully ``` - Add an exclusion for a folder: ```bash - $ mdatp --exclusion --add-folder /var/log/ - Configuration updated successfully + $ mdatp exclusion folder add --path /var/log/ + Folder exclusion configured successfully ``` - Add an exclusion for a process: ```bash - $ mdatp --exclusion --add-process cat - Configuration updated successfully + $ mdatp exclusion process add --name cat + Process exclusion configured successfully ``` ## Validate exclusions lists with the EICAR test file diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 31656eeae6..702afa998e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -268,7 +268,7 @@ Download the onboarding package from Microsoft Defender Security Center: Initially the client machine is not associated with an organization. Note that the *orgId* attribute is blank: ```bash - mdatp --health orgId + mdatp health --field org_id ``` 2. Run MicrosoftDefenderATPOnboardingLinuxServer.py, and note that, in order to run this command, you must have `python` installed on the device: @@ -280,13 +280,13 @@ Download the onboarding package from Microsoft Defender Security Center: 3. Verify that the machine is now associated with your organization and reports a valid organization identifier: ```bash - mdatp --health orgId + mdatp health --field org_id ``` 4. A few minutes after you complete the installation, you can see the status by running the following command. A return value of `1` denotes that the product is functioning as expected: ```bash - mdatp --health healthy + mdatp health --field healthy ``` > [!IMPORTANT] @@ -298,7 +298,7 @@ Download the onboarding package from Microsoft Defender Security Center: - Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command): ```bash - mdatp --health realTimeProtectionEnabled + mdatp health --field real_time_protection_enabled ``` - Open a Terminal window. Copy and execute the following command: @@ -310,7 +310,7 @@ Download the onboarding package from Microsoft Defender Security Center: - The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats: ```bash - mdatp --threat --list --pretty + mdatp threat list ``` ## Log installation issues diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 34b6be737e..2227ba8f15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -241,8 +241,8 @@ Now run the tasks files under `/etc/ansible/playbooks/`. - Validation/configuration: ```bash - $ ansible -m shell -a 'mdatp --connectivity-test' all - $ ansible -m shell -a 'mdatp --health' all + $ ansible -m shell -a 'mdatp connectivity test' all + $ ansible -m shell -a 'mdatp health' all ``` - Uninstallation: diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index 3914bf58e0..0db0c18a3a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -174,10 +174,10 @@ Enrolled agent devices periodically poll the Puppet Server, and install new conf On the agent machine, you can also check the onboarding status by running: ```bash -$ mdatp --health +$ mdatp health ... licensed : true -orgId : "[your organization identifier]" +org_id : "[your organization identifier]" ... ``` @@ -190,7 +190,7 @@ orgId : "[your organization identifier]" You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: ```bash -mdatp --health healthy +mdatp health --field healthy ``` The above command prints `1` if the product is onboarded and functioning as expected. diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-pua.md b/windows/security/threat-protection/microsoft-defender-atp/linux-pua.md index b0cd02009a..415341d721 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-pua.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-pua.md @@ -53,7 +53,7 @@ You can configure how PUA files are handled from the command line or from the ma In Terminal, execute the following command to configure PUA protection: ```bash -$ mdatp --threat --type-handling potentially_unwanted_application [off|audit|block] +$ mdatp threat policy set --type potentially_unwanted_application --action [off|audit|block] ``` ### Use the management console to configure PUA protection: diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index adc92e7c31..7014bcacaa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -31,29 +31,24 @@ If you can reproduce a problem, please increase the logging level, run the syste 1. Increase logging level: ```bash - $ mdatp --log-level verbose - Creating connection to daemon - Connection established - Operation succeeded + $ mdatp log level set --level verbose + Log level configured successfully ``` 2. Reproduce the problem. -3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds: +3. Run `sudo mdatp diagnostic create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds: ```bash - $ sudo mdatp --diagnostic --create - Creating connection to daemon - Connection established + $ sudo mdatp diagnostic create + Diagnostic file created: ``` 4. Restore logging level: ```bash - $ mdatp --log-level info - Creating connection to daemon - Connection established - Operation succeeded + $ mdatp log level set --level info + Log level configured successfully ``` ## Log installation issues @@ -78,21 +73,22 @@ Important tasks, such as controlling product settings and triggering on-demand s |Group |Scenario |Command | |-------------|-------------------------------------------|-----------------------------------------------------------------------| -|Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | -|Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | -|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | -|Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | -|Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| -|Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | -|Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| -|Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | -|Health |Check the product's health |`mdatp --health` | -|Protection |Scan a path |`mdatp --scan --path [path]` | -|Protection |Do a quick scan |`mdatp --scan --quick` | -|Protection |Do a full scan |`mdatp --scan --full` | -|Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` | -|Protection |Request a security intelligence update |`mdatp --definition-update` | +|Configuration|Turn on/off real-time protection |`mdatp config real_time_protection --value [enabled|disabled]` | +|Configuration|Turn on/off cloud protection |`mdatp config cloud --value [enabled|disabled]` | +|Configuration|Turn on/off product diagnostics |`mdatp config cloud-diagnostic --value [enabled|disabled]` | +|Configuration|Turn on/off automatic sample submission |`mdatp config cloud-automatic-sample-submission [enabled|disabled]` | +|Configuration|Turn on/off AV passive mode |`mdatp config passive-mode [enabled|disabled]` | +|Configuration|Turn on PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action block` | +|Configuration|Turn off PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action off` | +|Configuration|Turn on audit mode for PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action audit` | +|Diagnostics |Change the log level |`mdatp log level set --level verbose [error|warning|info|verbose]` | +|Diagnostics |Generate diagnostic logs |`mdatp diagnostic create` | +|Health |Check the product's health |`mdatp health` | +|Protection |Scan a path |`mdatp scan custom --path [path]` | +|Protection |Do a quick scan |`mdatp scan quick` | +|Protection |Do a full scan |`mdatp scan full` | +|Protection |Cancel an ongoing on-demand scan |`mdatp scan cancel` | +|Protection |Request a security intelligence update |`mdatp definitions update` | ## Microsoft Defender ATP portal information diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md index 4a25d355bf..a124167305 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md @@ -29,7 +29,7 @@ ms.topic: conceptual To test if Microsoft Defender ATP for Linux can communicate to the cloud with the current network settings, run a connectivity test from the command line: ```bash -$ mdatp --connectivity-test +$ mdatp connectivity test ``` If the connectivity test fails, check if the machine has Internet access and if [any of the endpoints required by the product](microsoft-defender-atp-linux.md#network-connections) are blocked by a proxy or firewall. @@ -84,7 +84,7 @@ $ sudo systemctl daemon-reload; sudo systemctl restart mdatp Upon success, attempt another connectivity test from the command line: ```bash -$ mdatp --connectivity-test +$ mdatp connectivity test ``` If the problem persists, contact customer support. diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md index 0982c630fa..8ffdc04ee8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md @@ -116,6 +116,7 @@ and try again. If none of the above steps help, collect the diagnostic logs: ```bash -$ sudo mdatp --diagnostic --create +$ sudo mdatp diagnostic create +Diagnostic file created: ``` Path to a zip file that contains the logs will be displayed as an output. Reach out to our customer support with these logs. diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-perf.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-perf.md index 55da60a602..6748041572 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-perf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-perf.md @@ -36,7 +36,8 @@ The following steps can be used to troubleshoot and mitigate these issues: If your device is not managed by your organization, real-time protection can be disabled from the command line: ```bash - $ mdatp --config realTimeProtectionEnabled false + $ mdatp config real-time-protection --value disabled + Configuration property updated ``` If your device is managed by your organization, real-time protection can be disabled by your administrator using the instructions in [Set preferences for Microsoft Defender ATP for Linux](linux-preferences.md). @@ -49,19 +50,20 @@ The following steps can be used to troubleshoot and mitigate these issues: This feature is enabled by default on the `Dogfood` and `InsisderFast` channels. If you're using a different update channel, this feature can be enabled from the command line: ```bash - $ mdatp config real_time_protection_statistics_enabled on + $ mdatp config real-time-protection-statistics --value enabled ``` This feature requires real-time protection to be enabled. To check the status of real-time protection, run the following command: ```bash - $ mdatp health + $ mdatp health --field real_time_protection_enabled ``` Verify that the `real_time_protection_enabled` entry is `true`. Otherwise, run the following command to enable it: ```bash - $ mdatp --config realTimeProtectionEnabled true + $ mdatp config real-time-protection --value enabled + Configuration property updated ``` To collect current statistics, run: From b9c85e035b770cbf10936088243cf703959540e4 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 8 Jun 2020 20:38:25 -0700 Subject: [PATCH 07/31] Update supported file systems --- .../microsoft-defender-atp-linux.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index 0a57598987..4ece6145ec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -92,10 +92,20 @@ If you experience any installation failures, refer to [Troubleshooting installat - The solution currently provides real-time protection for the following file system types: - btrfs + - ecryptfs - ext2 - ext3 - ext4 + - fuse + - fuseblk + - jfs + - nfs + - overlay + - ramfs + - reiserfs - tmpfs + - udf + - vfat - xfs More file system types will be added in the future. From 6871121d5e0e04d92cf709ebc48fec66bdfd4e21 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 8 Jun 2020 20:49:42 -0700 Subject: [PATCH 08/31] Add release notes for 101.00.75 --- .../microsoft-defender-atp/linux-whatsnew.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md index 4c49223e78..e7408568e2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md @@ -19,6 +19,12 @@ ms.topic: conceptual # What's new in Microsoft Defender Advanced Threat Protection for Linux +## 101.00.75 + +- Added support for the following file system types: ecryptfs, fuse, fuseblk, jfs, nfs, overlay, ramfs, reiserfs, udf, and vfat +- New syntax for the command-line tool. See [this page](linux-resources.md#configure-from-the-command-line) for more information. +- Performance improvements & bug fixes + ## 100.90.70 > [!WARNING] From 1ae027aece701aeb2592bf1e40bd4004e13148dd Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 8 Jun 2020 20:54:28 -0700 Subject: [PATCH 09/31] Add note on product expiration --- .../microsoft-defender-atp/linux-updates.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md index 37b668c4f2..50bbc417f9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md @@ -26,6 +26,12 @@ ms.topic: conceptual Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. +> [!WARNING] +> Each version of Microsoft Defender ATP for Linux has an expiration date, after which it will no longer continue to protect your device. You must update the product prior to this date. To check the expiration date, run the following command: +> ```bash +> mdatp health --field product_expiration +> ``` + To update Microsoft Defender ATP for Linux manually, execute one of the following commands: ## RHEL and variants (CentOS and Oracle Linux) From 0fdaac8f013ef40f4cb594bc13f0fdd6618517eb Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 8 Jun 2020 20:57:30 -0700 Subject: [PATCH 10/31] Add note on how to check definition update status --- .../microsoft-defender-atp/linux-install-manually.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 702afa998e..ef65ef7094 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -290,7 +290,10 @@ Download the onboarding package from Microsoft Defender Security Center: ``` > [!IMPORTANT] - > When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `0`.
+ > When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes. During this time the above command returns a value of `false`. You can check the status of the definition update using the following command: + > ```bash + > mdatp health --field definitions_status + > ``` > Please note that you may also need to configure a proxy after completing the initial installation. See [Configure Microsoft Defender ATP for Linux for static proxy discovery: Post-installation configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration#post-installation-configuration). 5. Run a detection test to verify that the machine is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded machine: From 27164b2faf243a6e1d50e506d12b437bfdbc7ce7 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 9 Jun 2020 09:18:07 -0700 Subject: [PATCH 11/31] wired in two new topics to TOC --- windows/deployment/TOC.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 20ea156b13..663b28017e 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -12,7 +12,7 @@ - name: Windows update fundamentals href: update/waas-overview.md - name: Types of Windows updates - href: update/waas-quick-start.md#definitions + href: update/get-started-updates-channels-tools.md - name: Servicing the Windows 10 operating system href: update/waas-servicing-strategy-windows-10-updates.md @@ -62,8 +62,8 @@ - name: Prepare items: - - name: Prepare to deploy Windows 10 - href: deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md + - name: Prepare to deploy Windows 10 updates + href: update/prepare-deploy-windows.md - name: Evaluate and update infrastructure href: update/update-policies.md - name: Set up Delivery Optimization for Windows 10 updates From 7eff29f7496d02e9dec6713cbb90ab09bb645d5b Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 9 Jun 2020 10:58:25 -0700 Subject: [PATCH 12/31] slight adjustment --- windows/deployment/TOC.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 663b28017e..7195a47f76 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -11,7 +11,7 @@ href: update/waas-quick-start.md - name: Windows update fundamentals href: update/waas-overview.md - - name: Types of Windows updates + - name: Basics of Windows updates, channels, and tools href: update/get-started-updates-channels-tools.md - name: Servicing the Windows 10 operating system href: update/waas-servicing-strategy-windows-10-updates.md From 2e762b0ff506a8b542732e3475ed7ee3383ef684 Mon Sep 17 00:00:00 2001 From: 1justingilmore Date: Wed, 10 Jun 2020 17:43:07 -0600 Subject: [PATCH 13/31] Copy edits for 401116 Light copy edits. --- ...ix-a-powershell-scripts-for-surface-hub.md | 34 +---- mdop/appv-v5/app-v-50-prerequisites.md | 143 ++++++------------ ...n-the-mbam-international-release-mbam-1.md | 5 +- .../mbam-20-privacy-statement-mbam-2.md | 27 +--- ...ficate-authentication-device-enrollment.md | 13 +- ...erated-authentication-device-enrollment.md | 48 ++---- .../mdm/mobile-device-enrollment.md | 24 +-- ...remise-authentication-device-enrollment.md | 10 +- ...soft-defender-security-center-antivirus.md | 38 +++-- 9 files changed, 108 insertions(+), 234 deletions(-) diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index f74f2297fa..9295d1d8ac 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -16,7 +16,6 @@ ms.localizationpriority: medium # PowerShell for Surface Hub - PowerShell scripts to help set up and manage your Microsoft Surface Hub. - [PowerShell scripts for Surface Hub admins](#scripts-for-admins) @@ -30,7 +29,6 @@ PowerShell scripts to help set up and manage your Microsoft Surface Hub. - [Auto-accepting and declining meeting requests](#auto-accept-meetings-cmdlet) - [Accepting external meeting requests](#accept-ext-meetings-cmdlet) - ## Prerequisites To successfully execute these PowerShell scripts, you will need to install the following prerequisites: @@ -41,7 +39,6 @@ To successfully execute these PowerShell scripts, you will need to install the f ## PowerShell scripts for Surface Hub administrators - What do the scripts do? - Create device accounts for setups using pure single-forest on-premises (Microsoft Exchange and Skype 2013 and later only) or online (Microsoft Office 365), that are configured correctly for your Surface Hub. @@ -56,11 +53,8 @@ What do you need in order to run the scripts? >[!NOTE] >Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub. -  - ## Running the scripts - The account creation scripts will: - Ask for administrator credentials @@ -178,11 +172,8 @@ These are the attributes that are set by the scripts: -  - ## Account creation scripts - These scripts will create a device account for you. You can use the [Account verification script](#acct-verification-ps-scripts) to make sure they ran correctly. The account creation scripts cannot modify an already existing account, but can be used to help you understand which cmdlets need to be run to configure the existing account correctly. @@ -257,7 +248,6 @@ if (!$credNewAccount -Or [System.String]::IsNullOrEmpty($strDisplayName) -Or [Sy exit 1 } - ## Sign in to remote powershell for exchange and lync online ## $credExchange = $null @@ -307,7 +297,8 @@ Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue Import-PSSession $sessLync -AllowClobber -WarningAction SilentlyContinue ## Create the Exchange mailbox ## -# Note: These exchange commandlets do not always throw their errors as exceptions +>[!Note] +>These exchange commandlets do not always throw their errors as exceptions # Because Get-Mailbox will throw an error if the mailbox is not found $Error.Clear() @@ -324,7 +315,6 @@ $status["Mailbox Setup"] = "Successfully created a mailbox for the new account" $strEmail = $mailbox.WindowsEmailAddress PrintSuccess "The following mailbox has been created for this room: $strEmail" - ## Create or retrieve a policy that will be applied to surface hub devices ## # The policy disables requiring a device password so that the SurfaceHub does not need to be lockable to use Active Sync $strPolicy = Read-Host 'Please enter the name for a new Surface Hub ActiveSync policy that will be created and applied to this account. @@ -674,7 +664,8 @@ Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue Import-PSSession $sessCS -AllowClobber -WarningAction SilentlyContinue ## Create the Exchange mailbox ## -# Note: These exchange commandlets do not always throw their errors as exceptions +>[!Note] +>These exchange commandlets do not always throw their errors as exceptions # Because Get-Mailbox will throw an error if the mailbox is not found $Error.Clear() @@ -994,7 +985,6 @@ else ## Account verification script - This script will validate the previously-created device account on a Surface Hub, no matter which method was used to create it. This script is basically pass/fail. If one of the test errors out, it will show a detailed error message, but if all tests pass, the end result will be a summary report. For example, you might see: ``` syntax @@ -1446,7 +1436,6 @@ Cleanup ## Enable Skype for Business - This script will enable Skype for Business on a device account. Use it only if Skype for Business wasn't previously enabled during account creation. ```PowerShell @@ -1607,7 +1596,6 @@ Cleanup ## Useful cmdlets - ### Creating a Surface Hub-compatible ActiveSync policy For Surface Hub to use Exchange services, a device account configured with a compatible ActiveSync policy must be provisioned on the device. This policy has the following requirements: @@ -1674,19 +1662,9 @@ Set-CalendarProcessing $strRoomUpn -AutomateProcessing AutoAccept For a device account to accept external meeting requests (a meeting request from an account not in the same tenant/domain), the device account must be set to allow processing of external meeting requests. Once set, the device account will automatically accept or decline meeting requests from external accounts as well as local accounts. ->**Note**  If the **AutomateProcessing** attribute is not set to **AutoAccept**, then setting this will have no effect. - -  +>[!Note] +>If the **AutomateProcessing** attribute is not set to **AutoAccept**, then setting this will have no effect. ```PowerShell Set-CalendarProcessing $strRoomUpn -ProcessExternalMeetingMessages $true ``` - -  - -  - - - - - diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md index e90a62583c..ace08aceef 100644 --- a/mdop/appv-v5/app-v-50-prerequisites.md +++ b/mdop/appv-v5/app-v-50-prerequisites.md @@ -16,11 +16,10 @@ ms.date: 08/30/2016 # App-V 5.0 Prerequisites - Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you should make sure that you have met the prerequisites to install the product. This topic contains information to help you successfully plan for preparing your computing environment before you deploy the App-V 5.0 features. -**Important** -**The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages: +>[!Important] +>**The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages: - [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) @@ -28,8 +27,6 @@ Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you - [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - The following table lists prerequisite information that pertains to specific operating systems. @@ -69,15 +66,10 @@ The following table lists prerequisite information that pertains to specific ope
- - ## Installation prerequisites for App-V 5.0 - -**Note** -The following prerequisites are already installed for computers that run Windows 8. - - +>[!Note] +>The following prerequisites are already installed for computers that run Windows 8. Each of the App-V 5.0 features have specific prerequisites that must be met before the App-V 5.0 features can be successfully installed. @@ -100,8 +92,8 @@ The following table lists the installation prerequisites for the App-V 5.0 clien

Software requirements

- - ### Prerequisites for the App-V 5.0 Remote Desktop Services client -**Note** -The following prerequisites are already installed for computers that run Windows Server 2012. - - +>[!Note] +>The following prerequisites are already installed for computers that run Windows Server 2012. The following table lists the installation prerequisites for the App-V 5.0 Remote Desktop Services client: @@ -158,8 +146,8 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot

Software requirements

- - ### Prerequisites for the App-V 5.0 Sequencer -**Note** -The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012. - - +>[!Note] +>The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012. The following table lists the installation prerequisites for the App-V 5.0 Sequencer. If possible, the computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. -**Note** -If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - +>[!Note] +>If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). @@ -221,16 +203,16 @@ If the system requirements of a locally installed application exceed the require

Software requirements
- - ### Prerequisites for the App-V 5.0 server -**Note** -The following prerequisites are already installed for computers that run Windows Server 2012: +>[!Note] +>The following prerequisites are already installed for computers that run Windows Server 2012: - Microsoft .NET Framework 4.5. This eliminates the Microsoft .NET Framework 4 requirement. @@ -256,26 +236,18 @@ The following prerequisites are already installed for computers that run Windows - Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (https://support.microsoft.com/kb/2533623) - **Important** - You can still download install the previous KB. However, it may have been replaced with a more recent version. - - - - + >[!Important] + >You can still download install the previous KB. However, it may have been replaced with a more recent version. The following table lists the installation prerequisites for the App-V 5.0 server. The account that you use to install the server components must have administrative rights on the computer that you are installing on. This account must also have the ability to query Active Directory Directory Services. Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to the specified ports. -**Note** -Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service. - - +>[!Note] +>Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service. The App-V 5.0 server is supported for a standalone deployment, where all the components are deployed on the same server, and a distributed deployment. Depending on the topology that you use to deploy the App-V 5.0 server, the data that you will need for each component will slightly change. -**Important** -The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported. - - +>[!Important] +>The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported. @@ -292,8 +264,8 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

Management Server

The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.

@@ -339,8 +311,8 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.

    @@ -349,14 +321,14 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

  • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the management database is AppVManagement.

  • App-V 5.0 management server location – specifies the machine account on which the management server is deployed. This should be specified in the following format Domain\MachineAccount.

  • App-V 5.0 management server installation administrator - specifies the account that will be used to install the App-V 5.0 management server. You should use the following format: Domain\AdministratorLoginName.

    • -

  • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see Configure SQL Server Agent to Restart Services Automatically (https://go.microsoft.com/fwlink/?LinkId=273725).

    • +

  • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see Configure SQL Server Agent to Restart Services Automatically

Reporting Server

Publishing Server

 @@ -412,25 +384,8 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
- - - - - - - ## Related topics - [Planning to Deploy App-V](planning-to-deploy-app-v.md) [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - - - - - - - - - diff --git a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md index d365a7ce2c..19ad1f3d57 100644 --- a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md +++ b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md @@ -16,12 +16,10 @@ ms.date: 08/30/2016 # Known Issues in the MBAM International Release - This section contains known issues for Microsoft BitLocker Administration and Monitoring (MBAM) International Release. ## Known Issues in the MBAM International Release - ### The Installation Process Does Not Specify Update Upon updating the Microsoft BitLocker Administration and Monitoring server or servers, the Setup program does not state that an update is being installed. @@ -36,13 +34,12 @@ If you are using a certificate for authentication between MBAM servers, after up ### MBAM Svclog File Filling Disk Space -If you have followed Knowledge Base article 2668170, [https://support.microsoft.com/kb/2668170](https://go.microsoft.com/fwlink/?LinkID=247277), you might have to repeat the KB steps after you install this update. +If you have followed [Knowledge Base article 2668170](https://go.microsoft.com/fwlink/?LinkID=247277), you might have to repeat the KB steps after you install this update. **Workaround**: None. ## Related topics - [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md)   diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md index 1d8f677dab..d2e12fb643 100644 --- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md @@ -16,10 +16,8 @@ ms.date: 08/30/2016 # MBAM 2.0 Privacy Statement - ## Microsoft BitLocker Administration and Monitoring (MBAM) v2 Privacy Statement - Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft BitLocker Administration and Monitoring v2 (MBAM). This is a preliminary disclosure that focuses on features that communicate with the Internet and is not intended to be an exhaustive list. Microsoft BitLocker Administration and Monitoring (MBAM) enhances BitLocker by simplifying deployment and key recovery, centralizing provisioning, monitoring and reporting of encryption status for fixed and removable drives, and minimizing support costs. This release provides support for Windows 8 as well as improvements on Configuration Manager Integration and key recovery functionality. @@ -86,13 +84,12 @@ Microsoft Error Reporting is not turned on or off by MBAM. MBAM will utilize wha "HKLM\\Software\\Wow6432Node\\Microsoft\\Microsoft Standalone System Sweeper Tool" (for the 64-bit version) -**Warning** - -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. +>[!Warning] +>Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. Important Information: Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their PCs. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available on [TechNet](https://technet.microsoft.com/library/cc709644.aspx). -Additional information on how to modify enable and disable error reporting is available at this support article: [(https://support.microsoft.com/kb/188296)](https://support.microsoft.com/kb/188296). +Additional information on how to modify enable and disable error reporting is available at this support article: [How to disable or enable Dr. Watson for Windows](https://support.microsoft.com/kb/188296). ### Microsoft Update @@ -102,15 +99,15 @@ Microsoft Update is a service that provides Windows updates as well as updates f **Information Collected, Processed, or Transmitted:** -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . +For details about what information is collected and how it is used, see the [Update Services Privacy Statement](https://go.microsoft.com/fwlink/?LinkId=244400). **Use of Information:** -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . +For details about what information is collected and how it is used, see the [Update Services Privacy Statement](https://go.microsoft.com/fwlink/?LinkId=244400). **Choice/Control:** -For details about controlling this feature, see the Update Services Privacy Statement at . +For details about controlling this feature, see the [Update Services Privacy Statement](https://go.microsoft.com/fwlink/?LinkId=244000). ### Customer Experience Improvement Program @@ -120,7 +117,7 @@ The Customer Experience Improvement Program (“CEIP”) collects basic informat **Information Collected, Processed, or Transmitted:** -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . +For more information about the information collected, processed, or transmitted by CEIP, see the [CEIP privacy statement](https://go.microsoft.com/fwlink/?LinkID=52097). **Use of Information:** @@ -132,14 +129,4 @@ CEIP is off by default. You're offered the opportunity to participate in CEIP du ## Related topics - [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index dd72081354..1441d87c96 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -14,15 +14,13 @@ ms.date: 06/26/2017 # Certificate authentication device enrollment - This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -> **Note**  To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). - +>[!Note] +>To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). ## In this topic - - [Discovery service](#discovery-service) - [Enrollment policy web service](#enrollment-policy-web-service) - [Enrollment web service](#enrollment-web-service) @@ -507,10 +505,3 @@ The following example shows the encoded provisioning XML. protocol. This configuration service provider is being deprecated for Windows 10. --> ``` - -  - - - - - diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index e8ad3c9cd8..8af297cb56 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -14,7 +14,6 @@ ms.date: 07/28/2017 # Federated authentication device enrollment - This section provides an example of the mobile device enrollment protocol using federated authentication policy. When the authentication policy is set to Federated, the web authentication broker is leveraged by the enrollment client to get a security token. The enrollment client calls the web authentication broker API within the response message to start the process. The server should build the web authentication broker pages to fit the device screen and should be consistent with the existing enrollment UI. The opaque security token that is returned from the broker as an end page is used by the enrollment client as the device security secret during the client certificate request call. The <AuthenticationServiceURL> element the discovery response message specifies web authentication broker page start URL. @@ -23,7 +22,6 @@ For details about the Microsoft mobile device enrollment protocol for Windows 1 ## In this topic - [Discovery service](#discovery-service) [Enrollment policy web service](#enrollment-policy-web-service) [Enrollment web service](#enrollment-web-service) @@ -32,12 +30,10 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme ## Discovery service - The discovery web service provides the configuration information necessary for a user to enroll a phone with a management service. The service is a restful web service over HTTPS (server authentication only). -> **Note**  The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. - - +>[!Note] +>The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -131,24 +127,21 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - In Windows, Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +>[!Note]   +>The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be leveraged by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. -> **Note**  Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: +>[!Note] +>Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: > - Parse the OS version from the data sent up during the discovery request. > - Append the OS version as a parameter in the AuthenticationServiceURL. > - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. - - A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. -> **Note**  The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. - - +>[!Note] +>The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. The following are the explicit requirements for the server. @@ -237,7 +230,6 @@ The following example shows a response received from the discovery web service w ## Enrollment policy web service - Policy service is optional. By default, if no policies are specified, the minimum key length is 2k and the hash algorithm is SHA-1. This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message. @@ -302,9 +294,8 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. For Windows device, we will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +>[!Note]   +>The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -387,7 +378,6 @@ The following snippet shows the policy web service response. ## Enrollment web service - This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DM client. The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully. @@ -396,9 +386,8 @@ Note that the RequestSecurityToken will use a custom TokenType (http: **Note**  The policy service and the enrollment service must be on the same server; that is, they must have the same host name. - - +>[!Note] +>The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for federated authentication. @@ -487,9 +476,8 @@ The following example shows the enrollment web service request for federated aut After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR). -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +>[!Note] +>The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc), because the token is more than an X.509 v3 certificate. @@ -640,11 +628,3 @@ The following code shows sample provisioning XML (presented in the preceding pac - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. - - - - - - - - diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 1d91d3ec3b..1b6590f392 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -14,7 +14,6 @@ ms.date: 08/11/2017 # Mobile device enrollment - Mobile device enrollment is the first phase of enterprise management. The device is configured to communicate with the MDM server using security precautions during the enrollment process. The enrollment service verifies that only authenticated and authorized devices can be managed by their enterprise. The enrollment process includes the following steps: @@ -33,21 +32,20 @@ The enrollment process includes the following steps: ## Enrollment protocol - There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). The enrollment process involves the following steps: -**Discovery request** +### Discovery request The discovery request is a simple HTTP post call that returns XML over HTTP. The returned XML includes the authentication URL, the management service URL, and the user credential type. -**Certificate enrollment policy** +### Certificate enrollment policy The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619345) -**Certificate enrollment** +### Certificate enrollment The certificate enrollment is an implementation of the MS-WSTEP protocol. -**Management configuration** +### Management configuration The server sends provisioning XML that contains a server certificate (for SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. The following topics describe the end-to-end enrollment process using various authentication methods: @@ -56,19 +54,18 @@ The following topics describe the end-to-end enrollment process using various au - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) -> **Note**  As a best practice, do not use hardcoded server-side checks on values such as: +>[!Note]   +>As a best practice, do not use hardcoded server-side checks on values such as: > - User agent string > - Any fixed URIs that are passed during enrollment > - Specific formatting of any value unless otherwise noted, such as the format of the device ID. - ## Enrollment support for domain-joined devices -  + Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in **Settings**. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device. ## Disable MDM enrollments - Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. ![Disable MDM enrollment policy in GP Editor](images/mdm-enrollment-disable-policy.png) @@ -89,7 +86,6 @@ The following scenarios do not allow MDM enrollments: ## Enrollment migration - **Desktop:** After the MDM client upgrade from Windows 8.1 to Windows 10, enrollment migration starts at the first client-initiated sync with the MDM service. The enrollment migration start time depends on the MDM server configuration. For example, for Intune it runs every 6 hours. Until the enrollment migration is completed, the user interface will show no enrollment and server push will not work. @@ -100,7 +96,6 @@ To manually trigger enrollment migration, you can run MDMMaintenenceTask. ## Enrollment error messages - The enrollment server can decline enrollment messages using the SOAP Fault format. Errors created can be sent as follows: ```xml @@ -196,8 +191,6 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma -  - In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example: ```xml @@ -291,13 +284,10 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. -  - TraceID is a freeform text node which is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment. ## Related topics - - [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md index 22c3ac4fbe..8b8510e448 100644 --- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md @@ -30,7 +30,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). -> [!NOTE] +>[!NOTE] >The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The device’s automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -78,7 +78,7 @@ The following logic is applied: - If the device is not redirected, it prompts the user for the server address. - If the device is redirected, it prompts the user to allow the redirect. -The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address +The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address: ``` https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc @@ -129,7 +129,7 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. -> [!NOTE] +>[!NOTE] >The HTTP server response must not be chunked; it must be sent as one message. The following example shows a response received from the discovery web service for OnPremise authentication: @@ -214,7 +214,7 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. We will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. -> [!NOTE] +>[!NOTE] >The HTTP server response must not be chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -306,7 +306,7 @@ The RequestSecurityToken will use a custom TokenType (http://schema The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. -> [!NOTE] +>[!NOTE] >The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for OnPremise authentication. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md index c2d53844a7..4d8b9d2e78 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md @@ -26,11 +26,13 @@ In Windows 10, version 1703 and later, the Windows Defender app is part of the W Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703. -> [!IMPORTANT] -> Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.
If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. ->It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. ->This will significantly lower the protection of your device and could lead to malware infection. +>[!IMPORTANT] +>Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. +>If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +>It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. + +>This will significantly lower the protection of your device and could lead to malware infection. See the [Windows Security article](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app. @@ -46,7 +48,7 @@ The Windows Security app is a client interface on Windows 10, version 1703 and l ## Comparison of settings and functions of the old app and the new app -All of the previous functions and settings from the Windows Defender app (in versions of Windows 10 before version 1703) are now found in the new Windows Security app. Settings that were previously located in Windows Settings under **Update & security** > **Windows Defender** are also now in the new app. +All of the previous functions and settings from the Windows Defender app (in versions of Windows 10 before version 1703) are now found in the new Windows Security app. Settings that were previously located in Windows Settings under **Update & security** > **Windows Defender** are also now in the new app. The following diagrams compare the location of settings and functions between the old and new apps: @@ -66,8 +68,8 @@ Item | Windows 10, before version 1703 | Windows 10, version 1703 and later | De This section describes how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Microsoft Defender Antivirus in the Windows Security app. -> [!NOTE] -> If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured. +>[!NOTE] +>If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured. @@ -95,7 +97,6 @@ This section describes how to perform some of the most common tasks when reviewi 4. Click **Check for updates** to download new protection updates (if there are any). - ### Ensure Microsoft Defender Antivirus is enabled in the Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -110,7 +111,6 @@ This section describes how to perform some of the most common tasks when reviewi >If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. >If you install another antivirus product, Microsoft Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). - ### Add exclusions for Microsoft Defender Antivirus in the Windows Security app @@ -135,21 +135,19 @@ The following table summarizes exclusion types and what happens: |**File type** |File extension
Example: `.test` |All files with the `.test` extension anywhere on your device are skipped by Microsoft Defender Antivirus. | |**Process** |Executable file path
Example: `c:\test\process.exe` |The specific process and any files that are opened by that process are skipped by Microsoft Defender Antivirus. | -To learn more, see: +To learn more, see: - [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus) - [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus) ### Review threat detection history in the Windows Defender Security Center app - 1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or  - searching the start menu for **Defender**. - - 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). - - 3. Click **Threat history** + 1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - 4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**,  - **Allowed threats**). + 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). + + 3. Click **Threat history** + + 4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**, **Allowed threats**). @@ -167,6 +165,4 @@ To learn more, see: ## Related articles -- [Microsoft Defender Antivirus](microsoft-defender-antivirus-in-windows-10.md) - - +- [Microsoft Defender Antivirus](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file From b349c9ad5e3e293fa38d2388a423ff16db3aa828 Mon Sep 17 00:00:00 2001 From: 1justingilmore Date: Thu, 11 Jun 2020 11:11:51 -0600 Subject: [PATCH 14/31] Copy edits for 401116 fixed fixed note coding, --- ...ix-a-powershell-scripts-for-surface-hub.md | 16 ++++----- mdop/appv-v5/app-v-50-prerequisites.md | 36 +++++++++---------- .../mbam-20-privacy-statement-mbam-2.md | 4 +-- ...ficate-authentication-device-enrollment.md | 4 +-- ...erated-authentication-device-enrollment.md | 28 +++++++-------- .../mdm/mobile-device-enrollment.md | 10 ++---- ...remise-authentication-device-enrollment.md | 16 ++++----- ...soft-defender-security-center-antivirus.md | 20 +++++------ 8 files changed, 64 insertions(+), 70 deletions(-) diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index 9295d1d8ac..d4aee59674 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -50,8 +50,8 @@ What do you need in order to run the scripts? - Remote PowerShell access to your organization's domain or tenant, Exchange servers, and Skype for Business servers. - Admin credentials for your organization's domain or tenant, Exchange servers, and Skype for Business servers. ->[!NOTE] ->Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub. +> [!NOTE] +> Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub. ## Running the scripts @@ -297,8 +297,8 @@ Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue Import-PSSession $sessLync -AllowClobber -WarningAction SilentlyContinue ## Create the Exchange mailbox ## ->[!Note] ->These exchange commandlets do not always throw their errors as exceptions +> [!Note] +> These exchange commandlets do not always throw their errors as exceptions # Because Get-Mailbox will throw an error if the mailbox is not found $Error.Clear() @@ -664,8 +664,8 @@ Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue Import-PSSession $sessCS -AllowClobber -WarningAction SilentlyContinue ## Create the Exchange mailbox ## ->[!Note] ->These exchange commandlets do not always throw their errors as exceptions +> [!Note] +> These exchange commandlets do not always throw their errors as exceptions # Because Get-Mailbox will throw an error if the mailbox is not found $Error.Clear() @@ -1662,8 +1662,8 @@ Set-CalendarProcessing $strRoomUpn -AutomateProcessing AutoAccept For a device account to accept external meeting requests (a meeting request from an account not in the same tenant/domain), the device account must be set to allow processing of external meeting requests. Once set, the device account will automatically accept or decline meeting requests from external accounts as well as local accounts. ->[!Note] ->If the **AutomateProcessing** attribute is not set to **AutoAccept**, then setting this will have no effect. +> [!Note] +> If the **AutomateProcessing** attribute is not set to **AutoAccept**, then setting this will have no effect. ```PowerShell Set-CalendarProcessing $strRoomUpn -ProcessExternalMeetingMessages $true diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md index ace08aceef..428a2cf5f8 100644 --- a/mdop/appv-v5/app-v-50-prerequisites.md +++ b/mdop/appv-v5/app-v-50-prerequisites.md @@ -18,8 +18,8 @@ ms.date: 08/30/2016 Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you should make sure that you have met the prerequisites to install the product. This topic contains information to help you successfully plan for preparing your computing environment before you deploy the App-V 5.0 features. ->[!Important] ->**The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages: +> [!Important] +> **The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages: - [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) @@ -68,8 +68,8 @@ The following table lists prerequisite information that pertains to specific ope ## Installation prerequisites for App-V 5.0 ->[!Note] ->The following prerequisites are already installed for computers that run Windows 8. +> [!Note] +> The following prerequisites are already installed for computers that run Windows 8. Each of the App-V 5.0 features have specific prerequisites that must be met before the App-V 5.0 features can be successfully installed. @@ -126,8 +126,8 @@ The following table lists the installation prerequisites for the App-V 5.0 clien ### Prerequisites for the App-V 5.0 Remote Desktop Services client ->[!Note] ->The following prerequisites are already installed for computers that run Windows Server 2012. +> [!Note] +> The following prerequisites are already installed for computers that run Windows Server 2012. The following table lists the installation prerequisites for the App-V 5.0 Remote Desktop Services client: @@ -180,13 +180,13 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot ### Prerequisites for the App-V 5.0 Sequencer ->[!Note] ->The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012. +> [!Note] +> The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012. The following table lists the installation prerequisites for the App-V 5.0 Sequencer. If possible, the computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. ->[!Note] ->If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). +> [!Note] +> If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). @@ -227,8 +227,8 @@ The following table lists the installation prerequisites for the App-V 5.0 Seque ### Prerequisites for the App-V 5.0 server ->[!Note] ->The following prerequisites are already installed for computers that run Windows Server 2012: +> [!Note] +> The following prerequisites are already installed for computers that run Windows Server 2012: - Microsoft .NET Framework 4.5. This eliminates the Microsoft .NET Framework 4 requirement. @@ -236,18 +236,18 @@ The following table lists the installation prerequisites for the App-V 5.0 Seque - Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (https://support.microsoft.com/kb/2533623) - >[!Important] - >You can still download install the previous KB. However, it may have been replaced with a more recent version. + > [!Important] + > You can still download install the previous KB. However, it may have been replaced with a more recent version. The following table lists the installation prerequisites for the App-V 5.0 server. The account that you use to install the server components must have administrative rights on the computer that you are installing on. This account must also have the ability to query Active Directory Directory Services. Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to the specified ports. ->[!Note] ->Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service. +> [!Note] +> Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service. The App-V 5.0 server is supported for a standalone deployment, where all the components are deployed on the same server, and a distributed deployment. Depending on the topology that you use to deploy the App-V 5.0 server, the data that you will need for each component will slightly change. ->[!Important] ->The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported. +> [!Important] +> The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported.
diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md index d2e12fb643..55aa14a2c0 100644 --- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md @@ -84,8 +84,8 @@ Microsoft Error Reporting is not turned on or off by MBAM. MBAM will utilize wha "HKLM\\Software\\Wow6432Node\\Microsoft\\Microsoft Standalone System Sweeper Tool" (for the 64-bit version) ->[!Warning] ->Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. +> [!Warning] +> Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. Important Information: Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their PCs. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available on [TechNet](https://technet.microsoft.com/library/cc709644.aspx). diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index 1441d87c96..565fd3436d 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -16,8 +16,8 @@ ms.date: 06/26/2017 This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). ->[!Note] ->To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). +> [!Note] +> To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). ## In this topic diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 8af297cb56..69cdc60a1c 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -32,8 +32,8 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a phone with a management service. The service is a restful web service over HTTPS (server authentication only). ->[!Note] ->The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. +> [!Note] +> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -127,21 +127,21 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - In Windows, Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. ->[!Note]   ->The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. +> [!Note]   +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be leveraged by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. ->[!Note] ->Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: +> [!Note] +> Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: > - Parse the OS version from the data sent up during the discovery request. > - Append the OS version as a parameter in the AuthenticationServiceURL. > - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. ->[!Note] ->The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. +> [!Note] +> The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. The following are the explicit requirements for the server. @@ -294,8 +294,8 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. For Windows device, we will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. ->[!Note]   ->The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. +> [!Note]   +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -386,8 +386,8 @@ Note that the RequestSecurityToken will use a custom TokenType (http:[!Note] ->The policy service and the enrollment service must be on the same server; that is, they must have the same host name. +> [!Note] +> The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for federated authentication. @@ -476,8 +476,8 @@ The following example shows the enrollment web service request for federated aut After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR). ->[!Note] ->The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. +> [!Note] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc), because the token is more than an X.509 v3 certificate. diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 1b6590f392..bb09b8f063 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -54,8 +54,8 @@ The following topics describe the end-to-end enrollment process using various au - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) ->[!Note]   ->As a best practice, do not use hardcoded server-side checks on values such as: +> [!Note]   +> As a best practice, do not use hardcoded server-side checks on values such as: > - User agent string > - Any fixed URIs that are passed during enrollment > - Specific formatting of any value unless otherwise noted, such as the format of the device ID. @@ -292,9 +292,3 @@ TraceID is a freeform text node which is logged. It should identify the server s - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) - - - - - - diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md index 8b8510e448..2ff94e841f 100644 --- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md @@ -30,8 +30,8 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). ->[!NOTE] ->The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. +> [!NOTE] +> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The device’s automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -129,8 +129,8 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. ->[!NOTE] ->The HTTP server response must not be chunked; it must be sent as one message. +> [!NOTE] +> The HTTP server response must not be chunked; it must be sent as one message. The following example shows a response received from the discovery web service for OnPremise authentication: @@ -214,8 +214,8 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. We will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. ->[!NOTE] ->The HTTP server response must not be chunked; it must be sent as one message. +> [!NOTE] +> The HTTP server response must not be chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -306,8 +306,8 @@ The RequestSecurityToken will use a custom TokenType (http://schema The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. ->[!NOTE] ->The policy service and the enrollment service must be on the same server; that is, they must have the same host name. +> [!NOTE] +> The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for OnPremise authentication. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md index 4d8b9d2e78..6367bd636a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md @@ -26,13 +26,13 @@ In Windows 10, version 1703 and later, the Windows Defender app is part of the W Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703. ->[!IMPORTANT] ->Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. ->If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +> [!IMPORTANT] +> Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. +> If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. ->It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. +> It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. ->This will significantly lower the protection of your device and could lead to malware infection. +> This will significantly lower the protection of your device and could lead to malware infection. See the [Windows Security article](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app. @@ -68,8 +68,8 @@ Item | Windows 10, before version 1703 | Windows 10, version 1703 and later | De This section describes how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Microsoft Defender Antivirus in the Windows Security app. ->[!NOTE] ->If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured. +> [!NOTE] +> If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured. @@ -107,9 +107,9 @@ This section describes how to perform some of the most common tasks when reviewi 4. Toggle the **Real-time protection** switch to **On**. - >[!NOTE] - >If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. - >If you install another antivirus product, Microsoft Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). + > [!NOTE] + > If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. + > If you install another antivirus product, Microsoft Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). From e3598614acc20ce37591d9492d8844b65d0cab3b Mon Sep 17 00:00:00 2001 From: ErikMoreau Date: Mon, 15 Jun 2020 22:54:58 +0200 Subject: [PATCH 15/31] Update mac-install-manually.md fixed Commands to enable the copy button & paste to work in terminal window without the need to remove leading $ or results in the command boxes --- .../microsoft-defender-atp/mac-install-manually.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md index ebaa93dac7..1a2de2881f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md @@ -81,21 +81,19 @@ The installation proceeds. The client machine is not associated with orgId. Note that the *orgId* attribute is blank. ```bash - $ mdatp --health orgId + mdatp --health orgId ``` 2. Run the Python script to install the configuration file: ```bash - $ /usr/bin/python MicrosoftDefenderATPOnboardingMacOs.py - Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) + /usr/bin/python MicrosoftDefenderATPOnboardingMacOs.py ``` 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: ```bash - $ mdatp --health orgId - E6875323-A6C0-4C60-87AD-114BBE7439B8 + mdatp --health orgId ``` After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. From 63dea0fc624e30749d5efa9245d7f4b6d310bfd7 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 15 Jun 2020 14:39:22 -0700 Subject: [PATCH 16/31] Add aka.ms download to top of release notes. --- devices/hololens/hololens-release-notes.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md index 38e382a7b6..e6bd017294 100644 --- a/devices/hololens/hololens-release-notes.md +++ b/devices/hololens/hololens-release-notes.md @@ -20,6 +20,10 @@ appliesto: # HoloLens 2 release notes +If you would like to download the latest HoloLens 2 FFU to flash a your HoloLens 2 via Advanced Recovery Companion then you may download it from [here](https://aka.ms/hololens2download). This is kept up to date and will match the latest generally avalible build. + +HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive). + ## Windows Holographic, version 2004 - June 2020 Update - Build 19041.1106 @@ -80,9 +84,6 @@ We are excited to announce our May 2020 major software update for HoloLens 2, ** | Hand Tracking improvements | Hand Tracking improvements make buttons and 2D slate interactions more accurate | | Quality improvements and fixes | Various system performance and reliability improvements across the platform | -> [!Note] -> HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive). - ### Support for Windows Autopilot Windows Autopilot for HoloLens 2 lets the device sales channel pre-enroll HoloLens into your Intune tenant. When devices arrive, they’re ready to self-deploy as shared devices under your tenant. To take advantage of self-deployment, devices will need to connect to a network during the first screen in setup using either a USB-C to ethernet dongle or USB-C to LTE dongle. From 05b1d7a1ede9d1785e54e532aaf9d1e004d76d17 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 15 Jun 2020 16:50:08 -0700 Subject: [PATCH 17/31] Trying to fix build warning, added other fixes --- ...erated-authentication-device-enrollment.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 69cdc60a1c..01d4daf010 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -18,7 +18,7 @@ This section provides an example of the mobile device enrollment protocol using The <AuthenticationServiceURL> element the discovery response message specifies web authentication broker page start URL. -For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). ## In this topic @@ -32,7 +32,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a phone with a management service. The service is a restful web service over HTTPS (server authentication only). -> [!Note] +> [!NOTE] > The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -41,28 +41,28 @@ The first request is a standard HTTP GET request. The following example shows a request via HTTP GET to the discovery server given user@contoso.com as the email address. -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: unknown Header Byte Count: 153 Body Byte Count: 0 ``` -``` +```http GET /EnrollmentServer/Discovery.svc HTTP/1.1 User-Agent: Windows Phone 8 Enrollment Client Host: EnterpriseEnrollment.contoso.com Pragma: no-cache ``` -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: text/html Header Byte Count: 248 Body Byte Count: 0 ``` -``` +```http HTTP/1.1 200 OK Connection: Keep-Alive Pragma: no-cache @@ -82,7 +82,7 @@ The following logic is applied: The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address -``` +```http https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc ``` @@ -127,7 +127,7 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - In Windows, Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. -> [!Note]   +> [!Note] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be leveraged by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. @@ -163,7 +163,7 @@ After authentication is complete, the auth server should return an HTML form doc > [!NOTE] > To make an application compatible with strict Content Security Policy, it is usually necessary to make some changes to HTML templates and client-side code, add the policy header, and test that everything works properly once the policy is deployed. -``` +```html HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding @@ -294,7 +294,7 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. For Windows device, we will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. -> [!Note]   +> [!NOTE] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -541,7 +541,7 @@ The following example shows the enrollment web service response. The following code shows sample provisioning XML (presented in the preceding package as a security token): -``` +```xml From af4e70d5caa0f81bab2802d8d6ab315e0ad65c8c Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 15 Jun 2020 16:53:29 -0700 Subject: [PATCH 18/31] Trying to fix a build warning Suspected issue: Spaces immediately following [!NOTE] on the same line --- windows/client-management/mdm/mobile-device-enrollment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index bb09b8f063..061a5abdb2 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -54,7 +54,7 @@ The following topics describe the end-to-end enrollment process using various au - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) -> [!Note]   +> [!Note] > As a best practice, do not use hardcoded server-side checks on values such as: > - User agent string > - Any fixed URIs that are passed during enrollment From c1ec6af8a1495b40cf73596b947d788f332cf5f9 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Mon, 15 Jun 2020 17:39:45 -0700 Subject: [PATCH 19/31] Update index.yml Uses landing page yml template for consistency with Surface devices --- devices/surface-hub/index.yml | 206 +++++++++++++++------------------- 1 file changed, 92 insertions(+), 114 deletions(-) diff --git a/devices/surface-hub/index.yml b/devices/surface-hub/index.yml index 249deba5a0..f91c453b06 100644 --- a/devices/surface-hub/index.yml +++ b/devices/surface-hub/index.yml @@ -1,127 +1,105 @@ -### YamlMime:Hub +### YamlMime:Landing title: Surface Hub documentation # < 60 chars summary: Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device. # < 160 chars -# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin -brand: windows metadata: title: Surface Hub documentation # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Get started with Microsoft Surface Hub. # Required; article description that is displayed in search results. < 160 chars. - services: product-insights + description: Get started with Microsoft Surface Hub # Required; article description that is displayed in search results. < 160 chars. ms.service: product-insights #Required; service per approved list. service slug assigned to your service by ACOM. - ms.topic: hub-page # Required - ms.prod: surface-hub - ms.technology: windows - audience: ITPro - ms.localizationpriority: medium + ms.topic: landing-page # Required + manager: laurawi author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - manager: laurawi + audience: itpro + ms.localizationpriority: High -# highlightedContent section (optional) -# Maximum of 8 items -highlightedContent: -# itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - items: - # Card - - title: What's new in Surface Hub 2S? - itemType: whats-new - url: surface-hub-2s-whats-new.md - # Card - - title: Surface Hub security overview - itemType: learn - url: surface-hub-security.md - # Card - - title: Manage Surface Hub 2S with Intune - itemType: how-to-guide - url: surface-hub-2s-manage-intune.md - # Card - - title: Operating system essentials - itemType: learn - url: differences-between-surface-hub-and-windows-10-enterprise.md - # Card - - title: Surface Hub 2S Site Readiness Guide - itemType: learn - url: surface-hub-2s-site-readiness-guide.md - # Card - - title: Customize Surface Hub 2S installation - itemType: how-to-guide - url: surface-hub-2s-custom-install.md +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new -# productDirectory section (optional) -productDirectory: - title: Deploy, manage, and support your Surface Hub devices # < 60 chars (optional) - summary: Find related links to deploy, manage and support your Surface Hub devices. # < 160 chars (optional) - items: +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Surface devices + linkLists: + - linkListType: overview + links: + - text: What's new in Surface Hub 2S? + url: surface-hub-2s-whats-new.md + - text: Surface Hub 2S tech specs + url: surface-hub/surface-hub-2s-techspecs.md + - text: Operating system essentials + url: differences-between-surface-hub-and-windows-10-enterprise.md + + # Card (optional) + - title: Get started + linkLists: + - linkListType: get-started + links: + - text: Surface Hub 2S Site Readiness Guide + url: surface-hub-2s-site-readiness-guide.md + - text: Customize Surface Hub 2S installation + url: surface-hub-2s-custom-install.md + - text: Prepare your environment for Surface Hub 2S + url: surface-hub-2s-prepare-environment.md + + # Card + - title: Deploy Surface Hub + linkLists: + - linkListType: deploy + links: + - text: Surface Hub 2S adoption and training + url: surface-hub-2s-adoption-kit.md + - text: Surface Hub 2S deployment checklist + url: surface-hub-2s-deploy-checklist.md + - text: Create device account + url: surface-hub-2s-account.md + # Card - - title: Deploy - # imageSrc should be square in ratio with no whitespace - imageSrc: https://docs.microsoft.com/office/media/icons/deploy-blue.svg - links: - - url: surface-hub-2s-adoption-kit.md - text: Surface Hub 2S adoption and training - - url: surface-hub-2s-deploy-checklist.md - text: Surface Hub 2S deployment checklist - - url: surface-hub-2s-account.md - text: Create device account - # Card - - title: Manage - imageSrc: https://docs.microsoft.com/office/media/icons/process-flow-blue.svg - links: - - url: surface-hub-2s-manage-intune.md - text: Manage with Intune - - url: local-management-surface-hub-settings.md - text: Manage local settings - # Card - - title: Secure - imageSrc: https://docs.microsoft.com/office/media/icons/security-blue.svg - links: - - url: surface-hub-2s-secure-with-uefi-semm.md - text: Secure with UEFI and SEMM - - url: surface-hub-wifi-direct.md - text: Wi-Fi security considerations - # Card - - title: Troubleshoot - imageSrc: https://docs.microsoft.com/office/media/icons/connector-blue.svg - links: - - url: https://support.microsoft.com/help/4493926 - text: Service and warranty - - url: surface-hub-2s-recover-reset.md - text: Recover & reset Surface Hub 2S - - url: support-solutions-surface-hub.md - text: Surface Hub support solutions - - url: https://support.office.com/article/Enable-Microsoft-Whiteboard-on-Surface-Hub-b5df4539-f735-42ff-b22a-0f5e21be7627 - text: Enable Microsoft Whiteboard on Surface Hub + - title: Manage Surface devices + linkLists: + - linkListType: how-to-guide + links: + - text: Manage Surface Hub 2S with Intune + url: surface-hub-2s-manage-intune.md + - text: Manage local settings + url: local-management-surface-hub-settings.md + - text: Manage Windows updates on Surface Hub + url: manage-windows-updates-for-surface-hub.md -# additionalContent section (optional) -# Card with links style -additionalContent: - # Supports up to 3 sections - sections: - - title: Other content # < 60 chars (optional) - summary: Find related links for videos, community and support. # < 160 chars (optional) - items: - # Card - - title: Get ready for Surface Hub 2S - links: - - text: Ordering Surface Hub 2S - url: https://www.microsoft.com/p/surface-hub-2S/8P62MW6BN9G4?activetab=pivot:overviewtab - - text: Prepare your environment for Surface Hub 2S - url: surface-hub-2s-prepare-environment.md - # Card - - title: Surface Hub 2S Videos - links: - - text: Adoption and training videos - url: surface-hub-2s-adoption-videos.md - - text: Surface Hub 2S with Teams - url: https://www.youtube.com/watch?v=CH2seLS5Wb0 - - text: Surface Hub 2S with Microsoft 365 - url: https://www.youtube.com/watch?v=I4N2lQX4WyI&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ&index=7 - # Card - - title: Community - links: - - text: Join the Surface Hub Technical Community - url: https://techcommunity.microsoft.com/t5/Surface-Hub/bd-p/SurfaceHub - - text: Join the Surface Devices Technical Community - url: https://techcommunity.microsoft.com/t5/Surface-Devices/ct-p/SurfaceDevices + # Card + - title: Explore security guidance + linkLists: + - linkListType: learn + links: + - text: Secure and manage Surface Hub 2S with SEMM and UEFI + url: surface-hub-2s-secure-with-uefi-semm.md + - text: Wi-Fi security considerations + url: surface-hub-wifi-direct.md + - text: Surface Hub security overview + url: surface-hub-security.md + + # Card + - title: Troubleshoot Surface Hub + linkLists: + - linkListType: learn + links: + - text: Service and warranty + url: https://support.microsoft.com/help/4493926 + - text: Recover & reset Surface Hub 2S + url: surface-hub-2s-recover-reset.md + - text: Surface Hub support solutions + url: support-solutions-surface-hub.md + + +# Card + - title: Surface Hub 2S Videos + linkLists: + - linkListType: video + links: + - text: Adoption and training videos + url: surface-hub-2s-adoption-videos.md + - text: Surface Hub 2S with Teams + url: https://www.youtube.com/watch?v=CH2seLS5Wb0 + - text: Surface Hub 2S with Microsoft 365 + url: https://www.youtube.com/watch?v=I4N2lQX4WyI&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ&index=7 From a08f5f518feb04e74e80245214f22e2c841a6d5a Mon Sep 17 00:00:00 2001 From: Zachariusz Karwacki Date: Mon, 15 Jun 2020 23:19:13 -0700 Subject: [PATCH 20/31] Fix grammar in mac-install-with-intune.md after change https://github.com/MicrosoftDocs/windows-docs-pr/commit/b192690b4bf683fe18aac55f4b4e7a1f11e27360 --- .../microsoft-defender-atp/mac-install-with-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index d892904b96..2a03c67c16 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -207,7 +207,7 @@ You may now enroll more devices. You can also enroll them later, after you have ``` -9. To allow Defender and Auto Update for displaying notifications in UI on macOS 10.15 (Catalina), import the following .mobileconfig as a custom payload: +9. To allow Defender and Auto Update to display notifications in UI on macOS 10.15 (Catalina), import the following .mobileconfig as a custom payload: ```xml From 63018ce3074fdcbad731b0d64f7fae5782264d1a Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Tue, 16 Jun 2020 08:49:11 -0700 Subject: [PATCH 21/31] spelling --- devices/hololens/hololens-release-notes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md index e6bd017294..f3f4221ee9 100644 --- a/devices/hololens/hololens-release-notes.md +++ b/devices/hololens/hololens-release-notes.md @@ -20,7 +20,7 @@ appliesto: # HoloLens 2 release notes -If you would like to download the latest HoloLens 2 FFU to flash a your HoloLens 2 via Advanced Recovery Companion then you may download it from [here](https://aka.ms/hololens2download). This is kept up to date and will match the latest generally avalible build. +If you would like to download the latest HoloLens 2 FFU to flash your HoloLens 2 via Advanced Recovery Companion then you may download it from [here](https://aka.ms/hololens2download). This is kept up-to-date and will match the latest generally available build. HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive). From 9195108f8835b94223960c2fc49d20eb2cee7863 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Tue, 16 Jun 2020 09:10:59 -0700 Subject: [PATCH 22/31] link to ARC --- devices/hololens/hololens-release-notes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md index f3f4221ee9..d89a856d4a 100644 --- a/devices/hololens/hololens-release-notes.md +++ b/devices/hololens/hololens-release-notes.md @@ -20,7 +20,7 @@ appliesto: # HoloLens 2 release notes -If you would like to download the latest HoloLens 2 FFU to flash your HoloLens 2 via Advanced Recovery Companion then you may download it from [here](https://aka.ms/hololens2download). This is kept up-to-date and will match the latest generally available build. +If you would like to download the latest HoloLens 2 FFU to flash your HoloLens 2 via [Advanced Recovery Companion](hololens-recovery.md#re-install-the-operating-system) then you may download it from [here](https://aka.ms/hololens2download). This is kept up-to-date and will match the latest generally available build. HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive). From 0dd4d0f1c94fb601a83667ba5573eab7f84dc875 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 16 Jun 2020 09:34:15 -0700 Subject: [PATCH 23/31] Update index.yml --- devices/surface-hub/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/index.yml b/devices/surface-hub/index.yml index f91c453b06..a4a4b05f20 100644 --- a/devices/surface-hub/index.yml +++ b/devices/surface-hub/index.yml @@ -27,7 +27,7 @@ landingContent: - text: What's new in Surface Hub 2S? url: surface-hub-2s-whats-new.md - text: Surface Hub 2S tech specs - url: surface-hub/surface-hub-2s-techspecs.md + url: surface-hub-2s-techspecs.md - text: Operating system essentials url: differences-between-surface-hub-and-windows-10-enterprise.md From 96e42b92999941dc3d9ed5715aca838bf4e6b564 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 16 Jun 2020 10:57:57 -0700 Subject: [PATCH 24/31] Styling --- .../microsoft-defender-atp/linux-resources.md | 2 +- .../microsoft-defender-atp/linux-whatsnew.md | 4 +-- .../microsoft-defender-atp-linux.md | 32 +++++++++---------- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 7014bcacaa..9682edb6d0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -37,7 +37,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 2. Reproduce the problem. -3. Run `sudo mdatp diagnostic create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds: +3. Run `sudo mdatp diagnostic create` to back up Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds: ```bash $ sudo mdatp diagnostic create diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md index e7408568e2..0c3138f156 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md @@ -21,8 +21,8 @@ ms.topic: conceptual ## 101.00.75 -- Added support for the following file system types: ecryptfs, fuse, fuseblk, jfs, nfs, overlay, ramfs, reiserfs, udf, and vfat -- New syntax for the command-line tool. See [this page](linux-resources.md#configure-from-the-command-line) for more information. +- Added support for the following file system types: `ecryptfs`, `fuse`, `fuseblk`, `jfs`, `nfs`, `overlay`, `ramfs`, `reiserfs`, `udf`, and `vfat` +- New syntax for the command-line tool. For more information, see [this page](linux-resources.md#configure-from-the-command-line). - Performance improvements & bug fixes ## 100.90.70 diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index 4ece6145ec..edc161f217 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -91,22 +91,22 @@ If you experience any installation failures, refer to [Troubleshooting installat - Disk space: 650 MB - The solution currently provides real-time protection for the following file system types: - - btrfs - - ecryptfs - - ext2 - - ext3 - - ext4 - - fuse - - fuseblk - - jfs - - nfs - - overlay - - ramfs - - reiserfs - - tmpfs - - udf - - vfat - - xfs + - `btrfs` + - `ecryptfs` + - `ext2` + - `ext3` + - `ext4` + - `fuse` + - `fuseblk` + - `jfs` + - `nfs` + - `overlay` + - `ramfs` + - `reiserfs` + - `tmpfs` + - `udf` + - `vfat` + - `xfs` More file system types will be added in the future. From eb6e528d00dd5591641a6172b259c00d5fb8bb78 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 16 Jun 2020 12:16:47 -0700 Subject: [PATCH 25/31] Update hub-teams-app.md --- devices/surface-hub/hub-teams-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/hub-teams-app.md b/devices/surface-hub/hub-teams-app.md index 90d82560d8..358d5f8d3c 100644 --- a/devices/surface-hub/hub-teams-app.md +++ b/devices/surface-hub/hub-teams-app.md @@ -21,4 +21,4 @@ The Microsoft Teams app for Surface Hub is periodically updated and available vi | --------------------- | --------------------------------------------------------------------------------------------------- | -------------------------------- | | 0.2020.13201.0 | - 3x3 Gallery view on Surface Hub
- Ability to search for External users | June 10, 2020
| | 0.2020.13201 | - Quality improvements and Bug fixes | June 1, 2020
| -| 0.2020.4301.0 | - Accept incoming PSTN calls on Surface Hub
- Added controls for Attendee/Presenter role changes | May 21, 2020 | +| 0.2020.4301.0 | - Accept incoming PSTN calls on Surface Hub
- Consume Attendee/Presenter role changes | May 21, 2020 | From f919763538a5a1b874fa0f72c5f8d67e853512da Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Tue, 16 Jun 2020 13:44:50 -0700 Subject: [PATCH 26/31] blurb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Minor comments. I’d add a very short blurb on what the release notes page is so that we don’t jump so abruptly into: “hey here is where you can download the latest FFU from”. Something along the lines of: To ensure you have a productive experience with your HoloLens devices, we continue to release feature, bug and security updates. In this page you can learn about what’s new on HoloLens each month. Then, one small suggestion: If you would like to download the latest HoloLens 2 FFU to flash your device via Advanced Recovery Companion then you may download it from here. This is kept up-to-date and will match the latest generally available build. --- devices/hololens/hololens-release-notes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md index d89a856d4a..13141cb40f 100644 --- a/devices/hololens/hololens-release-notes.md +++ b/devices/hololens/hololens-release-notes.md @@ -20,7 +20,7 @@ appliesto: # HoloLens 2 release notes -If you would like to download the latest HoloLens 2 FFU to flash your HoloLens 2 via [Advanced Recovery Companion](hololens-recovery.md#re-install-the-operating-system) then you may download it from [here](https://aka.ms/hololens2download). This is kept up-to-date and will match the latest generally available build. +To ensure you have a productive experience with your HoloLens devices, we continue to release feature, bug and security updates. In this page you can learn about what’s new on HoloLens each month. If you would like to download the latest HoloLens 2 FFU to flash your device via [Advanced Recovery Companion](hololens-recovery.md#re-install-the-operating-system) then you may download it from [here](https://aka.ms/hololens2download). This is kept up-to-date and will match the latest generally available build. HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive). From bb5cdb296bd8dbb7f3366d45fe2c660a6294ccbf Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 16 Jun 2020 14:52:30 -0700 Subject: [PATCH 27/31] Indented content in a list item --- .../microsoft-defender-atp/mac-install-manually.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md index 1a2de2881f..c2941c40da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually.md @@ -66,10 +66,10 @@ To complete this process, you must have admin privileges on the machine. ![Security and privacy window screenshot](../microsoft-defender-antivirus/images/MDATP-31-SecurityPrivacySettings.png) -The installation proceeds. + The installation proceeds. -> [!CAUTION] -> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but some features, such as real-time protection, will be disabled. See [Troubleshoot kernel extension issues](mac-support-kext.md) for information on how to resolve this. + > [!CAUTION] + > If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but some features, such as real-time protection, will be disabled. See [Troubleshoot kernel extension issues](mac-support-kext.md) for information on how to resolve this. > [!NOTE] > macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-time protection will not be available until the machine is rebooted. From df6ac5c1ddd7dc29ca453ce8209f8e107e757e06 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 16 Jun 2020 15:55:32 -0700 Subject: [PATCH 28/31] Corrected indentation of a code block MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous indentation resulted in the code block being rendered entirely—including the backticks—as a block of plain text. --- .../linux-install-with-ansible.md | 46 +++++++++---------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 2227ba8f15..f6753d00a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -149,31 +149,31 @@ Create subtask or role files that contribute to an actual task. First create the > [!NOTE] > In case of Oracle Linux, replace *[distro]* with “rhel”. - ```bash - - name: Add Microsoft apt repository for MDATP - apt_repository: - repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [channel] main - update_cache: yes - state: present - filename: microsoft-[channel].list - when: ansible_os_family == "Debian" + ```bash + - name: Add Microsoft apt repository for MDATP + apt_repository: + repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [channel] main + update_cache: yes + state: present + filename: microsoft-[channel].list + when: ansible_os_family == "Debian" - - name: Add Microsoft APT key - apt_key: - keyserver: https://packages.microsoft.com/ - id: BC528686B50D79E339D3721CEB3E94ADBE1229CF - when: ansible_os_family == "Debian" + - name: Add Microsoft APT key + apt_key: + keyserver: https://packages.microsoft.com/ + id: BC528686B50D79E339D3721CEB3E94ADBE1229CF + when: ansible_os_family == "Debian" - - name: Add Microsoft yum repository for MDATP - yum_repository: - name: packages-microsoft-com-prod-[channel] - description: Microsoft Defender ATP - file: microsoft-[channel] - baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/ - gpgcheck: yes - enabled: Yes - when: ansible_os_family == "RedHat" - ``` + - name: Add Microsoft yum repository for MDATP + yum_repository: + name: packages-microsoft-com-prod-[channel] + description: Microsoft Defender ATP + file: microsoft-[channel] + baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/ + gpgcheck: yes + enabled: Yes + when: ansible_os_family == "RedHat" + ``` - Create the actual install/uninstall YAML files under `/etc/ansible/playbooks`. From 28ab437dbee81dc0a0a9f063cf72e8fcc322fe6c Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 16 Jun 2020 22:08:58 -0700 Subject: [PATCH 29/31] update --- .../deployment/vda-subscription-activation.md | 32 +++++++++---------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 61edc16bf7..62a9dc2999 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -66,28 +66,26 @@ For examples of activation issues, see [Troubleshoot the user experience](https: 4. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. 5. Click **Add**, type **Authenticated users**, and then click **OK** three times. 6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again. -7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). -8. Open Windows Configuration Designer and click **Provison desktop services**. -9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10. - - 1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. +7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps to use Windows Configuration Designer and inject an activation key. Otherwise, skip to step 20. +8. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). +9. Open Windows Configuration Designer and click **Provison desktop services**. +10. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. - Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step. - 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. -10. On the Set up network page, choose **Off**. -11. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. +11. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. +12. On the Set up network page, choose **Off**. +13. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. - Note: This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). -12. On the Add applications page, add applications if desired. This step is optional. -13. On the Add certificates page, add certificates if desired. This step is optional. -14. On the Finish page, click **Create**. -15. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 16. - 1. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. - 2. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: +14. On the Add applications page, add applications if desired. This step is optional. +15. On the Add certificates page, add certificates if desired. This step is optional. +16. On the Finish page, click **Create**. +17. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. +18. Type the following at an elevated command prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: - ``` + ```cmd Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg" ``` - 3. Right-click the mounted image in file explorer and click **Eject**. -16. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. +19. Right-click the mounted image in file explorer and click **Eject**. +20. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. ## Azure Active Directory-joined VMs From a29825ff0d26b81e778d2e18a09ef98594bffbe7 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 16 Jun 2020 22:38:09 -0700 Subject: [PATCH 30/31] update --- windows/configuration/set-up-shared-or-guest-pc.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index d77ca25608..00fb65ab30 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -9,7 +9,6 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 05/27/2020 ms.reviewer: manager: dansimp --- @@ -93,20 +92,20 @@ You can configure Windows to be in shared PC mode in a couple different ways: 5. From the **Platform** menu, select **Windows 10 and later**. 6. From the **Profile** menu, select **Shared multi-user device**. - ![custom OMA-URI policy in Intune](images/Shared_PC_1.png) + ![custom OMA-URI policy in Intune](images/shared_pc_1.jpg) 7. Select **Create**. 8. Enter a name for the policy (e.g. My Win10 Shared devices policy). You can optionally add a description should you wish to do so. 9. Select **Next**. 10. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. - ![Shared PC settings in ICD](images/Shared_PC_3.png) + ![Shared PC settings in ICD](images/shared_pc_3.png) 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. - A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. - ![Shared PC settings in ICD](images/icd-adv-shared-pc.PNG) + ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) - WMI bridge: Environments that use Group Policy can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the [MDM_SharedPC class](https://msdn.microsoft.com/library/windows/desktop/mt779129.aspx). For all device settings, the WMI Bridge client must be executed under local system user; for more information, see [Using PowerShell scripting with the WMI Bridge Provider](https://docs.microsoft.com/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). For example, open PowerShell as an administrator and enter the following: From 7279c29b29ea5a4f3c49d97523116078a2a8a68b Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 17 Jun 2020 09:29:05 -0700 Subject: [PATCH 31/31] fixing a typo --- windows/deployment/update/get-started-updates-channels-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/get-started-updates-channels-tools.md b/windows/deployment/update/get-started-updates-channels-tools.md index 82a5957f04..0331ff4981 100644 --- a/windows/deployment/update/get-started-updates-channels-tools.md +++ b/windows/deployment/update/get-started-updates-channels-tools.md @@ -47,7 +47,7 @@ The first step of controlling when and how devices install updates is assigning ### Semi-annual Channel -In the Semi-annual Channel, feature updates are available as soon as Microsoft releases them, twice per year. As long as a device isn't set to defer feature updates, any device using the Semi-annual Channel will install a feature update as soon as it's released. If you use Windows Update for Business, the Semi-annual Channel provides three months of additional total deployment time before being required to update to the next release.{IS THIS STILL TRUE?} +In the Semi-annual Channel, feature updates are available as soon as Microsoft releases them, twice per year. As long as a device isn't set to defer feature updates, any device using the Semi-annual Channel will install a feature update as soon as it's released. If you use Windows Update for Business, the Semi-annual Channel provides three months of additional total deployment time before being required to update to the next release. > [!NOTE] > All releases of Windows 10 have **18 months of servicing for all editions**--these updates provide security and feature updates for the release. However, fall releases of the **Enterprise and Education editions** will have an **additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release**. This extended servicing window applies to Enterprise and Education editions starting with Windows 10, version 1607.